Stary System, Czas Go Sprawdzic...

[deadfrog]

Witam, problem opisany TUTAJ

 

System ma juz ponad 2 lata, przez ten czas dzialal bardzo stabilnie, ale ostatnio coraz czesciej przy np otwieraniu folderu wyskakiwala informacja o bledzie explorera i koniecznosci jego zamkniecia, pozniej wlaczal sie spowrotem i dzialal az do nastepnego razu. Moze to przez to ze w ciagu ostatnich kilku miesiecy nie mialem czasu na jego konserwacje... teraz doszedl problem w ff3 i postanowilem zwrocic sie do Was z prosba o diagnoze...

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - LOG z hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:15:24, on 2008-06-18

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

D:\Programy\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

C:\WINDOWS\Explorer.EXE

D:\Programy\AD-AWA~1\Ad-Watch.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

D:\Programy\DAEMON Tools Pro\DTProAgent.exe

D:\Programy\Gadu-Gadu\gg.exe

C:\Program Files\Gigabyte\Common\GNConfig.exe

C:\Documents and Settings\Konrad\Pulpit\SYSTEM\Core Temp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\WISPTIS.EXE

D:\Programy\foobar2000\foobar2000.exe

J:\Nowy folder\HiJackThis.exe

D:\Programy\Firefox\firefox.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O1 - Hosts: ˙ţ]

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Acrobat\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [AWMON] "D:\Programy\AD-AWA~1\Ad-Watch.exe"

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programy\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "D:\Programy\RivaTuner v2.06\RivaTuner.exe" /S

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Programy\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\StrongGG.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: Core Temp.lnk = C:\Documents and Settings\Konrad\Pulpit\SYSTEM\Core Temp.exe

O4 - Global Startup: Gigabyte Wireless Utility.lnk = C:\Program Files\Gigabyte\Common\GNConfig.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programy\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{8E02FB18-0E24-435B-BC20-69F40ACDF49A}: NameServer = 192.168.1.2,192.168.1.3

O17 - HKLM\System\CCS\Services\Tcpip\..\{9F89225E-F197-486F-9E1C-94915F64C7F2}: NameServer = 192.168.1.2,192.168.1.3

O17 - HKLM\System\CCS\Services\Tcpip\..\{B10F93CD-D38C-43EC-BC58-FC9D654079A1}: NameServer = 192.168.1.2,192.168.1.3

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Programy\ewido anti-spyware 4.0\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

 

--

End of file - 5507 bytes

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - LOG z sillent runners

"Silent Runners.vbs", revision 58, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

 

 

Startup items buried in registry:

---------------------------------

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"DAEMON Tools Pro Agent" = ""D:\Programy\DAEMON Tools Pro\DTProAgent.exe"" ["DT Soft Ltd."]

"Gadu-Gadu" = ""D:\Programy\Gadu-Gadu\StrongGG.exe"" [null data]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"AWMON" = ""D:\Programy\AD-AWA~1\Ad-Watch.exe"" ["Lavasoft Sweden"]

"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]

"DAEMON Tools" = ""D:\Programy\DAEMON Tools\daemon.exe" -lang 1033" [file not found]

"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"DaemonTools_WhenUSave_Installer" = "C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe" [file not found]

"RivaTunerStartupDaemon" = ""D:\Programy\RivaTuner v2.06\RivaTuner.exe" /S" [empty string]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "AcroIEHlprObj Class"

\InProcServer32\(Default) = "D:\Programy\Acrobat\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Megaupload Toolbar"

\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "]

{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Spybot-S&D IE Protection"

\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"

-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"

-> {HKLM...CLSID} = "DesktopContext Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

-> {HKLM...CLSID} = "Desktop Explorer"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"

-> {HKLM...CLSID} = "nView Desktop Context Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]

"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"

-> {HKLM...CLSID} = "Portable Media Devices Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]

"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"

-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]

"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"

-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

-> {HKLM...CLSID} = "Microsoft Office Outlook"

\InProcServer32\(Default) = "D:\Programy\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"

\InProcServer32\(Default) = "D:\Programy\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "D:\Programy\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"

-> {HKLM...CLSID} = "Nokia Phone Browser"

\InProcServer32\(Default) = "D:\Programy\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]

"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"

-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"

-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"

\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"

-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"

\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"

-> {HKLM...CLSID} = "NVIDIA CPL Extension"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{E2A19B18-B1AC-4623-BBC4-11334A7B9D4B}" = "ZasysaczSGG"

-> {HKLM...CLSID} = "ZasysaczExt"

\InProcServer32\(Default) = "D:\Programy\Gadu-Gadu\plugs\Zasysacz.dll" [null data]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"

-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"

\InProcServer32\(Default) = "D:\Programy\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

 

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

 

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"

-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"

\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]

 

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

!ZasysaczSGG\(Default) = "{E2A19B18-B1AC-4623-BBC4-11334A7B9D4B}"

-> {HKLM...CLSID} = "ZasysaczExt"

\InProcServer32\(Default) = "D:\Programy\Gadu-Gadu\plugs\Zasysacz.dll" [null data]

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "D:\Programy\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"

-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]

 

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "D:\Programy\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]

 

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"

-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "D:\Programy\WinRAR\rarext.dll" [null data]

 

 

Group Policies {GPedit.msc branch and setting}:

-----------------------------------------------

 

Note: detected settings may not have any effect.

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

 

"DisableRegistryTools" = (REG_DWORD) dword:0x00000000

{User Configuration|Administrative Templates|System|

Prevent access to registry editing tools}

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

 

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Shutdown: Allow system to be shut down without having to log on}

 

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Devices: Allow undock without having to log on}

 

 

Active Desktop and Wallpaper:

-----------------------------

 

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

 

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "%APPDATA%\IrfanView\IrfanView_Wallpaper.bmp"

 

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp"

 

 

Enabled Screen Saver:

---------------------

 

HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

 

 

Windows Portable Device AutoPlay Handlers

-----------------------------------------

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

 

NeroAutoPlay7CDAudio\

"Provider" = "Nero SoundTrax"

"InvokeProgID" = "Nero.AutoPlay3"

"InvokeVerb" = "HandleCDBurningOnArrival_CDAudio"

HKLM\SOFTWARE\Classes\Nero.AutoPlay3\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "D:\Programy\Nero 7\Nero SoundTrax\SoundTrax.exe /" ["Nero AG"]

 

NeroAutoPlay7CopyCD\

"Provider" = "Nero Burning ROM"

"InvokeProgID" = "Nero.AutoPlay3"

"InvokeVerb" = "PlayMusicFilesOnArrival_CopyCD"

HKLM\SOFTWARE\Classes\Nero.AutoPlay3\shell\PlayMusicFilesOnArrival_CopyCD\command\(Default) = "D:\Programy\Nero 7\Core\nero.exe /Dialog:DiscCopy /Drive:%L" ["Nero AG"]

 

NeroAutoPlay7PlayAudioCD\

"Provider" = "Nero ShowTime"

"InvokeProgID" = "Nero.AutoPlay3"

"InvokeVerb" = "PlayCDAudioOnArrival_PlayAudioCD"

HKLM\SOFTWARE\Classes\Nero.AutoPlay3\shell\PlayCDAudioOnArrival_PlayAudioCD\command\(Default) = "D:\Programy\Nero 7\Nero ShowTime\ShowTime.exe /Play /Drive:%L" ["Nero AG"]

 

NMMPlayCDAudioOnArrival\

"Provider" = "Nokia Music Manager"

"InvokeProgID" = "NokiaMusicManager"

"InvokeVerb" = "NMMPlayCD"

HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMPlayCD\command\(Default) = "D:\Programy\Nokia\Nokia PC Suite 6\MusicManager.exe /playCD "%L"" ["Nokia"]

 

NMMRipCDAudioOnArrival\

"Provider" = "Nokia Music Manager"

"InvokeProgID" = "NokiaMusicManager"

"InvokeVerb" = "NMMRipCD"

HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMRipCD\command\(Default) = "D:\Programy\Nokia\Nokia PC Suite 6\MusicManager.exe /ripCD "%L"" ["Nokia"]

 

 

Startup items in "Konrad" & "All Users" startup folders:

--------------------------------------------------------

 

C:\Documents and Settings\Konrad\Menu Start\Programy\Autostart

"Core Temp" -> shortcut to: "C:\Documents and Settings\Konrad\Pulpit\SYSTEM\Core Temp.exe" [null data]

 

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart

"Gigabyte Wireless Utility" -> shortcut to: "C:\Program Files\Gigabyte\Common\GNConfig.exe -s" ["GIGABYTE TECHNOLOGY CO., LTD."]

 

 

Winsock2 Service Provider DLLs:

-------------------------------

 

Namespace Service Providers

 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

 

Transport Service Providers

 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 08, 18

%SystemRoot%\system32\mswsock.dll [MS], 09 - 12, 15 - 17, 19 - 42

%SystemRoot%\system32\rsvpsp.dll [MS], 13 - 14

 

 

Toolbars, Explorer Bars, Extensions:

------------------------------------

 

Toolbars

 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\

"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"

-> {HKLM...CLSID} = "Megaupload Toolbar"

\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "]

 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"

-> {HKLM...CLSID} = "Megaupload Toolbar"

\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "]

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\

"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided)

-> {HKLM...CLSID} = "Megaupload Toolbar"

\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "]

 

Explorer Bars

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\

 

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"

Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32\(Default) = "D:\Programy\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

 

Extensions (Tools menu items, main toolbar menu buttons)

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Console"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}"

-> {HKCU...CLSID} = "Java Plug-in 1.5.0_10"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]

-> {HKLM...CLSID} = "Java Plug-in 1.5.0_10"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."]

 

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Badanie"

 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\

"MenuText" = "Spybot - Search & Destroy Configuration"

"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"

-> {HKLM...CLSID} = "Spybot-S&D IE Protection"

\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

 

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

"ButtonText" = "Messenger"

"MenuText" = "Windows Messenger"

"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

 

 

Miscellaneous IE Hijack Points

------------------------------

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\

<<H>> "Tabs" = "C:\Documents and Settings\Konrad\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [null data]

 

 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

 

ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "D:\Programy\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]

LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]

NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]

NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data]

ScsiAccess, ScsiAccess, "C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe" [null data]

Usługa Pomocnik IPv6, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

 

 

Print Monitors:

---------------

 

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\

Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."]

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

 

 

---------- (launch time: 2008-06-18 23:22:18)

<<!>>: Suspicious data at a malware launch point.

<<H>>: Suspicious data at a browser hijack point.

 

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer "No" at the

first message box and "Yes" at the second message box.

---------- (total run time: 36 seconds, including 18 seconds for message boxes)

[deadfrog]

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - report.txt

SDFix: Version 1.194
Run by Konrad on 2008-06-19 at 00:14

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :


C:\WINDOWS\system32
:{4B9A1497-0817-47C4-9612-D6A1C53ACF57} 12
Total size: 12 bytes.
system32: deleted 12 bytes in 1 streams.

Checking for remaining Streams

C:\WINDOWS\system32
No streams found.


Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 00:18:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:56be8ec3
"s2"=dword:971d8388
"h0"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:d2,83,eb,88,57,64,cf,06,5e,c7,34,e4,22,90,01,90,27,74,b8,20,b8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:92,4b,10,4e,c9,d9,3d,02,42,e4,6e,b6,56,39,d7,8f,e6,10,72,26,31,..
"p0"="d:\Programy\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,55,f6,a5,6c,58,37,c5,7c,dd,35,ba,7c,f3,91,41,ad,2b,..
"hdf12"=hex:0a,9b,7b,e3,e3,40,a1,c7,92,23,e6,8a,cc,a6,22,6c,a7,6a,d6,00,45,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:9f,97,8f,b9,cd,1b,61,df,d6,38,18,8a,18,a1,ce,03,30,0e,9b,ff,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:3f,2b,60,7c,f3,85,cd,41,62,bd,30,0b,c1,56,39,6c,0b,bf,04,0d,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,91,53,a5,6c,9e,bb,d9,fc,b1,a2,83,38,0e,85,7e,4c,34,..
"hdf12"=hex:51,43,9d,89,cc,eb,ff,6a,39,34,9b,97,1f,46,ed,0e,d6,57,bb,85,98,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:9a,c5,a6,b7,4e,58,cb,a9,63,be,20,86,e3,a6,4f,2a,a3,ea,82,85,0b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:42,85,7c,fe,3b,ed,ed,f3,7f,19,ea,43,f3,e9,68,1f,38,e3,c9,31,6b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Programy\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:14,37,e8,7d,ca,4e,89,b5,fa,bf,21,10,26,ba,34,b8,f5,13,d8,36,6b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e9,f2,ce,8e,76,08,73,8e,99,34,ba,04,57,7e,75,57,df,..
"khjeh"=hex:86,11,5d,81,ad,73,28,19,a2,e6,b0,bc,f3,b3,ed,4b,09,fc,6f,44,65,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9a,df,ac,d8,d5,72,2b,e1,de,13,ed,66,5e,e8,02,ee,6d,54,9d,2f,e8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Programy\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:14,37,e8,7d,ca,4e,89,b5,fa,bf,21,10,26,ba,34,b8,f5,13,d8,36,6b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e9,f2,ce,8e,76,08,73,8e,99,34,ba,04,57,7e,75,57,df,..
"khjeh"=hex:86,11,5d,81,ad,73,28,19,a2,e6,b0,bc,f3,b3,ed,4b,09,fc,6f,44,65,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9a,df,ac,d8,d5,72,2b,e1,de,13,ed,66,5e,e8,02,ee,6d,54,9d,2f,e8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:d2,83,eb,88,57,64,cf,06,5e,c7,34,e4,22,90,01,90,27,74,b8,20,b8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:92,4b,10,4e,c9,d9,3d,02,42,e4,6e,b6,56,39,d7,8f,e6,10,72,26,31,..
"p0"="d:\Programy\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,55,f6,a5,6c,58,37,c5,7c,dd,35,ba,7c,f3,91,41,ad,2b,..
"hdf12"=hex:0a,9b,7b,e3,e3,40,a1,c7,92,23,e6,8a,cc,a6,22,6c,a7,6a,d6,00,45,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:9f,97,8f,b9,cd,1b,61,df,d6,38,18,8a,18,a1,ce,03,30,0e,9b,ff,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:3f,2b,60,7c,f3,85,cd,41,62,bd,30,0b,c1,56,39,6c,0b,bf,04,0d,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,91,53,a5,6c,9e,bb,d9,fc,b1,a2,83,38,0e,85,7e,4c,34,..
"hdf12"=hex:51,43,9d,89,cc,eb,ff,6a,39,34,9b,97,1f,46,ed,0e,d6,57,bb,85,98,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:9a,c5,a6,b7,4e,58,cb,a9,63,be,20,86,e3,a6,4f,2a,a3,ea,82,85,0b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:42,85,7c,fe,3b,ed,ed,f3,7f,19,ea,43,f3,e9,68,1f,38,e3,c9,31,6b,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\Programy\\Gadu-Gadu\\gg.exe"="D:\\Programy\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"D:\\Programy\\bearshare\\BearShare.exe"="D:\\Programy\\bearshare\\BearShare.exe:*:Enabled:BearShare"
"D:\\Programy\\LimeWire\\LimeWire.exe"="D:\\Programy\\LimeWire\\LimeWire.exe:*:Disabled:LimeWire"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Konnekt\\konnekt.exe"="C:\\Program Files\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core"
"F:\\Quake3\\quake3.exe"="F:\\Quake3\\quake3.exe:*:Enabled:quake3"
"E:\\Games\\Q3\\quake3.exe"="E:\\Games\\Q3\\quake3.exe:*:Enabled:quake3"
"D:\\Programy\\Hamachi\\hamachi.exe"="D:\\Programy\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client"
"K:\\GAMES\\FEAR\\FEAR.exe"="K:\\GAMES\\FEAR\\FEAR.exe:*:Enabled:FEAR"
"D:\\Programy\\Bittorrent\\bittorrent.exe"="D:\\Programy\\Bittorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"="K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"="K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :



Files with Hidden Attributes :

Wed 27 Jun 2007 446 ...H. --- "C:\Boot.BAK"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 20 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT714.tmp"
Wed 14 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c3e13424b5ca403dd00c8550d4b5fddd\BITAA.tmp"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT28.tmp"
Sun 6 Apr 2008 4,521 ...HR --- "C:\Documents and Settings\Konrad\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

Finished!

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - LOG z combofix

ComboFix 08-06-16.5 - Konrad 2008-06-19 0:24:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.543 [GMT 2:00]
Running from: J:\Nowy folder\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Konrad\Dane aplikacji\macromedia\Flash Player\#SharedObjects\VRZXGSP6\www.broadcaster.com
C:\Documents and Settings\Konrad\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Konrad\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Konrad\Ustawienia lokalne\Temporary Internet Files\head_firmware.inf
C:\Documents and Settings\Konrad\Ustawienia lokalne\Temporary Internet Files\T10.GIF
C:\Documents and Settings\Konrad\Ustawienia lokalne\Temporary Internet Files\T10_0x4102_0x1113_N_ENG.ZIP
C:\Documents and Settings\Konrad\Ustawienia lokalne\Temporary Internet Files\T10_0x4102_0x1113_N_ENG_CROSS.ZIP

.
((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 )))))))))))))))))))))))))))))))
.

2008-06-19 00:11 . 2008-06-19 00:12 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-19 00:07 . 2008-06-19 00:19 <DIR> d-------- C:\SDFix
2008-06-19 00:04 . 2008-06-19 00:04 <DIR> d-------- C:\Program Files\Java
2008-06-19 00:04 . 2008-06-19 00:04 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-19 00:04 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-17 21:34 . 2008-06-17 21:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-17 21:34 . 2008-06-17 22:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-17 21:14 . 2008-06-18 13:01 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-06-15 23:57 . 2008-06-16 00:08 68 --a------ C:\WINDOWS\Awpr.ini
2008-06-15 23:55 . 2008-06-16 00:08 <DIR> d-------- C:\Program Files\ElcomSoft
2008-06-15 23:42 . 2008-06-18 12:56 <DIR> d-------- C:\Program Files\Passware
2008-06-15 19:25 . 2008-06-15 19:28 <DIR> d-------- C:\Program Files\CommViewWiFi
2008-06-15 15:44 . 2008-06-15 15:44 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-15 15:44 . 2008-06-15 15:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 08:31 . 2008-04-14 17:53 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-18 22:09 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\foobar2000
2008-06-18 10:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-17 19:15 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\MegauploadToolbar
2008-06-15 17:08 --------- d-----w C:\Program Files\mIRC
2008-05-20 20:55 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Hamachi
2008-05-20 13:06 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-20 13:06 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-19 19:01 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-05-11 21:36 --------- d-----w C:\Program Files\PopCap Games
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-05 18:21 --------- d-----w C:\Documents and Settings\test\Dane aplikacji\Gadu-Gadu
2008-05-05 18:19 --------- d-----w C:\Documents and Settings\test\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-05-05 18:18 --------- d-----w C:\Documents and Settings\test\Dane aplikacji\Lavasoft
2008-05-05 18:12 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Gadu-Gadu
2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2004-09-28 01:00 26,240 ----a-w C:\WINDOWS\inf\RAMDSK.SYS
.

------- Sigcheck -------

2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2006-04-22 16:10 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="D:\Programy\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136]
"Gadu-Gadu"="D:\Programy\Gadu-Gadu\StrongGG.exe" [2007-12-08 09:49 21504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AWMON"="D:\Programy\AD-AWA~1\Ad-Watch.exe" [2005-05-25 12:12 517632]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-03-28 21:48 949376]
"DAEMON Tools"="D:\Programy\DAEMON Tools\daemon.exe" [ ]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-11-15 11:04 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-15 11:04 8523776]
"DaemonTools_WhenUSave_Installer"="C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe" [ ]
"RivaTunerStartupDaemon"="D:\Programy\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 20:05 2650112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\Konrad\Menu Start\Programy\Autostart\
Core Temp.lnk - C:\Documents and Settings\Konrad\Pulpit\SYSTEM\Core Temp.exe [2006-08-14 00:55:26 179200]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Gigabyte Wireless Utility.lnk - C:\Program Files\Gigabyte\Common\GNConfig.exe [2008-02-27 23:02:17 753664]

[HKLM\~\startupfolder\C:^Documents and Settings^Konrad^Menu Start^Programy^Autostart^HDDlife.lnk]
path=C:\Documents and Settings\Konrad\Menu Start\Programy\Autostart\HDDlife.lnk
backup=C:\WINDOWS\pss\HDDlife.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON]
--a------ 2005-05-25 12:12 517632 D:\Programy\AD-AWA~1\Ad-Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 00:44 15360 C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
--a------ 2007-09-06 15:08 136136 D:\Programy\DAEMON Tools Pro\DTProAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSaveNow_Installer]
C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]
D:\Programy\Eset\nod32kui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-11-15 11:04 8523776 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-11-15 11:04 81920 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
--a------ 2004-12-20 17:12 131072 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-11-15 11:04 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 D:\Programy\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 2006-06-27 16:21 1449984 D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
--a------ 2007-10-30 20:05 2650112 D:\Programy\RivaTuner v2.06\RivaTuner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"nlsvc"=2 (0x2)
"Diskeeper"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"D:\\Programy\\Gadu-Gadu\\gg.exe"=
"D:\\Programy\\bearshare\\BearShare.exe"=
"D:\\Programy\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"E:\\Games\\Q3\\quake3.exe"=
"D:\\Programy\\Hamachi\\hamachi.exe"=
"K:\\GAMES\\FEAR\\FEAR.exe"=
"D:\\Programy\\Bittorrent\\bittorrent.exe"=
"K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"K:\\GAMES\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\AmdAcpi.sys [2005-02-14 11:54]
R1 amdtools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\amdtools.sys [2005-01-19 10:44]
R1 SysTool;SysTool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\SysTool.sys [2006-11-10 15:08]
R2 nxsIO32;NextSensor Kernel I/O Driver;C:\WINDOWS\System32\DRIVERS\nxsIO32.sys [2006-08-22 20:06]
R3 TCCrystalCpuInfo;TCCrystalCpuInfo;C:\DOCUME~1\Konrad\USTAWI~1\Temp\TCCpuInfo.sys []
S3 ATE_PROCMON;ATE_PROCMON;D:\Programy\Anti Trojan Elite\ATEPMon.sys []
S3 CrystalCpuInfo;CrystalCpuInfo;C:\DOCUME~1\Konrad\USTAWI~1\Temp\CpuInfo.sys []
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 00:26:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-06-19 0:26:53
ComboFix-quarantined-files.txt 2008-06-18 22:26:41

Pre-Run: 1,368,731,648 bajtów wolnych
Post-Run: 1,363,881,984 bajtów wolnych

165 --- E O F --- 2008-06-15 17:32:42

A DaemonTools_WhenUSave_Installer nie ma mozliwosci odinstalowania musi to byc jakas pozostalosc po starym deamon toolsie bo od dawna nie instaluje whenusave.

Pasek w ff3 jest dalej 8O

[deadfrog]

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - log

Malwarebytes' Anti-Malware 1.18
Database version: 871

16:38:10 2008-06-20
mbam-log-6-20-2008 (16-38-10).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 188307
Time elapsed: 47 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Konrad\results.txt (Malware.Trace) -> Quarantined and deleted successfully.

pasek w ff nadal jest ;/ Edytowane 20 Czerwca 2008 przez deadfrog