Podejrzewam ze mam keyloggera na komputerze. Nie będę owijał w bawełnę i odrazu pokaze logi
skanowałem w tej kolejnosci:
HiJackThis>>>combofix>>>(ponownie) HiJackThis
Logi HiJackthis przed combofixem:
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:00:01, on 2008-11-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\regx32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\regx32.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "d:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: lsass.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3271 bytes
Combofix
- Kod: Zaznacz wszystko
ComboFix 08-11-30.01 - komp 2008-11-29 21:05:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.72 [GMT 1:00]
Uruchomiony z: d:\pierdzioły\ComboFix.exe
* Utworzono nowy punkt przywracania
[COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR]
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\komp\Menu Start\Programy\Autostart\lsass.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-28 do 2008-11-30 )))))))))))))))))))))))))))))))
.
2008-11-29 20:59 . 2008-11-29 20:59 <DIR> d-------- c:\program files\Trend Micro
2008-11-28 17:09 . 2008-11-28 17:19 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\Winamp
2008-11-27 20:49 . 2008-11-30 21:08 <DIR> d--h----- c:\documents and settings\Krzysztof\Ustawienia lokalne
2008-11-27 20:49 . 2008-11-27 20:50 <DIR> dr------- c:\documents and settings\Krzysztof\Ulubione
2008-11-27 20:49 . 2008-11-09 20:40 <DIR> d--h----- c:\documents and settings\Krzysztof\Szablony
2008-11-27 20:49 . 2008-11-09 21:08 <DIR> d-------- c:\documents and settings\Krzysztof\Pulpit
2008-11-27 20:49 . 2008-11-27 20:50 <DIR> dr------- c:\documents and settings\Krzysztof\Moje dokumenty
2008-11-27 20:49 . 2008-11-09 21:08 <DIR> dr------- c:\documents and settings\Krzysztof\Menu Start
2008-11-27 20:49 . 2008-11-27 20:54 <DIR> dr-h----- c:\documents and settings\Krzysztof\Dane aplikacji
2008-11-27 20:49 . 2008-11-27 20:50 <DIR> d-------- c:\documents and settings\Krzysztof
2008-11-26 22:51 . 2008-11-20 22:52 104,883,280 --a------ C:\temp3685.tmp
2008-11-26 22:40 . 2008-11-26 22:40 104,883,280 --a------ C:\temp1650.tmp
2008-11-26 22:39 . 2008-11-20 22:52 104,883,280 --a------ C:\temp5137.tmp
2008-11-26 14:28 . 2008-11-20 22:52 104,883,280 --a------ C:\temp1338.tmp
2008-11-26 14:27 . 2008-11-20 22:52 104,883,280 --a------ C:\temp5076.tmp
2008-11-26 08:03 . 2008-11-26 08:03 <DIR> dr------- c:\documents and settings\LocalService\Ulubione
2008-11-25 20:35 . 2008-11-20 22:52 104,883,280 --a------ C:\temp5534.tmp
2008-11-25 14:32 . 2008-11-28 17:27 <DIR> d-------- c:\program files\Tibia Auto
2008-11-25 14:13 . 2008-11-25 14:32 <DIR> d-------- c:\program files\Tibia
2008-11-23 14:44 . 2008-11-25 14:51 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\Tibia
2008-11-16 19:21 . 2008-11-16 19:21 <DIR> d-------- c:\program files\InstallShield Installation Information
2008-11-16 19:20 . 2008-11-16 19:20 <DIR> d-------- c:\program files\Lexmark
2008-11-16 19:17 . 2008-11-26 08:04 196 --a------ c:\windows\lexstat.ini
2008-11-16 19:15 . 2003-03-26 15:22 286,720 --a------ c:\windows\system32\lxblcomm.dll
2008-11-16 19:15 . 2003-04-10 10:52 73,728 --a------ c:\windows\system32\lxblpwr.dll
2008-11-16 19:15 . 2002-11-13 16:40 40,960 --a------ c:\windows\system32\lxblvs.dll
2008-11-16 19:14 . 2008-11-16 19:14 <DIR> d-------- c:\program files\Lexmark Z700-P700 Series
2008-11-16 19:14 . 2008-11-16 19:14 <DIR> d-------- c:\documents and settings\komp\WINDOWS
2008-11-16 19:04 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2008-11-16 19:04 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2008-11-13 14:27 . 2008-11-28 20:19 69 --a------ c:\windows\NeroDigital.ini
2008-11-12 18:56 . 2008-11-12 18:56 <DIR> d-------- c:\program files\Alwil Software
2008-11-12 18:56 . 2003-03-18 21:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2008-11-12 18:56 . 2003-03-18 20:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
2008-11-12 18:56 . 2003-02-21 04:42 348,160 --a------ c:\windows\system32\MSVCR71.dll
2008-11-11 21:16 . 2008-11-11 21:16 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\Nero
2008-11-11 21:11 . 2008-11-11 21:12 <DIR> d-------- c:\program files\Common Files\Nero
2008-11-11 21:11 . 2008-11-11 21:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero
2008-11-11 21:11 . 2006-03-17 12:45 1,757,184 --a------ c:\windows\system32\imagX7.dll
2008-11-11 21:11 . 2006-03-17 12:45 802,816 --a------ c:\windows\system32\imagXRA7.dll
2008-11-11 21:11 . 2006-03-17 12:45 497,296 --a------ c:\windows\system32\imagXpr7.dll
2008-11-11 21:11 . 2006-03-17 15:49 368,640 --a------ c:\windows\system32\TwnLib4.dll
2008-11-11 21:11 . 2006-03-17 12:45 258,048 --a------ c:\windows\system32\imagXR7.dll
2008-11-10 15:34 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-11-10 15:34 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-11-10 00:02 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2008-11-09 23:48 . 2008-11-09 23:48 159,576 --a------ c:\windows\Marsu-Fix 2.5 Uninstaller.exe
2008-11-09 23:42 . 2008-11-09 23:42 <DIR> d-------- c:\program files\ESET
2008-11-09 22:50 . 2008-11-09 22:50 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\ESET
2008-11-09 22:40 . 2008-11-09 22:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET
2008-11-09 22:25 . 2006-10-26 19:58 30,512 --a------ c:\windows\system32\mdimon.dll
2008-11-09 22:20 . 2008-11-09 22:20 <DIR> d-------- c:\program files\Microsoft Works
2008-11-09 22:03 . 2008-11-09 22:18 <DIR> d-------- c:\windows\SHELLNEW
2008-11-09 22:02 . 2008-11-09 22:26 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-09 21:54 . 2008-11-09 21:54 <DIR> d-------- c:\program files\SiS7012
2008-11-09 21:54 . 2003-04-08 09:56 820,133 -ra------ c:\windows\system32\drivers\sis7012.sys
2008-11-09 21:54 . 2002-07-01 18:10 115,864 --a--c--- c:\windows\system32\dllcache\a3d.dll
2008-11-09 21:54 . 2002-07-01 18:10 115,864 -ra------ c:\windows\system32\a3d.dll
2008-11-09 21:46 . 2008-11-09 21:51 <DIR> d-------- c:\windows\nview
2008-11-09 21:46 . 2006-03-09 15:29 180,224 --a------ c:\windows\system32\nvudisp.exe
2008-11-09 21:46 . 2008-11-29 20:49 50,257 --a------ c:\windows\system32\nvapps.xml
2008-11-09 21:46 . 2006-03-09 15:29 16,960 --a------ c:\windows\system32\nvdisp.nvu
2008-11-09 21:45 . 2008-11-16 19:19 <DIR> d-------- c:\program files\Common Files\InstallShield
2008-11-09 21:45 . 2008-11-09 21:45 <DIR> d-------- C:\NVIDIA
2008-11-09 21:45 . 2006-03-09 17:59 180,224 --a------ c:\windows\system32\NVUNINST.EXE
2008-11-09 21:23 . 2008-11-09 21:23 0 --a------ c:\windows\nsreg.dat
2008-11-09 21:17 . 2008-11-09 21:17 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\Gadu-Gadu
2008-11-09 21:14 . 2008-11-15 14:44 <DIR> d-------- c:\documents and settings\komp\Gadu-Gadu
2008-11-09 21:14 . 2004-08-04 00:07 171,776 --a------ c:\windows\system32\drivers\kmixer.sys
2008-11-09 21:14 . 2004-08-03 23:39 142,464 --a------ c:\windows\system32\drivers\aec.sys
2008-11-09 21:14 . 2004-08-04 00:15 82,944 --a------ c:\windows\system32\drivers\wdmaud.sys
2008-11-09 21:14 . 2004-08-04 00:15 60,800 --a------ c:\windows\system32\drivers\sysaudio.sys
2008-11-09 21:14 . 2001-08-17 23:00 54,272 --a------ c:\windows\system32\drivers\swmidi.sys
2008-11-09 21:14 . 2004-08-04 00:07 52,864 --a------ c:\windows\system32\drivers\DMusic.sys
2008-11-09 21:14 . 2004-08-03 23:58 7,552 --a------ c:\windows\system32\drivers\MSKSSRV.sys
2008-11-09 21:14 . 2004-08-04 00:07 6,400 --a------ c:\windows\system32\drivers\splitter.sys
2008-11-09 21:14 . 2004-08-03 23:58 5,376 --a------ c:\windows\system32\drivers\MSPCLOCK.sys
2008-11-09 21:14 . 2004-08-03 23:58 4,992 --a------ c:\windows\system32\drivers\MSPQM.sys
2008-11-09 21:14 . 2004-08-04 00:07 2,944 --a------ c:\windows\system32\drivers\drmkaud.sys
2008-11-09 21:13 . 2004-08-04 01:35 58,624 --a------ c:\windows\system32\drivers\redbook.sys
2008-11-09 21:13 . 2001-08-17 22:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys
2008-11-09 21:11 . 2004-08-04 01:44 77,312 --a------ c:\windows\system32\usbui.dll
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> dr-h----- c:\documents and settings\Default User\Ustawienia lokalne
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> d-------- c:\documents and settings\Default User\Ulubione
2008-11-09 21:08 . 2008-11-09 20:40 <DIR> d--h----- c:\documents and settings\Default User\Szablony
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> d-------- c:\documents and settings\Default User\Pulpit
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> d-------- c:\documents and settings\Default User\Moje dokumenty
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> dr------- c:\documents and settings\Default User\Menu Start
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> d-------- c:\documents and settings\All Users\Ulubione
2008-11-09 21:08 . 2008-11-09 21:08 <DIR> d--h----- c:\documents and settings\All Users\Szablony
2008-11-09 21:08 . 2008-11-28 17:19 <DIR> d-------- c:\documents and settings\All Users\Pulpit
2008-11-09 21:08 . 2008-11-09 22:26 <DIR> dr------- c:\documents and settings\All Users\Menu Start
2008-11-09 21:08 . 2008-11-09 20:43 <DIR> dr------- c:\documents and settings\All Users\Dokumenty
2008-11-09 21:08 . 2004-08-04 00:27 1,896,400 --a--c--- c:\windows\system32\dllcache\NT5.CAT
2008-11-09 21:07 . 2008-11-28 17:14 <DIR> d-------- c:\windows\system32\CatRoot2
2008-11-09 21:07 . 2008-11-09 21:08 <DIR> d-------- c:\windows\system32\CatRoot
2008-11-09 21:07 . 2008-11-09 21:08 <DIR> dr-h----- c:\documents and settings\Default User\Dane aplikacji
2008-11-09 21:07 . 2008-11-09 20:49 <DIR> d--h----- c:\documents and settings\Default User
2008-11-09 21:07 . 2008-11-11 21:11 <DIR> dr-h----- c:\documents and settings\All Users\Dane aplikacji
2008-11-09 21:07 . 2008-11-09 20:46 <DIR> d-------- c:\documents and settings\All Users
2008-11-09 21:07 . 2008-11-27 20:49 <DIR> d-------- C:\Documents and Settings
2008-11-09 21:04 . 2008-11-09 20:56 261 --a------ c:\windows\system32\$winnt$.inf
2008-11-09 21:01 . 2008-11-30 21:08 <DIR> d--h----- c:\documents and settings\komp\Ustawienia lokalne
2008-11-09 21:01 . 2008-11-09 21:01 <DIR> dr------- c:\documents and settings\komp\Ulubione
2008-11-09 21:01 . 2008-11-09 20:40 <DIR> d--h----- c:\documents and settings\komp\Szablony
2008-11-09 21:01 . 2008-11-29 21:00 <DIR> d-------- c:\documents and settings\komp\Pulpit
2008-11-09 21:01 . 2008-11-25 14:58 <DIR> dr------- c:\documents and settings\komp\Moje dokumenty
2008-11-09 21:01 . 2008-11-09 21:14 <DIR> dr------- c:\documents and settings\komp\Menu Start
2008-11-09 21:01 . 2008-11-28 17:09 <DIR> dr-h----- c:\documents and settings\komp\Dane aplikacji
2008-11-09 21:01 . 2008-11-16 19:14 <DIR> d-------- c:\documents and settings\komp
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-09 19:50 --------- d-----w c:\program files\microsoft frontpage
2008-11-09 19:45 --------- d-----w c:\program files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Gadu-Gadu"="d:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-09 7561216]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-03-09 86016]
"TrialReset"="c:\windows\regx32.exe" [2008-07-03 285327]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 79224]
"nwiz"="nwiz.exe" [2006-03-09 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Gadu-Gadu\\gg.exe"=
"d:\\Program Files\\FAT\\hl.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [2008-11-09 820133]
*Newly Created Service* - PROCEXP90
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-WinampAgent - d:\program files\Winamp\winampa.exe
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\komp\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]kz4quuk.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 21:08:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2008-11-30 21:10:41
ComboFix-quarantined-files.txt 2008-11-30 20:10:23
Przed: 4 266 516 480 bajtów wolnych
Po: 4,189,405,184 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
176
oraz ponownie logi HiJackThis po skanowaniu przez combofix:
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:38, on 2008-11-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\regx32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\regx32.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3192 bytes
Mam jeszcze pewna uwage... podczas uzytkowania komputera co jakis czas slychac takie klikanie jakby wlaczalo sie jakis folder (np. Mój Komputer >> dysk X) dokladnie takie klikanie slychac kilka razy co jakis czas, moze sie to wydawac głupie ale niewiem czy to ma jakies powiazanie z keyloggerem.
Czekam na dalsze instrukcje
zapisz jako 
