Spyware Doctor Activity Report
Generated on 2006–04–03 18:48:14 Spyware Doctor Homepage PC Tools Homepage Technical Support

Scan Results:
scan start: 2006–04–03 18:50:06
scan stop: 2006–04–03 19:01:24
scanned items: 50979
found items: 43
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts file scanner, Browser Defaults, Favorites and ZoneMap Scanner, ActiveX Scanner, Browser Activity Scanner, Disk Scanner

(1) Infection Name Location Risk
2 SpyAxe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler##{E2CA7CD1–1AD9–F1C4–3D2A–DC1A33E7AF9D} Elevated
3 Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta High
4 Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta## High
5 Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{4da4616d–7e6e–4fd9–a2d5–b6c535733e22} High
6 Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{4da4616d–7e6e–4fd9–a2d5–b6c535733e22}## High
7 Trojan.Popuper HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run##wininet.dll High
8 Security Toolbar HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{736B5468–BDAD–41BE–92D0–22AE2DDF7BCB} High
9 Security Toolbar HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{736B5468–BDAD–41BE–92D0–22AE2DDF7BCB}\iexplore High
10 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202} Elevated
11 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\ahqTdbx Elevated
12 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\gHzqQ Elevated
13 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\InProcServer32 Elevated
14 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\mXwD Elevated
15 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\pzhrjrlKNxq Elevated
16 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex Elevated
17 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\IconHandler Elevated
18 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{000214EE–0000–0000–C000–000000000046} Elevated
19 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{000214F9–0000–0000–C000–000000000046} Elevated
20 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{00021500–0000–0000–C000–000000000046} Elevated
21 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\ShellFolder Elevated
22 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\tnxagebl Elevated
23 SpywareQuake HKCR\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\yvowxowXAzga Elevated
24 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202} Elevated
25 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\ahqTdbx Elevated
26 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\gHzqQ Elevated
27 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\InProcServer32 Elevated
28 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\mXwD Elevated
29 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\pzhrjrlKNxq Elevated
30 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex Elevated
31 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\IconHandler Elevated
32 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{000214EE–0000–0000–C000–000000000046} Elevated
33 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{000214F9–0000–0000–C000–000000000046} Elevated
34 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\shellex\{00021500–0000–0000–C000–000000000046} Elevated
35 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\ShellFolder Elevated
36 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\tnxagebl Elevated
37 SpywareQuake HKLM\Software\Classes\CLSID\{5B55C4E3–C179–BA0B–B4FD–F2DB862D6202}\yvowxowXAzga Elevated
38 Trojan.Popuper HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4DA4616D–7E6E–4FD9–A2D5–B6C535733E22} High
39 Trojan.Popuper HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4DA4616D–7E6E–4FD9–A2D5–B6C535733E22}\iexplore High
40 Tracking Cookie(s) C:\Documents and Settings\Marek\Cookies\marek@m.webtrends[2].txt Medium
41 Tracking Cookie(s) C:\Documents and Settings\Marek\Cookies\marek@hit.gemius[2].txt Medium
42 PSGuard Desktop Hijacker C:\Documents and Settings\All Users\Menu Start\Security Troubleshooting.url High
43 Hotoffers Hijacker C:\WINDOWS\system32\Guninst.exe Elevated
44 Trojan.Popuper C:\WINDOWS\system32\ncompat.tlb High

Spybot
Vcodec: Dane (Plik, nothing done)
C:\WINDOWS\system32\ncompat.tlb

Windows Security Center.FirewallOverride: Ustawienia (Zmiany w rejestrze, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0

Windows Security Center.FirewallDisableNotify: Ustawienia (Zmiany w rejestrze, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Windows Security Center.AntiVirusDisableNotify: Ustawienia (Zmiany w rejestrze, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

Windows Security Center.UpdateDisableNotify: Ustawienia (Zmiany w rejestrze, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify!=dword:0

Poly–HTMLFilter: Identyfikator klasy (Klucz rejestru, nothing done)
HKEY_CLASSES_ROOT\CLSID\{0140DF95–9128–4053–AE72–F43F0CFCA062}

Poly–HTMLFilter: Identyfikator klasy (Klucz rejestru, nothing done)
HKEY_CLASSES_ROOT\CLSID\{B7AB564F–BE70–4AEC–928C–3FDCCD11809D}

Poly–HTMLFilter: Program pomocniczy przeglądarki (Klucz rejestru, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0140DF95–9128–4053–AE72–F43F0CFCA062}


––– Spybot – Search & Destroy version: 1.4 (build: 20050523) –––

2006–04–02 unins000.exe (51.41.0.0)
2005–05–31 blindman.exe (1.0.0.1)
2005–05–31 SpybotSD.exe (1.4.0.3)
2005–05–31 TeaTimer.exe (1.4.0.2)
2005–05–31 Update.exe (1.4.0.0)
2005–05–31 aports.dll (2.1.0.0)
2005–05–31 borlndmm.dll (7.0.4.453)
2005–05–31 delphimm.dll (7.0.4.453)
2005–05–31 SDHelper.dll (1.4.0.0)
2005–05–31 UnzDll.dll (1.73.1.1)
2005–05–31 ZipDll.dll (1.73.2.0)
2006–02–06 advcheck.dll (1.0.2.0)
2006–02–20 Tools.dll (2.0.0.2)
2006–04–01 Includes\Cookies.sbi (*)
2006–04–01 Includes\Dialer.sbi (*)
2006–04–01 Includes\Hijackers.sbi (*)
2006–04–01 Includes\Keyloggers.sbi (*)
2004–11–29 Includes\LSP.sbi (*)
2006–04–01 Includes\Malware.sbi (*)
2006–04–01 Includes\PUPS.sbi (*)
2006–04–01 Includes\Revision.sbi (*)
2006–04–01 Includes\Security.sbi (*)
2006–04–01 Includes\Spybots.sbi (*)
2005–02–17 Includes\Tracks.uti
2006–04–01 Includes\Trojans.sbi (*)

Logfile of HijackThis v1.99.1Scan saved at 19:22:40, on 2006–04–03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\AntiVirenKit 2006\AVKService.exe
C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe
C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Firewall\kavpf.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\ADSCLE~1.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
D:\Gadu–Gadu\Gadu–Gadu\gg.exe
D:\Office–2003\OFFICE11\OUTLOOK.EXE
D:\Office–2003\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\MOJE DOKUMENTY\SYSTEMOWE UŻYTKI\hijackthis\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gdata.pl/pl/news.php
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 – BHO: Poly HTML Filter BHO – {0140DF95–9128–4053–AE72–F43F0CFCA062} – C:\WINDOWS\system32\SiKernel.dll
O2 – BHO: SIPAKBHO Class – {40FB69E1–9B7B–453F–B238–37D8E9528929} – C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\PAKIEPlugins.dll
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 – BHO: PCTools Site Guard – {5C8B2A36–3DB1–42A4–A3CB–D426709BBFEB} – C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 – BHO: PCTools Browser Monitor – {B56A7D7D–6927–48C8–A975–17DF180C71AC} – C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 – BHO: Offliner AdFilter Helper – {DC9377A2–2E8D–44A1–99DB–F8A821DF254D} – C:\WINDOWS\system32\SiPlugins.dll
O3 – Toolbar: Pasek Webfilter – {75CD0BC5–E317–449C–9FF6–4986B3D48F64} – C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\PAKIEGUI.dll
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [nwiz] nwiz.exe /install
O4 – HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 – HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 – HKLM\..\Run: [AVKTray] "C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe"
O4 – HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 – Global Startup: Webfilter.lnk = C:\Program Files\G DATA\AntiVirenKit InternetSecurity\Webfilter\WebFilter.exe
O4 – Global Startup: Firewall.lnk = ?
O8 – Extra context menu item: Add selected links to Link Container – C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\System\Scripts\off_collector_sel.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://D:\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 – Extra context menu item: Show domain links – C:\PROGRA~1\GDATA~1\ANTIVI~1\WEBFIL~1\System\Scripts\off_domain_links.htm
O9 – Extra button: Spyware Doctor – {2D663D1A–8670–49D9–A1A5–4C56B4E14E84} – C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 – DPF: {17492023–C23A–453E–A040–C7C580BBF700} (Windows Genuine Advantage Validation Tool) – http://go.microsoft.com/fwlink/?linkid=39204
O16 – DPF: {6E32070A–766D–4EE6–879C–DC1FA91D2FC3} (MUWebControl Class) – http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123869869562
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 – Winlogon Notify: WgaLogon – C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 – Service: APC UPS Service – American Power Conversion Corporation – D:\BackUPS–APC\mainserv.exe
O23 – Service: AVKProxy – G DATA Software AG – C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 – Service: AVK Service (AVKService) – Unknown owner – C:\Program Files\AntiVirenKit 2006\AVKService.exe
O23 – Service: Straźnik AVK (AVKWCtl) – Unknown owner – C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\system32\nvsvc32.exe
O23 – Service: PC Tools Spyware Doctor (SDhelper) – PC Tools Research Pty Ltd – C:\Program Files\Spyware Doctor\sdhelp.exe

szzzzz:

O8 – Extra context menu item: Add selected links to Link Container – D:\AVK–IS_2004\Webfilter\System\Scripts\off_collector_sel.htm
O8 – Extra context menu item: Show domain links – D:\AVK–IS_2004\Webfilter\System\Scripts\off_domain_links.htm
O23 – Service: APC UPS Service – American Power Conversion Corporation – D:\BackUPS–APC\mainserv.exe

Wszystko usuwasz w trybie awaryjnym(F5 lub f8) bez przywracania systemu.Po wykonaniu zamiescic nowy LOG

O2 – BHO: (no name) – {4da4616d–7e6e–4fd9–a2d5–b6c535733e22} – (no file)

O2 – BHO: (no name) – {4da4616d–7e6e–4fd9–a2d5–b6c535733e22} – (no file)

szzzzz:

O8 – Extra context menu item: Add selected links to Link Container – D:\AVK–IS_2004\Webfilter\System\Scripts\off_collector_sel.htm
O8 – Extra context menu item: Show domain links – D:\AVK–IS_2004\Webfilter\System\Scripts\off_domain_links.htm
O23 – Service: APC UPS Service – American Power Conversion Corporation – D:\BackUPS–APC\mainserv.exe

O8 – Extra context menu item: Add selected links to Link Container – D:\AVK–IS_2004\Webfilter\System\Scripts\off_collector_sel.htm
O8 – Extra context menu item: Show domain links – D:\AVK–IS_2004\Webfilter\System\Scripts\off_domain_links.htm
O23 – Service: APC UPS Service – American Power Conversion Corporation – D:\BackUPS–APC\mainserv.exe

O8 – Extra context menu item: Add selected links to Link Container – D:\AVK–IS_2004\Webfilter\System\Scripts\off_collector_sel.htm
O8 – Extra context menu item: Show domain links – D:\AVK–IS_2004\Webfilter\System\Scripts\off_domain_links.htm
O23 – Service: APC UPS Service – American Power Conversion Corporation – D:\BackUPS–APC\mainserv.exe