Proszę o sprawdzenie log. [ zawieszanie komputera ]

[F?]

ComboFix

Kod: Zaznacz wszystko

ComboFix 09-02-01.01 - Admin 2009-02-02 14:46:07.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.3070.2551 [GMT 1:00]
Uruchomiony z: d:\narzędzia\ComboFix.exe
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\windows\IE4 Error Log.txt

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OREANS32
-------\Service_oreans32


(((((((((((((((((((((((((   Pliki utworzone od 2009-01-02 do 2009-02-02  )))))))))))))))))))))))))))))))
.

2009-02-02 13:49 . 2009-02-02 13:49   0   --ah-----   c:\windows\system32\mzloaguf.sys
2009-02-02 13:40 . 2009-02-02 13:40   0   --ah-----   c:\windows\system32\krdj.sys
2009-01-31 13:20 . 2009-01-31 13:20   18   --a------   c:\windows\nsreg2.dat
2009-01-31 13:18 . 2009-01-31 13:18   <DIR>   d--------   c:\program files\Onet-Chat-Client
2009-01-30 12:48 . 2009-01-30 12:48   0   --ah-----   c:\windows\system32\mzkwgu.sys
2009-01-28 20:01 . 2009-01-28 20:01   0   --ah-----   c:\windows\system32\shpdmblw.sys
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\SpacialAudio
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\Firebird
2009-01-27 16:53 . 2004-12-13 01:05   356,437   --a------   c:\windows\system32\GDS32.DLL
2009-01-23 14:10 . 2009-01-23 14:12   <DIR>   d--------   c:\program files\Microsoft SQL Server
2009-01-23 12:30 . 2009-01-23 12:30   62,608   --ah-----   c:\windows\system32\oanxi.sys
2009-01-23 12:30 . 2009-01-23 12:30   0   --ah-----   c:\windows\system32\pcubk.sys
2009-01-23 12:30 . 2009-01-23 12:30   0   --ah-----   c:\windows\system32\anxish.sys
2009-01-22 12:32 . 2009-01-22 12:32   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ATI
2009-01-22 12:29 . 2009-01-22 12:36   <DIR>   d--------   c:\program files\ATI
2009-01-22 12:24 . 2008-12-01 14:35   593,920   ---------   c:\windows\system32\ati2sgag.exe
2009-01-22 11:25 . 2009-01-22 12:59   <DIR>   d--------   c:\program files\SpeedFan
2009-01-22 11:25 . 2009-01-22 11:25   45   --a------   c:\windows\system32\initdebug.nfo
2009-01-22 11:24 . 2009-01-22 11:24   <DIR>   d--------   c:\program files\Trend Micro
2009-01-22 10:28 . 2009-01-22 10:28   62,608   --ah-----   c:\windows\system32\ktisencm.sys
2009-01-21 19:33 . 2009-01-21 19:33   <DIR>   d--------   c:\program files\mp3dj
2009-01-21 19:33 . 2009-01-21 19:33   286,720   ---------   c:\windows\Setup1.exe
2009-01-21 19:33 . 2009-01-21 19:33   73,216   --a------   c:\windows\ST6UNST.EXE
2009-01-19 16:53 . 2009-01-19 16:52   410,984   --a------   c:\windows\system32\deploytk.dll
2009-01-19 16:53 . 2009-01-19 16:52   73,728   --a------   c:\windows\system32\javacpl.cpl
2009-01-19 16:24 . 2009-01-19 16:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files
2009-01-19 16:19 . 2009-01-19 16:19   <DIR>   d--------   c:\program files\Headshot Player
2009-01-17 13:17 . 2009-01-17 13:17   <DIR>   d--------   C:\totalcmd
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\UC.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\RAR.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKUNZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\NOCLOSE.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\LHA.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\ARJ.PIF
2009-01-16 19:23 . 2009-01-16 19:23   0   --ah-----   c:\windows\system32\bnpdjs.sys
2009-01-16 18:59 . 2009-01-16 18:59   <DIR>   d--------   c:\windows\system32\AlertModule
2009-01-12 14:21 . 2009-01-12 14:21   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Hamachi
2009-01-11 17:39 . 2009-01-11 17:39   0   --ah-----   c:\windows\system32\szknx.sys
2009-01-11 15:44 . 2009-01-11 16:54   24,944   --a------   c:\windows\system32\drivers\GVTDrv.sys
2009-01-11 15:43 . 2006-11-24 14:47   40,136   --a------   c:\windows\system32\drivers\ET5Drv.sys
2009-01-11 13:57 . 2009-01-11 13:57   <DIR>   d--------   c:\program files\Yahoo!
2009-01-11 13:55 . 2009-01-11 13:55   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2009-01-11 13:55 . 2005-02-17 07:15   73,728   --a------   c:\windows\system32\ISUSPM.cpl
2009-01-11 13:32 . 2009-01-11 13:32   <DIR>   d--------   c:\windows\system32\pl
2009-01-11 13:30 . 2008-04-14 21:45   2,977,792   -----c---   c:\windows\system32\dllcache\wmploc.dll
2009-01-11 13:29 . 2008-04-14 00:10   10,240   ---------   c:\windows\system32\drivers\sffp_mmc.sys
2009-01-11 13:28 . 2006-12-29 00:31   19,569   --a------   c:\windows\[u]0[/u]00001_.tmp
2009-01-11 13:03 . 2009-01-22 12:15   10   --a------   c:\windows\WININIT.INI
2009-01-11 12:24 . 2009-01-11 12:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Lavasoft
2009-01-09 15:21 . 2009-01-09 15:21   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Media Player Classic
2009-01-09 15:19 . 2009-01-09 15:19   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\GrabPro
2009-01-08 16:29 . 2009-01-30 12:49   <DIR>   d--------   c:\program files\Orbitdownloader
2009-01-08 16:29 . 2009-01-30 12:28   <DIR>   d--------   C:\Downloads
2009-01-08 16:29 . 2009-01-30 12:29   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Orbit
2009-01-06 21:13 . 2009-01-06 21:13   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Leadertech
2009-01-06 20:48 . 2009-01-06 20:48   <DIR>   dr-h-----   c:\documents and settings\Admin\Dane aplikacji\SecuROM
2009-01-06 20:33 . 2009-01-09 16:43   682,280   --a------   c:\windows\system32\pbsvc.exe
2009-01-06 20:33 . 2009-01-09 16:43   22,328   --a------   c:\documents and settings\Admin\Dane aplikacji\PnkBstrK.sys
2009-01-06 20:25 . 2008-05-30 14:19   507,400   --a------   c:\windows\system32\XAudio2_1.dll
2009-01-06 20:25 . 2009-01-06 20:48   107,888   --a------   c:\windows\system32\CmdLineExt.dll
2009-01-06 20:25 . 2008-05-30 14:17   65,032   --a------   c:\windows\system32\XAPOFX1_0.dll
2009-01-06 20:23 . 2009-01-11 09:42   <DIR>   d--------   c:\windows\system32\drivers\umdf
2009-01-06 20:23 . 2008-03-05 15:56   1,420,824   --a------   c:\windows\system32\D3DCompiler_37.dll
2009-01-06 20:23 . 2007-04-04 18:53   81,768   --a------   c:\windows\system32\xinput1_3.dll
2009-01-06 20:22 . 2009-01-06 20:22   <DIR>   d--------   c:\windows\system32\xlive
2009-01-06 20:22 . 2009-01-07 14:44   <DIR>   d--------   c:\program files\Microsoft Games for Windows - LIVE
2009-01-06 19:57 . 2009-01-06 19:57   685,816   --a------   c:\windows\system32\drivers\sptd.sys
2009-01-04 17:27 . 2009-01-04 17:27   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Publish Providers
2009-01-04 17:26 . 2009-01-04 17:26   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Sony
2009-01-04 17:25 . 2009-01-23 14:20   <DIR>   d--------   c:\program files\Sony
2009-01-04 17:24 . 2009-01-23 14:10   <DIR>   d--------   c:\program files\Sony Setup

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-02 13:46   ---------   d-----w   c:\program files\cFosSpeed
2009-02-02 13:12   138,184   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2009-02-02 12:42   ---------   d-----w   c:\program files\Mozilla Thunderbird
2009-02-01 12:33   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\mIRC
2009-02-01 12:32   ---------   d-----w   c:\program files\mIRC
2009-01-28 16:38   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\teamspeak2
2009-01-23 13:12   ---------   d-----w   c:\program files\Microsoft.NET
2009-01-22 11:25   ---------   d-----w   c:\program files\ATI Technologies
2009-01-19 15:52   ---------   d-----w   c:\program files\Java
2009-01-16 18:00   ---------   d-----w   c:\program files\neostrada tp
2009-01-16 17:49   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-01-12 13:22   ---------   d-----w   c:\program files\Nero
2009-01-11 12:56   ---------   d-----w   c:\program files\GIGABYTE
2009-01-11 12:55   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-11 12:53   16,512   ----a-w   c:\windows\gdrv.sys
2009-01-11 08:41   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\PC Suite
2009-01-09 14:19   ---------   d-----w   c:\program files\K-Lite Codec Pack
2009-01-09 14:19   ---------   d-----w   c:\program files\ALLPlayer
2009-01-01 16:57   ---------   d-----w   c:\program files\VideoMach-2.7.2
2009-01-01 16:43   ---------   d-----w   c:\program files\VideoMach-4.0.4
2008-12-28 19:29   ---------   d---a-w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\TEMP
2008-12-23 12:48   ---------   d-----w   c:\program files\NAPI-PROJEKT
2008-12-21 15:13   ---------   d-----w   c:\program files\Ares
2008-12-16 15:49   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\AdobeUM
2008-12-15 21:20   ---------   d-----w   c:\program files\VDOWNLOADER
2008-12-15 21:20   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Desktopicon
2008-12-13 19:19   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Winamp
2008-12-13 18:27   ---------   d-----w   c:\program files\ivo
2008-12-13 13:53   ---------   d-----w   c:\program files\Gadu-Gadu
2008-12-13 13:03   ---------   d-----w   c:\program files\Winamp
2008-12-11 18:50   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Skype
2008-12-09 14:23   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems
2008-12-07 13:09   ---------   d-----w   c:\program files\Microsoft Works
2008-12-07 13:09   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help
2008-12-07 13:08   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Ventrilo
2008-12-07 13:06   ---------   d-----w   c:\program files\Microsoft Visual Studio 8
2008-12-07 12:59   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ESET
2008-12-06 21:28   0   ---ha-w   c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-06 21:28   0   ---ha-w   c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-12-06 21:28   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\PC Suite
2008-12-06 21:28   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Nokia
2008-12-06 21:26   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Installations
2008-12-06 11:33   33,824   ----a-w   c:\windows\system32\drivers\oreans32.sys
2008-12-05 20:42   ---------   d-----w   c:\program files\Reference Assemblies
2008-12-05 20:42   ---------   d-----w   c:\program files\MSBuild
2008-12-05 20:39   ---------   d-----w   c:\program files\MSXML 6.0
2008-12-05 19:15   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Thunderbird
2008-12-05 19:05   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\ATI
2008-12-05 19:04   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Gadu-Gadu
2008-12-05 18:41   315,392   ----a-w   c:\windows\HideWin.exe
2008-12-05 18:33   730,121   ----a-w   c:\program files\Common Files\unins000.exe
2008-12-05 18:33   5,657   ----a-w   c:\program files\Common Files\unins000.dat
2008-12-05 18:24   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\InstallShield
2008-12-02 16:13   ---------   d-----w   c:\program files\DivX
2008-03-09 06:25   236   ---ha-w   c:\program files\Common Files\dx.reg
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-19 136600]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^lsass.exe]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\lsass.exe
backup=c:\windows\pss\lsass.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Orbit.lnk]
path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-08-01 19:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]
--a------ 2008-11-24 20:44 869888 c:\program files\ALLPlayer\ALLUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]
-ra------ 2008-07-18 15:23 867544 c:\program files\cFosSpeed\cfosspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 22:51 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVPro]
--a------ 2007-07-26 15:05 20480 c:\program files\GIGABYTE\ET5Pro\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-06-17 15:00 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-08-11 07:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-09-20 19:16 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NOD32FiXTemDono"=2 (0x2)
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"d:\\Gry\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Gry\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Gry\\CoD5\\CoDWaWmp.exe"=
"d:\\Gry\\CoD5\\CoDWaW.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2002-09-28 3584]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

MSConfigStartUp-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-02 14:48:54
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:98,fa,e1,5d,1b,bb,b7,b3,44,2d,38,92,70,3b,63,f6,e1,8a,4b,82,15,
   6d,54,25,be,41,1f,ea,f9,73,ee,25,f8,8c,d2,aa,79,9f,04,35,6c,30,de,9b,12,4d,\
"rkeysecu"=hex:a6,f5,32,30,86,40,d0,18,c6,e2,09,4e,c0,58,b7,53

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\[u]0[/u]9"
"DeviceDesc"="???\17?\11\[u]0[/u]9"
"ProviderName"="???\11?\16?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"e:\\chipset\\rd790\\xp2k\\sbdrv\\smbus\\smbusati.inf\[u]0[/u]0"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\cFosSpeed\spd.exe
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-02-02 14:50:31 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-02-02 13:50:29

Przed: 238 584 205 312 bajtów wolnych
Po: 238,612,312,064 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut /usepmtimer

298

hijackthis

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:51:20, on 2009-02-02
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6493 bytes

No więc tak, jestem w tym kompletnie zielony. Komputer kupiłem pół roku temu, nie grałem w żadne gry z braku czasu i po prostu mnie to nie interesowało . Kiedyś jedynie grałem w Wiedźmina i Crysisa to komputer mi się raczej nie wieszał.
Teraz zacząłem grać w NFS: Undercover to po 10 min gry komputer staje [ Tak samo w GTA IV tylko, że tam pogram z 30 min ]. Naprawdę jest to bardzo denerwujące.

Mój komputer:

Kod: Zaznacz wszystko

Typ procesora:   TripleCore AMD Phenom 8750, 2400 MHz (12 x 200)
Nazwa płyty głównej:   Gigabyte GA-MA770-DS3  (2 PCI, 4 PCI-E x1, 1 PCI-E x16, 4 DDR2 DIMM, Audio, Gigabit LAN, IEEE-1394)
Mikroukład płyty głównej:   AMD 770, AMD K10
Pamięć fizyczna:   3072 MB
DIMM2: Kingston 9905316-132.A01LF   2 GB DDR2-800 DDR2 SDRAM  (6-6-6-18 @ 400 MHz)  (5-5-5-15 @ 333 MHz)  (4-4-4-12 @ 266 MHz)
DIMM4: Kingston 99U5316-028.A00LF   1 GB DDR2-800 DDR2 SDRAM  (6-6-6-18 @ 400 MHz)  (5-5-5-15 @ 333 MHz)  (4-4-4-12 @ 266 MHz)
Karta Graficzna: Asus Radeon HD4850
System: Win XP SP3, Sterowniki GPU CCC 8.12


Monitorowałem temperaturę karty graficznej i normalnie [ gry nie grałem ] to miałem ok 48stopni, a gdy ostro grałem to max 80 [ tak to 60-70 ]

Z góry dzięki za pomoc, pozdrawiam.

[Okocza]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[F?]

SDFix Raport:

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by Admin on 2009-02-10 at 13:40

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 13:46:56
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:46,24,8b,28,43,5f,87,f2,50,ba,56,11,eb,b9,fd,8e,e5,ae,b5,04,11,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:46,24,8b,28,43,5f,87,f2,50,ba,56,11,eb,b9,fd,8e,e5,ae,b5,04,11,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:52,f3,21,3d,8e,be,65,46,84,f0,1e,2e,cf,13,05,ab,d4,4a,d9,bb,0c,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares"
"D:\\Gry\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"="D:\\Gry\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"D:\\Gry\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"="D:\\Gry\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"D:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"="D:\\Gry\\Far Cry 2\\bin\\FarCry2.exe:*:Enabled:Far Cry 2"
"D:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"="D:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"
"D:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"="D:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe:*:Enabled:Editor"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"="C:\\Program Files\\Orbitdownloader\\orbitdm.exe:*:Enabled:Orbit"
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"="C:\\Program Files\\Orbitdownloader\\orbitnet.exe:*:Enabled:Orbit"
"D:\\Gry\\CoD5\\CoDWaWmp.exe"="D:\\Gry\\CoD5\\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"D:\\Gry\\CoD5\\CoDWaW.exe"="D:\\Gry\\CoD5\\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Mon  3 Mar 2008           568 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg"
Mon  3 Mar 2008         5,702 A..H. --- "C:\WINDOWS\nod32restoretemdono.reg"
Sun  9 Mar 2008           236 A..H. --- "C:\Program Files\Common Files\dx.reg"
Fri 23 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\anxish.sys"
Fri 16 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\bnpdjs.sys"
Mon  2 Feb 2009             0 A..H. --- "C:\WINDOWS\system32\krdj.sys"
Thu 22 Jan 2009        62,608 A..H. --- "C:\WINDOWS\system32\ktisencm.sys"
Fri 30 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\mzkwgu.sys"
Mon  2 Feb 2009             0 A..H. --- "C:\WINDOWS\system32\mzloaguf.sys"
Fri 23 Jan 2009        62,608 A..H. --- "C:\WINDOWS\system32\oanxi.sys"
Fri 23 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\pcubk.sys"
Wed 28 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\shpdmblw.sys"
Sun 11 Jan 2009             0 A..H. --- "C:\WINDOWS\system32\szknx.sys"
Tue 25 Nov 2008         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 18 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~115C.tmp"
Mon  1 Dec 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~117F.tmp"
Tue  2 Dec 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~1262.tmp"
Sat 15 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~18B7.tmp"
Wed 12 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~1AF2.tmp"
Fri 28 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~1B01.tmp"
Fri  7 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~2399.tmp"
Wed  3 Dec 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~28B7.tmp"
Tue 11 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~3115.tmp"
Fri 14 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~328A.tmp"
Wed 12 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~358.tmp"
Fri 14 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~3D.tmp"
Tue 18 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~52C.tmp"
Sun 30 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~6CC.tmp"
Sat 15 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~719.tmp"
Fri 14 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~881.tmp"
Tue 18 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~B79.tmp"
Sat 15 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~CA3.tmp"
Wed  5 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~D55.tmp"
Wed 12 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~D83.tmp"
Fri 14 Nov 2008       243,712 A..H. --- "C:\Documents and Settings\Liga\Ustawienia lokalne\Temp\~F6.tmp"
Tue  6 Jan 2009           444 ...HR --- "C:\Documents and Settings\Admin\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

[b]Finished![/b]



ComboFix

Kod: Zaznacz wszystko

ComboFix 09-02-01.01 - Admin 2009-02-10 13:53:48.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.3070.2519 [GMT 1:00]
Uruchomiony z: d:\narzędzia\ComboFix.exe
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-01-10 do 2009-02-10  )))))))))))))))))))))))))))))))
.

2009-02-10 13:38 . 2009-02-10 13:38   580,096   --a--c---   c:\windows\system32\dllcache\user32.dll
2009-02-10 13:35 . 2009-02-10 13:36   <DIR>   d--------   c:\windows\ERUNT
2009-02-09 22:02 . 2009-02-09 22:09   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
2009-02-09 22:02 . 2009-02-09 22:02   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Malwarebytes
2009-02-09 22:02 . 2009-02-09 22:02   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Malwarebytes
2009-02-09 22:02 . 2009-01-14 16:11   38,496   --a------   c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-09 22:02 . 2009-01-14 16:11   15,504   --a------   c:\windows\system32\drivers\mbam.sys
2009-02-09 22:01 . 2009-02-10 13:47   <DIR>   d--------   C:\SDFix
2009-02-09 15:48 . 2009-02-09 15:48   <DIR>   d--------   C:\ster
2009-02-02 13:49 . 2009-02-02 13:49   0   --ah-----   c:\windows\system32\mzloaguf.sys
2009-02-02 13:40 . 2009-02-02 13:40   0   --ah-----   c:\windows\system32\krdj.sys
2009-01-31 13:20 . 2009-01-31 13:20   18   --a------   c:\windows\nsreg2.dat
2009-01-31 13:18 . 2009-01-31 13:18   <DIR>   d--------   c:\program files\Onet-Chat-Client
2009-01-30 12:48 . 2009-01-30 12:48   0   --ah-----   c:\windows\system32\mzkwgu.sys
2009-01-28 20:01 . 2009-01-28 20:01   0   --ah-----   c:\windows\system32\shpdmblw.sys
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\SpacialAudio
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\Firebird
2009-01-27 16:53 . 2004-12-13 01:05   356,437   --a------   c:\windows\system32\GDS32.DLL
2009-01-23 14:10 . 2009-01-23 14:12   <DIR>   d--------   c:\program files\Microsoft SQL Server
2009-01-23 12:30 . 2009-01-23 12:30   62,608   --ah-----   c:\windows\system32\oanxi.sys
2009-01-23 12:30 . 2009-01-23 12:30   0   --ah-----   c:\windows\system32\pcubk.sys
2009-01-23 12:30 . 2009-01-23 12:30   0   --ah-----   c:\windows\system32\anxish.sys
2009-01-22 12:32 . 2009-01-22 12:32   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ATI
2009-01-22 12:29 . 2009-01-22 12:36   <DIR>   d--------   c:\program files\ATI
2009-01-22 12:24 . 2008-12-01 14:35   593,920   ---------   c:\windows\system32\ati2sgag.exe
2009-01-22 11:25 . 2009-02-10 12:52   <DIR>   d--------   c:\program files\SpeedFan
2009-01-22 11:25 . 2009-01-22 11:25   45   --a------   c:\windows\system32\initdebug.nfo
2009-01-22 11:24 . 2009-01-22 11:24   <DIR>   d--------   c:\program files\Trend Micro
2009-01-22 10:28 . 2009-01-22 10:28   62,608   --ah-----   c:\windows\system32\ktisencm.sys
2009-01-21 19:33 . 2009-01-21 19:33   <DIR>   d--------   c:\program files\mp3dj
2009-01-21 19:33 . 2009-01-21 19:33   286,720   ---------   c:\windows\Setup1.exe
2009-01-21 19:33 . 2009-01-21 19:33   73,216   --a------   c:\windows\ST6UNST.EXE
2009-01-19 16:53 . 2009-01-19 16:52   410,984   --a------   c:\windows\system32\deploytk.dll
2009-01-19 16:53 . 2009-01-19 16:52   73,728   --a------   c:\windows\system32\javacpl.cpl
2009-01-19 16:24 . 2009-01-19 16:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files
2009-01-19 16:19 . 2009-01-19 16:19   <DIR>   d--------   c:\program files\Headshot Player
2009-01-17 13:17 . 2009-01-17 13:17   <DIR>   d--------   C:\totalcmd
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\UC.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\RAR.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKUNZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\NOCLOSE.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\LHA.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\ARJ.PIF
2009-01-16 19:23 . 2009-01-16 19:23   0   --ah-----   c:\windows\system32\bnpdjs.sys
2009-01-16 18:59 . 2009-01-16 18:59   <DIR>   d--------   c:\windows\system32\AlertModule
2009-01-12 14:21 . 2009-01-12 14:21   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Hamachi
2009-01-11 17:39 . 2009-01-11 17:39   0   --ah-----   c:\windows\system32\szknx.sys
2009-01-11 15:44 . 2009-02-09 16:00   24,944   --a------   c:\windows\system32\drivers\GVTDrv.sys
2009-01-11 15:43 . 2006-11-24 14:47   40,136   --a------   c:\windows\system32\drivers\ET5Drv.sys
2009-01-11 13:57 . 2009-01-11 13:57   <DIR>   d--------   c:\program files\Yahoo!
2009-01-11 13:55 . 2009-01-11 13:55   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2009-01-11 13:55 . 2005-02-17 07:15   73,728   --a------   c:\windows\system32\ISUSPM.cpl
2009-01-11 13:32 . 2009-01-11 13:32   <DIR>   d--------   c:\windows\system32\pl
2009-01-11 13:30 . 2008-04-14 21:45   2,977,792   -----c---   c:\windows\system32\dllcache\wmploc.dll
2009-01-11 13:29 . 2008-04-14 00:10   10,240   ---------   c:\windows\system32\drivers\sffp_mmc.sys
2009-01-11 13:28 . 2006-12-29 00:31   19,569   --a------   c:\windows\[u]0[/u]00001_.tmp
2009-01-11 13:03 . 2009-01-22 12:15   10   --a------   c:\windows\WININIT.INI
2009-01-11 12:24 . 2009-01-11 12:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Lavasoft

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 12:48   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Orbit
2009-02-10 12:45   ---------   d-----w   c:\program files\cFosSpeed
2009-02-10 11:52   15,600   ----a-w   c:\windows\gdrv.sys
2009-02-10 11:48   ---------   d-----w   c:\program files\Mozilla Thunderbird
2009-02-09 14:51   183,112   ----a-w   c:\windows\system32\PnkBstrB.exe
2009-02-09 14:51   138,184   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2009-02-08 17:49   ---------   d-----w   c:\program files\Orbitdownloader
2009-02-08 14:52   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\mIRC
2009-02-08 14:51   ---------   d-----w   c:\program files\mIRC
2009-01-28 16:38   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\teamspeak2
2009-01-23 13:20   ---------   d-----w   c:\program files\Sony
2009-01-23 13:12   ---------   d-----w   c:\program files\Microsoft.NET
2009-01-23 13:10   ---------   d-----w   c:\program files\Sony Setup
2009-01-22 11:25   ---------   d-----w   c:\program files\ATI Technologies
2009-01-19 15:52   ---------   d-----w   c:\program files\Java
2009-01-16 18:00   ---------   d-----w   c:\program files\neostrada tp
2009-01-16 17:49   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-01-12 13:22   ---------   d-----w   c:\program files\Nero
2009-01-11 12:56   ---------   d-----w   c:\program files\GIGABYTE
2009-01-11 12:55   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-11 08:41   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\PC Suite
2009-01-09 15:43   682,280   ----a-w   c:\windows\system32\pbsvc.exe
2009-01-09 15:43   66,872   ----a-w   c:\windows\system32\PnkBstrA.exe
2009-01-09 15:43   22,328   ----a-w   c:\documents and settings\Admin\Dane aplikacji\PnkBstrK.sys
2009-01-09 14:21   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Media Player Classic
2009-01-09 14:19   ---------   d-----w   c:\program files\K-Lite Codec Pack
2009-01-09 14:19   ---------   d-----w   c:\program files\ALLPlayer
2009-01-09 14:19   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\GrabPro
2009-01-07 13:44   ---------   d-----w   c:\program files\Microsoft Games for Windows - LIVE
2009-01-06 20:13   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Leadertech
2009-01-06 19:48   107,888   ----a-w   c:\windows\system32\CmdLineExt.dll
2009-01-06 19:48   ---------   d--h--r   c:\documents and settings\Admin\Dane aplikacji\SecuROM
2009-01-06 18:57   685,816   ----a-w   c:\windows\system32\drivers\sptd.sys
2009-01-04 16:27   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Publish Providers
2009-01-04 16:26   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Sony
2009-01-01 16:57   ---------   d-----w   c:\program files\VideoMach-2.7.2
2009-01-01 16:43   ---------   d-----w   c:\program files\VideoMach-4.0.4
2008-12-28 19:29   ---------   d---a-w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\TEMP
2008-12-23 12:48   ---------   d-----w   c:\program files\NAPI-PROJEKT
2008-12-21 15:13   ---------   d-----w   c:\program files\Ares
2008-12-16 15:49   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\AdobeUM
2008-12-15 21:20   ---------   d-----w   c:\program files\VDOWNLOADER
2008-12-15 21:20   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Desktopicon
2008-12-13 19:19   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Winamp
2008-12-13 18:27   ---------   d-----w   c:\program files\ivo
2008-12-13 13:53   ---------   d-----w   c:\program files\Gadu-Gadu
2008-12-13 13:03   288,245   ----a-w   c:\windows\Help\WINAMP 5.X.EXE
2008-12-13 13:03   ---------   d-----w   c:\program files\Winamp
2008-12-11 18:50   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Skype
2008-12-08 11:53   57,344   ----a-w   c:\windows\system32\ff_vfw.dll
2008-12-07 18:08   795,648   ----a-w   c:\windows\system32\xvidcore.dll
2008-12-07 18:08   130,048   ----a-w   c:\windows\system32\xvidvfw.dll
2008-12-05 18:41   315,392   ----a-w   c:\windows\HideWin.exe
2008-12-05 18:33   730,121   ----a-w   c:\program files\Common Files\unins000.exe
2008-12-05 18:33   5,657   ----a-w   c:\program files\Common Files\unins000.dat
2008-12-05 18:16   558,142   ----a-w   c:\windows\java\Packages\F1BNZFJ5.ZIP
2008-12-05 18:16   155,995   ----a-w   c:\windows\java\Packages\J13XVLNZ.ZIP
2008-12-01 20:52   425,984   ----a-w   c:\windows\system32\ATIDEMGX.dll
2008-12-01 20:51   318,464   ----a-w   c:\windows\system32\ati2dvag.dll
2008-12-01 20:46   11,304,960   ----a-w   c:\windows\system32\atioglxx.dll
2008-12-01 20:41   188,416   ----a-w   c:\windows\system32\atipdlxx.dll
2008-12-01 20:40   43,520   ----a-w   c:\windows\system32\ati2edxx.dll
2008-12-01 20:40   26,112   ----a-w   c:\windows\system32\Ati2mdxx.exe
2008-12-01 20:40   147,456   ----a-w   c:\windows\system32\Oemdspif.dll
2008-12-01 20:40   143,360   ----a-w   c:\windows\system32\ati2evxx.dll
2008-12-01 20:38   598,016   ----a-w   c:\windows\system32\ati2evxx.exe
2008-12-01 20:37   53,248   ----a-w   c:\windows\system32\ATIDDC.DLL
2008-12-01 20:27   4,120,384   ----a-w   c:\windows\system32\ati3duag.dll
2008-12-01 20:19   307,200   ----a-w   c:\windows\system32\atiiiexx.dll
2008-12-01 20:11   2,495,360   ----a-w   c:\windows\system32\ativvaxx.dll
2008-12-01 19:57   48,640   ----a-w   c:\windows\system32\amdpcom32.dll
2008-12-01 19:53   45,056   ----a-w   c:\windows\system32\amdcalrt.dll
2008-12-01 19:53   45,056   ----a-w   c:\windows\system32\amdcalcl.dll
2008-12-01 19:53   401,408   ----a-w   c:\windows\system32\atikvmag.dll
2008-12-01 19:52   86,016   ----a-w   c:\windows\system32\atiadlxx.dll
2008-12-01 19:52   17,408   ----a-w   c:\windows\system32\atitvo32.dll
2008-12-01 19:50   3,252,224   ----a-w   c:\windows\system32\Amdcaldd.dll
2008-12-01 19:50   286,720   ----a-w   c:\windows\system32\atiok3x2.dll
2008-12-01 19:45   577,536   ----a-w   c:\windows\system32\ati2cqag.dll
2008-11-29 11:41   2,294,291   ----a-w   c:\windows\system32\x264vfw.dll
2008-03-09 06:25   236   ---ha-w   c:\program files\Common Files\dx.reg
.

(((((((((((((((((((((((((((((   snapshot@2009-02-02_14.50.05.10   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-02-10 12:37:02   12,034,048   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2009-02-10 12:37:02   196,608   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-02-10 12:36:19   12,034,048   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2009-02-10 12:36:19   196,608   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2009-02-10 12:45:41   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_3b8.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-19 136600]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-01-08 1715400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^lsass.exe]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\lsass.exe
backup=c:\windows\pss\lsass.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Orbit.lnk]
path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-08-01 19:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]
--a------ 2008-11-24 20:44 869888 c:\program files\ALLPlayer\ALLUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]
-ra------ 2008-07-18 15:23 867544 c:\program files\cFosSpeed\cfosspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 22:51 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVPro]
--a------ 2007-07-26 15:05 20480 c:\program files\GIGABYTE\ET5Pro\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-06-17 15:00 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-08-11 07:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-09-20 19:16 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NOD32FiXTemDono"=2 (0x2)
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"d:\\Gry\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Gry\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Gry\\CoD5\\CoDWaWmp.exe"=
"d:\\Gry\\CoD5\\CoDWaW.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2002-09-28 3584]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\psjwg6qp.default\
FF - prefs.js: browser.startup.homepage - google.pl
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 13:53:57
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:98,fa,e1,5d,1b,bb,b7,b3,44,2d,38,92,70,3b,63,f6,e1,8a,4b,82,15,
   6d,54,25,be,41,1f,ea,f9,73,ee,25,f8,8c,d2,aa,79,9f,04,35,6c,30,de,9b,12,4d,\
"rkeysecu"=hex:a6,f5,32,30,86,40,d0,18,c6,e2,09,4e,c0,58,b7,53

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\[u]0[/u]9"
"DeviceDesc"="???\17?\11\[u]0[/u]9"
"ProviderName"="???\11?\16?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"e:\\chipset\\rd790\\xp2k\\sbdrv\\smbus\\smbusati.inf\[u]0[/u]0"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-02-10 13:54:49
ComboFix-quarantined-files.txt  2009-02-10 12:54:47
ComboFix2.txt  2009-02-02 13:50:32

Przed: 238 444 486 656 bajtów wolnych
Po: 238,446,391,296 bajtów wolnych

290


hijackthis

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:56:35, on 2009-02-10
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6552 bytes

[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\mzloaguf.sys
c:\windows\system32\krdj.sys
c:\windows\system32\mzkwgu.sys
c:\windows\system32\shpdmblw.sys
c:\windows\system32\oanxi.sys
c:\windows\system32\pcubk.sys
c:\windows\system32\anxish.sys
c:\windows\system32\ktisencm.sys
c:\windows\system32\bnpdjs.sys
c:\windows\system32\szknx.sys

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

[F?]

Kod: Zaznacz wszystko

ComboFix 09-02-01.01 - Admin 2009-02-10 17:05:48.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.3070.2455 [GMT 1:00]
Uruchomiony z: d:\narzędzia\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Admin\Pulpit\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -

FILE ::
c:\windows\system32\anxish.sys
c:\windows\system32\bnpdjs.sys
c:\windows\system32\krdj.sys
c:\windows\system32\ktisencm.sys
c:\windows\system32\mzkwgu.sys
c:\windows\system32\mzloaguf.sys
c:\windows\system32\oanxi.sys
c:\windows\system32\pcubk.sys
c:\windows\system32\shpdmblw.sys
c:\windows\system32\szknx.sys
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\anxish.sys
c:\windows\system32\bnpdjs.sys
c:\windows\system32\krdj.sys
c:\windows\system32\ktisencm.sys
c:\windows\system32\mzkwgu.sys
c:\windows\system32\mzloaguf.sys
c:\windows\system32\oanxi.sys
c:\windows\system32\pcubk.sys
c:\windows\system32\shpdmblw.sys
c:\windows\system32\szknx.sys

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-01-10 do 2009-02-10  )))))))))))))))))))))))))))))))
.

2009-02-10 15:17 . 2009-02-10 15:17   <DIR>   d--------   c:\program files\Spyware Nuker
2009-02-10 15:17 . 2009-02-10 15:17   67,645   --a------   c:\windows\system32\drivers\pshook11.sys
2009-02-10 13:38 . 2009-02-10 13:38   580,096   --a--c---   c:\windows\system32\dllcache\user32.dll
2009-02-10 13:35 . 2009-02-10 13:36   <DIR>   d--------   c:\windows\ERUNT
2009-02-09 22:02 . 2009-02-09 22:09   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
2009-02-09 22:02 . 2009-02-09 22:02   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Malwarebytes
2009-02-09 22:02 . 2009-02-09 22:02   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Malwarebytes
2009-02-09 22:02 . 2009-01-14 16:11   38,496   --a------   c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-09 22:02 . 2009-01-14 16:11   15,504   --a------   c:\windows\system32\drivers\mbam.sys
2009-02-09 22:01 . 2009-02-10 13:47   <DIR>   d--------   C:\SDFix
2009-02-09 15:48 . 2009-02-09 15:48   <DIR>   d--------   C:\ster
2009-01-31 13:20 . 2009-01-31 13:20   18   --a------   c:\windows\nsreg2.dat
2009-01-31 13:18 . 2009-01-31 13:18   <DIR>   d--------   c:\program files\Onet-Chat-Client
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\SpacialAudio
2009-01-27 16:53 . 2009-01-27 16:53   <DIR>   d--------   c:\program files\Firebird
2009-01-27 16:53 . 2004-12-13 01:05   356,437   --a------   c:\windows\system32\GDS32.DLL
2009-01-23 14:10 . 2009-01-23 14:12   <DIR>   d--------   c:\program files\Microsoft SQL Server
2009-01-22 12:32 . 2009-01-22 12:32   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ATI
2009-01-22 12:29 . 2009-01-22 12:36   <DIR>   d--------   c:\program files\ATI
2009-01-22 12:24 . 2008-12-01 14:35   593,920   ---------   c:\windows\system32\ati2sgag.exe
2009-01-22 11:25 . 2009-02-10 12:52   <DIR>   d--------   c:\program files\SpeedFan
2009-01-22 11:25 . 2009-01-22 11:25   45   --a------   c:\windows\system32\initdebug.nfo
2009-01-22 11:24 . 2009-01-22 11:24   <DIR>   d--------   c:\program files\Trend Micro
2009-01-21 19:33 . 2009-01-21 19:33   <DIR>   d--------   c:\program files\mp3dj
2009-01-21 19:33 . 2009-01-21 19:33   286,720   ---------   c:\windows\Setup1.exe
2009-01-21 19:33 . 2009-01-21 19:33   73,216   --a------   c:\windows\ST6UNST.EXE
2009-01-19 16:53 . 2009-01-19 16:52   410,984   --a------   c:\windows\system32\deploytk.dll
2009-01-19 16:53 . 2009-01-19 16:52   73,728   --a------   c:\windows\system32\javacpl.cpl
2009-01-19 16:24 . 2009-01-19 16:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files
2009-01-19 16:19 . 2009-01-19 16:19   <DIR>   d--------   c:\program files\Headshot Player
2009-01-17 13:17 . 2009-01-17 13:17   <DIR>   d--------   C:\totalcmd
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\UC.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\RAR.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\PKUNZIP.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\NOCLOSE.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\LHA.PIF
2009-01-17 13:17 . 2008-07-29 07:04   545   --a------   c:\windows\ARJ.PIF
2009-01-16 18:59 . 2009-01-16 18:59   <DIR>   d--------   c:\windows\system32\AlertModule
2009-01-12 14:21 . 2009-01-12 14:21   <DIR>   d--------   c:\documents and settings\Admin\Dane aplikacji\Hamachi
2009-01-11 15:44 . 2009-02-09 16:00   24,944   --a------   c:\windows\system32\drivers\GVTDrv.sys
2009-01-11 15:43 . 2006-11-24 14:47   40,136   --a------   c:\windows\system32\drivers\ET5Drv.sys
2009-01-11 13:57 . 2009-01-11 13:57   <DIR>   d--------   c:\program files\Yahoo!
2009-01-11 13:55 . 2009-01-11 13:55   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2009-01-11 13:55 . 2005-02-17 07:15   73,728   --a------   c:\windows\system32\ISUSPM.cpl
2009-01-11 13:32 . 2009-01-11 13:32   <DIR>   d--------   c:\windows\system32\pl
2009-01-11 13:30 . 2008-04-14 21:45   2,977,792   -----c---   c:\windows\system32\dllcache\wmploc.dll
2009-01-11 13:29 . 2008-04-14 00:10   10,240   ---------   c:\windows\system32\drivers\sffp_mmc.sys
2009-01-11 13:28 . 2006-12-29 00:31   19,569   --a------   c:\windows\[u]0[/u]00001_.tmp
2009-01-11 13:03 . 2009-01-22 12:15   10   --a------   c:\windows\WININIT.INI
2009-01-11 12:24 . 2009-01-11 12:24   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Lavasoft

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 16:06   ---------   d-----w   c:\program files\cFosSpeed
2009-02-10 15:47   ---------   d-----w   c:\program files\Mozilla Thunderbird
2009-02-10 13:24   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Orbit
2009-02-10 11:52   15,600   ----a-w   c:\windows\gdrv.sys
2009-02-09 14:51   183,112   ----a-w   c:\windows\system32\PnkBstrB.exe
2009-02-09 14:51   138,184   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2009-02-08 17:49   ---------   d-----w   c:\program files\Orbitdownloader
2009-02-08 14:52   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\mIRC
2009-02-08 14:51   ---------   d-----w   c:\program files\mIRC
2009-01-28 16:38   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\teamspeak2
2009-01-23 13:20   ---------   d-----w   c:\program files\Sony
2009-01-23 13:12   ---------   d-----w   c:\program files\Microsoft.NET
2009-01-23 13:10   ---------   d-----w   c:\program files\Sony Setup
2009-01-22 11:25   ---------   d-----w   c:\program files\ATI Technologies
2009-01-19 15:52   ---------   d-----w   c:\program files\Java
2009-01-16 18:00   ---------   d-----w   c:\program files\neostrada tp
2009-01-16 17:49   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-01-12 13:22   ---------   d-----w   c:\program files\Nero
2009-01-11 12:56   ---------   d-----w   c:\program files\GIGABYTE
2009-01-11 12:55   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-11 08:41   ---------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\PC Suite
2009-01-09 15:43   682,280   ----a-w   c:\windows\system32\pbsvc.exe
2009-01-09 15:43   66,872   ----a-w   c:\windows\system32\PnkBstrA.exe
2009-01-09 15:43   22,328   ----a-w   c:\documents and settings\Admin\Dane aplikacji\PnkBstrK.sys
2009-01-09 14:21   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Media Player Classic
2009-01-09 14:19   ---------   d-----w   c:\program files\K-Lite Codec Pack
2009-01-09 14:19   ---------   d-----w   c:\program files\ALLPlayer
2009-01-09 14:19   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\GrabPro
2009-01-07 13:44   ---------   d-----w   c:\program files\Microsoft Games for Windows - LIVE
2009-01-06 20:13   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Leadertech
2009-01-06 19:48   107,888   ----a-w   c:\windows\system32\CmdLineExt.dll
2009-01-06 19:48   ---------   d--h--r   c:\documents and settings\Admin\Dane aplikacji\SecuROM
2009-01-06 18:57   685,816   ----a-w   c:\windows\system32\drivers\sptd.sys
2009-01-04 16:27   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Publish Providers
2009-01-04 16:26   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Sony
2009-01-01 16:57   ---------   d-----w   c:\program files\VideoMach-2.7.2
2009-01-01 16:43   ---------   d-----w   c:\program files\VideoMach-4.0.4
2008-12-28 19:29   ---------   d---a-w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\TEMP
2008-12-23 12:48   ---------   d-----w   c:\program files\NAPI-PROJEKT
2008-12-21 15:13   ---------   d-----w   c:\program files\Ares
2008-12-16 15:49   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\AdobeUM
2008-12-15 21:20   ---------   d-----w   c:\program files\VDOWNLOADER
2008-12-15 21:20   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Desktopicon
2008-12-13 19:19   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Winamp
2008-12-13 18:27   ---------   d-----w   c:\program files\ivo
2008-12-13 13:53   ---------   d-----w   c:\program files\Gadu-Gadu
2008-12-13 13:03   288,245   ----a-w   c:\windows\Help\WINAMP 5.X.EXE
2008-12-13 13:03   ---------   d-----w   c:\program files\Winamp
2008-12-11 18:50   ---------   d-----w   c:\documents and settings\Admin\Dane aplikacji\Skype
2008-12-08 11:53   57,344   ----a-w   c:\windows\system32\ff_vfw.dll
2008-12-07 18:08   795,648   ----a-w   c:\windows\system32\xvidcore.dll
2008-12-07 18:08   130,048   ----a-w   c:\windows\system32\xvidvfw.dll
2008-12-05 18:41   315,392   ----a-w   c:\windows\HideWin.exe
2008-12-05 18:33   730,121   ----a-w   c:\program files\Common Files\unins000.exe
2008-12-05 18:33   5,657   ----a-w   c:\program files\Common Files\unins000.dat
2008-12-05 18:16   558,142   ----a-w   c:\windows\java\Packages\F1BNZFJ5.ZIP
2008-12-05 18:16   155,995   ----a-w   c:\windows\java\Packages\J13XVLNZ.ZIP
2008-12-01 20:52   425,984   ----a-w   c:\windows\system32\ATIDEMGX.dll
2008-12-01 20:51   318,464   ----a-w   c:\windows\system32\ati2dvag.dll
2008-12-01 20:46   11,304,960   ----a-w   c:\windows\system32\atioglxx.dll
2008-12-01 20:41   188,416   ----a-w   c:\windows\system32\atipdlxx.dll
2008-12-01 20:40   43,520   ----a-w   c:\windows\system32\ati2edxx.dll
2008-12-01 20:40   26,112   ----a-w   c:\windows\system32\Ati2mdxx.exe
2008-12-01 20:40   147,456   ----a-w   c:\windows\system32\Oemdspif.dll
2008-12-01 20:40   143,360   ----a-w   c:\windows\system32\ati2evxx.dll
2008-12-01 20:38   598,016   ----a-w   c:\windows\system32\ati2evxx.exe
2008-12-01 20:37   53,248   ----a-w   c:\windows\system32\ATIDDC.DLL
2008-12-01 20:27   4,120,384   ----a-w   c:\windows\system32\ati3duag.dll
2008-12-01 20:19   307,200   ----a-w   c:\windows\system32\atiiiexx.dll
2008-12-01 20:11   2,495,360   ----a-w   c:\windows\system32\ativvaxx.dll
2008-12-01 19:57   48,640   ----a-w   c:\windows\system32\amdpcom32.dll
2008-12-01 19:53   45,056   ----a-w   c:\windows\system32\amdcalrt.dll
2008-12-01 19:53   45,056   ----a-w   c:\windows\system32\amdcalcl.dll
2008-12-01 19:53   401,408   ----a-w   c:\windows\system32\atikvmag.dll
2008-12-01 19:52   86,016   ----a-w   c:\windows\system32\atiadlxx.dll
2008-12-01 19:52   17,408   ----a-w   c:\windows\system32\atitvo32.dll
2008-12-01 19:50   3,252,224   ----a-w   c:\windows\system32\Amdcaldd.dll
2008-12-01 19:50   286,720   ----a-w   c:\windows\system32\atiok3x2.dll
2008-12-01 19:45   577,536   ----a-w   c:\windows\system32\ati2cqag.dll
2008-11-29 11:41   2,294,291   ----a-w   c:\windows\system32\x264vfw.dll
2008-03-09 06:25   236   ---ha-w   c:\program files\Common Files\dx.reg
.

(((((((((((((((((((((((((((((   snapshot@2009-02-02_14.50.05.10   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-02-10 12:37:02   12,034,048   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2009-02-10 12:37:02   196,608   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-02-10 12:36:19   12,034,048   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2009-02-10 12:36:19   196,608   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2009-02-10 13:20:44   10,134   ----a-r   c:\windows\Installer\{EC9E8EAA-2F25-4265-A77B-DA3AE3FF8EC3}\callmsi.exe
+ 2009-02-10 13:20:44   136,448   ----a-r   c:\windows\Installer\{EC9E8EAA-2F25-4265-A77B-DA3AE3FF8EC3}\egui.exe
+ 2008-06-10 17:47:42   39,944   ----a-w   c:\windows\system32\drivers\eamon.sys
+ 2008-06-10 17:48:38   53,256   ----a-w   c:\windows\system32\drivers\easdrv.sys
+ 2008-06-10 17:56:10   34,312   ----a-w   c:\windows\system32\drivers\epfwtdir.sys
+ 2009-02-10 13:24:00   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_634.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-19 136600]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-01-08 1715400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^lsass.exe]
path=c:\documents and settings\Admin\Menu Start\Programy\Autostart\lsass.exe
backup=c:\windows\pss\lsass.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Orbit.lnk]
path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-08-01 19:17 222592 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]
--a------ 2008-11-24 20:44 869888 c:\program files\ALLPlayer\ALLUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]
-ra------ 2008-07-18 15:23 867544 c:\program files\cFosSpeed\cfosspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 22:51 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVPro]
--a------ 2007-07-26 15:05 20480 c:\program files\GIGABYTE\ET5Pro\ETcall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-06-17 15:00 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-08-11 07:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-09-20 19:16 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NOD32FiXTemDono"=2 (0x2)
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"d:\\Gry\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Gry\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Gry\\CoD5\\CoDWaWmp.exe"=
"d:\\Gry\\CoD5\\CoDWaW.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-06-10 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-06-10 468224]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2002-09-28 3584]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - AXPSHOOK11
*NewlyCreated* - EVERESTDRIVER
*Deregistered* - AxPsHook11
*Deregistered* - EverestDriver
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\psjwg6qp.default\
FF - prefs.js: browser.startup.homepage - google.pl
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 17:06:02
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:98,fa,e1,5d,1b,bb,b7,b3,44,2d,38,92,70,3b,63,f6,e1,8a,4b,82,15,
   6d,54,25,be,41,1f,ea,f9,73,ee,25,f8,8c,d2,aa,79,9f,04,35,6c,30,de,9b,12,4d,\
"rkeysecu"=hex:a6,f5,32,30,86,40,d0,18,c6,e2,09,4e,c0,58,b7,53

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\[u]0[/u]9"
"DeviceDesc"="???\17?\11\[u]0[/u]9"
"ProviderName"="???\11?\16?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"e:\\chipset\\rd790\\xp2k\\sbdrv\\smbus\\smbusati.inf\[u]0[/u]0"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(1084)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-02-10 17:06:51
ComboFix-quarantined-files.txt  2009-02-10 16:06:49
ComboFix2.txt  2009-02-10 12:54:50
ComboFix3.txt  2009-02-02 13:50:32

Przed: 238 244 356 096 bajtów wolnych
Po: 238,241,275,904 bajtów wolnych

323


[wojtas]

skasuj:

c:\windows\000001_.tmp

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Autor postu otrzymał pochwałę

[F?]

Zrobiłem wszystkie te zabiegi [ wszystko czyste ], a gierka nadal się wiesza.

[Okocza]

F?, w takim wypadku nie będzie to wina syfu w komputerze, może taka wersja gry, sterowniki ewentualnie zmniejsz detale

Autor postu otrzymał pochwałę

[F?]

może taka wersja gry

W niektórych grach mam to samo

sterowniki

Najnowsze

ewentualnie zmniejsz detale

Zmniejszyłem o połowę i zagrałem tylko 3 min No i zapewne będę musiał coś grzebać w biosie.

[Okocza]

Najnowsze

zainstaluj trochę starsze, jaka grafika i jaki numerek sterów?

[F?]

PowerColor Radeon HD4850 512MB

CCC 8.12

[wojtas]

moze zainstaluj najnowszy directx..

[F?]

Mam wersję 9.0c, wersja 10.1 by coś zmieniła? No cóz dzisiaj spróbuję

Dodano 12.02.2009 12:39:28:
Nic z tego, to samo ;/

[wojtas]

moze przeinstaluj gre...

[F?]

To nic nie pomaga, w wiedźminie miałem to samo i raz na jakiś czas w gta4 ;/