2 trojany + rootkit =high risk

[losyart]

Cześć mam problem dzisiaj przy skanowaniu kompa avastem trafiłem na 2 trojany i jednego rootkita.Potem przeskanowałem AVG Anti-Spywarem i potwierdziło się co prawda były trochę inne nazwy ale kit przesyłam loga z hijacka może mi coś doradzicie jak to nie wystarczy to mogę wam napisać dokładne nazwy jakie mi wyświetlił spyware dla lepszego wglądu w problem

4C85-200E-4045-0004-0000-3M20-0800-35X3-0000-404C-EXCA-**** (*)

Windows XP 5.1
IA32
WinAspi: -

NT-SPTI used
Nero Version: 7.9.6.0
Internal Version: 7, 9, 6, 0
(Nero Express)
Recorder: <HL-DT-ST DVD-RAM GSA-H55L>Version: 1.03 - HA 1 TA 0 - 7.9.6.0
Adapter driver: <IDE> HA 1
Drive buffer : 2048kB
Bus Type : default (0) -> ATAPI, detected: ?
CD-ROM: <HL-DT-ST DVD-RAM GSA-H55L>Version: 1.03 - HA 1 TA 0 - 7.9.6.0
Adapter driver: <IDE> HA 1

=== Scsi-Device-Map ===
CdRomPeripheral : HL-DT-ST DVD-RAM GSA-H55L atapi Port 0 ID 0 DMA: On
DiskPeripheral : ST3250410AS atapi Port 1 ID 0 DMA: On
CdRomPeripheral : CB3370S OHM490V 1.01 ajfx5rxr Port 4 ID 0 DMA: Off

=== CDRom-Device-Map ===
HL-DT-ST DVD-RAM GSA-H55L J: CdRom0
CB3370S OHM490V K: CdRom1
=======================

AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 83886080 (0) Byte
BUFE : 0
Physical memory : 2047MB (2096428kB)
Free physical memory: 1476MB (1511864kB)
Memory in use : 27 %
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)

19.2.2008
Kompilacja ISO
00:17:45 #1 Text 0 File SCSIPTICommands.cpp, Line 424
LockMCN - completed sucessfully for IOCTL_STORAGE_MCN_CONTROL

00:17:45 #2 Text 0 File Isodoc.cpp, Line 6663
Iso document burn settings
------------------------------------------
Determine maximum speed : FALSE
Simulate : FALSE
Write : TRUE
Finalize CD : FALSE
Multisession : TRUE
Multisession type: : Start multisession
Burning mode : DAO
Mode : 1
ISO Level : 1 (Max. of 11 = 8 + 3 char)
Character set : ISO 9660
Joliet : TRUE
Allow pathdepth more than 8 directories : FALSE
Allow more than 255 characters in path : FALSE
Write ISO9660 ;1 file extensions : TRUE

00:17:45 #3 ISO9660GEN -11 File Geniso.cpp, Line 3343
First writeable address = 0 (0x00000000)

00:17:45 #4 Text 0 File Burncd.cpp, Line 3508
Turn on Disc-At-Once, using DVD media

00:17:45 #5 Text 0 File DlgWaitCD.cpp, Line 307
Last possible write address on media: 2295103 (510:01.28, 4482MB)
Last address to be written: 2287407 (508:18.57, 4467MB)

00:17:45 #6 Text 0 File DlgWaitCD.cpp, Line 319
Write in overburning mode: NO (enabled: CD)

00:17:45 #7 Text 0 File DlgWaitCD.cpp, Line 2964
Recorder: HL-DT-ST DVD-RAM GSA-H55L, Media type: DVD+R
Disc Manufacturer ID: YUDEN000, Media Type ID: T02, Product revision number: 0
Disc Application Code: 0, Extended Information Indicators: 3

00:17:45 #8 Text 0 File DlgWaitCD.cpp, Line 493
>>> Protocol of DlgWaitCD activities: <<<
=========================================

00:17:45 #9 Text 0 File ThreadedTransferInterface.cpp, Line 793
Setup items (after recorder preparation)
0: TRM_DATA_MODE1 ()
2 indices, index0 (150) not provided
original disc pos #0 + 2287408 (2287408) = #2287408/508:18.58
relocatable, disc pos for caching/writing not required/ required
-> TRM_DATA_MODE1, 2048, config 0, wanted index0 0 blocks, length 2287408 blocks [J: HL-DT-ST DVD-RAM GSA-H55L]
--------------------------------------------------------------

00:18:28 #10 Text 0 File ThreadedTransferInterface.cpp, Line 995
Prepare [J: HL-DT-ST DVD-RAM GSA-H55L] for write in CUE-sheet-DAO
DAO infos:
==========
MCN: ""
TOCType: 0x00; Session Closed, disc not fixated
Tracks 1 to 1: Idx 0 Idx 1 Next Trk
1: TRM_DATA_MODE1, 2048/0x00, FilePos 0 0 4684611584, ISRC ""
DAO layout:
===========
___Start_|____Track_|_Idx_|_CtrlAdr_|_____Size_|______NWA_|_RecDep__________
0 | lead-in | 0 | 0x41 | 0 | 0 | 0x00
0 | 1 | 0 | 0x41 | 0 | 0 | 0x00
0 | 1 | 1 | 0x41 | 2287408 | 0 | 0x00
2287408 | lead-out | 1 | 0x41 | 0 | 0 | 0x00

00:18:28 #11 Text 0 File SCSIPTICommands.cpp, Line 215
SPTILockVolume - completed successfully for FSCTL_LOCK_VOLUME

00:18:28 #12 Text 0 File Burncd.cpp, Line 4294
Caching options: cache CDRom or Network-Yes, small files-Yes (<64KB)

00:18:28 #13 Phase 24 File dlgbrnst.cpp, Line 1762
Caching of files started

00:18:29 #14 Text 0 File Burncd.cpp, Line 4413
Cache writing successful.

00:18:29 #15 Phase 25 File dlgbrnst.cpp, Line 1762
Caching of files completed

00:18:29 #16 Phase 36 File dlgbrnst.cpp, Line 1762
Burn process started at 8x (11 080 KB/s)

00:18:29 #17 Text 0 File ThreadedTransferInterface.cpp, Line 2721
Verifying disc position of item 0 (relocatable, disc pos, no patch infos, orig at #0): write at #0

00:18:29 #18 Text 0 File Cdrdrv.cpp, Line 9872
---- Disc Structure: Physical Format Information (00h) ----
Media Type: 0, Layer: 0, Address: 0 (0 h), AGID: 0; Length: 2050
Book Type: DVD+R (10), Part Version: 1.0x (1)
Disc Size: 120 mm, Maximum Rate: <not specified> (F h)
Number of Layers: 1, Track Path: Parallel Track Path (PTP), Layer Type: recordable
Linear Density: 0,267 um/bit, Track Density: 0,74 um/track
Starting Physical Sector Number of Data Area: 30000 h (DVD-ROM, DVD-R/-RW, DVD+R/+RW)
End Sector Number in Layer 0: 0 h (LBN: FFFD0000 h, 4193920 MB)
Data in Burst Cutting Area (BCA) does not exist
Disc Application Code: 0 / 0 h
Extended Information indicators: 3 h
Disc Manufacturer ID: YUDEN000
Media type ID: T02
Product revision number: 0
Number of Physical format information bytes in use in ADIP up to byte 63: 56
Media Specific [16..63]:
00 00 03 59 55 44 45 4E - 30 30 30 54 30 32 00 38 ...YUDEN000T02.8
23 54 37 10 02 4E 72 02 - 8C 63 16 16 0B 0B 0A 0A #T7..Nr..c......
01 19 1B 0C 0C 0C 0D 01 - 00 00 00 00 00 00 00 00 ................

00:18:29 #19 Text 0 File DVDR.cpp, Line 6553
Drive: HL-DT-ST DVD-RAM GSA-H55L
Book Type request [LG]: DVD-ROM
Changing the Book Type was finished successfully, return code 0

00:18:29 #20 CDR -1207 File DVDR.cpp, Line 6477
Book Type automatically set to: DVD-ROM

00:18:29 #21 SPTI -1066 File SCSIPassThrough.cpp, Line 179
CdRom0: SCSIStatus(x02) WinError(0) NeroError(-1066)
Sense Key: 0x05 (KEY_ILLEGAL_REQUEST)
Sense Code: 0x24
Sense Qual: 0x00
CDB Data: 0xAC 00 00 00 00 00 00 00 00 64 00 00
Sense Area: 0x70 00 05 00 00 00 00 0E 00 00 00 00 24
Buffer x0650d900: Len x648

00:18:29 #22 Text 0 File DVDPlusRW.cpp, Line 675
Start write address at LBA 0
DVD high compatibility mode: No

00:18:29 #23 Text 0 File ThreadedTransfer.cpp, Line 269
Pipe memory size 83836800

00:27:23 #24 Text 0 File WriterStatus.cpp, Line 113
<J: HL-DT-ST DVD-RAM GSA-H55L> start writing Lead-Out at LBA 2287408 (22E730h), length 0 blocks

00:28:02 #25 Text 0 File DVDPlusRW.cpp, Line 935
EndDAO: Last written address 2287408

00:28:02 #26 Phase 37 File dlgbrnst.cpp, Line 1762
Burn process completed successfully at 8x (11 080 KB/s)

00:28:04 #27 Text 0 File SCSIPTICommands.cpp, Line 261
SPTIDismountVolume - completed successfully for FSCTL_DISMOUNT_VOLUME

00:28:11 #28 Text 0 File Cdrdrv.cpp, Line 11185
DriveLocker: UnLockVolume completed

00:28:11 #29 Text 0 File SCSIPTICommands.cpp, Line 424
UnLockMCN - completed sucessfully for IOCTL_STORAGE_MCN_CONTROL


Existing drivers:

Registry Keys:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)

Bardzo proszę o pomoc bo póki co nic wielce dziwnego się nie dzieje tylko parę błędów wyskoczyło (tych czerwonych iksów) oczywiście dałem je wszystkie na kwarantannę(nie iksy tylko wykryte infekcje) ale trzeba szybko działać żeby inne dziwne rzeczy nie zaczęły się dziać.

[wojtas]

Wykonaj to co jest podane w tym temacie


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[losyart]

ComboFix 08-02-19.2 - Artur 2008-02-19 19:43:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1466 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-19 01:34 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-19 19:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-18 23:09 . 2008-02-18 23:09 43,520 --a------ C:\exujd.exe
2008-02-18 23:09 . 2008-02-18 23:09 27,648 --a------ C:\jupss.exe
2008-02-18 23:08 . 2008-02-18 23:08 58,368 --a------ C:\wpohl.exe
2008-02-18 23:08 . 2008-02-18 23:08 54,764 --a------ C:\WINDOWS\system32\3klagia.dll
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:34 . 2008-02-19 19:14 <DIR> d-------- C:\Program Files\AdVantage
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-18 23:12 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 04:30 . 2008-02-04 04:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-11-05 11:12 884176]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 19:44:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

SDFix: Version 1.143

Run by Artur on 2008-02-19 at 19:32

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services:

Name:
runtime

Path:
\??\C:\WINDOWS\System32\drivers\runtime.sys

runtime - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted



Folder C:\Program Files\Helper - Removed
Folder C:\WINDOWS\system32\wsnpoem - Removed


Removing Temp Files...

ADS Check:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:24, on 2008-02-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\VDOTool\TBPanel.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O3 - Toolbar: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 9209 bytes


[wojtas]

przeskanuj plik:

C:\WINDOWS\system32\DRIVERS\FT2593.sys

tu i zapisz sobie raporty z nich w notatniku

znasz te programy:

C:\Program Files\P2P_Torrent
C:\Program Files\AdVantage

??

Otworz notatnik i wklej w nim to:

File::
C:\exujd.exe
C:\jupss.exe
C:\wpohl.exe
C:\WINDOWS\system32\3klagia.dll

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum + log z hijacka nowy oraz tamte raporty

[losyart]

ale czym mam przeskanować ten plik?? a te 2 programy to jeden zdaje się pasek zadań do szukania torrentów a ten advantage to do daemona piszę powering daemon tols

[ Dodano: Dzisiaj o 11:47 ]
Przesyłam jeszcze raz logi.Kurcze głupi jestem drugi raz uruchomiłem tego samego wirusa przez próbę otwarcia jednego pliku

SDFix: Version 1.143

Run by Artur on 2008-02-21 at 11:25

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services:

Name:
runtime

Path:

runtime - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted





Removing Temp Files...

ADS Check:

A propo przy odpalaniu tego SD Fixa na początku wyskakuje komunikat C:\SDFix\SDFix\apps\ERDNT.E_E-File not found

ComboFix 08-02-19.2 - Artur 2008-02-21 11:36:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1389 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-20 03:38 . 2008-02-20 03:38 54,764 --a------ C:\WINDOWS\system32\syswindrv.bin
2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-19 01:34 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-21 11:32 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-18 23:09 . 2008-02-20 03:38 52,236 --a------ C:\jupss.exe
2008-02-18 23:09 . 2008-02-18 23:09 43,520 --a------ C:\exujd.exe
2008-02-18 23:08 . 2008-02-20 03:38 58,368 --a------ C:\wpohl.exe
2008-02-18 23:08 . 2008-02-18 23:08 54,764 --a------ C:\WINDOWS\system32\3klagia.dll
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-21 10:37 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 04:30 . 2008-02-04 04:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 11:38:39
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-21 11:39:33
ComboFix2.txt 2008-02-20 16:18:15
ComboFix3.txt 2008-02-20 05:08:44
ComboFix4.txt 2008-02-19 18:45:35
.
2008-02-17 10:39:17 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:41:57, on 2008-02-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\VDOTool\TBPanel.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O3 - Toolbar: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [2gb4i3hn] C:\WINDOWS\TEMP\348FC34C.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 9081 bytes

[ Dodano: Dzisiaj o 12:04 ]
Ściągnełem na nowo SDFixa i komunikat ERDNT.E_E znikł a więc przesyłam loga ponownie już bez błędu

SDFix: Version 1.144

Run by Artur on 2008-02-21 at 11:54

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services:

Name:
runtime
syswindrv

Path:
\??\C:\WINDOWS\system32\syswindrv.bin

runtime - Deleted
syswindrv - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted
C:\WINDOWS\system32\syswindrv.bin - Deleted





Removing Temp Files...

ADS Check:

Bardzo proszę o szybką pomoc bo zaczynają się dziać bardzo dziwne rzeczy internet muli a czasem nawet nie chce otworzyć spybot co chwila wykrywa jakieś wpisy i pytam mnie o zezwolenie na zmianę.Naprawdę nie wiem co robić

[wojtas]

skasuj:

O4 - HKLM\..\Run: [2gb4i3hn] C:\WINDOWS\TEMP\348FC34C.exe

ten plik przeskanuj;

C:\WINDOWS\system32\DRIVERS\FT2593.sys

tu:

http://virusscan.jotti.org/
http://www.virustotal.com/


Otworz notatnik i wklej w nim to:

File::
C:\jupss.exe
C:\exujd.exe
C:\wpohl.exe
C:\WINDOWS\system32\3klagia.dll
C:\WINDOWS\TEMP\348FC34C.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz raporty

[losyart]

skasuj:

O4 - HKLM\..\Run: [2gb4i3hn] C:\WINDOWS\TEMP\348FC34C.exe

Nie wiem gdzie jest ten plik wpisałem w wyszukaj i nic nie znalazło wszedłem w TEMPA bezpośrednio i żadnego pliku oo tej nazwie nie znalazłem.Jak go znaleźć żebby usunąć??


ten plik przeskanuj;

C:\WINDOWS\system32\DRIVERS\FT2593.sys

tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

Przeskanowałem ten plik i w każdej rubryce było napisane nothing found

Otworz notatnik i wklej w nim to:

File::
C:\jupss.exe
C:\exujd.exe
C:\wpohl.exe
C:\WINDOWS\system32\3klagia.dll
C:\WINDOWS\TEMP\348FC34C.exe

Tego jeszcze nie zrobiłem bo pomyślałem że wpierw trzeba skasowac ten plik a nie wiem gdzie i jak go znalezc

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz raporty

[wojtas]

zaznaczasz ten wpis w hijacku

O4 - HKLM\..\Run: [2gb4i3hn] C:\WINDOWS\TEMP\348FC34C.exe

i dajesz fix checked

pozniej kieruj sie instrukcjami dalszymi i wroc z logiem

[losyart]

Zrobiłem to co kazałeś czyli z loga combo fixa przerzuciłem te wpisy co najciekawsze były tylko 3 pozostałych dwóch nie widziałem i zapisałem do CFScript.txt i przerzuciłem no i teraz wygenerowało takiego loga dodam że tuż po generacji straciłem łączność z netem i musiałem reboota robić

ComboFix 08-02-19.2 - Artur 2008-02-22 0:53:58.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1458 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Artur\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-21 12:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-22 00:42 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-18 23:09 . 2008-02-18 23:09 43,520 --a------ C:\exujd.exe
2008-02-18 23:08 . 2008-02-20 03:38 58,368 --a------ C:\wpohl.exe
2008-02-18 23:08 . 2008-02-18 23:08 54,764 --a------ C:\WINDOWS\system32\3klagia.dll
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-21 10:37 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 04:30 . 2008-02-04 04:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-02-04 04:29 . 2008-02-04 04:29 <DIR> d-------- C:\Program Files\Nero
2008-02-04 04:29 . 2008-02-04 04:30 <DIR> d-------- C:\Program Files\Common Files\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 00:55:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-22 0:55:29
ComboFix-quarantined-files.txt 2008-02-21 23:55:27
ComboFix2.txt 2008-02-21 23:49:22
ComboFix3.txt 2008-02-21 23:39:23
ComboFix4.txt 2008-02-21 10:39:34
ComboFix5.txt 2008-02-20 16:18:15
.
2008-02-17 10:39:17 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:56:46, on 2008-02-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\VDOTool\TBPanel.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O3 - Toolbar: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 9085 bytes

SDFix: Version 1.144

Run by Artur on 2008-02-22 at 01:02

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services:

Name:
runtime
syswindrv

Path:

runtime - Deleted
syswindrv - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted
C:\WINDOWS\system32\syswindrv.bin - Deleted





Removing Temp Files...

ADS Check:

[ Dodano: Dzisiaj o 1:13 ]
acha no i usunąłem w hijacku to co mi kazałeś również

[ Dodano: Dzisiaj o 12:58 ]
no i jeszcze jedno mi się przypomniało może bedzie pomocne i cos Ci podpowie otóż przy skanowaniu spybotem wyskakuje problem Win32.Tiny.abk rodzaj 2 wpisów.

[wojtas]

przeskanuj te pliki na tamtych skanerach:

C:\WINDOWS\system32\Hidhlp.dll
C:\WINDOWS\system32\drivers\FT2593.sys

i daj raporty

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\exujd.exe
C:\wpohl.exe
C:\WINDOWS\system32\3klagia.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

[losyart]

przy skanowaniu hid.hlp.dll tymi dwoma skanerami na jednym w wynikach nie było żadnej wartości natomiast na drugim wszędzie nothing found nawet wyników nie mogłem wydrukować nie wiem czemu ale mogę Ci napisać przynajmniej.Przy skanowaniu drugiego było tak samo.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\yvmfttig

*******************

Script file located at: \??\C:\Program Files\otyguqcj.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\exujd.exe deleted successfully.
File C:\wpohl.exe deleted successfully.


Could not open file C;\WINDOWS\system32\3klagia.dll for deletion
Deletion of file C;\WINDOWS\system32\3klagia.dll failed!

Could not process line:
C;\WINDOWS\system32\3klagia.dll
Status: 0xc000003a


Completed script processing.

*******************

Finished! Terminate.

ComboFix 08-02-19.2 - Artur 2008-02-22 18:47:44.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1416 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-22 to 2008-02-22 )))))))))))))))))))))))))))))))
.

2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-21 12:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-22 18:37 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-18 23:08 . 2008-02-18 23:08 54,764 --a------ C:\WINDOWS\system32\3klagia.dll
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-22 12:05 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 04:30 . 2008-02-04 04:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-02-04 04:29 . 2008-02-04 04:29 <DIR> d-------- C:\Program Files\Nero
2008-02-04 04:29 . 2008-02-04 04:30 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-04 04:29 . 2008-02-04 04:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-02-03 21:57 . 2008-02-03 21:58 <DIR> d-------- C:\WINDOWS\NV1676128.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 18:49:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-22 18:49:59
ComboFix-quarantined-files.txt 2008-02-22 17:49:56
ComboFix2.txt 2008-02-22 16:06:15
ComboFix3.txt 2008-02-21 23:55:30
ComboFix4.txt 2008-02-21 23:49:22
ComboFix5.txt 2008-02-21 23:39:23
.
2008-02-17 10:39:17 --- E O F ---

Jeszcze muszę nadmienić że mam coraz większy problem z otwieraniem mozilli na szczęście poakcji avengera powróciła przynajmniej narazie.Nie wiem czy to Ci coś da ale w kwarantannie AVG Spywarea mam 10 Infekcji High 7 Downloader.Agent.hyy 2 Proxy.Wintu.a i 1 Rootkit.Agent.pr

[wojtas]

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED


sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\3klagia.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

coś da ale w kwarantannie AVG Spywarea

skasuj folder kwarantanny

potem zastosuj jeszcze raz sdfixa

i daj loga z combofixa i wlasnie nowy raport z sd

[losyart]

SDFix: Version 1.144

Run by Artur on 2008-02-22 at 16:48

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services:

Name:
runtime
syswindrv

Path:

runtime - Deleted
syswindrv - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted
C:\WINDOWS\system32\syswindrv.bin - Deleted





Removing Temp Files...

ADS Check:


Rebooting...


Checking Files:

Trojan Files Found:

C:\208872~1 - Deleted
C:\Program Files\Helper\1203372612.dll - Deleted
C:\WINDOWS\system32\syswindrv.bin - Deleted





Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 20:08:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1d,6b,33,36,3e,f5,0b,bd,e2,da,56,88,90,3f,f7,f2,32,44,e7,9e,e4,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,af,aa,20,78,d4,40,3b,47,c3,c8,74,3d,51,6d,6f,9b,31,..
"khjeh"=hex:1d,48,6c,0f,56,15,34,b1,6e,86,9c,c2,61,1b,23,50,1f,4d,42,88,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4e,59,45,7a,43,4e,63,34,3c,9b,7d,98,56,e3,d3,97,74,0c,b2,ba,66,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1d,6b,33,36,3e,f5,0b,bd,e2,da,56,88,90,3f,f7,f2,32,44,e7,9e,e4,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,af,aa,20,78,d4,40,3b,47,c3,c8,74,3d,51,6d,6f,9b,31,..
"khjeh"=hex:1d,48,6c,0f,56,15,34,b1,6e,86,9c,c2,61,1b,23,50,1f,4d,42,88,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4e,59,45,7a,43,4e,63,34,3c,9b,7d,98,56,e3,d3,97,74,0c,b2,ba,66,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Disabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Disabled:Orb Application"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Disabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:


File Backups: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Tue 5 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BITD.tmp"

Finished!

ComboFix 08-02-19.2 - Artur 2008-02-22 20:16:04.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1450 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-22 to 2008-02-22 )))))))))))))))))))))))))))))))
.

2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-21 12:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-22 20:10 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-22 12:05 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 04:30 . 2008-02-04 04:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-02-04 04:29 . 2008-02-04 04:29 <DIR> d-------- C:\Program Files\Nero
2008-02-04 04:29 . 2008-02-04 04:30 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-04 04:29 . 2008-02-04 04:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-02-03 21:57 . 2008-02-03 21:58 <DIR> d-------- C:\WINDOWS\NV1676128.TMP
2008-02-03 21:57 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S1 3klagia;3klagia;C:\WINDOWS\system32\3klagia.dll []
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 20:17:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-22 20:18:50
ComboFix-quarantined-files.txt 2008-02-22 19:18:47
ComboFix2.txt 2008-02-22 17:50:00
ComboFix3.txt 2008-02-22 16:06:15
ComboFix4.txt 2008-02-21 23:55:30
ComboFix5.txt 2008-02-21 23:49:22
.
2008-02-17 10:39:17 --- E O F ---

[ Dodano: Dzisiaj o 20:28 ]
przy odpalce na awaryjnym sdfixa wyskoczył jakiś komunikat że brak podkatalogu backups i wyglądało na to że nie wykonał roboty na awaryjnym zresetowałem na normalny i dokańczał pracę dziwne trochę?? Dlatego nie wiem czy ten raport jest właściwy w razie czego zawsze mogę przecież na nowo go ściągnąć

[wojtas]

zainstaluj:

http://www.programosy.pl/program,comodo-firewall.html

wklej do notatnika:

Driver::
3klagia

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[losyart]

ComboFix 08-02-23 - Artur 2008-02-23 1:07:02.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1450 [GMT 1:00]
Running from: C:\Documents and Settings\Artur\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Artur\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


((((((((((((((((((((((((( Files Created from 2008-01-23 to 2008-02-23 )))))))))))))))))))))))))))))))
.

2008-02-23 00:47 . 2008-02-23 00:47 <DIR> d-------- C:\Program Files\COMODO
2008-02-23 00:47 . 2008-02-23 00:47 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Comodo
2008-02-23 00:47 . 2008-02-23 00:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo
2008-02-23 00:47 . 2008-02-23 00:47 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2008-02-23 00:47 . 2008-02-23 00:47 84,856 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-02-23 00:47 . 2008-02-23 00:47 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-02-19 19:31 . 2008-02-19 19:31 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\SDFix
2008-02-19 01:43 . 2008-02-19 01:43 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-19 01:31 . 2008-02-19 01:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 01:31 . 2008-02-19 02:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 23:41 . 2008-02-21 12:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-18 23:41 . 2008-02-18 23:41 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\PC Tools
2008-02-18 23:41 . 2008-02-23 01:11 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-18 23:41 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-18 23:41 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-18 23:41 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-18 23:41 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 02:53 . 2008-02-17 02:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 02:53 . 2008-02-17 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-16 19:13 . 2008-02-16 19:13 <DIR> d-------- C:\temp
2008-02-16 18:57 . 2008-02-16 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Media Center Programs
2008-02-15 16:06 . 2008-02-15 16:06 <DIR> d-------- C:\Program Files\AMD
2008-02-14 22:59 . 2008-02-14 22:59 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\My Games
2008-02-14 21:17 . 2008-02-14 21:17 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Real
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-14 21:16 . 2008-02-14 21:16 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 16:26 . 2008-02-14 16:26 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-02-14 09:15 . 2008-02-14 09:15 385 --a------ C:\WINDOWS\ODBC.INI
2008-02-14 09:14 . 2008-02-14 09:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-02-14 09:13 . 2008-02-14 09:14 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-14 08:10 . 2008-02-14 08:10 <DIR> d-------- C:\Program Files\Raccoonworks
2008-02-14 08:10 . 2008-02-14 08:10 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-02-14 08:03 . 2008-02-14 16:01 <DIR> d-------- C:\Program Files\Network Stumbler
2008-02-14 06:03 . 2008-02-14 06:03 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\AdobeUM
2008-02-14 03:53 . 2008-02-19 19:12 <DIR> d-------- C:\Program Files\Ascentive
2008-02-13 03:17 . 2008-02-13 03:17 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-02-12 21:49 . 2008-02-16 01:50 <DIR> d-------- C:\Program Files\The All-Seeing Eye
2008-02-12 20:55 . 2008-02-12 20:55 22,328 --a------ C:\Documents and Settings\Artur\Dane aplikacji\PnkBstrK.sys
2008-02-12 20:54 . 2008-02-12 20:54 277 --a------ C:\WINDOWS\game.ini
2008-02-12 20:37 . 2008-02-12 20:37 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-12 20:34 . 2008-02-12 20:35 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-12 20:32 . 2008-02-12 20:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-10 23:06 . 2008-02-22 12:05 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-10 23:06 . 2008-02-10 23:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-10 23:01 . 2008-02-18 23:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-10 23:01 . 2008-02-10 23:19 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Winamp
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\Common Files\HP
2008-02-10 15:07 . 2008-02-10 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-02-10 15:05 . 2008-02-10 15:05 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-02-10 15:04 . 2008-02-10 15:04 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-10 14:56 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-02-10 14:56 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-10 14:55 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-10 14:55 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-10 14:41 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-10 14:41 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-10 14:41 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-10 14:41 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-10 14:41 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-10 14:41 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-10 14:41 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-10 14:38 . 2008-02-10 15:07 <DIR> d-------- C:\Program Files\HP
2008-02-10 14:35 . 2008-02-10 15:29 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\HP
2008-02-10 14:35 . 2008-02-10 15:08 113,574 --a------ C:\WINDOWS\hpoins07.dat
2008-02-10 14:35 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\P2P_Torrent
2008-02-09 15:01 . 2008-02-09 15:01 <DIR> d-------- C:\Program Files\Conduit
2008-02-09 15:01 . 2008-02-09 18:35 <DIR> d-------- C:\Program Files\BitComet Acceleration Patch
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-09 13:23 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-09 13:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-08 19:36 . 2008-02-16 02:23 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-02-08 19:36 . 2008-02-12 21:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe~
2008-02-08 19:36 . 2008-02-16 02:23 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-08 19:14 . 2008-02-08 19:14 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-08 01:34 . 2008-02-08 01:34 <DIR> d-------- C:\Program Files\eMule
2008-02-07 16:19 . 2008-02-14 02:27 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2008-02-07 14:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-07 14:13 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-06 16:18 . 2006-11-01 14:42 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-02-06 03:54 . 2008-02-06 03:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-05 22:48 . 2008-02-05 22:48 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-05 19:42 . 2008-02-05 19:42 <DIR> d-------- C:\Program Files\FT2593
2008-02-05 19:42 . 2007-06-07 03:36 57,344 --a------ C:\WINDOWS\system32\Hidhlp.dll
2008-02-05 19:42 . 2006-01-13 05:03 51,915 --a------ C:\WINDOWS\system32\drivers\FT2593.sys
2008-02-05 19:06 . 2008-02-05 19:06 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\DAEMON Tools
2008-02-05 19:04 . 2008-02-05 19:04 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 18:54 . 2008-02-05 18:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-02-05 16:40 . 2008-02-05 16:44 <DIR> d---s---- C:\Documents and Settings\Artur\UserData
2008-02-05 15:49 . 2008-02-12 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\Artur\Dane aplikacji\Ahead
2008-02-05 10:07 . 2008-02-05 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-02-04 15:11 . 2008-02-04 15:11 <DIR> d-------- C:\WINDOWS\Sun
2008-02-04 04:31 . 2008-02-04 04:32 <DIR> d-------- C:\Program Files\Common Files\LightScribe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 16:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-03 19:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-03 17:43 --------- d-----w C:\Program Files\VDOTool
2008-02-03 17:39 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-03 17:39 --------- d-----w C:\Program Files\Realtek
2008-02-03 17:37 --------- d-----w C:\Program Files\DIFX
2008-02-03 17:27 --------- d-----w C:\Documents and Settings\Artur\Dane aplikacji\InstallShield
2008-02-03 17:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-03 17:01 --------- d-----w C:\Program Files\Usługi online
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\P2P_Torrent\tbP2P_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{BC4BE15D-6A34-4356-9E97-79E43DA32B1D}"= C:\Program Files\P2P_Torrent\tbP2P_.dll [2008-01-07 18:38 1530904]

[HKEY_CLASSES_ROOT\clsid\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-20 07:19 81920]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 08:20 2194744]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 14:36 2169368]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 15:55 1628208]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 15:55 1057328]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-14 21:16 185896]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-02-23 00:47 1502976]
"combofix"="C:\WINDOWS\system32\kmd.exe" [2004-08-03 23:44 395776]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll
"LoadAppInit_DLLs"=1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7741:TCP"= 7741:TCP:BitComet 7741 TCP
"7741:UDP"= 7741:UDP:BitComet 7741 UDP

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-02-23 00:47]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-02-23 00:47]
R3 FT2593;FT2593 Filter;C:\WINDOWS\system32\DRIVERS\FT2593.sys [2006-01-13 05:03]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
S3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 14:42]
S3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-05-19 15:02]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-23 01:11:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-02-23 1:16:26 - machine was rebooted [Artur]
ComboFix-quarantined-files.txt 2008-02-23 00:16:20
ComboFix2.txt 2008-02-22 19:18:52
ComboFix3.txt 2008-02-22 17:50:00
ComboFix4.txt 2008-02-22 16:06:15
ComboFix5.txt 2008-02-21 23:55:30
.

Ten twój cały firewall zidentyfikował tego całego combofixa jako malware?? Czy to normalne>>?? Zaczyna mi tu coś brzydko pachnieć

[ Dodano: Dzisiaj o 1:24 ]
Poza tym przy skanowaniu wykrył dwa potencjalne malware mimo iż uważałem je za zaufane i wcześniej póki nie otworzyłem tego feralnego pliku wcale nie stwarzały żadnych problemów

[wojtas]

czasami zdarza sie ze combofixa uwazaja jako malware. jakie pliki wykrylo Ci jako malware?

[losyart]

piszę tak Unknown Malware C:Documents and Settings\Artur\Progi\EyeInstaller.exe ten prog nie sprawiał problemów
i drugi Unknown Malware C:Downloads BioshockCrack\paul.dll-Ten nawet nie działał ale o ile pamiętam do rejestru się dopisał jednakże żadnych szkód ani alarmów nie wywołał.
Ps.Czy jak ściągam jakiś plik z neta to jest jakiś sposób żeby się upewnić czy oby nie będzie on szkodliwy?? Przeskanować tymi antivirami na stronach co mi podałeś?? A może jakiś inny sposób jest??

[wojtas]

piszę tak Unknown Malware C:Documents and Settings\Artur\Progi\EyeInstaller.exe ten prog nie sprawiał problemów
i drugi Unknown Malware C:Downloads BioshockCrack\paul.dll-Ten nawet nie działał ale o ile pamiętam do rejestru się dopisał jednakże żadnych szkód ani alarmów nie wywołał.

byc moze to falszywy alarm chodz drugi plik wyglada na cr@cka wiec moze jest jakims syfem...

Przeskanować tymi antivirami na stronach co mi podałeś

tak najlepiej

[losyart]

Wielkie dzięki za pomoc.!! System chyba odzyskał sprawność bo już żadnych sygnałów o błędach jak na razie nie daje

Ale ja chciałem spytać Cię o jeszcze jedno czy z każdym wirusem trzeba postępować podobnie tzn wiadomo trzeba generować logi wyszukać nieznane wpisy i usuwać je przy pomocy programików które mi podrzuciłeś i skanować.Czy zasady są zawsze podobne czy czasem trzeba używać jeszcze bardziej skomplikowanych metod??

[Dzi@dek]

Ale ja chciałem spytać Cię o jeszcze jedno czy z każdym wirusem trzeba postępować podobnie tzn wiadomo trzeba generować logi wyszukać nieznane wpisy i usuwać je przy pomocy programików które mi podrzuciłeś i skanować.Czy zasady są zawsze podobne czy czasem trzeba używać jeszcze bardziej skomplikowanych metod??
Powrót do góry
Wyślij prywatną wiadomość Wyślij email Firefox

Metody sa różne- żeby nie zrobić sobie krzywdy - lepiej podesłać log do kontroli z opisem problemu tutaj na forum-wtedy będzie można poradzić co i jak.