bardzo prosze o sprawdzenie loga - wolny pc

[_-LESTAT-_]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:42, on 2007-12-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/WebfettiInitialSetup1.0.0.15-3.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: CachemanXP (CachemanXPService) - Unknown owner - C:\Program Files\CachemanXP\CachemanXP.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 3860 bytes

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[_-LESTAT-_]

SDFix: Version 1.119

Run by _-MATEUSZ-_ on 2007-12-21 at 21:06

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\DOCUME~1\_-MATE~1\Pulpit\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\dt\2007-08-30_15-09-59-170125531 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-14-59-170425515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-19-59-170725593 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-24-59-171025671 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-29-59-171325609 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-34-59-171625828 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-39-59-171925578 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-44-59-172225515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-49-59-172525562 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-54-59-172825515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_15-59-59-173125515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_16-04-59-173425609 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_16-09-59-173725515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_16-14-59-174025500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_16-29-59-174925515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_16-34-59-175225515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_17-54-59-180025515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_17-59-59-180325515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-14-59-184825531 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-19-59-185125578 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-24-59-185425515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-29-59-185725515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-34-59-186025671 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-44-59-186625515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-49-59-186925515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_19-54-59-187225687 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-04-59-187825515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-09-59-188125593 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-14-59-188425609 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-19-59-188725500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-24-59-189025515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-29-59-189325515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-34-59-189625609 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_20-39-59-189925500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_21-59-59-194725500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_22-04-59-195025531 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_22-09-59-195325609 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_22-14-59-195625515 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_22-19-59-195925500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_22-34-59-196825500 - Deleted
C:\WINDOWS\system32\dt\2007-08-30_23-34-59-200425500 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_09-49-59-237325531 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_09-54-59-237625546 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_09-59-59-237925562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-04-59-238225625 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-09-59-238525734 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-14-59-238825562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-19-59-239125562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-24-59-239425562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-29-59-239725562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_10-59-59-241525562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_11-04-59-241825656 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_11-19-59-242725562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_11-24-59-243025562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-34-59-247225562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-39-59-247525656 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-44-59-247825562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-49-59-248125562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-54-59-248425562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_12-59-59-248725687 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_13-04-59-249025562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_13-09-59-249325562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_13-19-59-249925562 - Deleted
C:\WINDOWS\system32\dt\2007-08-31_13-24-59-250225562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-09-59-170125531 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-14-59-170425515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-19-59-170725593 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-24-59-171025671 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-29-59-171325609 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-34-59-171625828 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-39-59-171925578 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-44-59-172225515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-49-59-172525562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-54-59-172825515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_15-59-59-173125515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_16-04-59-173425609 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_16-09-59-173725515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_16-14-59-174025500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_16-29-59-174925515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_16-34-59-175225515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_17-54-59-180025515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_17-59-59-180325515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-14-59-184825531 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-19-59-185125578 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-24-59-185425515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-29-59-185725515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-34-59-186025671 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-44-59-186625515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-49-59-186925515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_19-54-59-187225687 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-04-59-187825515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-09-59-188125593 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-14-59-188425609 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-19-59-188725500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-24-59-189025515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-29-59-189325515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-34-59-189625609 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_20-39-59-189925500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_21-59-59-194725500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_22-04-59-195025531 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_22-09-59-195325609 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_22-14-59-195625515 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_22-19-59-195925500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_22-34-59-196825500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-30_23-34-59-200425500 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_09-49-59-237325531 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_09-54-59-237625546 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_09-59-59-237925562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-04-59-238225625 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-09-59-238525734 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-14-59-238825562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-19-59-239125562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-24-59-239425562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-29-59-239725562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_10-59-59-241525562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_11-04-59-241825656 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_11-19-59-242725562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_11-24-59-243025562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-34-59-247225562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-39-59-247525656 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-44-59-247825562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-49-59-248125562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-54-59-248425562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_12-59-59-248725687 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_13-04-59-249025562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_13-09-59-249325562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_13-19-59-249925562 - Deleted
C:\WINDOWS\system32\dt\th_2007-08-31_13-24-59-250225562 - Deleted
C:\WINDOWS\system32\inst.dat - Deleted
C:\WINDOWS\system32\pk.bin - Deleted
C:\WINDOWS\system32\web.dat - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 21:08:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:785ea642
"s2"=dword:5ab64313
"h0"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:0d,6e,c9,00,a5,6d,37,d9,8c,0e,36,e7,62,5b,27,9d,2e,c2,ec,52,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:98,ac,bf,26,b2,fd,a8,66,68,57,5d,35,89,11,5b,1e,91,a3,6e,ca,c5,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,7f,99,c7,71,be,4b,02,e3,13,54,16,ca,41,36,e0,bc,e1,..
"hdf12"=hex:30,16,0f,16,cd,73,b2,55,7e,c3,51,e1,2c,57,87,bd,f2,bf,6a,5b,7f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:c6,6d,ca,e7,ac,62,f4,e8,5c,ff,a3,92,a1,94,74,b3,38,fb,f5,32,11,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,88,9d,b9,71,e9,6f,5d,66,c0,ae,02,ef,ed,58,f5,14,4d,..
"hdf12"=hex:26,91,7c,35,a4,b6,93,a8,cc,a7,8b,a5,2d,7b,5d,7f,98,72,b8,16,db,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:0b,47,f6,bc,fc,e8,5a,94,7d,6c,6a,9d,22,b1,25,54,fc,a9,ad,92,86,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:55,6f,03,8c,2b,4a,4b,b9,15,98,48,f8,f9,b3,5c,2e,2d,a5,d1,1a,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{39D15A18-5D77-4151-B702-B1E399042A45}]
"DhcpRetryStatus"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:0d,6e,c9,00,a5,6d,37,d9,8c,0e,36,e7,62,5b,27,9d,2e,c2,ec,52,a5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:98,ac,bf,26,b2,fd,a8,66,68,57,5d,35,89,11,5b,1e,91,a3,6e,ca,c5,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,7f,99,c7,71,be,4b,02,e3,13,54,16,ca,41,36,e0,bc,e1,..
"hdf12"=hex:30,16,0f,16,cd,73,b2,55,7e,c3,51,e1,2c,57,87,bd,f2,bf,6a,5b,7f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:76,9e,31,36,56,4a,c1,e1,79,de,20,f0,25,55,13,95,61,e1,a4,de,b6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,88,9d,b9,71,e9,6f,5d,66,c0,ae,02,ef,ed,58,f5,14,4d,..
"hdf12"=hex:26,91,7c,35,a4,b6,93,a8,cc,a7,8b,a5,2d,7b,5d,7f,98,72,b8,16,db,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:0b,47,f6,bc,fc,e8,5a,94,7d,6c,6a,9d,22,b1,25,54,fc,a9,ad,92,86,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:55,6f,03,8c,2b,4a,4b,b9,15,98,48,f8,f9,b3,5c,2e,2d,a5,d1,1a,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:0d,6e,c9,00,a5,6d,37,d9,8c,0e,36,e7,62,5b,27,9d,2e,c2,ec,52,a5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:09,e4,e0,93,e2,4d,a0,ff,b3,73,f2,60,23,19,3f,4b,f5,02,ea,f7,91,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,88,49,23,5e,69,b4,98,ba,c0,23,95,45,ec,3c,3e,19,4e,..
"khjeh"=hex:24,81,46,0d,d2,dc,9b,62,27,12,26,72,81,41,7c,77,0c,f0,9a,c3,70,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b9,d3,ca,02,1a,99,bd,f5,b8,4e,d3,33,13,9d,e5,7b,6f,a4,85,dc,19,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:02,13,c1,ce,52,a8,82,1a,7f,32,44,7c,bd,3a,9d,2e,6c,64,a9,82,55,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\A\1u]
"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,00,..
"Changed"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\A\1u]

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\\Tlen.pl\\tlen.exe"="F:\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"="C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe:*:Enabled:mRouterRuntime"
"F:\\uTorrent\\utorrent.exe"="F:\\uTorrent\\utorrent.exe:*:Enabled:uTorrent"
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"="C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe:*:Enabled:GameCenter"
"E:\\Loki\\Loki.exe"="E:\\Loki\\Loki.exe:*:Enabled:Loki"
"E:\\Loki\\Autorun\\AutoRun.exe"="E:\\Loki\\Autorun\\AutoRun.exe:*:Enabled:Loki - AutoRun"
"E:\\uTorrent\\utorrent.exe"="E:\\uTorrent\\utorrent.exe:*:Enabled:uTorrent"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent"
"E:\\Gry\\Bitwa o —r˘dziemie\\game.dat"="E:\\Gry\\Bitwa o —r˘dziemie\\game.dat:*:Enabled:Bitwa o —r˘dziemie (tm)"
"E:\\Gry\\GPGNet\\GPG.Multiplayer.Client.exe"="E:\\Gry\\GPGNet\\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\_-MATE~1\Pulpit\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 8 Mar 2007 258,560 A..H. --- "C:\Program Files\Adobe\upx.exe"
Thu 11 Oct 2007 444 ...HR --- "C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

Finished!

ComboFix 07-12-21.4 - _-MATEUSZ-_ 2007-12-21 21:13:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1673 [GMT 1:00]
Running from: C:\Documents and Settings\_-MATEUSZ-_\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\hosts
C:\WINDOWS\system32\bpkwb.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 )))))))))))))))))))))))))))))))
.

2007-12-21 21:05 . 2007-12-21 21:05 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 21:00 . 2007-12-21 21:00 2,350 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 19:57 . 2007-12-21 19:57 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-20 19:11 . 2007-12-20 19:11 <DIR> d-------- C:\WINDOWS\Application Data
2007-12-20 19:11 . 2007-12-20 19:11 18,768 --a------ C:\GDIPFONTCACHEV1.DAT
2007-12-17 17:17 . 2007-12-17 17:17 <DIR> d-------- C:\WINDOWS\system32\xlive
2007-12-17 16:25 . 2007-12-17 16:25 <DIR> d-------- C:\Program Files\OpenAL
2007-12-13 13:28 . 2007-12-13 13:28 <DIR> d-------- C:\WINDOWS\ShellNew
2007-12-11 22:32 . 2007-12-12 16:40 <DIR> d-------- C:\Program Files\Shareaza
2007-12-11 22:29 . 2007-12-11 22:30 <DIR> d-------- C:\Program Files\Kazaa Lite Rewolucja
2007-12-11 22:29 . 2007-12-11 22:29 <DIR> d-------- C:\My Shared Folder
2007-12-11 22:29 . 2007-12-11 22:29 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kazaa Lite
2007-12-11 22:21 . 2007-12-11 22:21 <DIR> d-------- C:\Program Files\BearShare Applications
2007-12-11 22:17 . 2007-12-11 22:18 <DIR> d-------- C:\Program Files\Ares
2007-12-11 22:15 . 2007-12-14 22:58 <DIR> d-------- C:\Program Files\MoorHunt
2007-12-11 12:28 . 2007-12-21 19:45 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-12-11 12:28 . 2007-12-21 19:45 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-11 12:27 . 2007-12-11 12:27 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-12-08 20:26 . 2007-12-08 20:26 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-12-08 20:26 . 2007-12-08 20:26 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Documents
2007-12-08 13:32 . 2007-12-08 13:32 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-12-08 13:32 . 2007-12-08 13:32 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Sony Ericsson
2007-12-02 19:06 . 2007-12-02 19:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kazaa
2007-12-01 13:23 . 2007-12-01 13:23 <DIR> d-------- C:\Program Files\FLVPlayer
2007-11-28 15:17 . 2007-11-28 15:17 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\InstallShield
2007-11-26 21:56 . 2007-11-26 21:56 13,653,824 --a------ C:\WINDOWS\system32\xlivefnt.dll
2007-11-26 21:56 . 2007-11-26 21:56 10,155,840 --a------ C:\WINDOWS\system32\xlive.dll
2007-11-26 21:56 . 2007-11-26 21:56 151,415 --a------ C:\WINDOWS\system32\xlive.dll.cat
2007-11-24 11:07 . 2007-11-24 11:07 713 --a------ C:\WINDOWS\unins001.dat
2007-11-22 19:24 . 2007-11-22 19:28 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Mount&Blade

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 20:07 6,553,600 ----a-w C:\Documents and Settings\_-MATEUSZ-_\NTUSER.DAT
2007-12-19 17:40 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Macromedia
2007-12-17 15:25 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2007-12-17 15:25 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-12-11 11:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-09 10:31 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\uTorrent
2007-12-09 10:30 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Skype
2007-12-09 09:05 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\skypePM
2007-11-20 17:51 --------- d-----w C:\Program Files\uTorrent
2007-11-18 19:02 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ezsid.dat
2007-11-18 19:01 --------- d-----w C:\Program Files\Skype
2007-11-18 19:01 --------- d-----w C:\Program Files\Common Files\Skype
2007-11-18 19:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype
2007-11-17 09:06 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Adobe
2007-11-12 15:29 5,120 ----a-w C:\WINDOWS\system32\BReWErS.dll
2007-11-09 21:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\nView_Profiles
2007-11-09 21:49 --------- d-----w C:\Program Files\Siemens Data Suite SX1
2007-11-09 21:49 --------- d-----w C:\Program Files\Intuwave
2007-11-09 21:49 --------- d-----w C:\Program Files\Common Files\Siemens AG Shared
2007-11-09 20:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-08 13:59 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2007-11-08 13:56 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\HP
2007-11-05 15:45 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Winamp
2007-11-05 15:31 --------- d-----w C:\Program Files\DFX
2007-11-05 15:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DFX
2007-11-05 13:34 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-03 12:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DAEMON Tools Pro
2007-11-03 12:39 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-03 12:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2007-11-03 12:30 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\DAEMON Tools Pro
2007-11-03 10:53 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\MusicIP
2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-10-28 15:52 8,531,968 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-10-28 15:52 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-10-28 15:52 7,424,992 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-28 15:52 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-10-28 15:52 6,541,312 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-10-28 15:52 5,768,320 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-10-28 15:52 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-10-28 15:52 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-10-28 15:52 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-10-28 15:52 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-10-28 15:52 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-10-28 15:52 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-10-28 15:52 380,928 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-10-28 15:52 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-10-28 15:52 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-10-28 15:52 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-10-28 15:52 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-10-28 15:52 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-10-28 15:52 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-10-28 15:52 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-10-28 15:52 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-10-28 15:52 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-10-28 15:52 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-10-28 15:52 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-10-28 15:52 3,698,688 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-10-28 15:52 3,407,872 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-10-28 15:52 3,330,048 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-10-28 15:52 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-10-28 15:52 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-10-28 15:52 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-10-28 15:52 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-10-28 15:52 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-10-28 15:52 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-20 01:27]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^_-MATEUSZ-_^Menu Start^Programy^Autostart^hamachi.lnk]
path=C:\Documents and Settings\_-MATEUSZ-_\Menu Start\Programy\Autostart\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADS]
2007-01-27 17:00 208384 --a------ C:\Windows\ADS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 23:12 49152 --a------ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
2007-02-12 12:01 1149440 --a------ D:\programy\Tlen\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mRouterConfig for Siemens Data Suite SX1]
2003-10-03 12:47 143360 --a------ C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterConfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
C:\Program Files\RivaTuner v2.05\RivaTuner.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-08-22 10:51]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-26 22:21]
S2 CachemanXPService;CachemanXP;C:\Program Files\CachemanXP\CachemanXP.exe []
S3 cglptnt;cglptnt;C:\totalcmd\cglptnt.sys [2007-01-01 05:56]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 23:54]
S3 RivaTuner32;RivaTuner32;C:\Program Files\RivaTuner v2.05\RivaTuner32.sys [2007-09-27 18:20]
S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys [2004-10-30 02:05]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 15:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 15:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 15:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 15:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 15:50]

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 21:14:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-21 21:14:44
.
2007-11-03 13:01:56 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:22, on 2007-12-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LClock\lclock.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/WebfettiInitialSetup1.0.0.15-3.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: CachemanXP (CachemanXPService) - Unknown owner - C:\Program Files\CachemanXP\CachemanXP.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 3514 bytes

[wojtas]

C:\Program Files\BearShare Applications

skasuj ten folder ^^

oraz wpis:

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/WebfettiInitialSetup1.0.0.15-3.cab

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADS]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[_-LESTAT-_]

niestety jest tak samo ...

[wojtas]

daj nowy log z hijacka i combofixa

[_-LESTAT-_]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:15:25, on 2007-12-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
E:\Gry\Mount&Blade\mount&blade.exe
D:\programy\Tlen\tlen.exe
C:\Program Files\Opera\Opera.exe
D:\programy\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {631FF594-EC25-4CFF-B869-402DF294E1D6} (Instalator oprogramowania Onet.pl) - http://slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: CachemanXP (CachemanXPService) - Unknown owner - C:\Program Files\CachemanXP\CachemanXP.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4251 bytes

ComboFix 07-12-21.4 - _-MATEUSZ-_ 2007-12-24 10:16:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1614 [GMT 1:00]
Running from: C:\Documents and Settings\_-MATEUSZ-_\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-24 to 2007-12-24 )))))))))))))))))))))))))))))))
.

2007-12-22 18:21 . 2007-12-22 18:21 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Sun
2007-12-22 18:21 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-22 18:20 . 2007-12-22 18:21 <DIR> d-------- C:\Program Files\Java
2007-12-22 18:18 . 2007-12-22 18:18 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-22 18:15 . 2007-12-22 18:15 <DIR> d-------- C:\Program Files\Onet
2007-12-22 18:15 . 2007-12-22 18:15 <DIR> d-------- C:\Program Files\Common Files\Onet.pl
2007-12-22 18:15 . 2007-12-22 18:15 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Kamerzysta
2007-12-22 18:15 . 2007-12-22 18:15 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Czat
2007-12-22 18:15 . 2007-12-22 18:15 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\AutoUpdate
2007-12-21 21:05 . 2007-12-21 21:05 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 21:00 . 2007-12-21 21:00 2,350 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 19:57 . 2007-12-21 19:57 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-20 19:11 . 2007-12-20 19:11 <DIR> d-------- C:\WINDOWS\Application Data
2007-12-20 19:11 . 2007-12-20 19:11 18,768 --a------ C:\GDIPFONTCACHEV1.DAT
2007-12-17 17:17 . 2007-12-17 17:17 <DIR> d-------- C:\WINDOWS\system32\xlive
2007-12-17 16:25 . 2007-12-17 16:25 <DIR> d-------- C:\Program Files\OpenAL
2007-12-13 13:28 . 2007-12-13 13:28 <DIR> d-------- C:\WINDOWS\ShellNew
2007-12-11 22:32 . 2007-12-12 16:40 <DIR> d-------- C:\Program Files\Shareaza
2007-12-11 22:29 . 2007-12-11 22:30 <DIR> d-------- C:\Program Files\Kazaa Lite Rewolucja
2007-12-11 22:29 . 2007-12-11 22:29 <DIR> d-------- C:\My Shared Folder
2007-12-11 22:29 . 2007-12-11 22:29 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kazaa Lite
2007-12-11 22:15 . 2007-12-14 22:58 <DIR> d-------- C:\Program Files\MoorHunt
2007-12-11 12:28 . 2007-12-23 14:49 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-12-11 12:28 . 2007-12-23 14:49 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-11 12:27 . 2007-12-11 12:27 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-12-08 20:26 . 2007-12-08 20:26 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-12-08 20:26 . 2007-12-08 20:26 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Documents
2007-12-08 13:32 . 2007-12-08 13:32 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-12-08 13:32 . 2007-12-08 13:32 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Sony Ericsson
2007-12-02 19:06 . 2007-12-02 19:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kazaa
2007-12-01 13:23 . 2007-12-01 13:23 <DIR> d-------- C:\Program Files\FLVPlayer
2007-11-28 15:17 . 2007-11-28 15:17 <DIR> d-------- C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\InstallShield
2007-11-26 21:56 . 2007-11-26 21:56 13,653,824 --a------ C:\WINDOWS\system32\xlivefnt.dll
2007-11-26 21:56 . 2007-11-26 21:56 10,155,840 --a------ C:\WINDOWS\system32\xlive.dll
2007-11-26 21:56 . 2007-11-26 21:56 151,415 --a------ C:\WINDOWS\system32\xlive.dll.cat
2007-11-24 11:07 . 2007-11-24 11:07 713 --a------ C:\WINDOWS\unins001.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 15:16 6,553,600 ----a-w C:\Documents and Settings\_-MATEUSZ-_\NTUSER.DAT
2007-12-19 17:40 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Macromedia
2007-12-17 15:25 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2007-12-17 15:25 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-12-11 11:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-09 10:31 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\uTorrent
2007-12-09 10:30 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Skype
2007-12-09 09:05 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\skypePM
2007-11-22 18:28 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Mount&Blade
2007-11-20 17:51 --------- d-----w C:\Program Files\uTorrent
2007-11-18 19:02 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ezsid.dat
2007-11-18 19:01 --------- d-----w C:\Program Files\Skype
2007-11-18 19:01 --------- d-----w C:\Program Files\Common Files\Skype
2007-11-18 19:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype
2007-11-17 09:06 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Adobe
2007-11-12 15:29 5,120 ----a-w C:\WINDOWS\system32\BReWErS.dll
2007-11-09 21:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\nView_Profiles
2007-11-09 21:49 --------- d-----w C:\Program Files\Siemens Data Suite SX1
2007-11-09 21:49 --------- d-----w C:\Program Files\Intuwave
2007-11-09 21:49 --------- d-----w C:\Program Files\Common Files\Siemens AG Shared
2007-11-09 20:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-08 13:59 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2007-11-08 13:56 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\HP
2007-11-05 15:45 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\Winamp
2007-11-05 15:31 --------- d-----w C:\Program Files\DFX
2007-11-05 15:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DFX
2007-11-05 13:34 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-03 12:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DAEMON Tools Pro
2007-11-03 12:39 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-03 12:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2007-11-03 12:30 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\DAEMON Tools Pro
2007-11-03 10:53 --------- d-----w C:\Documents and Settings\_-MATEUSZ-_\Dane aplikacji\MusicIP
2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-10-28 15:52 8,531,968 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-10-28 15:52 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-10-28 15:52 7,424,992 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-28 15:52 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-10-28 15:52 6,541,312 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-10-28 15:52 5,768,320 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-10-28 15:52 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-10-28 15:52 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-10-28 15:52 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-10-28 15:52 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-10-28 15:52 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-10-28 15:52 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-10-28 15:52 380,928 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-10-28 15:52 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-10-28 15:52 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-10-28 15:52 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-10-28 15:52 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-10-28 15:52 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-10-28 15:52 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-10-28 15:52 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-10-28 15:52 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-10-28 15:52 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-10-28 15:52 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-10-28 15:52 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-10-28 15:52 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-10-28 15:52 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-10-28 15:52 3,698,688 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-10-28 15:52 3,407,872 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-10-28 15:52 3,330,048 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-10-28 15:52 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-10-28 15:52 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-10-28 15:52 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-10-28 15:52 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-10-28 15:52 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-10-28 15:52 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-10-28 15:52 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-10-28 15:52 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-10-28 15:52 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-10-28 15:52 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-10-28 15:52 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-10-28 15:52 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-21_21.14.12,39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-24 21:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 21:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 22:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-12-24 08:35:26 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6a4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-20 01:27]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^_-MATEUSZ-_^Menu Start^Programy^Autostart^hamachi.lnk]
path=C:\Documents and Settings\_-MATEUSZ-_\Menu Start\Programy\Autostart\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 23:12 49152 --a------ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
2007-02-12 12:01 1149440 --a------ D:\programy\Tlen\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mRouterConfig for Siemens Data Suite SX1]
2003-10-03 12:47 143360 --a------ C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterConfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
C:\Program Files\RivaTuner v2.05\RivaTuner.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-08-22 10:51]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-26 22:21]
S2 CachemanXPService;CachemanXP;C:\Program Files\CachemanXP\CachemanXP.exe []
S3 cglptnt;cglptnt;C:\totalcmd\cglptnt.sys [2007-01-01 05:56]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 23:54]
S3 RivaTuner32;RivaTuner32;C:\Program Files\RivaTuner v2.05\RivaTuner32.sys [2007-09-27 18:20]
S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys [2004-10-30 02:05]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 15:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 15:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 15:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 15:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 15:50]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-24 10:17:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\LClock\LC.dll
.
Completion time: 2007-12-24 10:17:42
C:\ComboFix2.txt ... 2007-12-21 21:14
.
2007-11-03 13:01:56 --- E O F ---

[wojtas]

skasuj:

O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

system masz czysty