bład critical error! attention pomocy

[Dj.McG]

Witam wszystkich forumowiczów

taki właśnie pojawia mi sie komunikat instalowałem juz
takie programy jak:
SDFix
Fixiedef
wwdc
SeconfigXP
i nadal problem występuje komunikat

pojawia sie zawsze jak chce otworzyć jakiś folder i odwołuje sie do jakieś strony z której chce pobrać plik, gdy pobieram plik antywirus sie włącza ze wykrył wirusa
dodam ze przeskanowałem dyski virusów nie wykrył a problem nadal występuje
Prosze o pomoc
LOG z programu
Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:02:50, on 2008-07-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ClipX\clipx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: BHO.toolbar3 - {A4D16645-4149-41FB-B670-E06072E540C1} - C:\WINDOWS\system32\sofbho.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ClipX] C:\Program Files\ClipX\clipx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: bucz2.lnk = ?
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D65C0DDA-CD7F-4E55-BE84-F1CDEC6DD661}: NameServer = 168.192.1.1 168.192.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7479 bytes

[/quote]

[Okocza]

zanim zaczniemy usuwac cos z hj i combo zastosuj to:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

[Dj.McG]

zanim zaczniemy usuwac cos z hj i combo zastosuj to:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

Pomogło!!!
dzieki wielkie
troche sie mi ikony pozmieniały oraz tło pulpitu dodatkowo po restarcie jakieś nowe urządzenie wykryło ale bład juz sie nie pokazuje

[Okocza]

nie, wstaw teraz logi z combofixa i hijacka - bo masz syf w komputerze

[Dj.McG]

ale jak wstawić te logi???
co gdzie jak??

[Okocza]

http://www.forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

http://www.forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

lektura

[Dj.McG]

ComboFix 08-07-24.3 - Administrator 2008-07-25 15:02:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1548 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\00088F29.bin
C:\Program Files\myglobalsearch\bar\Cache\000894E6.bin
C:\Program Files\myglobalsearch\bar\Cache\0008968C.bin
C:\Program Files\myglobalsearch\bar\Cache\002F7AB9
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\btfunc.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((( Files Created from 2008-06-25 to 2008-07-25 )))))))))))))))))))))))))))))))
.

2008-07-25 14:21 . 2008-07-25 14:22 2,359,350 --a------ C:\WINDOWS\ACD Wallpaper.bmp
2008-07-25 14:16 . 2008-07-25 14:16 3,116 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-25 14:02 . 2008-07-25 14:02 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-07-25 14:02 . 2008-07-25 14:02 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-25 14:02 . 2005-04-28 21:32 1,284,608 --a------ C:\WINDOWS\system32\SET1E4.tmp
2008-07-25 14:02 . 2005-04-28 21:32 395,776 --a------ C:\WINDOWS\system32\SET1E2.tmp
2008-07-25 14:02 . 2005-04-28 21:32 75,264 --a------ C:\WINDOWS\system32\SET1E3.tmp
2008-07-25 13:58 . 2008-07-24 01:27 <DIR> d-------- C:\SDFix
2008-07-25 13:24 . 2008-07-25 13:24 <DIR> d-------- C:\Program Files\Ableton
2008-07-25 13:24 . 2008-07-25 13:25 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ableton
2008-07-25 13:24 . 2007-12-05 01:40 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2008-07-25 13:24 . 2007-12-05 01:40 233,472 --a------ C:\WINDOWS\system32\rex shared library.dll
2008-07-25 11:59 . 2008-07-25 12:52 <DIR> d-------- C:\Program Files\SkanerOnline
2008-07-25 11:08 . 2008-07-25 11:08 18,944 --a------ C:\WINDOWS\system32\sofiebho.dll
2008-07-25 11:08 . 2008-07-25 11:08 18,944 --a------ C:\WINDOWS\system32\sofie.dll
2008-07-25 11:08 . 2008-07-25 11:08 18,944 --a------ C:\WINDOWS\system32\homie.dll
2008-07-25 11:08 . 2008-07-25 11:08 18,944 --a------ C:\WINDOWS\system32\hombho.dll
2008-07-25 11:07 . 2008-07-25 11:07 18,944 --a------ C:\WINDOWS\system32\domie.dll
2008-07-25 11:07 . 2008-07-25 11:07 18,944 --a------ C:\WINDOWS\system32\dombho.dll
2008-07-22 12:53 . 2005-11-08 20:02 708,608 --a------ C:\WINDOWS\system32\SYNSOACC.dll
2008-07-22 12:53 . 2005-11-08 11:20 147,456 --a------ C:\WINDOWS\system32\SynsoLChk.dll
2008-07-22 12:53 . 2003-07-31 20:28 147,425 --a------ C:\WINDOWS\system32\SYNSOACC-Aide.chm
2008-07-22 12:53 . 2003-05-26 15:29 120,468 --a------ C:\WINDOWS\system32\SYNSOACC-Hilfe.chm
2008-07-22 12:53 . 2003-05-26 15:29 114,279 --a------ C:\WINDOWS\system32\SYNSOACC-Help.chm
2008-07-22 12:53 . 2005-11-03 17:14 45,056 --a------ C:\WINDOWS\system32\Synsopos.exe
2008-07-22 12:53 . 2005-11-03 12:17 16,896 --a------ C:\WINDOWS\system32\drivers\synasUSB.sys
2008-07-22 00:37 . 2008-07-22 00:37 <DIR> d-------- C:\Program Files\Common Files\Steinberg
2008-07-21 17:15 . 2008-07-21 17:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Reallusion
2008-07-21 17:14 . 2008-07-21 17:14 <DIR> d-------- C:\Program Files\Common Files\Reallusion
2008-07-20 18:21 . 2008-07-20 18:21 <DIR> d-------- C:\Program Files\Nexus
2008-07-20 12:11 . 2008-07-25 11:51 <DIR> d-------- C:\Downloads
2008-07-19 18:08 . 2008-07-19 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-07-19 18:07 . 2008-07-19 18:07 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-07-19 17:51 . 2008-07-19 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-07-19 17:51 . 2008-07-19 17:52 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\PC Suite
2008-07-19 17:51 . 2008-07-19 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nokia
2008-07-19 17:50 . 2008-07-19 17:50 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-07-19 17:50 . 2008-07-19 17:50 <DIR> d-------- C:\Program Files\DIFX
2008-07-19 17:50 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-07-19 17:49 . 2008-07-20 01:01 <DIR> d-------- C:\Program Files\Nokia
2008-07-19 17:49 . 2008-07-19 18:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-07-19 17:49 . 2008-02-01 16:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-07-19 16:46 . 2008-07-25 11:52 <DIR> d-------- C:\Program Files\FlashGet
2008-07-19 16:46 . 2004-08-03 23:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2008-07-18 20:35 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-07-18 20:35 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-07-10 11:46 . 2008-07-10 11:46 <DIR> d-------- C:\Program Files\AskSBar
2008-07-10 11:46 . 2008-07-10 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-07-10 11:46 . 2008-07-20 18:50 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Azureus
2008-07-10 11:45 . 2008-07-10 11:45 <DIR> d-------- C:\Program Files\Vuze
2008-07-07 08:18 . 2008-07-07 08:18 <DIR> d-------- C:\Program Files\Digidesign
2008-07-07 08:18 . 2003-09-10 18:00 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll
2008-07-06 18:26 . 2008-07-06 18:26 <DIR> d-------- C:\Program Files\MSECache
2008-07-06 12:03 . 2008-07-06 12:03 29 --a------ C:\WINDOWS\coolacm.ini
2008-07-05 11:01 . 2008-07-05 11:01 <DIR> d-------- C:\Program Files\Native Instruments
2008-07-04 16:14 . 2008-07-04 16:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2008-07-04 16:13 . 2004-08-04 00:44 91,136 --a------ C:\WINDOWS\system32\drivers\kswdmcap.ax
2008-07-04 16:13 . 2004-08-04 00:44 61,952 --a------ C:\WINDOWS\system32\drivers\kstvtune.ax
2008-07-04 16:13 . 2004-08-04 00:44 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll
2008-07-04 16:13 . 2004-08-04 00:44 28,672 --a------ C:\WINDOWS\system32\drivers\vidcap.ax
2008-07-04 16:12 . 2008-07-04 16:12 <DIR> d-------- C:\Program Files\IVT Corporation
2008-07-04 16:12 . 2004-08-04 00:44 43,008 --a------ C:\WINDOWS\system32\drivers\ksxbar.ax
2008-07-02 17:45 . 2008-07-02 17:45 <DIR> d-------- C:\Program Files\GForce
2008-07-01 21:42 . 2008-07-01 21:42 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-30 21:39 . 2008-06-30 21:39 <DIR> d-------- C:\Program Files\Real Alternative
2008-06-30 21:04 . 2008-06-30 21:04 0 --a------ C:\WINDOWS\hpqEmlSz.INI
2008-06-30 18:38 . 2008-06-30 18:38 <DIR> d-------- C:\WINDOWS\Sun
2008-06-30 18:33 . 2008-06-30 18:33 <DIR> d-------- C:\Program Files\Sun
2008-06-30 18:33 . 2008-06-30 18:33 <DIR> d-------- C:\Program Files\Java
2008-06-30 18:33 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-30 18:24 . 2008-06-30 18:24 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-29 15:03 . 2008-06-29 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\HP
2008-06-29 14:45 . 2008-06-29 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG
2008-06-29 14:38 . 2008-06-29 14:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY
2008-06-29 14:38 . 2008-07-20 18:41 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\HPAppData
2008-06-29 14:37 . 2008-06-29 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant
2008-06-29 14:37 . 2008-06-29 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Common Files\HP
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-06-29 14:35 . 2008-06-29 14:38 <DIR> d-------- C:\Program Files\HP
2008-06-29 14:32 . 2008-06-29 14:45 153,459 --a------ C:\WINDOWS\hpoins14.dat
2008-06-29 14:32 . 2007-09-20 03:14 2,000 --------- C:\WINDOWS\hpomdl14.dat
2008-06-25 21:00 . 2008-06-25 21:01 <DIR> d-------- C:\Program Files\Edirol

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-25 12:59 --------- d-----w C:\Program Files\Cool2000
2008-07-25 09:51 --------- d-----w C:\Program Files\ESET
2008-07-23 12:47 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2008-07-23 09:54 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\skypePM
2008-07-22 11:00 --------- d-----w C:\Program Files\Syncrosoft
2008-07-22 10:24 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Steinberg
2008-07-21 22:32 --------- d-----w C:\Program Files\Steinberg
2008-07-21 15:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-07 06:18 --------- d-----w C:\Program Files\VstPlugins
2008-07-07 06:17 --------- d-----w C:\Program Files\Arturia
2008-07-03 17:17 --------- d-----w C:\Program Files\foobar2000
2008-06-30 19:38 --------- d-----w C:\Program Files\ffdshow
2008-06-25 18:20 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-23 19:11 --------- d-----w C:\Program Files\BearShare
2008-06-22 19:34 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Cool Record Edit Pro
2008-06-21 01:12 --------- d-----w C:\Program Files\Image-Line
2008-06-21 01:05 --------- d-----w C:\Program Files\Outsim
2008-06-20 14:41 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-06-19 17:44 --------- d-----w C:\Program Files\rgcaudio
2008-06-19 15:26 --------- d-----w C:\Program Files\Cakewalk
2008-06-19 15:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Cakewalk
2008-06-16 15:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-16 14:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-16 14:47 --------- d-----w C:\Program Files\Ahead
2008-06-14 16:10 --------- d-----w C:\Program Files\SplitCam
2008-06-14 16:03 --------- d-----w C:\Program Files\Skype
2008-06-14 16:03 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-14 16:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-14 16:02 13,824 ----a-w C:\WINDOWS\system32\drivers\splitcam.sys
2008-06-14 15:43 --------- d-----w C:\Program Files\ClipX
2008-06-13 15:19 --------- d-----w C:\Program Files\ACD
2008-06-13 13:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 13:44 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft Web Folders
2008-06-13 13:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard
2008-06-13 13:03 16,376 ----a-w C:\WINDOWS\gdrv.sys
2008-06-13 12:54 --------- d-----w C:\Program Files\WinFast
2008-06-13 12:54 --------- d-----w C:\Program Files\Ulead Systems
2008-06-13 12:54 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-06-10 18:24 --------- d-----w C:\Program Files\iZotope
2008-06-10 18:24 --------- d-----w C:\Program Files\Common Files\iZotope
2008-06-10 18:24 --------- d-----w C:\Program Files\Common Files\Digidesign
2008-06-10 18:22 --------- d-----w C:\Program Files\PSP-audioware.com
2008-06-10 18:19 --------- d-----w C:\Program Files\PSPaudioware.com
2008-06-10 18:16 286,720 ----a-w C:\WINDOWS\iun506.exe
2008-06-10 17:34 --------- d-----w C:\Program Files\Spectrasonics
2008-06-10 17:24 --------- d-----w C:\Program Files\Winamp
2008-06-10 16:55 --------- d-----w C:\Program Files\Waves
2008-06-10 16:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-10 16:15 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-06-10 16:15 --------- d-----w C:\Program Files\DAEMON Tools
2008-06-10 16:11 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd9261.sys
2008-06-10 16:11 664,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-06-10 15:38 --------- d-----w C:\Program Files\WinAce
2008-06-10 15:38 --------- d-----w C:\Program Files\ASUS
2008-06-10 14:16 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-06-10 14:01 --------- d-----w C:\Program Files\Realtek
2008-06-10 14:01 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield
2008-06-10 13:59 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-10 13:52 --------- d-----w C:\Program Files\Intel
2008-06-10 13:51 --------- d-----w C:\Program Files\Yahoo!
2008-06-10 13:49 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-06-10 13:49 6,235,384 ----a-w C:\WINDOWS\LCD Demo.exe
2008-06-10 13:49 503,808 ----a-w C:\WINDOWS\Asus_LCD_ScreenSaver.scr
2008-06-10 13:49 37,232 ----a-w C:\WINDOWS\ASScrProlog.exe
2008-06-10 13:49 262,512 ----a-w C:\WINDOWS\ASUS LCD ScreenSaver Uninstaller.exe
2008-06-10 13:49 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-06-10 13:31 558,142 ----a-w C:\WINDOWS\java\Packages\RJVTRPNX.ZIP
2008-06-10 13:31 155,995 ----a-w C:\WINDOWS\java\Packages\ATJBTBHB.ZIP
2008-06-10 13:29 --------- d-----w C:\Program Files\Usługi online
2006-05-24 14:38 233,472 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 15:00 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 12:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 14:59 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 10:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 16:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 09:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 09:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 09:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 09:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

------- Sigcheck -------

2002-09-29 02:00 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-10 11:46 66912]

[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-07-10 11:46 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:44 1667584]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2004-12-28 19:02 770048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS Camera ScreenSaver"="C:\WINDOWS\ASScrProlog.exe" [2008-06-10 15:49 37232]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2007-09-05 11:13 141848]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2007-09-05 11:13 166424]
"Persistence"="C:\WINDOWS\System32\igfxpers.exe" [2007-09-05 11:13 137752]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 08:36 36864]
"36X Raid Configurer"="C:\WINDOWS\System32\xRaidSetup.exe" [2007-08-29 10:55 1966080]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-10 16:16 921600]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-09 00:00 128920]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2003-12-29 17:01 159744]
"ClipX"="C:\Program Files\ClipX\clipx.exe" [2005-11-30 23:34 68608]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 14:18 307200]
"JulaPan"="JulaPan.Exe" [2007-09-06 03:29 417792 C:\WINDOWS\system32\JulaPan.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 12:14 16844800 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2003-09-17 11:00]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2003-09-17 11:01]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2003-09-17 11:00]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2007-09-06 03:29]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2007-09-06 03:29]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2003-09-10 09:53]
S3 SynasUSB;SynasUSB;C:\WINDOWS\system32\drivers\SynasUSB.sys [2005-11-03 12:17]
S3 TCCrystalCpuInfo;TCCrystalCpuInfo;C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\TCCpuInfo.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.yahoo.com/
O8 -: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 -: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O17 -: HKLM\CCS\Interface\{D65C0DDA-CD7F-4E55-BE84-F1CDEC6DD661}: NameServer = 168.192.1.1 168.192.1.1

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-25 15:04:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-07-25 15:06:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-25 13:06:03
ComboFix2.txt 2008-07-25 10:47:16

Pre-Run: 350,522,445,824 bajtów wolnych
Post-Run: 350,465,724,416 bajt˘w wolnych

297

te logi sa wygenerowane z combofixa-

[ Dodano: Dzisiaj o 15:15 ]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:15:09, on 2008-07-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ClipX\clipx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ClipX] C:\Program Files\ClipX\clipx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: bucz2.lnk = ?
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D65C0DDA-CD7F-4E55-BE84-F1CDEC6DD661}: NameServer = 168.192.1.1 168.192.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7338 bytes

a tu logi z Hijack

[ Dodano: Dzisiaj o 15:18 ]
Jeden kolega z forum polecił mi:

Utworz na pulpicie plik CFScript.txt, wklej do niego:

Folder::
C:\\Program Files\\AskSBar\\

File::
C:\\WINDOWS\\system32\\sofbho.dll
C:\\WINDOWS\\system32\\sofiebho.dll
C:\\WINDOWS\\system32\\sofie.dll
C:\\WINDOWS\\system32\\homie.dll
C:\\WINDOWS\\system32\\hombho.dll
C:\\WINDOWS\\system32\\domie.dll
C:\\WINDOWS\\system32\\dombho.dll
C:\\WINDOWS\\hpqEmlSz.INI

Registry::
[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\URLSearchHooks]
\"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}\"=-

[-HKEY_CLASSES_ROOT\\clsid\\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]
[-HKEY_LOCAL_MACHINE\\~\\Browser Helper Objects\\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
[-HKEY_LOCAL_MACHINE\\~\\Browser Helper Objects\\{A4D16645-4149-41FB-B670-E06072E540C1}]

Zapisz i przeciagnij go na ikone combofix.

??

[Okocza]

Kod: Zaznacz wszystko

C:\WINDOWS\system32\JulaPan.Exe
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe


zrob tamto i to co ja Ci dałem

to na fix w hijack this - masz w temacie opisane jak to zrobic. wracasz ze swiezym logiem z combo i hj

[Dj.McG]

OK zrobiłem
jednak w trybie awaryjnym jak odpalałem fix w Hijack to nieznalazłem tych plików co mi podałeś
moze dlatego ze umiesciłem w w pliku txt do combo fixa
>>sprawdz>



a nizej logi
combofix

ComboFix 08-07-24.3 - Administrator 2008-07-25 15:30:59.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1504 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Pulpit\CFScript.txt.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\\WINDOWS\\hpqEmlSz.INI
C:\\WINDOWS\\system32\\dombho.dll
C:\\WINDOWS\\system32\\domie.dll
C:\\WINDOWS\\system32\\hombho.dll
C:\\WINDOWS\\system32\\homie.dll
C:\\WINDOWS\\system32\\sofbho.dll
C:\\WINDOWS\\system32\\sofie.dll
C:\\WINDOWS\\system32\\sofiebho.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\\Program Files\\AskSBar\\\bar\1.bin\A2FFXTBR.JAR
C:\\Program Files\\AskSBar\\\bar\1.bin\A2FFXTBR.MANIFEST
C:\\Program Files\\AskSBar\\\bar\1.bin\A2HIGHIN.EXE
C:\\Program Files\\AskSBar\\\bar\1.bin\A2NTSTBR.JAR
C:\\Program Files\\AskSBar\\\bar\1.bin\A2NTSTBR.MANIFEST
C:\\Program Files\\AskSBar\\\bar\1.bin\A2PLUGIN.DLL
C:\\Program Files\\AskSBar\\\bar\1.bin\ASKSBAR.DLL
C:\\Program Files\\AskSBar\\\bar\1.bin\NPASKSBR.DLL
C:\\Program Files\\AskSBar\\\bar\1.bin\V2RSSMNU.DLL
C:\\Program Files\\AskSBar\\\bar\Cache\00020380
C:\\Program Files\\AskSBar\\\bar\Cache\00020C89.bin
C:\\Program Files\\AskSBar\\\bar\Cache\000211A9.bin
C:\\Program Files\\AskSBar\\\bar\Cache\00021E6B.bin
C:\\Program Files\\AskSBar\\\bar\Cache\00021FC3.bin
C:\\Program Files\\AskSBar\\\bar\Cache\000221C6.bin
C:\\Program Files\\AskSBar\\\bar\Cache\000222FF.bin
C:\\Program Files\\AskSBar\\\bar\Cache\files.ini
C:\\Program Files\\AskSBar\\\bar\History\search2
C:\\Program Files\\AskSBar\\\bar\Settings\prevcfg2.htm
C:\\Program Files\\AskSBar\\\SrchAstt\1.bin\A2SRCHAS.DLL
C:\\WINDOWS\\hpqEmlSz.INI
C:\\WINDOWS\\system32\\dombho.dll
C:\\WINDOWS\\system32\\domie.dll
C:\\WINDOWS\\system32\\hombho.dll
C:\\WINDOWS\\system32\\homie.dll
C:\\WINDOWS\\system32\\sofie.dll
C:\\WINDOWS\\system32\\sofiebho.dll
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
C:\WINDOWS\system32\JulaPan.Exe

.
((((((((((((((((((((((((( Files Created from 2008-06-25 to 2008-07-25 )))))))))))))))))))))))))))))))
.

2008-07-25 14:21 . 2008-07-25 14:22 2,359,350 --a------ C:\WINDOWS\ACD Wallpaper.bmp
2008-07-25 14:16 . 2008-07-25 14:16 3,116 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-25 14:02 . 2008-07-25 14:02 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-07-25 14:02 . 2008-07-25 14:02 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-25 14:02 . 2005-04-28 21:32 1,284,608 --a------ C:\WINDOWS\system32\SET1E4.tmp
2008-07-25 14:02 . 2005-04-28 21:32 395,776 --a------ C:\WINDOWS\system32\SET1E2.tmp
2008-07-25 14:02 . 2005-04-28 21:32 75,264 --a------ C:\WINDOWS\system32\SET1E3.tmp
2008-07-25 13:58 . 2008-07-24 01:27 <DIR> d-------- C:\SDFix
2008-07-25 13:24 . 2008-07-25 13:24 <DIR> d-------- C:\Program Files\Ableton
2008-07-25 13:24 . 2008-07-25 13:25 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ableton
2008-07-25 13:24 . 2007-12-05 01:40 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2008-07-25 13:24 . 2007-12-05 01:40 233,472 --a------ C:\WINDOWS\system32\rex shared library.dll
2008-07-25 11:59 . 2008-07-25 12:52 <DIR> d-------- C:\Program Files\SkanerOnline
2008-07-22 12:53 . 2005-11-08 20:02 708,608 --a------ C:\WINDOWS\system32\SYNSOACC.dll
2008-07-22 12:53 . 2005-11-08 11:20 147,456 --a------ C:\WINDOWS\system32\SynsoLChk.dll
2008-07-22 12:53 . 2003-07-31 20:28 147,425 --a------ C:\WINDOWS\system32\SYNSOACC-Aide.chm
2008-07-22 12:53 . 2003-05-26 15:29 120,468 --a------ C:\WINDOWS\system32\SYNSOACC-Hilfe.chm
2008-07-22 12:53 . 2003-05-26 15:29 114,279 --a------ C:\WINDOWS\system32\SYNSOACC-Help.chm
2008-07-22 12:53 . 2005-11-03 17:14 45,056 --a------ C:\WINDOWS\system32\Synsopos.exe
2008-07-22 12:53 . 2005-11-03 12:17 16,896 --a------ C:\WINDOWS\system32\drivers\synasUSB.sys
2008-07-22 00:37 . 2008-07-22 00:37 <DIR> d-------- C:\Program Files\Common Files\Steinberg
2008-07-21 17:15 . 2008-07-21 17:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Reallusion
2008-07-21 17:14 . 2008-07-21 17:14 <DIR> d-------- C:\Program Files\Common Files\Reallusion
2008-07-20 18:21 . 2008-07-20 18:21 <DIR> d-------- C:\Program Files\Nexus
2008-07-20 12:11 . 2008-07-25 11:51 <DIR> d-------- C:\Downloads
2008-07-19 18:08 . 2008-07-19 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-07-19 18:07 . 2008-07-19 18:07 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-07-19 17:51 . 2008-07-19 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-07-19 17:51 . 2008-07-19 17:52 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\PC Suite
2008-07-19 17:51 . 2008-07-19 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nokia
2008-07-19 17:50 . 2008-07-19 17:50 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-07-19 17:50 . 2008-07-19 17:50 <DIR> d-------- C:\Program Files\DIFX
2008-07-19 17:50 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-07-19 17:49 . 2008-07-20 01:01 <DIR> d-------- C:\Program Files\Nokia
2008-07-19 17:49 . 2008-07-19 18:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-07-19 17:49 . 2008-02-01 16:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-07-19 16:46 . 2008-07-25 11:52 <DIR> d-------- C:\Program Files\FlashGet
2008-07-19 16:46 . 2004-08-03 23:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2008-07-18 20:35 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-07-18 20:35 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-07-10 11:46 . 2008-07-10 11:46 <DIR> d-------- C:\Program Files\AskSBar
2008-07-10 11:46 . 2008-07-10 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-07-10 11:46 . 2008-07-20 18:50 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Azureus
2008-07-10 11:45 . 2008-07-10 11:45 <DIR> d-------- C:\Program Files\Vuze
2008-07-07 08:18 . 2008-07-07 08:18 <DIR> d-------- C:\Program Files\Digidesign
2008-07-07 08:18 . 2003-09-10 18:00 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll
2008-07-06 18:26 . 2008-07-06 18:26 <DIR> d-------- C:\Program Files\MSECache
2008-07-06 12:03 . 2008-07-06 12:03 29 --a------ C:\WINDOWS\coolacm.ini
2008-07-05 11:01 . 2008-07-05 11:01 <DIR> d-------- C:\Program Files\Native Instruments
2008-07-04 16:14 . 2008-07-04 16:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2008-07-04 16:13 . 2004-08-04 00:44 91,136 --a------ C:\WINDOWS\system32\drivers\kswdmcap.ax
2008-07-04 16:13 . 2004-08-04 00:44 61,952 --a------ C:\WINDOWS\system32\drivers\kstvtune.ax
2008-07-04 16:13 . 2004-08-04 00:44 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll
2008-07-04 16:13 . 2004-08-04 00:44 28,672 --a------ C:\WINDOWS\system32\drivers\vidcap.ax
2008-07-04 16:12 . 2008-07-04 16:12 <DIR> d-------- C:\Program Files\IVT Corporation
2008-07-04 16:12 . 2004-08-04 00:44 43,008 --a------ C:\WINDOWS\system32\drivers\ksxbar.ax
2008-07-02 17:45 . 2008-07-02 17:45 <DIR> d-------- C:\Program Files\GForce
2008-07-01 21:42 . 2008-07-01 21:42 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-30 21:39 . 2008-06-30 21:39 <DIR> d-------- C:\Program Files\Real Alternative
2008-06-30 18:38 . 2008-06-30 18:38 <DIR> d-------- C:\WINDOWS\Sun
2008-06-30 18:33 . 2008-06-30 18:33 <DIR> d-------- C:\Program Files\Sun
2008-06-30 18:33 . 2008-06-30 18:33 <DIR> d-------- C:\Program Files\Java
2008-06-30 18:33 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-30 18:24 . 2008-06-30 18:24 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-29 15:03 . 2008-06-29 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\HP
2008-06-29 14:45 . 2008-06-29 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG
2008-06-29 14:38 . 2008-06-29 14:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY
2008-06-29 14:38 . 2008-07-20 18:41 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\HPAppData
2008-06-29 14:37 . 2008-06-29 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant
2008-06-29 14:37 . 2008-06-29 15:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Common Files\HP
2008-06-29 14:36 . 2008-06-29 14:36 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-06-29 14:35 . 2008-06-29 14:38 <DIR> d-------- C:\Program Files\HP
2008-06-29 14:32 . 2008-06-29 14:45 153,459 --a------ C:\WINDOWS\hpoins14.dat
2008-06-29 14:32 . 2007-09-20 03:14 2,000 --------- C:\WINDOWS\hpomdl14.dat
2008-06-25 21:00 . 2008-06-25 21:01 <DIR> d-------- C:\Program Files\Edirol

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-25 12:59 --------- d-----w C:\Program Files\Cool2000
2008-07-25 09:51 --------- d-----w C:\Program Files\ESET
2008-07-23 12:47 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2008-07-23 09:54 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\skypePM
2008-07-22 11:00 --------- d-----w C:\Program Files\Syncrosoft
2008-07-22 10:24 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Steinberg
2008-07-21 22:32 --------- d-----w C:\Program Files\Steinberg
2008-07-21 15:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-07 06:18 --------- d-----w C:\Program Files\VstPlugins
2008-07-07 06:17 --------- d-----w C:\Program Files\Arturia
2008-07-03 17:17 --------- d-----w C:\Program Files\foobar2000
2008-06-30 19:38 --------- d-----w C:\Program Files\ffdshow
2008-06-25 18:20 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-23 19:11 --------- d-----w C:\Program Files\BearShare
2008-06-22 19:34 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Cool Record Edit Pro
2008-06-21 01:12 --------- d-----w C:\Program Files\Image-Line
2008-06-21 01:05 --------- d-----w C:\Program Files\Outsim
2008-06-20 14:41 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-06-19 17:44 --------- d-----w C:\Program Files\rgcaudio
2008-06-19 15:26 --------- d-----w C:\Program Files\Cakewalk
2008-06-19 15:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Cakewalk
2008-06-16 15:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-16 14:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-16 14:47 --------- d-----w C:\Program Files\Ahead
2008-06-14 16:10 --------- d-----w C:\Program Files\SplitCam
2008-06-14 16:03 --------- d-----w C:\Program Files\Skype
2008-06-14 16:03 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-14 16:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-14 16:02 13,824 ----a-w C:\WINDOWS\system32\drivers\splitcam.sys
2008-06-14 15:43 --------- d-----w C:\Program Files\ClipX
2008-06-13 15:19 --------- d-----w C:\Program Files\ACD
2008-06-13 13:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 13:44 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft Web Folders
2008-06-13 13:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard
2008-06-13 13:03 16,376 ----a-w C:\WINDOWS\gdrv.sys
2008-06-13 12:54 --------- d-----w C:\Program Files\WinFast
2008-06-13 12:54 --------- d-----w C:\Program Files\Ulead Systems
2008-06-13 12:54 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-06-10 18:24 --------- d-----w C:\Program Files\iZotope
2008-06-10 18:24 --------- d-----w C:\Program Files\Common Files\iZotope
2008-06-10 18:24 --------- d-----w C:\Program Files\Common Files\Digidesign
2008-06-10 18:22 --------- d-----w C:\Program Files\PSP-audioware.com
2008-06-10 18:19 --------- d-----w C:\Program Files\PSPaudioware.com
2008-06-10 18:16 286,720 ----a-w C:\WINDOWS\iun506.exe
2008-06-10 17:34 --------- d-----w C:\Program Files\Spectrasonics
2008-06-10 17:24 --------- d-----w C:\Program Files\Winamp
2008-06-10 16:55 --------- d-----w C:\Program Files\Waves
2008-06-10 16:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-10 16:15 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-06-10 16:15 --------- d-----w C:\Program Files\DAEMON Tools
2008-06-10 16:11 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd9261.sys
2008-06-10 16:11 664,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-06-10 15:38 --------- d-----w C:\Program Files\WinAce
2008-06-10 15:38 --------- d-----w C:\Program Files\ASUS
2008-06-10 14:16 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-06-10 14:16 270,336 ----a-w C:\WINDOWS\system32\imon.dll
2008-06-10 14:01 --------- d-----w C:\Program Files\Realtek
2008-06-10 14:01 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield
2008-06-10 13:59 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-10 13:52 --------- d-----w C:\Program Files\Intel
2008-06-10 13:51 --------- d-----w C:\Program Files\Yahoo!
2008-06-10 13:49 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-06-10 13:49 6,235,384 ----a-w C:\WINDOWS\LCD Demo.exe
2008-06-10 13:49 503,808 ----a-w C:\WINDOWS\Asus_LCD_ScreenSaver.scr
2008-06-10 13:49 37,232 ----a-w C:\WINDOWS\ASScrProlog.exe
2008-06-10 13:49 262,512 ----a-w C:\WINDOWS\ASUS LCD ScreenSaver Uninstaller.exe
2008-06-10 13:49 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-06-10 13:31 558,142 ----a-w C:\WINDOWS\java\Packages\RJVTRPNX.ZIP
2008-06-10 13:31 155,995 ----a-w C:\WINDOWS\java\Packages\ATJBTBHB.ZIP
2008-06-10 13:29 --------- d-----w C:\Program Files\Usługi online
2006-05-24 14:38 233,472 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 15:00 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 12:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 14:59 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 10:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 16:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 09:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 09:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 09:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 09:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

------- Sigcheck -------

2002-09-29 02:00 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:44 1667584]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2004-12-28 19:02 770048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS Camera ScreenSaver"="C:\WINDOWS\ASScrProlog.exe" [2008-06-10 15:49 37232]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2007-09-05 11:13 141848]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2007-09-05 11:13 166424]
"Persistence"="C:\WINDOWS\System32\igfxpers.exe" [2007-09-05 11:13 137752]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 08:36 36864]
"36X Raid Configurer"="C:\WINDOWS\System32\xRaidSetup.exe" [2007-08-29 10:55 1966080]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-10 16:16 921600]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-09 00:00 128920]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2003-12-29 17:01 159744]
"ClipX"="C:\Program Files\ClipX\clipx.exe" [2005-11-30 23:34 68608]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 14:18 307200]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 12:14 16844800 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2003-09-17 11:00]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2003-09-17 11:01]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2003-09-17 11:00]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2007-09-06 03:29]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2007-09-06 03:29]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2003-09-10 09:53]
S3 SynasUSB;SynasUSB;C:\WINDOWS\system32\drivers\SynasUSB.sys [2005-11-03 12:17]
S3 TCCrystalCpuInfo;TCCrystalCpuInfo;C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\TCCpuInfo.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-25 15:32:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2008-07-25 15:34:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-25 13:34:36
ComboFix2.txt 2008-07-25 13:06:07
ComboFix3.txt 2008-07-25 10:47:16

Oraz Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:47:14, on 2008-07-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ClipX\clipx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ClipX] C:\Program Files\ClipX\clipx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: bucz2.lnk = ?
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D65C0DDA-CD7F-4E55-BE84-F1CDEC6DD661}: NameServer = 168.192.1.1 168.192.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6502 bytes

[Okocza]

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

[Dj.McG]

zrobiłem wszytko jak mówisz
a ten program FixIedef przeskanował mi komputer i nic nie wykrył
co do optymalizacji windowsa to niewiem dokonca co moge usunac
jednej wiem ze nie wolno odznaczyć , prog emitujacego klucz na USB oszukuje program ze niby cały czas usb jest wpięte (firmy stainberg jak coś to pomoże)

[Magik]

jusched
msmsgs
bucz2
HPwuschd

Kod: Zaznacz wszystko

clipx

[Okocza]

wfwiz
hpwuschd2
msmsgs

to wyłącz - wiesz co to "bucz2"

[Dj.McG]

ClipX musi zostać bo to mój niezbędnik
a bucz2 to moje połaczenie do sieci z netem sam dodałem do autostartu wiec zostaje
teraz restart.

[ Dodano: Dzisiaj o 13:02 ]
po tych całych zmianach nie widze teraz nic w sieci
w jaki sposób moge to odkrecić by znów mogł bym kompiować i wymieniać się plikami??