brak menedzera zadań bardzo wolny komp itp help!

[burgund]

Witam, mam problem z kompem wpadło mi kilka wirusów i reklamiarzy - ciągle wyskakujące okienka itp przeskanowałem dwoma anty wirami i anty adaware. Okienka juz tak czesto nie wyskakują ale system bardzo zwalnia praktycznie nieda sie na nim pracować (pisze z innego kompa). Nie wiem czy da sie go jeszcze uratowac. wklejam loga z combofixa (musialem uruchomić go w trybie awaryjnym bo inaczej - zwiecha). Z innych objawów to właśnie brak menedzera zadań i zniknęły dyski C i D( widoczne w trybie awaryjnym)
log z combofixa:

ComboFix 08-06-16.5 - admin 2008-06-19 21:40:28.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.818 [GMT 2:00]
Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\admin\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
C:\Documents and Settings\admin\Pulpit\Error Cleaner.url
C:\Documents and Settings\admin\Pulpit\Privacy Protector.url
C:\Documents and Settings\admin\Pulpit\Spyware&Malware Protection.url
C:\Documents and Settings\admin\Ulubione\Error Cleaner.url
C:\Documents and Settings\admin\Ulubione\Privacy Protector.url
C:\Documents and Settings\admin\Ulubione\Spyware&Malware Protection.url
C:\WINDOWS\system32\itlykucq.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\mlJYSkLd.dll
C:\WINDOWS\system32\mtvohoqc.ini
C:\WINDOWS\system32\ofwdjwbs.dll
C:\WINDOWS\system32\opnlMdEX.dll
C:\WINDOWS\system32\rddifklr.ini
C:\WINDOWS\system32\rqmltdni.ini
C:\WINDOWS\system32\sbwjdwfo.ini
C:\WINDOWS\system32\uqgtlyoy.ini
C:\WINDOWS\system32\XEdMlnpo.ini
C:\WINDOWS\system32\XEdMlnpo.ini2
C:\WINDOWS\system32\yoyltgqu.dll
K:\MS32DLL.dll.vbs

.
((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.

2008-06-19 21:04 . 2008-06-19 21:04 91,392 --a------ C:\WINDOWS\system32\rlkfiddr.dll
2008-06-18 17:04 . 2008-06-18 17:07 <DIR> d-------- C:\Program Files\Opera
2008-06-17 18:48 . 2008-06-17 18:48 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-17 18:48 . 2008-06-17 18:48 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-17 18:46 . 2008-06-18 22:54 2,981,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-17 18:46 . 2008-06-19 21:09 335,904 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-17 18:46 . 2008-06-18 22:54 27,520 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-17 18:46 . 2008-06-19 21:09 4,324 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-17 18:35 . 2008-06-17 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-06-17 18:28 . 2008-06-17 18:28 <DIR> d-------- C:\Program Files\3D Fish School 3
2008-06-17 18:28 . 2007-07-27 17:37 3,403,776 --a------ C:\WINDOWS\3D Fish School 3.scr
2008-06-17 18:28 . 2007-05-24 15:41 118,784 --a------ C:\WINDOWS\dx7ogl32.dll
2008-06-16 19:54 . 2008-06-16 19:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-06-16 19:52 . 2008-06-16 19:52 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-16 19:10 . 2008-06-19 21:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-16 19:07 . 2008-06-17 08:24 <DIR> dr-h----- C:\$VAULT$.AVG
2008-06-16 19:00 . 2008-06-16 19:00 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 19:55 . 2008-06-15 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-15 19:49 . 2008-06-15 19:49 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-06-15 19:49 . 2008-06-17 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-06-15 19:49 . 2008-06-17 18:09 <DIR> d-------- C:\Documents and Settings\admin\Dane aplikacji\AVG7
2008-06-14 19:33 . 2008-06-14 19:33 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2008-06-11 18:41 . 2008-04-14 17:53 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-05 23:19 . 2008-06-05 23:19 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-05 09:35 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-06-05 09:12 . 2008-06-14 19:29 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-06-03 21:12 . 2008-06-03 21:12 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2008-06-03 20:51 . 2008-06-03 20:51 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-06-03 20:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002386_.tmp
2008-06-03 20:45 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-03 20:42 . 2008-06-03 20:42 <DIR> d-------- C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-19 19:05 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype
2008-06-19 19:03 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM
2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats
2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-08 16:24 --------- d-----w C:\Program Files\PITy
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-06 15:56 8,105 ----a-w C:\WINDOWS\system32\drivers\bDriver.sys
2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe
2008-05-06 15:56 --------- d-----w C:\Program Files\Borg Software
2008-04-29 20:40 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Gadu-Gadu
2008-04-29 18:17 --------- d-----w C:\Program Files\Skype
2008-04-29 18:16 --------- d-----w C:\Program Files\Common Files\Skype
2008-04-29 18:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-04-29 14:05 --------- d-----w C:\Program Files\Sunbelt Software
2008-04-29 13:49 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-25 16:21 26,964 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-04-23 20:10 --------- d-----w C:\Program Files\PCFriendly
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1542806F-9435-4B72-875D-845A86725465}]
C:\WINDOWS\kvsdpfeaqnm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
2008-04-25 18:22 62728 --a------ E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8E1F6C9A-86C0-4811-B45A-278E754B457F}"= "C:\WINDOWS\rtsplgob.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{8e1f6c9a-86c0-4811-b45a-278e754b457f}]
[HKEY_CLASSES_ROOT\rtsplgob.1]
[HKEY_CLASSES_ROOT\TypeLib\{2858B7C6-04ED-47DD-88EA-7B488F260762}]
[HKEY_CLASSES_ROOT\rtsplgob]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792]
"C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe" [ ]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-04 17:21 2089808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496]
"PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112]
"UC_SMB"="" []
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360]
"nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768]
"LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288]
"TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269]
"KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608]
"EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440]
"24ad6d4b"="C:\WINDOWS\system32\indtlmqr.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xkefqtgs"= {3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - C:\WINDOWS\xkefqtgs.dll [ ]
"rnopbfgt"= {AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - C:\WINDOWS\rnopbfgt.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16]
R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37]
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
S2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03]
S2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29]
S2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

.
Contents of the 'Scheduled Tasks' folder
"2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 21:47:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-19 21:54:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-19 19:53:58

Pre-Run: 4,792,598,528 bajtów wolnych
Post-Run: 7,130,607,616 bajt˘w wolnych

176 --- E O F --- 2008-06-14 17:34:20

[Okocza]

od razu z grubej rury:

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo


i nowe logi z comvofixa i hj

[burgund]

Moge to wszystko zrobic wtrybie awaryjnym ? Bo normalnie to zajmie z 5 godzin!

[Magik]

dobra

wklej log z HijackThis bo on w trybie awaryjnym dziala,
przeskanuj system ewido anti-spyware i komp powinien zaczac dzialac. I wtedy zrobisz

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

[Okocza]

tak, w awaryjnym to zrób..

[burgund]

log hijacka (po przeskanowaniu smitfraudfix z opcji 2) :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:24:40, on 2008-06-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: QXK Olive - {1542806F-9435-4B72-875D-845A86725465} - C:\WINDOWS\kvsdpfeaqnm.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O3 - Toolbar: rtsplgob - {8E1F6C9A-86C0-4811-B45A-278E754B457F} - C:\WINDOWS\rtsplgob.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TV Card Remote Control Device Monitor] C:\WINDOWS\713xRMTMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [lxbumon.exe] "C:\Program Files\Lexmark 6200 Series\lxbumon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6200 Series\ezprint.exe"
O4 - HKLM\..\Run: [24ad6d4b] rundll32.exe "C:\WINDOWS\system32\indtlmqr.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe] "C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: xkefqtgs - {3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - C:\WINDOWS\xkefqtgs.dll (file missing)
O21 - SSODL: rnopbfgt - {AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - C:\WINDOWS\rnopbfgt.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbucoms.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6712 bytes

[Magik]

dajesz na fix

Kod: Zaznacz wszystko

R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no file)
O2 - BHO: QXK Olive - {1542806F-9435-4B72-875D-845A86725465} - C:\WINDOWS\kvsdpfeaqnm.dll (file missing)
   O3 - Toolbar: rtsplgob - {8E1F6C9A-86C0-4811-B45A-278E754B457F} - C:\WINDOWS\rtsplgob.dll (file missing)
O4 - HKLM\..\Run: [24ad6d4b] rundll32.exe "C:\WINDOWS\system32\indtlmqr.dll",b
O4 - HKCU\..\Run: [C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe] "C:\Documents and Settings\All Users\Dane aplikacji\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe" /autorun
O21 - SSODL: xkefqtgs - {3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - C:\WINDOWS\xkefqtgs.dll (file missing)
O21 - SSODL: rnopbfgt - {AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - C:\WINDOWS\rnopbfgt.dll (file missing)

i jedziesz dalej

[burgund]

super!!!! komp ruszył z kopyta! Dyski sie znalazły i menedzer zadań tez! Dzięki wielkie! Panowie naprawde szacun
Byłem pewien ze juz tyko format pomoże...
Jakiego antyvira byscie polecili na przyszłość?

[Magik]

Jakiego antyvira byscie polecili na przyszłość?

standardowo
NOD lub Kaspersky

zrob jeszcze by okocza


1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

[wojtas]

i do tego nowe logi jeszcze

[burgund]

log z hj

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:01, on 2008-06-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\system32\PROMon.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\713xRMTMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe
C:\Program Files\Keyboard & Mouse Driver\KMConfig.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\713xRMT.exe
C:\Program Files\Lexmark 6200 Series\lxbumon.exe
C:\Program Files\Lexmark 6200 Series\ezprint.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Keyboard & Mouse Driver\KMProcess.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\System32\lxbucoms.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = xęƒ



¨*Â
¸‚ż
xęƒ0VHţ
ÍÖM
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1542806F-9435-4B72-875D-845A86725465} - (no file)
O2 - BHO: (no name) - {21251F50-8877-4B97-937F-C374AE7B20A9} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: (no name) - {BA44CBC8-E16A-4F36-B066-4D75699E171D} - (no file)
O2 - BHO: (no name) - {F18E2675-283E-444F-868A-FBD15E208968} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TV Card Remote Control Device Monitor] C:\WINDOWS\713xRMTMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [lxbumon.exe] "C:\Program Files\Lexmark 6200 Series\lxbumon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6200 Series\ezprint.exe"
O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mks.com.pl
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: mlJYSkLd - C:\WINDOWS\
O21 - SSODL: xkefqtgs - {3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - (no file)
O21 - SSODL: rnopbfgt - {AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbucoms.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 8643 bytes

combo mi sie zwiesił przy generowaniu loga (czekałem z 20 min)

[wojtas]

skasuj:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = xę�



¨*Â
¸‚ż
xę�0V�Hţ
ÍÖM
O2 - BHO: (no name) - {05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file)
O2 - BHO: (no name) - {1542806F-9435-4B72-875D-845A86725465} - (no file)
O2 - BHO: (no name) - {21251F50-8877-4B97-937F-C374AE7B20A9} - (no file)
O2 - BHO: (no name) - {BA44CBC8-E16A-4F36-B066-4D75699E171D} - (no file)
O2 - BHO: (no name) - {F18E2675-283E-444F-868A-FBD15E208968} - (no file)
O20 - Winlogon Notify: mlJYSkLd - C:\WINDOWS\
O21 - SSODL: xkefqtgs - {3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - (no file)
O21 - SSODL: rnopbfgt - {AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - (no file)

i daj loga z dssa ( opis w przyklejonym)

[burgund]

udało sie z combo fixa :

ComboFix 08-06-16.5 - admin 2008-06-20 0:06:52.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.615 [GMT 2:00]
Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.

2008-06-19 22:24 . 2008-06-19 22:24 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-19 22:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-19 22:17 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-06-19 22:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-19 21:04 . 2008-06-19 21:04 91,392 --a------ C:\WINDOWS\system32\rlkfiddr.dll
2008-06-18 17:04 . 2008-06-18 17:07 <DIR> d-------- C:\Program Files\Opera
2008-06-17 18:48 . 2008-06-17 18:48 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-17 18:48 . 2008-06-17 18:48 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-17 18:46 . 2008-06-19 23:33 2,981,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-17 18:46 . 2008-06-19 23:33 335,904 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-17 18:46 . 2008-06-19 23:33 27,520 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-17 18:46 . 2008-06-19 23:33 4,324 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-17 18:35 . 2008-06-17 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-06-17 18:28 . 2008-06-17 18:28 <DIR> d-------- C:\Program Files\3D Fish School 3
2008-06-17 18:28 . 2007-07-27 17:37 3,403,776 --a------ C:\WINDOWS\3D Fish School 3.scr
2008-06-17 18:28 . 2007-05-24 15:41 118,784 --a------ C:\WINDOWS\dx7ogl32.dll
2008-06-16 19:54 . 2008-06-16 19:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-06-16 19:52 . 2008-06-16 19:52 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-16 19:10 . 2008-06-20 00:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-16 19:07 . 2008-06-17 08:24 <DIR> dr-h----- C:\$VAULT$.AVG
2008-06-16 19:00 . 2008-06-16 19:00 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-15 19:55 . 2008-06-15 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-15 19:49 . 2008-06-15 19:49 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-06-15 19:49 . 2008-06-17 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-06-15 19:49 . 2008-06-17 18:09 <DIR> d-------- C:\Documents and Settings\admin\Dane aplikacji\AVG7
2008-06-14 19:33 . 2008-06-14 19:33 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2008-06-11 18:41 . 2008-04-14 17:53 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-05 23:19 . 2008-06-05 23:19 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-05 09:35 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-06-05 09:12 . 2008-06-19 22:45 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-06-03 21:12 . 2008-06-03 21:12 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2008-06-03 20:51 . 2008-06-03 20:51 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-06-03 20:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002386_.tmp
2008-06-03 20:45 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-03 20:42 . 2008-06-03 20:42 <DIR> d-------- C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-19 22:10 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype
2008-06-19 22:01 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM
2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats
2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-17 07:16 155,995 ----a-w C:\WINDOWS\java\Packages\CBDVZP7D.ZIP
2008-05-08 16:24 --------- d-----w C:\Program Files\PITy
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-05-06 15:56 8,105 ----a-w C:\WINDOWS\system32\drivers\bDriver.sys
2008-05-06 15:56 43,520 ----a-w C:\WINDOWS\system32\bt8x8.dll
2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe
2008-05-06 15:56 --------- d-----w C:\Program Files\Borg Software
2008-04-29 20:40 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Gadu-Gadu
2008-04-29 18:17 --------- d-----w C:\Program Files\Skype
2008-04-29 18:16 --------- d-----w C:\Program Files\Common Files\Skype
2008-04-29 18:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-04-29 14:05 --------- d-----w C:\Program Files\Sunbelt Software
2008-04-29 13:49 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll
2008-04-25 16:21 26,964 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-04-23 20:10 --------- d-----w C:\Program Files\PCFriendly
2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:52 178,976 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ------w C:\WINDOWS\system32\dllcache\win32k.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-19_23.45.03,20 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-19 21:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-19 21:59:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05D47D24-11BA-41F0-9A9B-782BF7719937}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1542806F-9435-4B72-875D-845A86725465}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{21251F50-8877-4B97-937F-C374AE7B20A9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
2008-04-25 18:22 62728 --a------ E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA44CBC8-E16A-4F36-B066-4D75699E171D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F18E2675-283E-444F-868A-FBD15E208968}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-04 17:21 2089808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496]
"PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112]
"UC_SMB"="" []
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360]
"nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768]
"LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288]
"TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269]
"KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608]
"EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440]
"AVP"="E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 18:21 201992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJYSkLd]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16]
R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37]
R2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03]
R2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29]
R2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

*Newly Created Service* - NMSCFG
.
Contents of the 'Scheduled Tasks' folder
"2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-20 00:10:21
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
TV Card Remote Control Device Monitor = C:\WINDOWS\713xRMTMon.exe?RtlDllShutdownInProgress???????s??????????8??????????????????????????|???|???????|???|???????????|??6~-?6~????????????P?????????????????????6~??????;~?????????(f?8t??????,?????;~4?????6~????????????P???????|???E?6~??????????????A????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-20 0:12:25
ComboFix-quarantined-files.txt 2008-06-19 22:12:02

Pre-Run: 6,774,800,384 bajtów wolnych
Post-Run: 6,767,263,744 bajtów wolnych

174 --- E O F --- 2008-06-14 17:34:20

[Magik]

jak usunales te kosmetyczne wpisy, ktore zapodalwojtas

spij spokojnie, tu juz nic nie ma

Pozdrawiam

[Okocza]

Panie emo Magik myli się Pan

wklejasz w notatniku

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJYSkLd]


w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....