brak tapety spowolniona praca.

[aneta205]

Witam prosze o sprawdzenie loga . Złapalem prawdopodobnie trojana .Objawy są w postaci znikniecia tapety i spowolniona praca ogulna ,posiadam program anty wirusowy nod32 wykrywa przy skanowaniu ale go niemoge usunac pomimo lokalizaci zainfekowanego pliku.

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 17:24:20, on 2007-11-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\WinPCDoctor\SysRep.exe
C:\PROGRA~1\WINPCD~1\ucookw.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\RtkBtMnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\Rar$EX01.500\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [WinPCDoctor] C:\Program Files\WinPCDoctor\SysRep.exe
O4 - HKLM\..\Run: [ucookw] "C:\PROGRA~1\WINPCD~1\ucookw.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F76088C-D2F4-45D9-991C-A4D85667C72F}: NameServer = 212.2.96.51 212.2.96.52
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

[wojtas]

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[aneta205]

Witam dzieki za szybka pomoc ,zastosowałem sie do wskazowek,loga z kombo fiksa nie udalo sie zrobic bo sam sie odinstalowywuje i znika .inne logi wklejam nizej.Po przeskanowaniu nodem 32 nie wykrywa infekci ani wirusa,ale po przeskanowaniu Spyware doctor wykrywa to co zalonczylem na zdieciu i nie wiem co dalej robic

Pozdrawiam

Kod: Zaznacz wszystko

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-18 18:52:36
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Kod: Zaznacz wszystko

SmitFraudFix v2.253

Scan done at 18:32:42,46, 2007-11-18
Run from C:\Documents and Settings\Adam\Pulpit\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 212.2.96.51
DNS Server Search Order: 212.2.96.52

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2F76088C-D2F4-45D9-991C-A4D85667C72F}: NameServer=212.2.96.51 212.2.96.52
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2F76088C-D2F4-45D9-991C-A4D85667C72F}: NameServer=212.2.96.51 212.2.96.52


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning not selected.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko


SDFix: Version 1.114

Run by Adam on 2007-11-18 at 18:48

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-18 18:52:36
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Disabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 13 Nov 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 14 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1738c621b33e51e95e7a1d6339d42049\BIT10.tmp"

Finished!

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 19:26:28, on 2007-11-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\PROGRA~1\WINPCD~1\ucookw.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\RtkBtMnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\Rar$EX00.813\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [WinPCDoctor] C:\Program Files\WinPCDoctor\SysRep.exe
O4 - HKLM\..\Run: [ucookw] "C:\PROGRA~1\WINPCD~1\ucookw.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F76088C-D2F4-45D9-991C-A4D85667C72F}: NameServer = 212.2.96.51 212.2.96.52
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

[wojtas]

znasz to:

O4 - HKLM\..\Run: [ucookw] "C:\PROGRA~1\WINPCD~1\ucookw.exe" -start

jesli nie to skasuj wpis w hijacku + pogrubiony folder wywal do kosza

i daj loga z combofixa (tylko przed uzyciem go zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

[aneta205]

usunąłem O4 - HKLM\..\Run: [ucookw] "C:\PROGRA~1\WINPCD~1\ucookw.exe" -start ale ręcznie po sprawdzeniu już go nie było.
Log z tego programu Combofixa udał się

Kod: Zaznacz wszystko

ComboFix 07-11-08.1 - Adam 2007-11-17 21:10:17.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.589 [GMT 1:00]
Running from: C:\Documents and Settings\Adam\Pulpit\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adam\Dane aplikacji\setup_en[1].exe

.
(((((((((((((((((((((((((   Files Created from 2007-10-17 to 2007-11-17  )))))))))))))))))))))))))))))))
.

2007-11-18 19:05   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-11-18 18:47   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-11-18 18:16   2,994   --a------   C:\WINDOWS\system32\tmp.reg
2007-11-18 18:15   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2007-11-18 18:15   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-11-18 18:15   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-11-18 18:15   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-11-18 18:15   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2007-11-17 22:31   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\winpcdoctor
2007-11-16 21:06   <DIR>   d--------   C:\Program Files\WinPCDoctor
2007-11-16 21:06   <DIR>   d--------   C:\Program Files\Common Files\WinPCDoctor
2007-11-16 21:06   1,060,864   --a------   C:\WINDOWS\system32\mfc71.dll
2007-11-16 21:06   89,088   --a------   C:\WINDOWS\system32\atl71.dll
2007-11-16 20:32   <DIR>   d--------   C:\Program Files\Spyware Doctor
2007-11-16 20:32   <DIR>   d-a------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-16 20:32   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\PC Tools
2007-11-16 20:32   79,688   --a------   C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-16 20:32   62,280   --a------   C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-16 20:32   41,288   --a------   C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-16 20:32   29,000   --a------   C:\WINDOWS\system32\drivers\kcom.sys
2007-11-16 20:31   626,688   --a------   C:\WINDOWS\system32\msvcr80.dll
2007-11-16 20:31   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2007-11-07 11:45   <DIR>   d--------   C:\Program Files\Edgard
2007-10-27 09:31   <DIR>   d--------   C:\iPlus
2007-10-25 17:14   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2007-10-23 06:15   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\FaxCtr
2007-10-22 21:30   <DIR>   d--------   C:\Program Files\Lexmark Fax Solutions
2007-10-22 21:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FaxCtr
2007-10-22 21:30   339,968   -ra------   C:\WINDOWS\system32\IMGMAN32.DLL
2007-10-22 21:30   98,345   -ra------   C:\WINDOWS\system32\IMHOST32.DLL
2007-10-22 21:30   32,768   --a------   C:\WINDOWS\system32\LXPRMON.DLL
2007-10-22 21:30   20,480   --a------   C:\WINDOWS\system32\LXPMONUI.DLL
2007-10-22 21:30   12,288   --a------   C:\WINDOWS\system32\LXPMONRC.DLL
2007-10-22 21:29   <DIR>   d--------   C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-10-22 21:26   <DIR>   d--------   C:\Program Files\Lx_cats
2007-10-22 21:26   139,264   -ra------   C:\WINDOWS\system32\lxbtcoin.dll
2007-10-22 21:26   126,976   -ra------   C:\WINDOWS\system32\lxbtsnls.dll
2007-10-22 21:26   87,040   --a------   C:\WINDOWS\system32\wiafbdrv.dll
2007-10-22 21:26   87,040   --a--c---   C:\WINDOWS\system32\dllcache\wiafbdrv.dll
2007-10-22 21:26   65,536   -ra------   C:\WINDOWS\system32\lxbtcfg.dll
2007-10-22 21:25   <DIR>   d--------   C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
2007-10-22 21:25   <DIR>   d--------   C:\Temp
2007-10-22 21:25   <DIR>   d--------   C:\Program Files\Lexmark 5200 Series
2007-10-20 09:15   94,000   -ra------   C:\WINDOWS\system32\drivers\ss_mdm.sys
2007-10-20 09:15   58,320   -ra------   C:\WINDOWS\system32\drivers\ss_bus.sys
2007-10-20 09:15   8,304   -ra------   C:\WINDOWS\system32\drivers\ss_mdfl.sys
2007-10-20 09:15   6,144   -ra------   C:\WINDOWS\system32\drivers\ss_cmnt.sys
2007-10-20 09:15   6,144   -ra------   C:\WINDOWS\system32\drivers\ss_cm.sys
2007-10-20 09:15   5,808   -ra------   C:\WINDOWS\system32\drivers\ss_whnt.sys
2007-10-20 09:15   5,808   -ra------   C:\WINDOWS\system32\drivers\ss_wh.sys
2007-10-18 15:45   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\Samsung
2007-10-18 13:37   <DIR>   d--------   C:\Program Files\Samsung
2007-10-18 11:04   <DIR>   d--------   C:\Program Files\MSXML 4.0
2007-10-17 17:55   <DIR>   d--------   C:\Program Files\Samples
2007-10-17 17:51   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2007-10-17 17:50   <DIR>   d--------   C:\WINDOWS\system32\Samsung PC Studio Codecs
2007-10-17 17:50   2,067,140   -ra------   C:\WINDOWS\system32\avcodec.dll
2007-10-17 17:50   679,936   --a------   C:\WINDOWS\system32\fun_mp4_enc.dll
2007-10-17 17:50   61,440   --a------   C:\WINDOWS\system32\mp4_vcodec.dll
2007-10-17 17:47   <DIR>   d--------   C:\WINDOWS\system32\Samsung_USB_Drivers

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-26 06:21   ---------   d-----w   C:\Program Files\iPlus
2007-10-22 20:30   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-22 20:30   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-10-17 15:10   ---------   d-----w   C:\Program Files\Winamp
2007-10-17 13:57   ---------   d-----w   C:\Documents and Settings\Adam\Dane aplikacji\Ahead
2007-09-23 18:55   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-09-22 14:27   ---------   d-----w   C:\Documents and Settings\Adam\Dane aplikacji\Gadu-Gadu
2007-09-22 14:24   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-09-22 14:23   4,346,704   ----a-w   C:\gg77.exe
2007-08-23 18:35   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2007-08-21 06:18   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-16 10:23 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-08-16 10:21 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-08-16 10:20]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 11:17]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 11:13]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 11:17]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 14:40]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-08-23 19:35]
"iPlusManager"="C:\Program Files\iPlus\iPlusChecker.exe" [2007-08-29 10:10]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 11:03]
"LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 17:30]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2004-03-23 14:07]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24]
"WinPCDoctor"="C:\Program Files\WinPCDoctor\SysRep.exe" [2007-11-07 14:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 15:45]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-19 14:33]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
S3 GTF32BUS;GT F32 BUS;C:\WINDOWS\system32\DRIVERS\gtf32bus.sys
S3 GTPTSER;GT PT SER;C:\WINDOWS\system32\DRIVERS\gtptser.sys
S3 GTSCSER;GT SC SER;C:\WINDOWS\system32\DRIVERS\gtscser.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aab7e75-5460-11dc-929f-0016d4cb34b8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-17 21:11:38
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXBTCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-17 21:12:16
.
   --- E O F ---

[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aab7e75-5460-11dc-929f-0016d4cb34b8}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[aneta205]

tak zrobiłem i czy to już koniec? I jak można sprawdzić czy już nie ma wirusów ?

[jeff]

tak zrobiłem i czy to już koniec? I jak można sprawdzić czy już nie ma wirusów ?

daj nowe logi

[aneta205]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:38:23, on 2007-11-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\WinPCDoctor\SysRep.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\RtkBtMnt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Adam\USTAWI~1\Temp\Rar$EX00.531\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [WinPCDoctor] C:\Program Files\WinPCDoctor\SysRep.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F76088C-D2F4-45D9-991C-A4D85667C72F}: NameServer = 212.2.96.51 212.2.96.52
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

Kod: Zaznacz wszystko

ComboFix 07-11-08.1 - Adam 2007-11-17 21:35:29.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.574 [GMT 1:00]
Running from: C:\Documents and Settings\Adam\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-10-17 to 2007-11-17  )))))))))))))))))))))))))))))))
.

2007-11-18 19:05   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-11-18 18:47   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-11-18 18:16   2,994   --a------   C:\WINDOWS\system32\tmp.reg
2007-11-18 18:15   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2007-11-18 18:15   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-11-18 18:15   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-11-18 18:15   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-11-18 18:15   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2007-11-17 22:31   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\winpcdoctor
2007-11-16 21:06   <DIR>   d--------   C:\Program Files\WinPCDoctor
2007-11-16 21:06   <DIR>   d--------   C:\Program Files\Common Files\WinPCDoctor
2007-11-16 21:06   1,060,864   --a------   C:\WINDOWS\system32\mfc71.dll
2007-11-16 21:06   89,088   --a------   C:\WINDOWS\system32\atl71.dll
2007-11-16 20:32   <DIR>   d--------   C:\Program Files\Spyware Doctor
2007-11-16 20:32   <DIR>   d-a------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-16 20:32   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\PC Tools
2007-11-16 20:32   79,688   --a------   C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-16 20:32   62,280   --a------   C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-16 20:32   41,288   --a------   C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-16 20:32   29,000   --a------   C:\WINDOWS\system32\drivers\kcom.sys
2007-11-16 20:31   626,688   --a------   C:\WINDOWS\system32\msvcr80.dll
2007-11-16 20:31   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2007-11-07 11:45   <DIR>   d--------   C:\Program Files\Edgard
2007-10-27 09:31   <DIR>   d--------   C:\iPlus
2007-10-25 17:14   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2007-10-23 06:15   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\FaxCtr
2007-10-22 21:30   <DIR>   d--------   C:\Program Files\Lexmark Fax Solutions
2007-10-22 21:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FaxCtr
2007-10-22 21:30   339,968   -ra------   C:\WINDOWS\system32\IMGMAN32.DLL
2007-10-22 21:30   98,345   -ra------   C:\WINDOWS\system32\IMHOST32.DLL
2007-10-22 21:30   32,768   --a------   C:\WINDOWS\system32\LXPRMON.DLL
2007-10-22 21:30   20,480   --a------   C:\WINDOWS\system32\LXPMONUI.DLL
2007-10-22 21:30   12,288   --a------   C:\WINDOWS\system32\LXPMONRC.DLL
2007-10-22 21:29   <DIR>   d--------   C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-10-22 21:26   <DIR>   d--------   C:\Program Files\Lx_cats
2007-10-22 21:26   139,264   -ra------   C:\WINDOWS\system32\lxbtcoin.dll
2007-10-22 21:26   126,976   -ra------   C:\WINDOWS\system32\lxbtsnls.dll
2007-10-22 21:26   87,040   --a------   C:\WINDOWS\system32\wiafbdrv.dll
2007-10-22 21:26   87,040   --a--c---   C:\WINDOWS\system32\dllcache\wiafbdrv.dll
2007-10-22 21:26   65,536   -ra------   C:\WINDOWS\system32\lxbtcfg.dll
2007-10-22 21:25   <DIR>   d--------   C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
2007-10-22 21:25   <DIR>   d--------   C:\Temp
2007-10-22 21:25   <DIR>   d--------   C:\Program Files\Lexmark 5200 Series
2007-10-20 09:15   94,000   -ra------   C:\WINDOWS\system32\drivers\ss_mdm.sys
2007-10-20 09:15   58,320   -ra------   C:\WINDOWS\system32\drivers\ss_bus.sys
2007-10-20 09:15   8,304   -ra------   C:\WINDOWS\system32\drivers\ss_mdfl.sys
2007-10-20 09:15   6,144   -ra------   C:\WINDOWS\system32\drivers\ss_cmnt.sys
2007-10-20 09:15   6,144   -ra------   C:\WINDOWS\system32\drivers\ss_cm.sys
2007-10-20 09:15   5,808   -ra------   C:\WINDOWS\system32\drivers\ss_whnt.sys
2007-10-20 09:15   5,808   -ra------   C:\WINDOWS\system32\drivers\ss_wh.sys
2007-10-18 15:45   <DIR>   d--------   C:\Documents and Settings\Adam\Dane aplikacji\Samsung
2007-10-18 13:37   <DIR>   d--------   C:\Program Files\Samsung
2007-10-18 11:04   <DIR>   d--------   C:\Program Files\MSXML 4.0
2007-10-17 17:55   <DIR>   d--------   C:\Program Files\Samples
2007-10-17 17:51   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2007-10-17 17:50   <DIR>   d--------   C:\WINDOWS\system32\Samsung PC Studio Codecs
2007-10-17 17:50   2,067,140   -ra------   C:\WINDOWS\system32\avcodec.dll
2007-10-17 17:50   679,936   --a------   C:\WINDOWS\system32\fun_mp4_enc.dll
2007-10-17 17:50   61,440   --a------   C:\WINDOWS\system32\mp4_vcodec.dll
2007-10-17 17:47   <DIR>   d--------   C:\WINDOWS\system32\Samsung_USB_Drivers

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-26 06:21   ---------   d-----w   C:\Program Files\iPlus
2007-10-22 20:30   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-22 20:30   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-10-17 15:10   ---------   d-----w   C:\Program Files\Winamp
2007-10-17 13:57   ---------   d-----w   C:\Documents and Settings\Adam\Dane aplikacji\Ahead
2007-09-23 18:55   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-09-22 14:27   ---------   d-----w   C:\Documents and Settings\Adam\Dane aplikacji\Gadu-Gadu
2007-09-22 14:24   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-09-22 14:23   4,346,704   ----a-w   C:\gg77.exe
2007-08-23 18:35   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2007-08-21 06:18   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-16 10:23 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-08-16 10:21 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-08-16 10:20]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 11:17]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 11:13]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 11:17]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 14:40]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-08-23 19:35]
"iPlusManager"="C:\Program Files\iPlus\iPlusChecker.exe" [2007-08-29 10:10]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 11:03]
"LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 17:30]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2004-03-23 14:07]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24]
"WinPCDoctor"="C:\Program Files\WinPCDoctor\SysRep.exe" [2007-11-07 14:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 15:45]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-19 14:33]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
S3 GTF32BUS;GT F32 BUS;C:\WINDOWS\system32\DRIVERS\gtf32bus.sys
S3 GTPTSER;GT PT SER;C:\WINDOWS\system32\DRIVERS\gtptser.sys
S3 GTSCSER;GT SC SER;C:\WINDOWS\system32\DRIVERS\gtscser.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-17 21:36:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXBTCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-17 21:37:14
C:\ComboFix2.txt ... 2007-11-17 21:12
.
   --- E O F ---

[wojtas]

C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
C:\Program Files\Common Files\WinPCDoctor
C:\Documents and Settings\Adam\Dane aplikacji\winpcdoctor

skasuj te foldery...

zastosuj RogueRemover