Dodatkowy antywir, zniknęła tapeta

[Buszinio]

Witam! Ściągnełem jakiś plik, odpaliłem go i od tego momentu zainstalował mi się jakiś antywirus, znieknęła tapeta, cokolwiek chce włączyć (film, muzyke, winrar) to wyskakuje, że plik jest zarażony wirusem, nie mam dźwięku w kompie... Jak temu zaradzić?

Logi:

Hijackthis:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:24, on 2009-11-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\winupdate86.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15003&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\winhelper86.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winhelper86.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5957 bytes


Silent Runners:

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 60, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"DAEMON Tools Lite" = ""C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun" ["DT Soft Ltd"]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"PC Suite Tray" = ""C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray" ["Nokia"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."]
"StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun" ["Advanced Micro Devices, Inc."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"avgnt" = ""C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min" ["Avira GmbH"]
"Malwarebytes Anti-Malware (reboot)" = ""C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript" ["Malwarebytes Corporation"]
"winupdate86.exe" = "C:\WINDOWS\system32\winupdate86.exe" [MS]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."]

{D4027C7F-154A-4066-A1AD-4243D8127440}\(Default) = "Ask Toolbar BHO"
  -> {HKLM...CLSID} = "Ask Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Ask.com\GenericAskToolbar.dll" ["Ask.com"]

{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."]

{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl"
  -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete"
  -> {HKLM...CLSID} = "IE Microsoft AutoComplete"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
  -> {HKLM...CLSID} = "History Band"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" ["Advanced Micro Devices, Inc."]

"{872A9397-E0D6-4e28-B64D-52B8D0A7EA35}" = "Display CPL Extension"
  -> {HKLM...CLSID} = "DisplayCplExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll" ["Advanced Micro Devices, Inc."]

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir Desktop\shlext.dll" ["Avira GmbH"]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

"{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C}" = "Logitech Setpoint Extension"
  -> {HKLM...CLSID} = "KbLogiExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\kbcplext.dll" ["Logitech Inc."]

"{B9B9F083-2B04-452A-8691-83694AC1037B}" = "Logitech Setpoint Extension"
  -> {HKLM...CLSID} = "LogiExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\mcplext.dll" ["Logitech Inc."]

"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser"
  -> {HKLM...CLSID} = "Nokia Phone Browser"
                   \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll" ["Nokia"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\

<<!>> skype4com\CLSID = "{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}"
  -> {HKLM...CLSID} = "IEProtocolHandler Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL" ["Skype Technologies"]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir Desktop\shlext.dll" ["Avira GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
  -> {HKLM...CLSID} = "MBAMShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\

Nokia\(Default) = "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}"
  -> {HKLM...CLSID} = "Nokia Phone Browser"
                   \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll" ["Nokia"]

HKLM\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\

ACE\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" ["Advanced Micro Devices, Inc."]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
  -> {HKLM...CLSID} = "MBAMShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir Desktop\shlext.dll" ["Avira GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]


Default executables:
--------------------

<<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile"


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoDrives" = (REG_DWORD) dword:0x00000000
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoDrives" = (REG_DWORD) dword:0x00000000
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) dword:0x00000000
{unrecognized setting}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

MPCPlayCDAudioOnArrival\
"Provider" = "Media Player Classic"
"InvokeProgID" = "MediaPlayerClassic.Autorun"
"InvokeVerb" = "PlayCDAudio"
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["mpc-hc@Sourceforge"]

MPCPlayDVDMovieOnArrival\
"Provider" = "Media Player Classic"
"InvokeProgID" = "MediaPlayerClassic.Autorun"
"InvokeVerb" = "PlayDVDMovie"
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["mpc-hc@Sourceforge"]

MPCPlayMusicFilesOnArrival\
"Provider" = "Media Player Classic"
"InvokeProgID" = "MediaPlayerClassic.Autorun"
"InvokeVerb" = "PlayMusicFiles"
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"]

MPCPlayVideoFilesOnArrival\
"Provider" = "Media Player Classic"
"InvokeProgID" = "MediaPlayerClassic.Autorun"
"InvokeVerb" = "PlayVideoFiles"
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"]


Startup items in "Mateusz" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data]
"Logitech SetPoint" -> shortcut to: "C:\Program Files\Logitech\SetPoint\SetPoint.exe" ["Logitech Inc."]


Enabled Scheduled Tasks:
------------------------

"Scheduled Update for Ask Toolbar" -> launches: "C:\Program Files\Ask.com\UpdateTask.exe" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\winhelper86.dll [null data], 01, 15
%SystemRoot%\system32\mswsock.dll [MS], 02 - 04, 07 - 14
%SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{32099AAC-C132-4136-9E9A-4E364A424E17}"
  -> {HKLM...CLSID} = "DAEMON Tools Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll" [null data]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"
  -> {HKLM...CLSID} = "Ask Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Ask.com\GenericAskToolbar.dll" ["Ask.com"]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{32099AAC-C132-4136-9E9A-4E364A424E17}" = (no title provided)
  -> {HKLM...CLSID} = "DAEMON Tools Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll" [null data]

"{D4027C7F-154A-4066-A1AD-4243D8127440}" = (no title provided)
  -> {HKLM...CLSID} = "Ask Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Ask.com\GenericAskToolbar.dll" ["Ask.com"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Avira AntiVir Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir Desktop\avguard.exe"" ["Avira GmbH"]
Avira AntiVir Scheduler, AntiVirSchedulerService, ""C:\Program Files\Avira\AntiVir Desktop\sched.exe"" ["Avira GmbH"]
Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."]
ServiceLayer, ServiceLayer, ""C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"" ["Nokia."]


---------- (launch time: 2009-11-13 19:10:50)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
---------- (total run time: 56 seconds, including 18 seconds for message boxes)


[NieWiem]

Buszinio, te programy były fajne kilka lat temu. Jesteś na tym forum często, dajesz nam logi, więc powinieneś wiedzieć, że nie o nie prosimy

• Pobierz aplikację OTL i zapisz ją na pulpicie.
• Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
• Gdy pojawi sie okno, skonfiguruj go następująco:
  • Zaznacz opcje LOP Check i Purity Check
  • Zaznacz opcje Scan All Users.
  • Upewnij się, że w okienku Extra Registry jest zaznaczone Use Safelist.
• Upewnij się, że wszystkie pozostałe okna są zamknięte i pozwól mu pracować bez zakłóceń - nie stukaj w klawiaturę, nie ruszaj myszką.
• Kliknij Run Scan i poczekaj cierpliwie aż program wykona swoje.
• Kiedy skanowanie sie skończy, pojawią sie 2 okna notatnika, zatytułowane OTL.txt i Extras.txt. Będą one zapisane w tym samym miejscu, co aplikacja OTL.
• Skopiuj (Edycja => Zaznacz wszystko, Edycja => Kopiuj) zawartość tych plików i wklej na http://www.wklej.org lub w poście w tagach [code].

[Buszinio]

Niestety mylisz się... Zarejestrowałem się sto lat temu to fakt, byłem kiedyś aktywnym userem, lecz od kilkunastu ładnych miesiącach jestem tutaj sporadycznie, więc nie jestem z wszystkim na bieżąco. Niemniej dzięki za uwage na przyszłość... Do rzeczy

Logi:

OTL

OTL.txt
extras.txt

[NieWiem]

Buszinio, za dużo tego i nie chce mi się pitolić z OTLem.

Pokaż loga z ComboFixa

[Buszinio]

Combofix

Kod: Zaznacz wszystko

ComboFix 09-11-14.03 - Mateusz 2009-11-14 18:58.7.2 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.3070.2605 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Mateusz\USTAWI~1\Temp\0.EXE
c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
c:\documents and settings\Mateusz\Menu Start\Advanced Virus Remover.lnk
c:\documents and settings\Mateusz\Pulpit\Advanced Virus Remover.lnk
c:\program files\AdvancedVirusRemover
c:\program files\AdvancedVirusRemover\AVR.exe
c:\windows\msa.exe
c:\windows\msb.exe
c:\windows\msc.exe
c:\windows\system32\16827.exe
c:\windows\system32\critical_warning.html
c:\windows\system32\msxml71.dll

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-10-14 do 2009-11-14  )))))))))))))))))))))))))))))))
.

2009-11-12 22:11 . 2009-11-12 22:11   21504   ----a-w-   c:\windows\system32\winhelper86.dll
2009-11-12 22:07 . 2006-03-02 12:00   5632   -c--a-w-   c:\windows\system32\dllcache\smimsgif.dll
2009-11-12 22:06 . 2006-03-02 12:00   14848   -c--a-w-   c:\windows\system32\dllcache\flattemp.exe
2009-11-12 22:04 . 2006-03-02 12:00   16384   -c--a-w-   c:\windows\system32\dllcache\isignup.exe
2009-11-12 21:56 . 2006-03-02 12:00   24661   -c--a-w-   c:\windows\system32\dllcache\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   24661   ----a-w-   c:\windows\system32\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   -c--a-w-   c:\windows\system32\dllcache\irclass.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   ----a-w-   c:\windows\system32\irclass.dll
2009-11-12 17:32 . 2009-11-12 11:41   29696   ----a-w-   c:\windows\system32\winupdate86.exe
2009-11-10 17:29 . 2008-03-21 12:57   14640   ----a-w-   c:\windows\system32\spmsgXP_2k3.dll
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\PC Suite
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Nokia
2009-11-10 17:28 . 2009-11-10 17:28   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\PC Suite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\PCSuite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\Nokia
2009-11-10 17:00 . 2008-08-26 09:26   18816   ----a-w-   c:\windows\system32\drivers\pccsmcfd.sys
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\PC Connectivity Solution
2009-11-10 16:18 . 2009-11-10 16:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Logitech
2009-11-10 16:18 . 2009-11-10 16:18   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\ARPPRODUCTICON.exe
2009-11-10 16:18 . 2007-01-23 14:44   20496   ----a-w-   c:\windows\system32\drivers\L8042Kbd.sys
2009-11-10 16:18 . 2007-01-30 00:46   69632   ----a-w-   c:\windows\system32\KemXML.dll
2009-11-10 16:18 . 2007-01-30 00:46   163840   ----a-w-   c:\windows\system32\kemutb.dll
2009-11-10 16:18 . 2007-01-30 00:46   110592   ----a-w-   c:\windows\system32\KemWnd.dll
2009-11-10 16:18 . 2007-01-30 00:46   135168   ----a-w-   c:\windows\system32\KemUtil.dll
2009-11-10 16:17 . 2009-11-10 16:17   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\ARPPRODUCTICON.exe
2009-11-10 16:17 . 2009-11-10 16:18   --------   d-----w-   c:\program files\Common Files\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\program files\Logitech
2009-11-10 16:01 . 2009-11-10 16:01   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Identities
2009-11-10 16:01 . 2009-11-14 13:25   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\AskToolbar
2009-11-03 19:53 . 2009-11-03 19:53   --------   d-----w-   c:\program files\SopCast
2009-11-03 19:53 . 2009-11-03 19:53   --------   d-----w-   c:\program files\Ask.com
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-09-10 13:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2009-11-01 13:03 . 2009-09-10 13:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-10-31 22:06 . 2009-10-31 22:06   --------   d-----w-   c:\program files\Trend Micro
2009-10-31 16:35 . 2009-10-31 16:35   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\My Games
2009-10-31 15:55 . 2009-10-31 15:55   --------   d-----w-   c:\program files\DAEMON Tools Toolbar
2009-10-31 15:54 . 2009-10-31 16:13   --------   d-----w-   c:\program files\DAEMON Tools Lite
2009-10-31 15:53 . 2009-10-31 15:53   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2009-10-31 15:53 . 2009-10-31 15:53   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\DAEMON Tools
2009-10-29 18:42 . 2009-10-29 18:42   --------   d-----w-   c:\program files\VID_0E8F&PID_0012
2009-10-23 22:18 . 2009-10-23 22:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Gadu-Gadu
2009-10-23 16:52 . 2009-10-23 16:52   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Media Player Classic
2009-10-23 15:33 . 2009-10-24 15:56   96104   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2009-10-23 15:33 . 2009-10-24 15:56   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-10-23 15:33 . 2009-02-13 09:29   22360   ----a-w-   c:\windows\system32\drivers\avgntmgr.sys
2009-10-23 15:33 . 2009-02-13 09:17   45416   ----a-w-   c:\windows\system32\drivers\avgntdd.sys
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\program files\Avira
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Avira
2009-10-23 10:44 . 2009-10-23 14:52   --------   d-----w-   c:\windows\SxsCaPendDel
2009-10-22 15:43 . 2008-04-14 20:51   221184   ----a-w-   c:\windows\system32\wmpns.dll
2009-10-22 15:37 . 2009-10-22 15:37   --------   d-----w-   c:\windows\ServicePackFiles
2009-10-22 15:33 . 2009-10-22 15:33   --------   d-----w-   c:\windows\EHome
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Real
2009-10-22 15:29 . 2004-01-11 22:00   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2009-10-22 15:29 . 2003-03-19 03:14   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\program files\Sun
2009-10-22 15:28 . 2009-10-22 15:28   410976   ----a-w-   c:\windows\system32\deploytk.dll
2009-10-22 15:28 . 2009-10-22 15:28   --------   d-----w-   c:\program files\Java
2009-10-22 15:28 . 2009-10-22 15:28   152576   ----a-w-   c:\documents and settings\Mateusz\Dane aplikacji\Sun\Java\jre1.6.0_10\lzma.dll
2009-10-22 13:17 . 2009-11-12 22:12   13896   ----a-w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\ATI

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-12 22:11 . 2006-03-02 12:00   83660   ----a-w-   c:\windows\system32\perfc015.dat
2009-11-12 22:11 . 2006-03-02 12:00   490284   ----a-w-   c:\windows\system32\perfh015.dat
2009-11-12 22:03 . 2009-10-21 15:23   23016   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-11-10 17:00 . 2009-11-10 16:59   --------   d-----w-   c:\program files\Nokia
2009-11-10 16:59 . 2009-11-10 16:59   95232   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   8192   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-11-10 16:59 . 2009-11-10 16:59   61440   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   10240   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-11-10 16:59 . 2009-11-10 16:59   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Installations
2009-11-10 16:58 . 2009-11-10 16:59   33984304   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe
2009-11-10 16:17 . 2009-10-21 15:36   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-11-02 09:05 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Skype
2009-10-24 14:15 . 2009-10-21 15:58   --------   d-----w-   c:\program files\Gadu-Gadu
2009-10-22 15:39 . 2009-10-21 15:25   76487   ----a-w-   c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Common Files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype
2009-10-22 15:30 . 2009-10-22 15:29   --------   d-----w-   c:\program files\K-Lite Codec Pack
2009-10-21 16:50 . 2009-10-21 16:50   --------   d-----w-   c:\program files\Opera
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\MSBuild
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\Reference Assemblies
2009-10-21 16:33 . 2009-10-21 16:33   --------   d-----w-   c:\program files\MSXML 6.0
2009-10-21 16:11 . 2009-10-21 16:11   0   ----a-w-   c:\windows\ativpsrm.bin
2009-10-21 16:09 . 2009-10-21 16:08   --------   d-----w-   c:\program files\ATI Technologies
2009-10-21 16:08 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-10-21 15:55 . 2009-10-21 15:48   --------   d-----w-   c:\program files\TP-LINK
2009-10-21 15:42 . 2009-10-21 15:42   --------   d-----w-   c:\program files\Common Files\Adobe
2009-10-21 15:41 . 2009-10-21 15:41   --------   d-----w-   c:\program files\DIFX
2009-10-21 15:39 . 2009-10-21 15:39   --------   d-----w-   c:\program files\Marvell
2009-10-21 15:36 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Realtek
2009-10-21 15:36 . 2009-10-21 15:36   315392   ----a-w-   c:\windows\HideWin.exe
2009-10-21 15:35 . 2009-10-21 15:35   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\InstallShield
2009-10-21 15:26 . 2009-10-21 15:26   --------   d-----w-   c:\program files\microsoft frontpage
2009-10-21 15:24 . 2009-10-21 15:24   --------   d-----w-   c:\program files\Usługi online
.

(((((((((((((((((((((((((((((   SnapShot_2009-11-12_22.19.45   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-14 13:30 . 2009-11-14 13:30   16384              c:\windows\temp\Perflib_Perfdata_734.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 17:04   1144712   ----a-w-   c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-07-23 21855528]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-22 136600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"winupdate86.exe"="c:\windows\system32\winupdate86.exe" [2009-11-12 29696]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-10 688128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-10-23 108289]

--- Inne Usługi/Sterowniki w Pamięci ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Zawartość folderu 'Zaplanowane zadania'

2009-11-14 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-04 17:04]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.ask.com?o=15003&l=dis
LSP: c:\windows\system32\winhelper86.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-14 19:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-11-14 19:03
ComboFix-quarantined-files.txt  2009-11-14 18:03
ComboFix2.txt  2009-11-13 18:03
ComboFix3.txt  2009-11-13 17:39
ComboFix4.txt  2009-11-13 10:21
ComboFix5.txt  2009-11-14 17:58

Przed: 16 943 439 872 bajtów wolnych
Po: 16 930 942 976 bajtów wolnych

- - End Of File - - 40DAE799D32B51A15660DF64E0605DBB


Dodam, że po ponownym uruchomieniu komputera (combofix niby usunął wirusa) problem powraca

[NieWiem]

Ta infekcja to absolutna nowość, bo jej plików nawet na googlach nie mogę znaleźć...



Muszę usuwać na instynkt i wyczucie, ale już widzę, że wyjątkowo ciężki bydlak. Nawet do LSP się dostała...

• pobierz program LSP-Fix i uruchom
• w głównym oknie programu zaznacz opcję I know what I'm doing
• w lewym okienku (Keep) wyszukaj i zaznacz
  

  Kod: Zaznacz wszystko

  winhelper86.dll

• za pomocą stzrałek >> przenieś do prawego okienka
• kliknij Finish i zrestartuj komputer.

Potem pokaż nowego loga z ComboFixa, nie chcę nic ruszać dopóki siedzi w LSP.

[Buszinio]

Kod: Zaznacz wszystko

ComboFix 09-11-14.03 - Mateusz 2009-11-14 20:01.8.2 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.3070.2502 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\41.exe
c:\windows\system32\AVR10.exe
c:\windows\system32\critical_warning.html

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-10-14 do 2009-11-14  )))))))))))))))))))))))))))))))
.

2009-11-12 22:11 . 2009-11-14 19:00   23040   ----a-w-   c:\windows\system32\winhelper86.dll
2009-11-12 22:07 . 2006-03-02 12:00   5632   -c--a-w-   c:\windows\system32\dllcache\smimsgif.dll
2009-11-12 22:06 . 2006-03-02 12:00   14848   -c--a-w-   c:\windows\system32\dllcache\flattemp.exe
2009-11-12 22:04 . 2006-03-02 12:00   16384   -c--a-w-   c:\windows\system32\dllcache\isignup.exe
2009-11-12 21:56 . 2006-03-02 12:00   24661   -c--a-w-   c:\windows\system32\dllcache\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   24661   ----a-w-   c:\windows\system32\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   -c--a-w-   c:\windows\system32\dllcache\irclass.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   ----a-w-   c:\windows\system32\irclass.dll
2009-11-12 17:32 . 2009-11-12 11:41   29696   ----a-w-   c:\windows\system32\winupdate86.exe
2009-11-10 17:29 . 2008-03-21 12:57   14640   ----a-w-   c:\windows\system32\spmsgXP_2k3.dll
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\PC Suite
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Nokia
2009-11-10 17:28 . 2009-11-10 17:28   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\PC Suite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\PCSuite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\Nokia
2009-11-10 17:00 . 2008-08-26 09:26   18816   ----a-w-   c:\windows\system32\drivers\pccsmcfd.sys
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\PC Connectivity Solution
2009-11-10 16:18 . 2009-11-10 16:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Logitech
2009-11-10 16:18 . 2009-11-10 16:18   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\ARPPRODUCTICON.exe
2009-11-10 16:18 . 2007-01-23 14:44   20496   ----a-w-   c:\windows\system32\drivers\L8042Kbd.sys
2009-11-10 16:18 . 2007-01-30 00:46   69632   ----a-w-   c:\windows\system32\KemXML.dll
2009-11-10 16:18 . 2007-01-30 00:46   163840   ----a-w-   c:\windows\system32\kemutb.dll
2009-11-10 16:18 . 2007-01-30 00:46   110592   ----a-w-   c:\windows\system32\KemWnd.dll
2009-11-10 16:18 . 2007-01-30 00:46   135168   ----a-w-   c:\windows\system32\KemUtil.dll
2009-11-10 16:17 . 2009-11-10 16:17   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\ARPPRODUCTICON.exe
2009-11-10 16:17 . 2009-11-10 16:18   --------   d-----w-   c:\program files\Common Files\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\program files\Logitech
2009-11-10 16:01 . 2009-11-10 16:01   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Identities
2009-11-10 16:01 . 2009-11-14 13:25   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\AskToolbar
2009-11-03 19:53 . 2009-11-03 19:53   --------   d-----w-   c:\program files\SopCast
2009-11-03 19:53 . 2009-11-03 19:53   --------   d-----w-   c:\program files\Ask.com
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-09-10 13:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2009-11-01 13:03 . 2009-09-10 13:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-10-31 22:06 . 2009-10-31 22:06   --------   d-----w-   c:\program files\Trend Micro
2009-10-31 16:35 . 2009-10-31 16:35   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\My Games
2009-10-31 15:55 . 2009-10-31 15:55   --------   d-----w-   c:\program files\DAEMON Tools Toolbar
2009-10-31 15:54 . 2009-10-31 16:13   --------   d-----w-   c:\program files\DAEMON Tools Lite
2009-10-31 15:53 . 2009-10-31 15:53   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2009-10-31 15:53 . 2009-10-31 15:53   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\DAEMON Tools
2009-10-29 18:42 . 2009-10-29 18:42   --------   d-----w-   c:\program files\VID_0E8F&PID_0012
2009-10-23 22:18 . 2009-10-23 22:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Gadu-Gadu
2009-10-23 16:52 . 2009-10-23 16:52   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Media Player Classic
2009-10-23 15:33 . 2009-10-24 15:56   96104   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2009-10-23 15:33 . 2009-10-24 15:56   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-10-23 15:33 . 2009-02-13 09:29   22360   ----a-w-   c:\windows\system32\drivers\avgntmgr.sys
2009-10-23 15:33 . 2009-02-13 09:17   45416   ----a-w-   c:\windows\system32\drivers\avgntdd.sys
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\program files\Avira
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Avira
2009-10-23 10:44 . 2009-10-23 14:52   --------   d-----w-   c:\windows\SxsCaPendDel
2009-10-22 15:43 . 2008-04-14 20:51   221184   ----a-w-   c:\windows\system32\wmpns.dll
2009-10-22 15:37 . 2009-10-22 15:37   --------   d-----w-   c:\windows\ServicePackFiles
2009-10-22 15:33 . 2009-10-22 15:33   --------   d-----w-   c:\windows\EHome
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Real
2009-10-22 15:29 . 2004-01-11 22:00   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2009-10-22 15:29 . 2003-03-19 03:14   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\program files\Sun
2009-10-22 15:28 . 2009-10-22 15:28   410976   ----a-w-   c:\windows\system32\deploytk.dll
2009-10-22 15:28 . 2009-10-22 15:28   --------   d-----w-   c:\program files\Java
2009-10-22 15:28 . 2009-10-22 15:28   152576   ----a-w-   c:\documents and settings\Mateusz\Dane aplikacji\Sun\Java\jre1.6.0_10\lzma.dll
2009-10-22 13:17 . 2009-11-12 22:12   13896   ----a-w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\ATI

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-14 19:08 . 2009-11-14 19:08   241156   ----a-w-   c:\windows\system32\msxml71.dll
2009-11-14 19:08 . 2009-11-14 19:08   --------   d-----w-   c:\program files\AdvancedVirusRemover
2009-11-14 19:08 . 2009-11-14 19:08   93696   ----a-w-   c:\windows\system32\41.exe
2009-11-12 22:11 . 2006-03-02 12:00   83660   ----a-w-   c:\windows\system32\perfc015.dat
2009-11-12 22:11 . 2006-03-02 12:00   490284   ----a-w-   c:\windows\system32\perfh015.dat
2009-11-12 22:03 . 2009-10-21 15:23   23016   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-11-10 17:00 . 2009-11-10 16:59   --------   d-----w-   c:\program files\Nokia
2009-11-10 16:59 . 2009-11-10 16:59   95232   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   8192   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-11-10 16:59 . 2009-11-10 16:59   61440   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   10240   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-11-10 16:59 . 2009-11-10 16:59   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Installations
2009-11-10 16:58 . 2009-11-10 16:59   33984304   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe
2009-11-10 16:17 . 2009-10-21 15:36   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-11-02 09:05 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Skype
2009-10-24 14:15 . 2009-10-21 15:58   --------   d-----w-   c:\program files\Gadu-Gadu
2009-10-22 15:39 . 2009-10-21 15:25   76487   ----a-w-   c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Common Files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype
2009-10-22 15:30 . 2009-10-22 15:29   --------   d-----w-   c:\program files\K-Lite Codec Pack
2009-10-21 16:50 . 2009-10-21 16:50   --------   d-----w-   c:\program files\Opera
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\MSBuild
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\Reference Assemblies
2009-10-21 16:33 . 2009-10-21 16:33   --------   d-----w-   c:\program files\MSXML 6.0
2009-10-21 16:11 . 2009-10-21 16:11   0   ----a-w-   c:\windows\ativpsrm.bin
2009-10-21 16:09 . 2009-10-21 16:08   --------   d-----w-   c:\program files\ATI Technologies
2009-10-21 16:08 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-10-21 15:55 . 2009-10-21 15:48   --------   d-----w-   c:\program files\TP-LINK
2009-10-21 15:42 . 2009-10-21 15:42   --------   d-----w-   c:\program files\Common Files\Adobe
2009-10-21 15:41 . 2009-10-21 15:41   --------   d-----w-   c:\program files\DIFX
2009-10-21 15:39 . 2009-10-21 15:39   --------   d-----w-   c:\program files\Marvell
2009-10-21 15:36 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Realtek
2009-10-21 15:36 . 2009-10-21 15:36   315392   ----a-w-   c:\windows\HideWin.exe
2009-10-21 15:35 . 2009-10-21 15:35   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\InstallShield
2009-10-21 15:26 . 2009-10-21 15:26   --------   d-----w-   c:\program files\microsoft frontpage
2009-10-21 15:24 . 2009-10-21 15:24   --------   d-----w-   c:\program files\Usługi online
.

(((((((((((((((((((((((((((((   SnapShot_2009-11-12_22.19.45   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-14 19:07 . 2009-11-14 19:07   16384              c:\windows\temp\Perflib_Perfdata_ee4.dat
+ 2009-11-14 19:07 . 2009-11-14 19:07   16384              c:\windows\temp\Perflib_Perfdata_720.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
2009-11-14 19:08   241156   ----a-w-   c:\windows\system32\msxml71.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 17:04   1144712   ----a-w-   c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-07-23 21855528]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"Advanced Virus Remover"="c:\program files\AdvancedVirusRemover\AVR.exe" [2009-11-14 795408]
"MailBlocker"="c:\docume~1\Mateusz\USTAWI~1\Temp\b.exe" [2009-11-14 151040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-22 136600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"winupdate86.exe"="c:\windows\system32\winupdate86.exe" [2009-11-12 29696]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-10 688128]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-10-23 108289]

--- Inne Usługi/Sterowniki w Pamięci ---

*Deregistered* - mbr
.
Zawartość folderu 'Zaplanowane zadania'

2009-11-14 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-04 17:04]

2009-11-14 c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
- c:\windows\msa.exe [2009-11-14 19:08]

2009-11-14 c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
- c:\docume~1\Mateusz\USTAWI~1\Temp\b.exe [2009-11-14 19:08]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.ask.com?o=15003&l=dis
LSP: c:\windows\system32\winhelper86.dll
.
.
------- Skojarzenia plików -------
.
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-14 20:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 


c:\windows\system32\AVR10.exe 795408 bytes executable

skanowanie pomyślnie ukończone
ukryte pliki: 1

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3252)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Gadu-Gadu\ggwhook.dll
c:\windows\system32\shdoclc.dll
c:\windows\system32\xpsp3res.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-11-14 20:09 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-11-14 19:09
ComboFix2.txt  2009-11-14 18:03
ComboFix3.txt  2009-11-13 18:03
ComboFix4.txt  2009-11-13 17:39
ComboFix5.txt  2009-11-14 19:01

Przed: 16 880 762 880 bajtów wolnych
Po: 16 851 636 224 bajtów wolnych

- - End Of File - - 20944003B8DDC73C86A7B464A95BE704


[NieWiem]

Czyli wszystko jasne. Jedziemy.

• Otwórz systemowy notatnik (i tylko on, ponieważ ComboFix jest niekompatybilny z innymi) i wklej do niego poniższy skrypt:
  

  http://forum.programosy.pl/dodatkowy-antywir-zniknela-tapeta-vp864883.html#p864883
  
  KillAll::
  
  Suspect::
  
  Collect::
  c:\windows\system32\winhelper86.dll
  c:\windows\system32\winupdate86.exe
  c:\windows\system32\41.exe
  c:\program files\AdvancedVirusRemover\AVR.exe
  c:\windows\system32\AVR10.exe
  c:\windows\system32\msxml71.dll
  
  File::
  c:\docume~1\Mateusz\USTAWI~1\Temp\b.exe
  c:\windows\msa.exe
  c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
  c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
  c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
  
  Folder::
  c:\program files\AdvancedVirusRemover
  c:\program files\Ask.com
  
  Registry::
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "MailBlocker"=-
  "Advanced Virus Remover"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "winupdate86.exe"=-
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
  "DisableTaskMgr"=dword:00000000
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoSetActiveDesktop"=dword:00000000
  "NoActiveDesktopChanges"=dword:00000000
  
  Reboot::

• Plik zapisz jako CFScript.txt
• Obowiązują te same zasady, jak przy normalnym używaniu ComboFixa, czyli:
  • nie klikać myszką
  • nie walić w klawiaturę
  • pozamykać wszystko co możliwe (to, co teraz czytasz też!)
  • wyłączyć antywirusa, firewalla i wszystko podobne
• Plik CFScript.txt przeciągnij i upuść na ikonę ComboFixa, jak na obrazku poniżej:
  
  
• To go uruchomi i rozpocznie się normalne działanie ComboFixa.
• Komputer poprosi o zgodę na resart - zgodzić się!
• Program wytworzy loga, którego wklejamy na forum w tagach [code] lub na stronie http://www.wklej.org

[Buszinio]

Kod: Zaznacz wszystko

ComboFix 09-11-15.01 - Mateusz 2009-11-14 20:34.9.2 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.3070.2528 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Mateusz\Pulpit\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\docume~1\Mateusz\USTAWI~1\Temp\b.exe"
"c:\windows\msa.exe"
"c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job"
"c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"

file zipped: c:\program files\AdvancedVirusRemover\AVR.exe
file zipped: c:\windows\system32\msxml71.dll
file zipped: c:\windows\system32\winhelper86.dll
file zipped: c:\windows\system32\winupdate86.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Mateusz\USTAWI~1\Temp\b.exe
c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
c:\documents and settings\Mateusz\Menu Start\Advanced Virus Remover.lnk
c:\documents and settings\Mateusz\Pulpit\Advanced Virus Remover.lnk
c:\program files\AdvancedVirusRemover
c:\program files\AdvancedVirusRemover\AVR.exe
c:\program files\Ask.com
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe
c:\windows\msa.exe
c:\windows\system32\msxml71.dll
c:\windows\system32\winhelper86.dll
c:\windows\system32\winupdate86.exe
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-10-14 do 2009-11-14  )))))))))))))))))))))))))))))))
.

2009-11-12 22:07 . 2006-03-02 12:00   5632   -c--a-w-   c:\windows\system32\dllcache\smimsgif.dll
2009-11-12 22:06 . 2006-03-02 12:00   14848   -c--a-w-   c:\windows\system32\dllcache\flattemp.exe
2009-11-12 22:04 . 2006-03-02 12:00   16384   -c--a-w-   c:\windows\system32\dllcache\isignup.exe
2009-11-12 21:56 . 2006-03-02 12:00   24661   -c--a-w-   c:\windows\system32\dllcache\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   24661   ----a-w-   c:\windows\system32\spxcoins.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   -c--a-w-   c:\windows\system32\dllcache\irclass.dll
2009-11-12 21:56 . 2006-03-02 12:00   13312   ----a-w-   c:\windows\system32\irclass.dll
2009-11-10 17:29 . 2008-03-21 12:57   14640   ----a-w-   c:\windows\system32\spmsgXP_2k3.dll
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\PC Suite
2009-11-10 17:28 . 2009-11-10 17:29   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Nokia
2009-11-10 17:28 . 2009-11-10 17:28   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\PC Suite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\PCSuite
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\Common Files\Nokia
2009-11-10 17:00 . 2008-08-26 09:26   18816   ----a-w-   c:\windows\system32\drivers\pccsmcfd.sys
2009-11-10 17:00 . 2009-11-10 17:00   --------   d-----w-   c:\program files\PC Connectivity Solution
2009-11-10 16:18 . 2009-11-10 16:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Logitech
2009-11-10 16:18 . 2009-11-10 16:18   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\ARPPRODUCTICON.exe
2009-11-10 16:18 . 2007-01-23 14:44   20496   ----a-w-   c:\windows\system32\drivers\L8042Kbd.sys
2009-11-10 16:18 . 2007-01-30 00:46   69632   ----a-w-   c:\windows\system32\KemXML.dll
2009-11-10 16:18 . 2007-01-30 00:46   163840   ----a-w-   c:\windows\system32\kemutb.dll
2009-11-10 16:18 . 2007-01-30 00:46   110592   ----a-w-   c:\windows\system32\KemWnd.dll
2009-11-10 16:18 . 2007-01-30 00:46   135168   ----a-w-   c:\windows\system32\KemUtil.dll
2009-11-10 16:17 . 2009-11-10 16:17   10134   ----a-r-   c:\documents and settings\Mateusz\Dane aplikacji\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\ARPPRODUCTICON.exe
2009-11-10 16:17 . 2009-11-10 16:18   --------   d-----w-   c:\program files\Common Files\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Logitech
2009-11-10 16:17 . 2009-11-10 16:17   --------   d-----w-   c:\program files\Logitech
2009-11-10 16:01 . 2009-11-10 16:01   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Identities
2009-11-10 16:01 . 2009-11-14 13:25   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\AskToolbar
2009-11-03 19:53 . 2009-11-03 19:53   --------   d-----w-   c:\program files\SopCast
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-09-10 13:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-11-01 13:03 . 2009-11-01 13:03   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2009-11-01 13:03 . 2009-09-10 13:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-10-31 22:06 . 2009-10-31 22:06   --------   d-----w-   c:\program files\Trend Micro
2009-10-31 16:35 . 2009-10-31 16:35   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\My Games
2009-10-31 15:55 . 2009-10-31 15:55   --------   d-----w-   c:\program files\DAEMON Tools Toolbar
2009-10-31 15:54 . 2009-10-31 16:13   --------   d-----w-   c:\program files\DAEMON Tools Lite
2009-10-31 15:53 . 2009-10-31 15:53   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2009-10-31 15:53 . 2009-10-31 15:53   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\DAEMON Tools
2009-10-29 18:42 . 2009-10-29 18:42   --------   d-----w-   c:\program files\VID_0E8F&PID_0012
2009-10-23 22:18 . 2009-10-23 22:18   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Gadu-Gadu
2009-10-23 16:52 . 2009-10-23 16:52   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Media Player Classic
2009-10-23 15:33 . 2009-10-24 15:56   96104   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2009-10-23 15:33 . 2009-10-24 15:56   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-10-23 15:33 . 2009-02-13 09:29   22360   ----a-w-   c:\windows\system32\drivers\avgntmgr.sys
2009-10-23 15:33 . 2009-02-13 09:17   45416   ----a-w-   c:\windows\system32\drivers\avgntdd.sys
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\program files\Avira
2009-10-23 15:33 . 2009-10-23 15:33   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Avira
2009-10-23 10:44 . 2009-10-23 14:52   --------   d-----w-   c:\windows\SxsCaPendDel
2009-10-22 15:43 . 2008-04-14 20:51   221184   ----a-w-   c:\windows\system32\wmpns.dll
2009-10-22 15:37 . 2009-10-22 15:37   --------   d-----w-   c:\windows\ServicePackFiles
2009-10-22 15:33 . 2009-10-22 15:33   --------   d-----w-   c:\windows\EHome
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\Real
2009-10-22 15:29 . 2004-01-11 22:00   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2009-10-22 15:29 . 2003-03-19 03:14   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2009-10-22 15:29 . 2009-10-22 15:29   --------   d-----w-   c:\program files\Sun
2009-10-22 15:28 . 2009-10-22 15:28   410976   ----a-w-   c:\windows\system32\deploytk.dll
2009-10-22 15:28 . 2009-10-22 15:28   --------   d-----w-   c:\program files\Java
2009-10-22 15:28 . 2009-10-22 15:28   152576   ----a-w-   c:\documents and settings\Mateusz\Dane aplikacji\Sun\Java\jre1.6.0_10\lzma.dll
2009-10-22 13:17 . 2009-11-12 22:12   13896   ----a-w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\ATI
2009-10-22 13:17 . 2009-10-22 13:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\ATI

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-12 22:11 . 2006-03-02 12:00   83660   ----a-w-   c:\windows\system32\perfc015.dat
2009-11-12 22:11 . 2006-03-02 12:00   490284   ----a-w-   c:\windows\system32\perfh015.dat
2009-11-12 22:03 . 2009-10-21 15:23   23016   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-11-10 17:29 . 2009-11-10 17:29   0   ---ha-w-   c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-11-10 17:00 . 2009-11-10 16:59   --------   d-----w-   c:\program files\Nokia
2009-11-10 16:59 . 2009-11-10 16:59   95232   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   8192   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-11-10 16:59 . 2009-11-10 16:59   61440   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-11-10 16:59 . 2009-11-10 16:59   10240   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-11-10 16:59 . 2009-11-10 16:59   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Installations
2009-11-10 16:58 . 2009-11-10 16:59   33984304   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe
2009-11-10 16:17 . 2009-10-21 15:36   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-11-02 09:05 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\Skype
2009-10-24 14:15 . 2009-10-21 15:58   --------   d-----w-   c:\program files\Gadu-Gadu
2009-10-22 15:39 . 2009-10-21 15:25   76487   ----a-w-   c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\program files\Common Files\Skype
2009-10-22 15:30 . 2009-10-22 15:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype
2009-10-22 15:30 . 2009-10-22 15:29   --------   d-----w-   c:\program files\K-Lite Codec Pack
2009-10-21 16:50 . 2009-10-21 16:50   --------   d-----w-   c:\program files\Opera
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\MSBuild
2009-10-21 16:35 . 2009-10-21 16:35   --------   d-----w-   c:\program files\Reference Assemblies
2009-10-21 16:33 . 2009-10-21 16:33   --------   d-----w-   c:\program files\MSXML 6.0
2009-10-21 16:11 . 2009-10-21 16:11   0   ----a-w-   c:\windows\ativpsrm.bin
2009-10-21 16:09 . 2009-10-21 16:08   --------   d-----w-   c:\program files\ATI Technologies
2009-10-21 16:08 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-10-21 15:55 . 2009-10-21 15:48   --------   d-----w-   c:\program files\TP-LINK
2009-10-21 15:42 . 2009-10-21 15:42   --------   d-----w-   c:\program files\Common Files\Adobe
2009-10-21 15:41 . 2009-10-21 15:41   --------   d-----w-   c:\program files\DIFX
2009-10-21 15:39 . 2009-10-21 15:39   --------   d-----w-   c:\program files\Marvell
2009-10-21 15:36 . 2009-10-21 15:36   --------   d-----w-   c:\program files\Realtek
2009-10-21 15:36 . 2009-10-21 15:36   315392   ----a-w-   c:\windows\HideWin.exe
2009-10-21 15:35 . 2009-10-21 15:35   --------   d-----w-   c:\documents and settings\Mateusz\Dane aplikacji\InstallShield
2009-10-21 15:26 . 2009-10-21 15:26   --------   d-----w-   c:\program files\microsoft frontpage
2009-10-21 15:24 . 2009-10-21 15:24   --------   d-----w-   c:\program files\Usługi online
.

(((((((((((((((((((((((((((((   SnapShot_2009-11-12_22.19.45   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-14 19:39 . 2009-11-14 19:39   16384              c:\windows\temp\Perflib_Perfdata_b28.dat
+ 2009-11-14 19:38 . 2009-11-14 19:38   16384              c:\windows\temp\Perflib_Perfdata_790.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-07-23 21855528]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-22 136600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-03-02 44544]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-10 688128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
"d:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-10-23 108289]

--- Inne Usługi/Sterowniki w Pamięci ---

*Deregistered* - mbr
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.ask.com?o=15003&l=dis
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-14 20:38
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3108)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Gadu-Gadu\ggwhook.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-11-14 20:40 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-11-14 19:40
ComboFix2.txt  2009-11-14 19:09
ComboFix3.txt  2009-11-14 18:03
ComboFix4.txt  2009-11-13 18:03
ComboFix5.txt  2009-11-14 19:34

Przed: 16 847 106 048 bajtów wolnych
Po: 16 815 644 672 bajtów wolnych

- - End Of File - - 9D00AD50AB3017780E68E393A31FF19E


Wygląda Ok, jak długo ?? Czysto?

[NieWiem]

1. Wejdź na stronę http://www.bleepingcomputer.com/submit-malware.php?channel=4
W katalogu C:\Qoobox\Quarantine znajdziesz plik Submit (data, godzina).zip. Zuploaduj go na tamtą stronę.
Linka podawać nie musisz, ponieważ był w CFScripcie. Pomoże to autorowi ComboFixa w dalszym rozwoju programu.

2. Usuń katalog C:\Qoobox

3. Zaktualizuj Malwarebytes i zrób pełen skan. Pokaż potem na forum raport z tego skanowania.



Autor postu otrzymał pochwałę

[Buszinio]

Dzięki wielkie! Zrobiłem tak jak pisałeś