Keylogger na komputerze

[casti]

Witam ktoś ukradł mi konto steam (counter strike) przez keyloggera. I wiem że on dalej znajduje się na moim komputerze. Dlatego proszę o sprawdzenie loga z hijack'a.

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:11, on 2009-06-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&Env=BASE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Randi\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{545E59DF-3CAA-4521-A17D-451F96BC59AE}: NameServer = 212.85.112.32,193.110.121.20
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Unknown owner - C:\Program Files\Creative\Shared Files\CTDevSrv.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

[Okocza]

casti, wrzuć log z RSITa

[casti]

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Randi at 2009-06-25 19:41:44
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 3 GB (33%) free of 10 GB
Total RAM: 1535 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:45, on 2009-06-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\bpk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Randi\Pulpit\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Randi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&Env=BASE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Randi\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [bpk] C:\WINDOWS\system32\bpk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{545E59DF-3CAA-4521-A17D-451F96BC59AE}: NameServer = 212.85.112.32,193.110.121.20
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Unknown owner - C:\Program Files\Creative\Shared Files\CTDevSrv.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 5680 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}]
IE Plugin Class - C:\WINDOWS\system32\bpkwb.dll [2008-06-25 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-10 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}]
IEPluginBHO Class - C:\Documents and Settings\Randi\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-05-28 42088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - &Tłumaczenie - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll [2005-11-05 323584]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-12-20 1451264]
"DeathAdder"=C:\Program Files\Razer\DeathAdder\razerhid.exe [2007-09-07 159744]
"Jet Detection"=C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-11-29 28672]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640]
"WINDVDPatch"=C:\WINDOWS\system32\CTHELPER.EXE [2002-07-02 24576]
"TrojanScanner"=C:\Program Files\Trojan Remover\Trjscan.exe [2009-06-01 1059720]
"bpk"=C:\WINDOWS\system32\bpk.exe [2008-06-25 438272]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeathAdder]
C:\Program Files\Razer\DeathAdder\razerhid.exe [2007-09-07 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ6.5\ICQ.exe silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu]
C:\Program Files\Nowe Gadu-Gadu\gg.exe [2009-05-28 10486376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2009-02-09 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
C:\WINDOWS\system32\oodtray.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Randi^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
D:\__GRY__\HEROES~1\REGIST~1\REGIST~1.EXE -d 803736 -l polish -r 7 -g Heroes of Might & Magic 5 -c us -i 2579 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-04-25 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=0
"NoColorChoice"=0
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0
"NoVisualStyleChoice"=0
"NoSizeChoice"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SynchronousMachineGroupPolicy"=0
"SynchronousUserGroupPolicy"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoSMBalloonTip"=1
"NoDriveTypeAutoRun"=149
"MemCheckBoxInRunDlg"=0
"NoClose"=0
"NoAutoTrayNotify"=0
"NoResolveTrack"=0
"NoResolveSearch"=1
"NoWelcomeScreen"=1
"NoRecentDocsNetHood"=1
"NoDesktopCleanupWizard"=1
"NoSharedDocuments"=1
"NoThemesTab"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoStrCmpLogical"=
"NoClose"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Disabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\__GRY__\Netsoccer\Netsoccer\server.exe"="D:\__GRY__\Netsoccer\Netsoccer\server.exe:*:Enabled:server"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\HLSW\hlsw.exe"="C:\Program Files\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"D:\__GRY__\CoD\CoDMP.exe"="D:\__GRY__\CoD\CoDMP.exe:*:Enabled:CoDMP"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\__GRY__\NeverwinterNights\NWN\nwmain.exe"="D:\__GRY__\NeverwinterNights\NWN\nwmain.exe:*:Enabled:Neverwinter Nights"
"C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu"
"D:\__GRY__\Valve\Steam\SteamApps\gregk7073\counter-strike\hl.exe"="D:\__GRY__\Valve\Steam\SteamApps\gregk7073\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Disabled:Adobe CSI CS4"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\ftp.exe"="C:\WINDOWS\system32\ftp.exe:*:Enabled:Program do transferu plików"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "C:\WINDOWS\system32\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-06-25 19:41:44 ----D---- C:\rsit
2009-06-25 19:39:27 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\BPK
2009-06-25 19:17:42 ----A---- C:\WINDOWS\system32\CF12287.exe
2009-06-25 19:17:37 ----A---- C:\Bug.txt
2009-06-25 19:17:24 ----D---- C:\32788R22FWJFW
2009-06-25 19:17:21 ----SD---- C:\ComboFix
2009-06-25 19:17:20 ----A---- C:\WINDOWS\system32\CF12150.exe
2009-06-25 19:16:59 ----D---- C:\Qoobox
2009-06-25 19:16:53 ----A---- C:\WINDOWS\system32\cmd.execf
2009-06-25 17:01:46 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2009-06-25 17:01:46 ----A---- C:\WINDOWS\system32\ztvunace26.dll
2009-06-25 17:01:46 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2009-06-25 17:01:46 ----A---- C:\WINDOWS\system32\unacev2.dll
2009-06-25 17:01:45 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2009-06-25 17:01:00 ----D---- C:\Program Files\Trojan Remover
2009-06-25 17:01:00 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\Simply Super Software
2009-06-25 17:01:00 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
2009-06-24 16:18:29 ----SHD---- C:\WINDOWS\system32\28463
2009-06-18 13:05:58 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\OpenFM
2009-06-07 11:07:39 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-06-07 11:07:30 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-07 11:07:20 ----D---- C:\WINDOWS\system32\PreInstall
2009-06-07 11:07:19 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-06-07 11:07:18 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-06-07 11:07:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-06-07 11:07:04 ----A---- C:\WINDOWS\imsins.BAK
2009-06-07 11:06:59 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-07 05:49:51 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-05-28 13:43:25 ----A---- C:\WINDOWS\{00000000-00000000-00000008-00001102-00000002-80271102}.BAK
2009-05-28 01:30:17 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2009-05-28 01:30:16 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-05-28 01:30:14 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-05-28 01:29:45 ----D---- C:\Program Files\TuneUp Utilities 2009

======List of files/folders modified in the last 1 months======

2009-06-25 19:40:30 ----D---- C:\WINDOWS\system32
2009-06-25 19:39:59 ----D---- C:\Program Files\Mozilla Firefox
2009-06-25 19:17:43 ----D---- C:\WINDOWS\system32\drivers
2009-06-25 17:01:00 ----D---- C:\Program Files
2009-06-25 15:55:01 ----D---- C:\Program Files\ALLPlayer
2009-06-25 15:37:38 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-25 15:37:07 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\HLSW
2009-06-25 03:46:13 ----D---- C:\WINDOWS\Temp
2009-06-25 03:12:21 ----D---- C:\WINDOWS\Prefetch
2009-06-25 00:02:40 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-24 18:16:15 ----D---- C:\WINDOWS
2009-06-24 14:06:17 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\foobar2000
2009-06-23 10:05:36 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\Nowe Gadu-Gadu
2009-06-21 17:43:12 ----D---- C:\Documents and Settings\Randi\Dane aplikacji\mIRC
2009-06-21 17:36:40 ----D---- C:\Program Files\mIRC
2009-06-21 17:11:01 ----AC---- C:\WINDOWS\NeroDigital.ini
2009-06-21 16:57:22 ----HD---- C:\WINDOWS\inf
2009-06-18 21:10:53 ----D---- C:\WINDOWS\system32\config
2009-06-11 08:20:02 ----SHD---- C:\WINDOWS\Installer
2009-06-08 22:41:08 ----D---- C:\Program Files\GeForceTweakUtility
2009-06-07 16:02:14 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-07 12:54:29 ----D---- C:\WINDOWS\AppPatch
2009-06-07 12:43:53 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-07 11:07:30 ----D---- C:\WINDOWS\WinSxS
2009-06-07 11:06:59 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-07 05:49:58 ----D---- C:\WINDOWS\SoftwareDistribution
2009-06-07 05:49:58 ----D---- C:\WINDOWS\Help
2009-06-03 07:34:55 ----AC---- C:\WINDOWS\LEXSTAT.INI
2009-06-03 00:41:03 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe
2009-06-03 00:40:47 ----D---- C:\Program Files\Common Files\Adobe
2009-05-29 15:59:37 ----D---- C:\Program Files\Nowe Gadu-Gadu
2009-05-28 13:55:54 ----SD---- C:\Documents and Settings\Randi\Dane aplikacji\Microsoft
2009-05-28 01:32:04 ----SD---- C:\WINDOWS\Tasks
2009-05-28 01:20:34 ----SHD---- C:\Documents and Settings\All Users\Dane aplikacji\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-26 23:31:34 ----RASH---- C:\boot.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-10-24 53256]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-10-24 34824]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-10-24 39944]
R2 hidusb;HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-07-19 127948]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-07-19 837548]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-07-19 11068]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-07-19 213860]
R3 DAdderFltr;DeathAdder Mouse; C:\WINDOWS\system32\drivers\dadder.sys [2007-08-02 22784]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-07-19 156604]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-07-24 998004]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-09 6307328]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-07-19 195432]
R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 a11hy7ur;a11hy7ur; C:\WINDOWS\system32\drivers\a11hy7ur.sys []
S3 ctljystk;Port gier dla karty Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
S3 emu10k1;Sterownik Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
S3 sfman;Sterownik Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2005-12-22 80272]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2005-12-22 10864]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2005-12-22 137884]
S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-04-25 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-04-25 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Sterownik filtru Przywracania systemu; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-15 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-10-24 468224]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-10 152984]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2004-05-24 311296]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-09 163908]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-05-28 604416]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-15 14336]
S2 CTDevice_Srv;CT Device Query service; C:\Program Files\Creative\Shared Files\CTDevSrv.exe []
S3 aspnet_state;Usługa stanu ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-05-13 77944]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-10-24 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-02-10 655624]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-05-28 361216]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336]
S4 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]

-----------------EOF-----------------


[Okocza]

casti, zastosuj na swoim komputerze combofixa

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[casti]

Kod: Zaznacz wszystko

ComboFix 09-06-24.05 - Randi 2009-06-25 20:00.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1535.1105 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Randi\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\28463
c:\windows\system32\28463\AKV.exe
c:\windows\system32\28463\SEKG.001
c:\windows\system32\28463\SEKG.002
c:\windows\system32\28463\SEKG.005
c:\windows\system32\28463\SEKG.006
c:\windows\system32\28463\SEKG.007
c:\windows\system32\28463\SEKG.exe
c:\windows\system32\drivers\ctoss2k.sys
c:\windows\system32\inst.dat
c:\windows\system32\pk.bin

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ossrv
-------\Service_ossrv


(((((((((((((((((((((((((   Pliki utworzone od 2009-05-25 do 2009-06-25  )))))))))))))))))))))))))))))))
.

2009-06-25 17:41 . 2009-06-25 17:41   --------   d-----w-   C:\rsit
2009-06-25 17:39 . 2009-06-25 17:39   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\BPK
2009-06-25 15:02 . 2009-05-19 20:29   3007352   ----a-w-   c:\documents and settings\Randi\Dane aplikacji\Simply Super Software\Trojan Remover\pat1A3.exe
2009-06-25 15:01 . 2006-06-19 11:01   69632   ----a-w-   c:\windows\system32\ztvcabinet.dll
2009-06-25 15:01 . 2006-05-25 13:52   162304   ----a-w-   c:\windows\system32\ztvunrar36.dll
2009-06-25 15:01 . 2005-08-25 23:50   77312   ----a-w-   c:\windows\system32\ztvunace26.dll
2009-06-25 15:01 . 2002-03-05 23:00   75264   ----a-w-   c:\windows\system32\unacev2.dll
2009-06-25 15:01 . 2003-02-02 18:06   153088   ----a-w-   c:\windows\system32\UNRAR3.dll
2009-06-25 15:01 . 2009-06-25 15:02   --------   d-----w-   c:\program files\Trojan Remover
2009-06-25 15:01 . 2009-06-25 15:01   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\Simply Super Software
2009-06-25 15:01 . 2009-06-25 15:01   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2009-06-18 11:05 . 2009-06-18 11:05   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\OpenFM
2009-06-08 23:33 . 2009-06-08 23:35   --------   d-----w-   c:\documents and settings\Randi\SMTPS
2009-06-07 09:07 . 2005-02-25 03:36   22752   ----a-w-   c:\windows\system32\spupdsvc.exe
2009-05-28 11:55 . 2009-05-28 11:55   15872   ----a-r-   c:\documents and settings\Randi\Dane aplikacji\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-05-28 09:23 . 2009-05-28 09:23   42088   ----a-w-   c:\documents and settings\Randi\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-28 08:34 . 2009-05-28 08:34   11264   ----a-w-   c:\documents and settings\Randi\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
2009-05-27 23:30 . 2009-05-27 23:30   604416   ----a-w-   c:\windows\system32\TUProgSt.exe
2009-05-27 23:30 . 2009-04-27 12:21   28928   ----a-w-   c:\windows\system32\uxtuneup.dll
2009-05-27 23:30 . 2009-05-27 23:30   361216   ----a-w-   c:\windows\system32\TuneUpDefragService.exe
2009-05-27 23:29 . 2009-06-18 14:27   --------   d-----w-   c:\program files\TuneUp Utilities 2009

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 18:04 . 2009-05-06 16:40   24   ----a-w-   c:\windows\system32\DVCStateBkp-{00000000-00000000-00000008-00001102-00000002-80271102}.dat
2009-06-25 18:04 . 2009-05-06 16:40   24   ----a-w-   c:\windows\system32\DVCState-{00000000-00000000-00000008-00001102-00000002-80271102}.dat
2009-06-25 13:55 . 2009-02-10 01:58   --------   d-----w-   c:\program files\ALLPlayer
2009-06-25 13:37 . 2009-03-17 23:52   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\HLSW
2009-06-24 12:06 . 2009-02-13 10:07   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\foobar2000
2009-06-23 08:05 . 2009-02-10 12:49   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\Nowe Gadu-Gadu
2009-06-21 15:43 . 2009-02-20 21:10   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\mIRC
2009-06-21 15:36 . 2009-03-12 20:10   --------   d-----w-   c:\program files\mIRC
2009-06-21 11:16 . 2009-02-13 10:14   4000   ----a-w-   C:\ao.dat
2009-06-08 20:41 . 2009-04-10 09:46   --------   d-----w-   c:\program files\GeForceTweakUtility
2009-06-02 22:40 . 2009-02-10 18:01   --------   d-----w-   c:\program files\Common Files\Adobe
2009-05-29 13:59 . 2009-05-20 19:27   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-05-27 23:20 . 2009-02-11 18:17   --------   d-sh--w-   c:\documents and settings\All Users\Dane aplikacji\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-24 10:32 . 2009-02-10 01:20   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-05-24 10:31 . 2009-05-24 10:00   --------   d-----w-   c:\program files\Ontrack
2009-05-24 10:30 . 2009-05-24 10:29   --------   d-----w-   c:\program files\CSE Demoplayer
2009-05-24 09:44 . 2009-05-23 23:10   --------   d-----w-   c:\program files\Runtime Software
2009-05-19 18:32 . 2009-03-24 11:37   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\Samsung
2009-05-19 18:24 . 2009-05-19 18:24   --------   d-----w-   c:\program files\Samsung
2009-05-19 11:20 . 2009-05-19 11:20   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\Gadu-Gadu
2009-05-18 16:55 . 2009-04-03 13:21   --------   d-----w-   c:\program files\VentriloMIX
2009-05-16 20:27 . 2009-05-16 20:26   --------   d-----w-   c:\program files\PDFCreator
2009-05-13 18:45 . 2009-02-10 17:18   108208   -c--a-w-   c:\documents and settings\Randi\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-13 18:45 . 2009-05-13 17:48   --------   d-----w-   c:\program files\Common Files\Autodesk Shared
2009-05-13 18:45 . 2009-05-13 18:43   --------   d-----w-   c:\program files\AutoCAD 2006
2009-05-13 18:43 . 2009-05-13 18:43   --------   d-----w-   c:\program files\AnswerWorks 4.0
2009-05-13 18:39 . 2009-04-16 05:16   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Autodesk
2009-05-13 18:34 . 2009-04-16 05:16   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\Autodesk
2009-05-13 17:48 . 2009-05-13 17:48   --------   d-----w-   c:\program files\Autodesk
2009-05-10 05:52 . 2009-05-10 05:50   --------   d-----w-   c:\program files\Nero
2009-05-10 05:50 . 2009-02-14 10:59   --------   d-----w-   c:\program files\Common Files\Nero
2009-05-10 05:50 . 2009-05-10 05:50   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Nero
2009-05-08 17:16 . 2009-05-08 17:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype
2009-05-08 17:11 . 2009-05-08 17:11   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2009-05-08 17:11 . 2009-05-08 17:11   --------   d-----w-   c:\documents and settings\Randi\Dane aplikacji\skypePM
2009-05-07 19:15 . 2001-10-26 19:15   67078   -c--a-w-   c:\windows\system32\perfc015.dat
2009-05-07 19:15 . 2001-10-26 19:15   435978   -c--a-w-   c:\windows\system32\perfh015.dat
2009-05-07 10:59 . 2009-05-07 10:59   --------   d-----w-   c:\program files\Audacity
2009-05-06 20:19 . 2009-05-06 20:19   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2009-05-06 13:10 . 2009-02-10 01:19   --------   d-----w-   c:\program files\Creative
2009-05-04 13:07 . 2009-05-04 19:29   2298680   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\Mozilla\Firefox\Profiles\qn3ruobg.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
2009-05-03 13:36 . 2009-04-20 20:45   334912   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\baseq3\cgamex86.dll
2009-05-03 13:36 . 2009-04-20 20:45   171072   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\baseq3\uix86.dll
2009-05-03 13:36 . 2009-04-20 20:45   441408   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\baseq3\qagamex86.dll
2009-05-03 13:35 . 2009-04-20 20:45   57344   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\pb\pbag.dll
2009-05-03 13:35 . 2009-04-20 20:45   479232   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\pb\pbsv.dll
2009-05-03 13:35 . 2009-04-20 20:45   874660   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\pb\pbcl.dll
2009-05-03 13:35 . 2009-04-20 20:45   2669632   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\baseq3\quakelive.dll
2009-05-03 13:08 . 2009-04-20 20:36   22328   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\PnkBstrK.sys
2009-05-03 13:08 . 2009-04-20 20:36   22328   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\PnkBstrK.sys
2009-05-01 13:37 . 2009-03-24 07:42   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-04-28 13:53 . 2009-04-28 13:53   --------   d-----w-   c:\program files\VideoLAN
2009-04-20 20:45 . 2009-04-20 20:45   874660   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\pb\pbcls.dll
2009-04-20 20:45 . 2009-04-20 20:45   57344   -c--a-w-   c:\documents and settings\Randi\Dane aplikacji\id Software\quakelive\home\pb\pbags.dll
2009-04-16 05:12 . 2009-04-16 05:12   130   -c--a-w-   c:\documents and settings\Randi\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
.

------- Sigcheck -------

[-] 2008-04-25 14:09   1571840   C8BDAD4065118558B3DC360FC96D81DB   c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-12-20 1451264]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-28 28672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-06-01 1059720]
"WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^Randi^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=c:\documents and settings\Randi\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=c:\windows\pss\Registration Heroes of Might & Magic 5.LNKStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" -lang 1033
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"UpdReg"=c:\windows\UpdReg.EXE
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\__GRY__\\Netsoccer\\Netsoccer\\server.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"d:\\__GRY__\\CoD\\CoDMP.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"d:\\__GRY__\\NeverwinterNights\\NWN\\nwmain.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"d:\\__GRY__\\Valve\\Steam\\SteamApps\\gregk7073\\counter-strike\\hl.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-10-24 34824]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-12-20 468224]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-05-28 604416]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2009-02-20 22784]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-SEKG Agent - c:\windows\system32\28463\SEKG.exe


.
------- Skan uzupełniający -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = https://shop.winamp.com/DRHM/servlet/ControllerServlet?Action=DisplayWaitDontLeavePopUpPage&SiteID=winamp&Locale=en_US&Env=BASE
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll
TCP: {545E59DF-3CAA-4521-A17D-451F96BC59AE} = 212.85.112.32,193.110.121.20
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 20:05
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="5CA428CC411E69731DF61E9C4A6ED2F12B07BC60840FE339F0CC704B5E992EF6B47F005887ACC81FFCE093A8C2057BDBC5A90F01FDA6440482F4B64D3F9BA83476422C36E73ACFE5D48FB34A34837821BA72CF34260A393A6B51A5FAA66D8D1FF021386489E7B9B7723D7050FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808BA7FD869164D6794A6171C11EC38DE3DABFC59C6DB287C67F2A33BD6EEE2217B48C02037E1AE4FC7BEAEC9B012AA7F621B7BEB9465308D0455F58790ACA3C467DCC89C28DA5635CABF232EA706FADC680DF28FBA40A6251A18AF0508B9E2A3F7813735DE3254381215366A78C4E5F0B4772320437693C7411FC7E6C41A342892245D13048C644775DAB43C8C2EF1CCAE42F3117941E4CC0FBE5FF314088C0E9F26326F863CA4244F1F0CF294530658424A6CE5EC916DDEA3413506896EC6650DE0501B19CC98647D67D2F3827B6ECC5E6239B8F20ADF7F1D65B18BF66E2293CC1EF778307BA871632CBFB58E205C3BF74D2CB52282D881A0DCDD06F7DC3FD1D59D0BFD87B9200B67D7ADC6B3F1E38485453920D787528D574DE50CE742A62D9F1290B91CACAE40744B1E453051FC6183F6F94BB4D6319EED501F48E9D9C184A9A1B348312E66F7F75AB46708D6845971042B229BE4B7049475FC79E116DD0FF36844DDCBCA3FEC664EB8F2024BBBCED280ADA035D8916201BE1A71789A2FD385753342B6C594AA36611647A9ADC4F22FF686596D8F4B31E92034159B3FCB30E74B97507F932795E0445D524D30A94C12E15E70741856BC8D85AD607D122D5528E0AD7679DD97E1669A429A013AD7B68BB4031FBE3408A4ACCB8B62115132C6D622D4B8BA826F19C7FD1C361CE59C5FAE54E3B3845D995B0BC578BA91F49D5F0C6D8D2F1C139A9A0DF86851B801AFC89318178E41BDA82BF0B9C2A1F9A115C9601501043DD36796BF0C442EB510A64CD64E54A5B5B6B6AD2CE0DA618DB6A308F062F7777E4008136FAAF51FB847009316387A02665929538DE957D6D0C337EE600EE3DB0884166B2EBDE48EA5929B1CF58909BF9AEE495F68F573750C8CA3A6D347569842828CCA93211CF6AA8F3DB91E6CA3915FF2456B969B8A43CC0B1D2CF43306295C50C935B924CCE834120D13BA7D16BC0493ACE0F4E5A0DA656B3FD070E6CC1DC8B5117FBE8B498877A019A3FA4E4B9A1D367782E2D05B6AE80D0938796D2C97BC330BD2C60F8B8FEA7350389263559782F1FBE0C4CF0333B206DA5CC5C5455033F6C2AE765BAD48C8FB87753935E736D0907A648448878C5D1E7D088D64DF9069E8A8E2F98FEF9492DA78D2AA315C0A6893924B8F9579604D51995F8F2FE5B9E2A18D967FBFB6E78866BC9825B9303D6C"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(804)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3844)
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Razer\DeathAdder\razertra.exe
c:\program files\Razer\DeathAdder\razerofa.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-25 20:07 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-06-25 18:07

Przed: 3 404 963 840 bajtów wolnych
Po: 3 389 890 560 bajtów wolnych

229   --- E O F ---   2009-06-07 10:44


Dodano Dzisiaj, 20:16:
już czysto jest?

[wojtas]

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

[casti]

weź napisz co to jest OTL

[wojtas]

OTL