komp zamula coraz bardziej, pomocy!

[Mojwa92]

Witam!
Mój komp coraz bardziej zamula - szczególnie w necie.
Przeskanowałam go czymś, ale nic nie dało...

Wstawiam loga z hijacka

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 17:04:10, on 2007-05-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\webHancer\Programs\whagent.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\GreatMemo\GreatMemo.exe
E:\UniSpiker-2.6\uni_spiker-2.6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Mojwa\Pulpit\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/english
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Easy Gif Animator Toolbar - {8AAE1BCA-A973-423F-9232-7007D8CED2C7} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\Demon\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\bjcenqeq.dll",realset
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\FIELD_AFFID.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles\vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles/vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GreatMemo.lnk = C:\Program Files\GreatMemo\GreatMemo.exe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{76CDCA55-3860-4F96-8E76-5C6D63360A67}: NameServer = 194.204.159.1,193.110.120.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000413 (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



Z góry dziękuję za pomoc!

[Precel]

lol jak zobaczylem twoj autostart to sie przerazilem
czy ty wszystko pchasz do autostartu
dziwie sie jakim cudem komp sie jeszcze uruchamia

[wojtas]

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy w awaryjnym

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem nowy log z hijacka oraz:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[Mojwa92]

Nie mogę otworzyc trybu awaryjnego.
UGH.
Co to moze byc?
Otwieram i w pewnym momencie komputer "staje".
Nawet komunikat znika [jeśli nie zdążę nacisnąć "TAK"].
Ehh...

[wojtas]

to zrob skany po kilka razy w normalnym

[Mojwa92]

Ok, przeskanowałam. Logi:

Kod: Zaznacz wszystko

"Mojwa" - 2007-05-19 21:40:20    Dodatek Service Pack 2 
ComboFix 07-05.19.5.V - Running from: "C:\Documents and Settings\Mojwa\Pulpit\"



((((((((((((((((((((((((((((((((((((((((((((((((((   V Log   )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\bbfkocvo.dll
C:\WINDOWS\system32\evolnqxs.dll
C:\WINDOWS\system32\gxumbegf.dll
C:\WINDOWS\system32\jtojlpkh.dll
C:\WINDOWS\system32\pxrobcoh.dll
C:\WINDOWS\system32\rwjfugpd.dll
C:\WINDOWS\system32\rxxjwqdj.dll


* * *  POST RUN FILES/FOLDERS  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\mc-110-12-0000140.exe
C:\WINDOWS\keyboard201.dat
C:\WINDOWS\keyboard211.dat
C:\WINDOWS\keyboard221.dat
C:\WINDOWS\keyboard231.dat
C:\WINDOWS\MTE3NDI6ODoxNg.exe
C:\Program Files\Common Files\y.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\DOCUME~1\Mojwa\DANEAP~1.\searchtoolbarcorp\Toolbar Vision\PageHistory.txt
C:\DOCUME~1\Mojwa\DANEAP~1.\searchtoolbarcorp\Toolbar Vision\WebHistory.txt
C:\Program Files\dns\affid.dat
C:\Program Files\dns\Catcher.dll
C:\Program Files\dns\cwebpage.dll
C:\Program Files\dns\uid.dat
C:\Program Files\dns\urls.dat
C:\Program Files\dns\version.txt
C:\Program Files\dns\x.bmp
C:\Program Files\ipwindows\ipwins.dll
C:\Program Files\ipwindows\ipwins.exe
C:\Program Files\ipwindows\UnInstall.exe
C:\Program Files\outlook\p.exe
C:\Program Files\outlook\p.zip
C:\Program Files\printview\chnlist.dat
C:\Program Files\printview\hotlist.dat
C:\Program Files\printview\pvmodule.exe
C:\Program Files\printview\remlist.dat
C:\Program Files\webhancer\Programs\license.txt
C:\Program Files\webhancer\Programs\readme.txt
C:\Program Files\webhancer\Programs\sporder.dll
C:\Program Files\webhancer\Programs\webhdll.dll
C:\Program Files\webhancer\Programs\whagent.exe
C:\Program Files\webhancer\Programs\whAgent.ini
C:\Program Files\webhancer\Programs\whiehlpr.dll
C:\Program Files\webhancer\Programs\whinstaller.exe
C:\Program Files\Common Files\{283E5~1\system.dll
C:\Program Files\Common Files\{283E5~1\Update.exe
C:\Program Files\Common Files\{283E5~3\system.dll
C:\Program Files\Common Files\{283E5~2\system.dll
C:\Program Files\Common Files\{283E5~2\Update.exe
C:\Program Files\Common Files\inetget
C:\Program Files\Common Files\services.exe
C:\WINDOWS\system32\nslookup.dll
C:\WINDOWS\system32\rundll.dll
C:\WINDOWS\system32\svchosts.exe
C:\WINDOWS\system32\unsvchosts.lzma
C:\WINDOWS\system32\winspool.dll
C:\DOCUME~1\Mojwa\DANEAP~1.\searchtoolbarcorp
C:\Program Files\dns
C:\Program Files\inetget2
C:\Program Files\ipwindows
C:\Program Files\outlook
C:\Program Files\printview
C:\Program Files\vsadd-in
C:\Program Files\windows
C:\Program Files\webhancer
C:\Program Files\Common Files\{283E5~1
C:\Program Files\Common Files\{283E5~3
C:\Program Files\Common Files\{283E5~2
C:\WINDOWS\system32\drivers\core.sys
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~    Purity    ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\DOCUME~1
C:\qoobox\purity\C\DOCUME~1\Mojwa
C:\qoobox\purity\C\DOCUME~1\Mojwa\DANEAP~1
C:\qoobox\purity\C\DOCUME~1\Mojwa\DANEAP~1\RACLE~1
C:\qoobox\purity\C\DOCUME~1\Mojwa\DANEAP~1\RACLE~1\RACLE~1
C:\qoobox\purity\C\DOCUME~1\Mojwa\DANEAP~1\RACLE~1\smss.exe
C:\qoobox\purity\C\Program Files\ASEMBL~1
C:\qoobox\purity\C\Program Files\CROSOF~1.NET
C:\qoobox\purity\C\Program Files\MCROSO~1.NET
C:\qoobox\purity\C\Program Files\RACLE~1
C:\qoobox\purity\C\Program Files\RACLE~2
C:\qoobox\purity\C\Program Files\SMBOLS~1
C:\qoobox\purity\C\Program Files\SSTEM~1
C:\qoobox\purity\C\Program Files\STEM~1
C:\qoobox\purity\C\Program Files\WNSXS~1
C:\qoobox\purity\C\Program Files\Common Files\ASKS~1
C:\qoobox\purity\C\Program Files\Common Files\DOBE~1
C:\qoobox\purity\C\Program Files\Common Files\PPATCH~1
C:\qoobox\purity\C\Program Files\Common Files\PPATCH~2
C:\qoobox\purity\C\Program Files\Common Files\SSEMBL~1
C:\qoobox\purity\C\Program Files\Common Files\YSTEM~1
C:\qoobox\purity\C\WINDOWS\ECURIT~1
C:\qoobox\purity\C\WINDOWS\FNTS~1
C:\qoobox\purity\C\WINDOWS\RACLE~1
C:\qoobox\purity\C\WINDOWS\SSTEM~1
C:\qoobox\purity\C\WINDOWS\ECURIT~1\w?wexec.exe
C:\qoobox\purity\C\WINDOWS\system32\ASEMBL~1
C:\qoobox\purity\C\WINDOWS\system32\CROSOF~1
C:\qoobox\purity\C\WINDOWS\system32\ECURIT~1
C:\qoobox\purity\C\WINDOWS\system32\FNTS~1
C:\qoobox\purity\C\WINDOWS\system32\PPPATC~1
C:\qoobox\purity\C\WINDOWS\system32\RACLE~1
C:\qoobox\purity\C\WINDOWS\system32\YSTEM3~1
C:\qoobox\purity\C\WINDOWS\system32\PPPATC~1\s?oolsv.exe


(((((((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_COM+_MESSAGES
-------\LEGACY_CORE
-------\COM+ Messages
-------\core


(((((((((((((((((((((((((((((((   Files Created from 2007-04-05 to 2007-05-19  ))))))))))))))))))))))))))))))))))


2007-05-19 21:11   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-05-19 21:08   <DIR>   d--------   C:\VundoFix Backups
2007-05-19 20:21   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-05-19 20:21   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-05-19 20:21   3,964   --a------   C:\WINDOWS\system32\tmp.reg
2007-05-19 20:21   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-05-12 23:16   488,333   ---hs----   C:\WINDOWS\system32\pqstv.ini2
2007-05-08 10:52   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Opera
2007-05-04 11:16   262,144   --a------   C:\DOCUME~1\oem\ntuser.dat
2007-04-28 12:08   7,552   --a------   C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-04-28 10:13   14   --a------   C:\DOCUME~1\Mojwa\getfile.dat
2007-04-24 19:32   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Gadu-Gadu
2007-04-22 23:51   14   --a------   C:\WINDOWS\system32\getfile.dat
2007-04-22 15:28   <DIR>   d--------   C:\WINDOWS\speech
2007-04-22 14:49   <DIR>   d--------   C:\Program Files\Common Files\Skype
2007-04-22 14:49   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-04-22 14:48   <DIR>   d--------   C:\Program Files\Skype


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2060-08-18 17:02:22   1,496,064   ------w   C:\WINDOWS\system32\CC3250MT.DLL
2060-08-18 16:40:44   909,824   ------w   C:\WINDOWS\system32\CP3245MT.DLL
2060-08-18 16:40:44   24,064   ------w   C:\WINDOWS\system32\BORLNDMM.DLL
2007-05-19 19:14:09   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Skype
2007-05-19 19:12:41   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\GreatMemo
2007-05-19 18:24:12   639,820   --sh--w   C:\WINDOWS\system32\pqstv.bak2
2007-05-19 18:20:27   --------   d-----w   C:\Program Files\Tlen.pl
2007-05-19 10:42:17   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\BearShare
2007-05-17 21:34:46   50,748   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-17 21:34:46   358,702   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-05-17 21:16:14   642,249   --sh--w   C:\WINDOWS\system32\pqstv.bak1
2007-05-16 21:19:17   --------   d-----w   C:\Program Files\Common Files\G DATA
2007-05-16 21:12:34   --------   d-----w   C:\Program Files\VS Online
2007-05-12 20:52:33   --------   d-----w   C:\Program Files\SAGEM
2007-05-12 11:30:48   --------   d-----w   C:\Program Files\Jasc Software Inc
2007-05-11 14:37:17   --------   d-----w   C:\Program Files\PestPatrol
2007-04-28 13:35:34   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2007-04-28 13:35:26   88   --sh--r   C:\WINDOWS\system32\9687AD0F78.sys
2007-04-27 21:29:54   --------   d-----w   C:\Program Files\Gadu-Gadu
2007-04-22 22:06:03   --------   d-----w   C:\Program Files\QuickTime
2007-04-22 22:01:13   --------   d-----w   C:\Program Files\Messenger
2007-04-22 21:59:12   --------   d-----w   C:\Program Files\Lexmark 2200 Series
2007-04-22 21:48:22   --------   d-----w   C:\Program Files\Common Files\LightScribe
2007-04-22 21:23:27   --------   d-----w   C:\Program Files\Winamp
2007-04-22 14:21:41   --------   d-----w   C:\Program Files\Torrent Master
2007-03-30 20:55:07   --------   d-----w   C:\Program Files\Windows Media Connect 2
2007-03-30 20:43:47   26,730   ----a-w   C:\WINDOWS\system32\tuvvuro.dll.vir
2007-03-29 16:03:47   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\DivX
2007-03-29 16:02:51   --------   d-----w   C:\Program Files\RADVideo
2007-03-28 16:48:09   --------   d-----w   C:\Program Files\Codec
2007-03-21 13:37:41   --------   d-----w   C:\Program Files\GreatMemo
2007-03-18 15:42:37   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Corel
2007-03-17 13:45:36   293,376   ----a-w   C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:38:47   579,072   ----a-w   C:\WINDOWS\system32\user32.dll
2007-03-08 15:38:47   40,960   ----a-w   C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:38:47   281,600   ----a-w   C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:37:33   1,843,840   ----a-w   C:\WINDOWS\system32\win32k.sys
2007-03-07 18:20:04   --------   d-----w   C:\Program Files\Shareaza
2007-03-06 08:48:43   88,280   ----a-w   C:\DOCUME~1\Mojwa\DANEAP~1\winantiviruspro2006freeinstall[1].exe
2007-03-04 22:14:03   282,212   --sha-w   C:\WINDOWS\system32\vtsqp.dll.vir
2007-02-05 20:19:48   185,856   ----a-w   C:\WINDOWS\system32\upnphost.dll


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{339777CF-25DC-4A23-9185-EE369E2F5474}=C:\WINDOWS\system32\aebrgnes.dll []
{3873A5A5-C3F8-4830-ABF5-9C83C8347B09}=C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll []
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 14:22]
{F97DA966-F09D-4cab-BF29-75A0026986EA}=C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll [2006-11-12 09:40]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2006-08-30 18:44 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2006-08-03 15:53 C:\WINDOWS\system32\VTTimer.exe]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2005-09-06 05:10]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03]
"Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 15:34]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-18 21:43]
"PestPatrol Control Center"="C:\PROGRA~1\PESTPA~1\PPControl.exe" [2004-11-15 11:49]
"PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2004-04-02 15:11]
"CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2005-01-10 09:35]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-09-26 16:49]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" []
"USB Storage Toolbox"="C:\Program Files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 21:44]
"DC6_check"="C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe" []
"ERS_check"="C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe" []
"DAEMON Tools-1033"="E:\Program Files\Demon\daemon.exe" [2004-08-22 18:05]
"BDMCon"="C:\Program Files\Softwin\BitDefender8\bdmcon.exe" [2005-06-20 12:10]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-05-09 12:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]
"Skype"="E:\Skype\Phone\Skype.exe" [2006-07-21 13:16]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-19 17:43]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FFTI"=C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles\vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles/vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Bhro"="C:\PROGRA~1\CROSOF~1.NET\alg.exe" -vt ndrv
"<NO NAME>"=C:\WINDOWS\ECURIT~1\WWEXEC~1.EXE
"Myfjwvt"=C:\Program Files\Common Files\?asks\w?wexec.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"="C:\Program Files\Trend Micro\Tmas\sshook.dll" [2006-06-03 13:36]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 
WudfServiceGroup   WUDFSvc 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
   

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-19 21:44:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-19 21:45:41 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-19 21:45


   --- E O F ---


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:48:31, on 2007-05-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
E:\Program Files\Demon\daemon.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\GreatMemo\GreatMemo.exe
E:\UniSpiker-2.6\uni_spiker-2.6.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Mojwa\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/english
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {339777CF-25DC-4A23-9185-EE369E2F5474} - C:\WINDOWS\system32\aebrgnes.dll (file missing)
O2 - BHO: Easy Gif Animator Toolbar Helper - {3873A5A5-C3F8-4830-ABF5-9C83C8347B09} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Easy Gif Animator Toolbar - {8AAE1BCA-A973-423F-9232-7007D8CED2C7} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\Demon\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles\vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles/vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GreatMemo.lnk = C:\Program Files\GreatMemo\GreatMemo.exe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{76CDCA55-3860-4F96-8E76-5C6D63360A67}: NameServer = 194.204.159.1,193.110.120.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\pqstv.ini2
C:\WINDOWS\system32\pqstv.bak1
C:\WINDOWS\system32\pqstv.bak2
C:\WINDOWS\system32\tuvvuro.dll.vir
C:\DOCUME~1\Mojwa\DANEAP~1\winantiviruspro2006freeinstall[1].exe
C:\WINDOWS\system32\vtsqp.dll.vir

Folders to delete:

C:\qoobox
C:\VundoFix Backups
C:\Program Files\BearShare applications\BearShare MediaBar
C:\Program Files\Common Files\WinAntiVirus Pro 2006

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: (no name) - {339777CF-25DC-4A23-9185-EE369E2F5474} - C:\WINDOWS\system32\aebrgnes.dll (file missing)
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles\vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Mojwa\Dane aplikacji\Mozilla\Firefox\Profiles/vq7mgomf.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combo i hijacka

[Mojwa92]

OK.
avenger.txt

Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qrrupyco

*******************

Script file located at: \??\C:\Program Files\letexmsj.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\tmp.reg deleted successfully.
File C:\WINDOWS\system32\pqstv.ini2 deleted successfully.
File C:\WINDOWS\system32\pqstv.bak1 deleted successfully.
File C:\WINDOWS\system32\pqstv.bak2 deleted successfully.
File C:\WINDOWS\system32\tuvvuro.dll.vir deleted successfully.
File C:\DOCUME~1\Mojwa\DANEAP~1\winantiviruspro2006freeinstall[1].exe deleted successfully.
File C:\WINDOWS\system32\vtsqp.dll.vir deleted successfully.
Folder C:\qoobox deleted successfully.
Folder C:\VundoFix Backups deleted successfully.
Folder C:\Program Files\BearShare applications\BearShare MediaBar deleted successfully.


Folder C:\Program Files\Common Files\WinAntiVirus Pro 2006 not found!
Deletion of folder C:\Program Files\Common Files\WinAntiVirus Pro 2006 failed!

Could not process line:
C:\Program Files\Common Files\WinAntiVirus Pro 2006
Status: 0xc0000034


Completed script processing.

*******************

Finished!  Terminate.

hijack

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 11:41:15, on 2007-05-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
E:\Program Files\Demon\daemon.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\Program Files\Softwin\BitDefender8\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
E:\Skype\Phone\Skype.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\GreatMemo\GreatMemo.exe
E:\UniSpiker-2.6\uni_spiker-2.6.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Mojwa\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/english
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Easy Gif Animator Toolbar Helper - {3873A5A5-C3F8-4830-ABF5-9C83C8347B09} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O3 - Toolbar: Easy Gif Animator Toolbar - {8AAE1BCA-A973-423F-9232-7007D8CED2C7} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\Demon\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GreatMemo.lnk = C:\Program Files\GreatMemo\GreatMemo.exe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{76CDCA55-3860-4F96-8E76-5C6D63360A67}: NameServer = 194.204.159.1,193.110.120.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



combo

Kod: Zaznacz wszystko

"Mojwa" - 2007-05-20 11:41:48    Dodatek Service Pack 2 
ComboFix 07-05.19.5.V - Running from: "C:\Documents and Settings\Mojwa\Pulpit\"



(((((((((((((((((((((((((((((((   Files Created from 2007-04-05 to 2007-05-20  ))))))))))))))))))))))))))))))))))


2007-05-20 11:36   <DIR>   d--------   C:\WINDOWS\CSC
2007-05-20 11:31   <DIR>   d--------   C:\WINDOWS\pss
2007-05-20 11:28   <DIR>   d--------   C:\avenger
2007-05-19 22:36   85   -r-------   C:\QUIZPG2.BAT
2007-05-19 22:05   <DIR>   d--------   C:\Program Files\MarBit
2007-05-19 21:45   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-05-19 21:11   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-05-19 20:21   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-05-19 20:21   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-05-19 20:21   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-05-08 10:52   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Opera
2007-05-04 11:16   262,144   --a------   C:\DOCUME~1\oem\ntuser.dat
2007-04-28 12:08   7,552   --a------   C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-04-28 10:13   14   --a------   C:\DOCUME~1\Mojwa\getfile.dat
2007-04-24 19:32   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Gadu-Gadu
2007-04-22 23:51   14   --a------   C:\WINDOWS\system32\getfile.dat
2007-04-22 15:28   <DIR>   d--------   C:\WINDOWS\speech
2007-04-22 14:49   <DIR>   d--------   C:\Program Files\Common Files\Skype
2007-04-22 14:49   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-04-22 14:48   <DIR>   d--------   C:\Program Files\Skype


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2060-08-18 17:02:22   1,496,064   ------w   C:\WINDOWS\system32\CC3250MT.DLL
2060-08-18 16:40:44   909,824   ------w   C:\WINDOWS\system32\CP3245MT.DLL
2060-08-18 16:40:44   24,064   ------w   C:\WINDOWS\system32\BORLNDMM.DLL
2007-05-20 09:41:02   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Skype
2007-05-20 09:39:29   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\GreatMemo
2007-05-20 09:27:18   --------   d-----w   C:\Program Files\BearShare Applications
2007-05-19 18:20:27   --------   d-----w   C:\Program Files\Tlen.pl
2007-05-19 10:42:17   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\BearShare
2007-05-17 21:34:46   50,748   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-17 21:34:46   358,702   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-05-16 21:19:17   --------   d-----w   C:\Program Files\Common Files\G DATA
2007-05-16 21:12:34   --------   d-----w   C:\Program Files\VS Online
2007-05-12 20:52:33   --------   d-----w   C:\Program Files\SAGEM
2007-05-12 11:30:48   --------   d-----w   C:\Program Files\Jasc Software Inc
2007-05-11 14:37:17   --------   d-----w   C:\Program Files\PestPatrol
2007-04-28 13:35:34   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2007-04-28 13:35:26   88   --sh--r   C:\WINDOWS\system32\9687AD0F78.sys
2007-04-27 21:29:54   --------   d-----w   C:\Program Files\Gadu-Gadu
2007-04-22 22:06:03   --------   d-----w   C:\Program Files\QuickTime
2007-04-22 22:01:13   --------   d-----w   C:\Program Files\Messenger
2007-04-22 21:59:12   --------   d-----w   C:\Program Files\Lexmark 2200 Series
2007-04-22 21:48:22   --------   d-----w   C:\Program Files\Common Files\LightScribe
2007-04-22 21:23:27   --------   d-----w   C:\Program Files\Winamp
2007-04-22 14:21:41   --------   d-----w   C:\Program Files\Torrent Master
2007-03-30 20:55:07   --------   d-----w   C:\Program Files\Windows Media Connect 2
2007-03-29 16:03:47   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\DivX
2007-03-29 16:02:51   --------   d-----w   C:\Program Files\RADVideo
2007-03-28 16:48:09   --------   d-----w   C:\Program Files\Codec
2007-03-21 13:37:41   --------   d-----w   C:\Program Files\GreatMemo
2007-03-18 15:42:37   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Corel
2007-03-17 13:45:36   293,376   ----a-w   C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:38:47   579,072   ----a-w   C:\WINDOWS\system32\user32.dll
2007-03-08 15:38:47   40,960   ----a-w   C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:38:47   281,600   ----a-w   C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:37:33   1,843,840   ----a-w   C:\WINDOWS\system32\win32k.sys
2007-03-07 18:20:04   --------   d-----w   C:\Program Files\Shareaza
2007-02-05 20:19:48   185,856   ----a-w   C:\WINDOWS\system32\upnphost.dll


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{3873A5A5-C3F8-4830-ABF5-9C83C8347B09}=C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2006-08-30 18:44 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2006-08-03 15:53 C:\WINDOWS\system32\VTTimer.exe]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2005-09-06 05:10]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03]
"Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 15:34]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-18 21:43]
"PestPatrol Control Center"="C:\PROGRA~1\PESTPA~1\PPControl.exe" [2004-11-15 11:49]
"PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2004-04-02 15:11]
"CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2005-01-10 09:35]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-09-26 16:49]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" []
"USB Storage Toolbox"="C:\Program Files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 21:44]
"DAEMON Tools-1033"="E:\Program Files\Demon\daemon.exe" [2004-08-22 18:05]
"BDMCon"="C:\Program Files\Softwin\BitDefender8\bdmcon.exe" [2005-06-20 12:10]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-05-09 12:19]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]
"Skype"="E:\Skype\Phone\Skype.exe" [2006-07-21 13:16]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-19 17:43]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Bhro"="C:\PROGRA~1\CROSOF~1.NET\alg.exe" -vt ndrv
"<NO NAME>"=C:\WINDOWS\ECURIT~1\WWEXEC~1.EXE
"Myfjwvt"=C:\Program Files\Common Files\?asks\w?wexec.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"="C:\Program Files\Trend Micro\Tmas\sshook.dll" [2006-06-03 13:36]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 
WudfServiceGroup   WUDFSvc 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
   

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-20 11:43:13
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-20 11:43:39
C:\ComboFix-quarantined-files.txt ... 2007-05-19 21:45
C:\ComboFix2.txt ... 2007-05-19 21:45


   --- E O F ---


Czysto już?

[wojtas]

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

skasuj wpis w hijacku i pogrubiony do kosza

C:\QUIZPG2.BAT
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Bhro"=-
"<NO NAME>"=-
"Myfjwvt"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[Mojwa92]

Ok, dzięki wielkie!

Dla pewności log z hijacka:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 12:33:18, on 2007-05-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Mojwa\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/english
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Easy Gif Animator Toolbar Helper - {3873A5A5-C3F8-4830-ABF5-9C83C8347B09} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O3 - Toolbar: Easy Gif Animator Toolbar - {8AAE1BCA-A973-423F-9232-7007D8CED2C7} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{76CDCA55-3860-4F96-8E76-5C6D63360A67}: NameServer = 194.204.159.1,193.110.120.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



I combo:

Kod: Zaznacz wszystko

"Mojwa" - 2007-05-20 12:33:55    Dodatek Service Pack 2 
ComboFix 07-05.19.5.V - Running from: "C:\Documents and Settings\Mojwa\Pulpit\"



(((((((((((((((((((((((((((((((   Files Created from 2007-04-05 to 2007-05-20  ))))))))))))))))))))))))))))))))))


2007-05-20 11:36   <DIR>   d--hs----   C:\WINDOWS\CSC
2007-05-20 11:31   <DIR>   d--------   C:\WINDOWS\pss
2007-05-20 11:28   <DIR>   d--------   C:\avenger
2007-05-19 22:05   <DIR>   d--------   C:\Program Files\MarBit
2007-05-19 21:45   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-05-19 21:11   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-05-19 20:21   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-05-19 20:21   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-05-19 20:21   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-05-08 10:52   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Opera
2007-05-04 11:16   262,144   --a------   C:\DOCUME~1\oem\ntuser.dat
2007-04-28 12:08   7,552   --a------   C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-04-28 10:13   14   --a------   C:\DOCUME~1\Mojwa\getfile.dat
2007-04-24 19:32   <DIR>   d--------   C:\DOCUME~1\Mojwa\DANEAP~1\Gadu-Gadu
2007-04-22 23:51   14   --a------   C:\WINDOWS\system32\getfile.dat
2007-04-22 15:28   <DIR>   d--------   C:\WINDOWS\speech
2007-04-22 14:49   <DIR>   d--------   C:\Program Files\Common Files\Skype
2007-04-22 14:49   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-04-22 14:48   <DIR>   d--------   C:\Program Files\Skype


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2060-08-18 17:02:22   1,496,064   ------w   C:\WINDOWS\system32\CC3250MT.DLL
2060-08-18 16:40:44   909,824   ------w   C:\WINDOWS\system32\CP3245MT.DLL
2060-08-18 16:40:44   24,064   ------w   C:\WINDOWS\system32\BORLNDMM.DLL
2007-05-20 09:49:11   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Skype
2007-05-20 09:39:29   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\GreatMemo
2007-05-20 09:27:18   --------   d-----w   C:\Program Files\BearShare Applications
2007-05-19 18:20:27   --------   d-----w   C:\Program Files\Tlen.pl
2007-05-19 10:42:17   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\BearShare
2007-05-17 21:34:46   50,748   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-17 21:34:46   358,702   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-05-16 21:19:17   --------   d-----w   C:\Program Files\Common Files\G DATA
2007-05-16 21:12:34   --------   d-----w   C:\Program Files\VS Online
2007-05-12 20:52:33   --------   d-----w   C:\Program Files\SAGEM
2007-05-12 11:30:48   --------   d-----w   C:\Program Files\Jasc Software Inc
2007-05-11 14:37:17   --------   d-----w   C:\Program Files\PestPatrol
2007-04-28 13:35:34   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2007-04-28 13:35:26   88   --sh--r   C:\WINDOWS\system32\9687AD0F78.sys
2007-04-27 21:29:54   --------   d-----w   C:\Program Files\Gadu-Gadu
2007-04-22 22:06:03   --------   d-----w   C:\Program Files\QuickTime
2007-04-22 22:01:13   --------   d-----w   C:\Program Files\Messenger
2007-04-22 21:59:12   --------   d-----w   C:\Program Files\Lexmark 2200 Series
2007-04-22 21:48:22   --------   d-----w   C:\Program Files\Common Files\LightScribe
2007-04-22 21:23:27   --------   d-----w   C:\Program Files\Winamp
2007-04-22 14:21:41   --------   d-----w   C:\Program Files\Torrent Master
2007-03-30 20:55:07   --------   d-----w   C:\Program Files\Windows Media Connect 2
2007-03-29 16:03:47   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\DivX
2007-03-29 16:02:51   --------   d-----w   C:\Program Files\RADVideo
2007-03-28 16:48:09   --------   d-----w   C:\Program Files\Codec
2007-03-21 13:37:41   --------   d-----w   C:\Program Files\GreatMemo
2007-03-18 15:42:37   --------   d-----w   C:\DOCUME~1\Mojwa\DANEAP~1\Corel
2007-03-17 13:45:36   293,376   ----a-w   C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:38:47   579,072   ----a-w   C:\WINDOWS\system32\user32.dll
2007-03-08 15:38:47   40,960   ----a-w   C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:38:47   281,600   ----a-w   C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:37:33   1,843,840   ----a-w   C:\WINDOWS\system32\win32k.sys
2007-03-07 18:20:04   --------   d-----w   C:\Program Files\Shareaza
2007-02-05 20:19:48   185,856   ----a-w   C:\WINDOWS\system32\upnphost.dll


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{3873A5A5-C3F8-4830-ABF5-9C83C8347B09}=C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2006-08-30 18:44 C:\WINDOWS\system32\VTTrayp.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 15:34]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-18 21:43]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-09-26 16:49]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" []
"USB Storage Toolbox"="C:\Program Files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 21:44]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-19 17:43]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=C:\WINDOWS\ECURIT~1\WWEXEC~1.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"="C:\Program Files\Trend Micro\Tmas\sshook.dll" [2006-06-03 13:36]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk
backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Trend Micro Anti-Spyware.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Trend Micro Anti-Spyware.lnk
backup=C:\WINDOWS\pss\Trend Micro Anti-Spyware.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mojwa^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Mojwa\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mojwa^Menu Start^Programy^Autostart^GreatMemo.lnk]
path=C:\Documents and Settings\Mojwa\Menu Start\Programy\Autostart\GreatMemo.lnk
backup=C:\WINDOWS\pss\GreatMemo.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mojwa^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk]
path=C:\Documents and Settings\Mojwa\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk
backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ]
C:\PROGRA~1\Wapster\AQQ\AQQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
"C:\Program Files\Softwin\BitDefender8\bdmcon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDNewsAgent]
"C:\Program Files\Softwin\BitDefender8\bdnagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CookiePatrol]
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"E:\Program Files\Demon\daemon.exe"  -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PestPatrol Control Center]
C:\PROGRA~1\PESTPA~1\PPControl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPMemCheck]
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"E:\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 
WudfServiceGroup   WUDFSvc 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
   

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-20 12:35:03
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-20 12:35:24
C:\ComboFix-quarantined-files.txt ... 2007-05-19 21:45
C:\ComboFix2.txt ... 2007-05-20 11:43
C:\ComboFix3.txt ... 2007-05-19 21:45


   --- E O F ---


Teraz wszystko jest w porządku?

[wojtas]

start>uruchom>regedit>przejdz do klucza;

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

i skasuj z prawokliku:

<NO NAME>