komputer zwalnia -> abebot -> log z hijacka

[DaGGerinho]

Witam mam problem z komputerem. Od pewnego czasu zaczął strasznie mulić a pingi w grach zwiększyły się znacznie. NOD32 wykrywał mi 2 potencjalne wirusy
Abebot i Trojan Downloader jednak żadnego z nich nie potrafił dodać do kwarantanny ani usunąć ;[ o to logi z HiJack-a

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:48, on 2008-04-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
E:\Program Files\DAP\DAP.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Winamp\Winamp.exe
C:\Documents and Settings\Krzysiek\Pulpit\pulpit\etminpro.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {C67AB21D-46D8-4C4A-97DF-FFACE77C0807} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "E:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [EdHTML] D:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Fraps] D:\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Clean Traces - E:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - E:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - E:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: urqOIbXR - urqOIbXR.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9340 bytes

Oprócz tego S&D zaczął mi wykrywać bardzo dużo Spywaru =[
Proszę o szybką pomoc!
Pozdrawiam

[ Dodano: Dzisiaj o 17:40 ]
Pomoże ktoś? ((((((

[ Dodano: Dzisiaj o 17:42 ]
Dodam także iż ani Combofix ani SDfix nie usunęły tego wirusa=\

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[DaGGerinho]

ComboFix

ComboFix 08-04-16.5 - Krzysiek 2008-04-17 22:52:22.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.565 [GMT 2:00]
Running from: E:\fragmovi\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Krzysiek\Pulpitblackbird.jpg
C:\Documents and Settings\Krzysiek\PulpitEditorFKWP1.5.exe
C:\Documents and Settings\Krzysiek\PulpitEditorFKWP2.0.exe
C:\Documents and Settings\Krzysiek\Pulpitfilemanagerclient.exe
C:\Documents and Settings\Krzysiek\Pulpitfkwp1.5.exe
C:\Documents and Settings\Krzysiek\Pulpitfkwp2.0.exe
C:\Documents and Settings\Krzysiek\Pulpitfwebd.exe
C:\Documents and Settings\Krzysiek\PulpitFWebdEditor.exe
C:\Documents and Settings\Krzysiek\PulpitTrojan.Win32.BlackBird.exe
C:\Documents and Settings\Krzysiek\Pulpitvirii
C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program Files\PC-Cleaner

.
((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))
.

2008-04-17 10:53 . 2008-04-17 11:04 <DIR> d-------- C:\Program Files\SkanerOnline
2008-04-13 23:16 . 2008-04-13 23:16 <DIR> d-------- C:\Program Files\Reflex
2008-04-10 20:22 . 2008-04-13 21:47 <DIR> d-------- C:\WINDOWS\system32\svcdll
2008-04-09 23:09 . 2008-04-09 23:09 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-04-06 21:58 . 2008-04-06 21:58 550,418 --a------ C:\WINDOWS\system32\x264vfw.dll
2008-04-06 10:05 . 2008-04-12 21:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 10:05 . 2008-04-06 10:05 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-03 01:26 . 2008-04-03 01:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-03-31 19:35 . 2008-03-31 19:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-03-29 18:18 . 2008-03-29 18:18 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-29 18:18 . 2008-03-29 18:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-03-29 18:08 . 2008-03-29 18:08 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Grisoft
2008-03-28 22:29 . 2008-03-28 22:29 93 --a------ C:\WINDOWS\wininit.ini
2008-03-28 20:39 . 2008-03-28 20:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-28 20:39 . 2008-03-28 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-03-28 19:50 . 2008-03-28 19:50 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-28 18:48 . 2008-04-17 22:49 <DIR> d-------- C:\SDFix
2008-03-28 18:37 . 2008-03-28 18:37 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\Grisoft
2008-03-28 18:37 . 2008-03-28 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-03-28 18:37 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-28 18:28 . 2008-03-28 18:28 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Program Files\Symantec
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-03-28 18:26 . 2007-03-21 21:39 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2008-03-28 17:32 . 2008-03-28 17:32 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-28 15:04 . 2008-03-28 15:04 <DIR> d-------- C:\Program Files\LimeWire
2008-03-27 23:04 . 2008-03-27 23:04 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-03-23 17:35 . 2008-03-23 17:35 <DIR> d---s---- C:\Documents and Settings\user\UserData
2008-03-23 13:11 . 2008-03-23 13:11 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-03-22 17:58 . 2008-03-22 17:59 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\Autodesk
2008-03-22 17:55 . 2008-03-22 17:55 231 --a------ C:\WINDOWS\system32\3dsmax.ini
2008-03-22 17:55 . 2008-03-22 17:55 43 --a------ C:\WINDOWS\system32\InstallSettings.ini
2008-03-22 17:54 . 2008-03-27 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-03-22 17:53 . 2008-03-22 17:55 <DIR> d-------- C:\Program Files\Autodesk
2008-03-18 20:29 . 2008-03-18 20:33 <DIR> d-------- C:\Program Files\Pitagoras 2000 Demo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 20:52 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype
2008-04-17 20:51 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-04-17 20:51 --------- d-----w C:\Program Files\Steam
2008-04-17 20:34 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\mIRC
2008-04-17 20:03 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\teamspeak2
2008-04-17 14:23 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-17 14:23 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-17 07:47 --------- d-----w C:\Program Files\Xfire
2008-04-15 21:02 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Xfire
2008-04-15 13:36 --------- d-----w C:\Program Files\Cell Phone Manager
2008-04-02 16:20 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Azureus
2008-04-01 20:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-29 17:46 --------- d-----w C:\Program Files\Gadu-Gadu
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 17:56 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Apple Computer
2008-03-12 15:20 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\BSplayer
2008-03-07 21:33 --------- d-----w C:\Program Files\Tibia
2008-03-06 16:59 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Tibia
2008-03-04 13:57 --------- d-----w C:\Program Files\Apple Software Update
2008-03-04 13:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-04 13:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-01 11:43 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Tibia
2008-02-25 14:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-25 14:06 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\InstallShield
2008-02-22 23:40 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\mIRC
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-17 12:29 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\4 cdrom
2008-02-17 11:53 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\4 cdrom
2008-02-17 11:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Time Dead Warn Default
2008-02-17 11:49 --------- d-----w C:\Documents and Settings\ajka\Dane aplikacji\4 cdrom
2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-19 21:58 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2007-10-28 00:18 519,259 --sha-w C:\WINDOWS\system32\drivers\firefox.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C67AB21D-46D8-4C4A-97DF-FFACE77C0807}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-17 03:49 23224104]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"EdHTML"="D:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 17:38 1443328]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-28 16:27 1271032]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"mrvylhby"="C:\WINDOWS\system32\gfwvyvkr.exe" [ ]
"Fraps"="D:\FRAPS\FRAPS.EXE" [2008-01-14 14:53 913064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 07:04 847872]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4.exe" [2006-07-13 08:12 729088]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21 54832]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"DownloadAccelerator"="E:\Program Files\DAP\DAP.exe" [2008-01-19 23:58 4576768]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-04-03 01:25:58 2987856]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 17:23:32 74308]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqOIbXR]
urqOIbXR.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"D:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"E:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Documents and Settings\\Krzysiek\\Ustawienia lokalne\\Dane aplikacji\\Evolutions-XML.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\Steam\\SteamApps\\mateusz_kukat\\counter-strike\\hl.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"D:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"D:\\cod\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15944:TCP"= 15944:TCP:NortonAV
"15006:TCP"= 15006:TCP:NortonAV

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-17 20:00:00 C:\WINDOWS\Tasks\A5888F03918F3F77.job"
- c:\docume~1\krzysiek\daneap~1\4cdrom~1\Global This Base.exe
"2008-04-17 20:00:00 C:\WINDOWS\Tasks\A9AAD598912D4FE0.job"
- c:\docume~1\ajka\daneap~1\4cdrom~1\Global This Base.exe
"2008-04-17 20:00:00 C:\WINDOWS\Tasks\AADD253E90CED9BA.job"
- c:\docume~1\user\daneap~1\4cdrom~1\Global This Base.exe
"2008-04-01 09:31:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 22:53:20
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-04-17 22:54:00
ComboFix-quarantined-files.txt 2008-04-17 20:53:50

Pre-Run: 1,826,643,968 bajtów wolnych
Post-Run: 1,833,684,992 bajtów wolnych
.
2008-04-11 22:20:56 --- E O F ---

SDFix

SDFix: Version 1.171
Run by Krzysiek on 2008-04-17 at 22:43

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 22:47:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg41]

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120% (Trial Version)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"="C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
"D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET"
"D:\\Program Files\\Azureus\\Azureus.exe"="D:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"D:\\Program Files\\mIRC\\mirc.exe"="D:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Disabled:Nero Home"
"E:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="E:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\Documents and Settings\\Krzysiek\\Ustawienia lokalne\\Dane aplikacji\\Evolutions-XML.exe"="C:\\Documents and Settings\\Krzysiek\\Ustawienia lokalne\\Dane aplikacji\\Evolutions-XML.exe:*:Enabled:Evolutions-XML"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\Documents and Settings\\Krzysiek\\Pulpit\\TibiCAM_8.0\\TibiCAM\\TibiCAM.exe"="C:\\Documents and Settings\\Krzysiek\\Pulpit\\TibiCAM_8.0\\TibiCAM\\TibiCAM.exe:*:Enabled:TibiCAM"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"="D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe:*:Enabled:Tony Hawk's American Wasteland"
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"="C:\\Program Files\\Autodesk\\Backburner\\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"="C:\\Program Files\\Autodesk\\Backburner\\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"="C:\\Program Files\\Autodesk\\Backburner\\server.exe:*:Enabled:backburner 2.3 server"
"C:\\Program Files\\Steam\\SteamApps\\mateusz_kukat\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\mateusz_kukat\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"="C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe:*:Enabled:Autodesk 3ds Max 2008 32-bit"
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"
"D:\\Program Files\\VentSrv\\ventrilo_srv.exe"="D:\\Program Files\\VentSrv\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"D:\\cod\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="D:\\cod\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:iw3mp"
"E:\\fragmovi\\mousestuff_pl\\mousestuff\\Tools\\damned\\TheDamned.exe"="E:\\fragmovi\\mousestuff_pl\\mousestuff\\Tools\\damned\\TheDamned.exe:*:Enabled:TheDamned"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Onet.pl - Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 10 Feb 2006 560,640 A.SH. --- "C:\Program Files\Cell Phone Manager\MobCfg.dll"
Fri 10 Feb 2006 614,400 A.SH. --- "C:\Program Files\Cell Phone Manager\MobSvr.exe"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 17 Sep 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 28 Oct 2007 519,259 A.SH. --- "C:\WINDOWS\system32\drivers\firefox.exe"
Mon 24 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 2 Nov 2007 2,222,592 A.SH. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Dane aplikacji\Evolutions-XML.exe"

Finished!

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:59:51, on 2008-04-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {C67AB21D-46D8-4C4A-97DF-FFACE77C0807} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "E:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [EdHTML] D:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [mrvylhby] C:\WINDOWS\system32\gfwvyvkr.exe
O4 - HKCU\..\Run: [Fraps] D:\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Clean Traces - E:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - E:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - E:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BA287B4-607A-432E-8A24-2926DC3374BD}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: urqOIbXR - urqOIbXR.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9186 bytes

Zrobione
Jest coś złego w tych logach jeszcze?

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\Tasks\A5888F03918F3F77.job
C:\WINDOWS\Tasks\A9AAD598912D4FE0.job
C:\WINDOWS\Tasks\AADD253E90CED9BA.job
C:\WINDOWS\system32\drivers\firefox.exe

Folder::
C:\WINDOWS\system32\svcdll
C:\Documents and Settings\All Users\Dane aplikacji\Time Dead Warn Default
C:\Documents and Settings\user\Dane aplikacji\4 cdrom
C:\Documents and Settings\Krzysiek\Dane aplikacji\4 cdrom
C:\Documents and Settings\ajka\Dane aplikacji\4 cdrom

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqOIbXR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mrvylhby"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[DaGGerinho]

ComboFix + CFScript

ComboFix 08-04-16.5 - Krzysiek 2008-04-18 12:43:05.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.556 [GMT 2:00]
Running from: E:\fragmovi\ComboFix.exe
Command switches used :: E:\fragmovi\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\drivers\firefox.exe
C:\WINDOWS\Tasks\A5888F03918F3F77.job
C:\WINDOWS\Tasks\A9AAD598912D4FE0.job
C:\WINDOWS\Tasks\AADD253E90CED9BA.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\ajka\Dane aplikacji\4 cdrom
C:\Documents and Settings\ajka\Dane aplikacji\4 cdrom\0
C:\Documents and Settings\All Users\Dane aplikacji\Time Dead Warn Default
C:\Documents and Settings\Krzysiek\Dane aplikacji\4 cdrom
C:\Documents and Settings\Krzysiek\Dane aplikacji\4 cdrom\0
C:\Documents and Settings\user\Dane aplikacji\4 cdrom
C:\Documents and Settings\user\Dane aplikacji\4 cdrom\0
C:\WINDOWS\system32\drivers\firefox.exe
C:\WINDOWS\system32\svcdll
C:\WINDOWS\system32\svcdll\BCAIBBAJEAJGI.dll
C:\WINDOWS\system32\svcdll\BCAIBBBCFGDFJ.dll
C:\WINDOWS\system32\svcdll\BCAIBBBFHBHFA.dll
C:\WINDOWS\system32\svcdll\BCAIBBCFBJDED.dll
C:\WINDOWS\system32\svcdll\BCAIBBDACDEGI.dll
C:\WINDOWS\system32\svcdll\BCAIBBFBBJEDH.dll
C:\WINDOWS\system32\svcdll\BCAIBBFEBICIB.dll
C:\WINDOWS\system32\svcdll\BCAIBBFHBHBCF.dll
C:\WINDOWS\system32\svcdll\BCAIBBGABFJGI.dll
C:\WINDOWS\system32\svcdll\BCAIBBGDBEIBC.dll
C:\WINDOWS\Tasks\A5888F03918F3F77.job
C:\WINDOWS\Tasks\A9AAD598912D4FE0.job
C:\WINDOWS\Tasks\AADD253E90CED9BA.job

.
((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.

2008-04-17 10:53 . 2008-04-17 11:04 <DIR> d-------- C:\Program Files\SkanerOnline
2008-04-13 23:16 . 2008-04-13 23:16 <DIR> d-------- C:\Program Files\Reflex
2008-04-09 23:09 . 2008-04-09 23:09 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-04-06 21:58 . 2008-04-06 21:58 550,418 --a------ C:\WINDOWS\system32\x264vfw.dll
2008-04-06 10:05 . 2008-04-12 21:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 10:05 . 2008-04-06 10:05 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-03 01:26 . 2008-04-03 01:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-03-31 19:35 . 2008-03-31 19:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-03-29 18:18 . 2008-03-29 18:18 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-29 18:18 . 2008-03-29 18:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-03-29 18:08 . 2008-03-29 18:08 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Grisoft
2008-03-28 22:29 . 2008-03-28 22:29 93 --a------ C:\WINDOWS\wininit.ini
2008-03-28 20:39 . 2008-03-28 20:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-28 20:39 . 2008-03-28 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-03-28 19:50 . 2008-03-28 19:50 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-28 18:48 . 2008-04-17 22:49 <DIR> d-------- C:\SDFix
2008-03-28 18:37 . 2008-03-28 18:37 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\Grisoft
2008-03-28 18:37 . 2008-03-28 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-03-28 18:37 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-28 18:28 . 2008-03-28 18:28 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Program Files\Symantec
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-28 18:26 . 2008-03-28 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-03-28 18:26 . 2007-03-21 21:39 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2008-03-28 17:32 . 2008-03-28 17:32 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-28 15:04 . 2008-03-28 15:04 <DIR> d-------- C:\Program Files\LimeWire
2008-03-27 23:04 . 2008-03-27 23:04 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-03-23 17:35 . 2008-03-23 17:35 <DIR> d---s---- C:\Documents and Settings\user\UserData
2008-03-23 13:11 . 2008-03-23 13:11 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-03-22 17:58 . 2008-03-22 17:59 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\Autodesk
2008-03-22 17:55 . 2008-03-22 17:55 231 --a------ C:\WINDOWS\system32\3dsmax.ini
2008-03-22 17:55 . 2008-03-22 17:55 43 --a------ C:\WINDOWS\system32\InstallSettings.ini
2008-03-22 17:54 . 2008-03-27 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-03-22 17:53 . 2008-03-22 17:55 <DIR> d-------- C:\Program Files\Autodesk
2008-03-18 20:29 . 2008-03-18 20:33 <DIR> d-------- C:\Program Files\Pitagoras 2000 Demo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 10:40 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-04-18 10:40 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype
2008-04-18 10:39 --------- d-----w C:\Program Files\Steam
2008-04-17 20:34 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\mIRC
2008-04-17 20:03 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\teamspeak2
2008-04-17 14:23 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-17 14:23 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-17 07:47 --------- d-----w C:\Program Files\Xfire
2008-04-15 21:02 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Xfire
2008-04-15 13:36 --------- d-----w C:\Program Files\Cell Phone Manager
2008-04-02 16:20 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Azureus
2008-04-01 20:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-29 17:46 --------- d-----w C:\Program Files\Gadu-Gadu
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 17:56 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Apple Computer
2008-03-12 15:20 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\BSplayer
2008-03-07 21:33 --------- d-----w C:\Program Files\Tibia
2008-03-06 16:59 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Tibia
2008-03-04 13:57 --------- d-----w C:\Program Files\Apple Software Update
2008-03-04 13:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-04 13:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-01 11:43 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Tibia
2008-02-25 14:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-25 14:06 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\InstallShield
2008-02-22 23:40 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\mIRC
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-19 21:58 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
.

((((((((((((((((((((((((((((( snapshot@2008-04-17_22.53.40.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-17 20:46:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-18 10:38:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-17 03:49 23224104]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"EdHTML"="D:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 17:38 1443328]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-28 16:27 1271032]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"Fraps"="D:\FRAPS\FRAPS.EXE" [2008-01-14 14:53 913064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 07:04 847872]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4.exe" [2006-07-13 08:12 729088]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21 54832]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"DownloadAccelerator"="E:\Program Files\DAP\DAP.exe" [2008-01-19 23:58 4576768]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-04-03 01:25:58 2987856]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 17:23:32 74308]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"D:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"E:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Documents and Settings\\Krzysiek\\Ustawienia lokalne\\Dane aplikacji\\Evolutions-XML.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\Steam\\SteamApps\\mateusz_kukat\\counter-strike\\hl.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"D:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"D:\\cod\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15944:TCP"= 15944:TCP:NortonAV
"15006:TCP"= 15006:TCP:NortonAV

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-01 09:31:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 12:44:29
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-04-18 12:45:14
ComboFix-quarantined-files.txt 2008-04-18 10:45:03
ComboFix2.txt 2008-04-17 20:54:01

Pre-Run: 5,622,136,832 bajtów wolnych
Post-Run: 5,611,302,912 bajtów wolnych
.
2008-04-11 22:20:56 --- E O F ---

[/quote]

[wojtas]

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

[DaGGerinho]

Ok zrobiłem wszystko co kazałeś Dzięki za pomoc
Pozdrawiam

Autor postu otrzymał pochwałę