męczacy wirus udający windows security system

[kasiulks]

bardzo proszę o sprawdzenie loga, ponieważ od wczoraj zaczęły mi wyskakiwać informacje typu że ktoś mi probuje zainfekować mojego pcta lub coś podobnego i żebym zainstalowała jakiś tam program. Coś mniej więcej takiego mi wychodzi. I co jakiś czas pokazuje mi się okienko udające te windowsowe z napisem windows security system z informacją, że mam trojana i abym przeskanowała i usunęła ten program teraz ( i są inf gdzie mam kliknąć, ile to potrwa i w ogole ) po ang wszystko jest nap.

a oto mój log:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:55:48, on 2008-06-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\444.0
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
c:\usr\MYSQL\bin\mysqld.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\portsv.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/search/index.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://o2.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {56A17A10-C7E9-4FD1-B890-6747264EE5B6} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [e-Kiosk] "C:\Program Files\e-Kiosk Reader\eGazetaST.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /scan
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kas\Menu Start\Programy\IMVU\Run IMVU.lnk
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206133173281
O16 - DPF: {A6916797-7ABD-4F07-93AE-098B6F543129} (CO2Player Class) - http://www.lemontv.pl/lmctrlp.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_38.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player Word Games) - http://67.15.101.3/g_bin/pl/wordssingle_2_0_0_34.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70F6FA4F-857B-4A33-ACC9-D751C8CEBED3}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBBEA0E6-3BA9-4A9F-9158-7DADD2C8991C}: NameServer = 69.50.166.94,69.31.80.244
O20 - AppInit_DLLs: wbsys.dll ?????????
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.0.exe (file missing)
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O24 - Desktop Component 0: (no name) - http://img16.echo.cx/img16/6231/mojalinia1by.png

--
End of file - 13994 bytes


z góry dziekuję. Męcze się juz troche nad tym i nic.

[Okocza]

Ściągnij program Fixwareout i zastosuj go

C:\WINDOWS\444.0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/search/index.html?src=ssb
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {56A17A10-C7E9-4FD1-B890-6747264EE5B6} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)

to fixujesz w hj + log z combofixa + skan smitfraudfix.

Autor postu otrzymał pochwałę

[kasiulks]

dziekuje bardzo, wszystko z powrotem jest normalne

[wojtas]

daj nowe logi z hijacka i combofixa

[kasiulks]

hmm że tez się chce komuś to czytać

combo:

Kod: Zaznacz wszystko

ComboFix 08-06-08.8 - Kas 2008-06-09 20:29:18.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.351 [GMT 2:00]
Running from: C:\Documents and Settings\Kas\Pulpit\sciagane\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\toolbar888\

.
(((((((((((((((((((((((((   Files Created from 2008-05-09 to 2008-06-09  )))))))))))))))))))))))))))))))
.

2008-06-09 18:11 . 2008-06-09 18:11   <DIR>   d----c---   C:\fixwareout
2008-06-09 18:01 . 2008-06-09 18:01   <DIR>   d--------   C:\Documents and Settings\Kasiuť
2008-06-09 17:52 . 2008-06-09 17:52   <DIR>   d--------   C:\WINDOWS\system32\2729
2008-06-09 17:15 . 2008-06-09 17:34   3,166   --a------   C:\WINDOWS\system32\tmp.reg
2008-06-09 17:14 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-06-09 17:14 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-06-09 17:14 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\404Fix.exe
2008-06-09 17:14 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-06-09 17:14 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-06-09 17:14 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 15:55 . 2008-06-09 15:55   <DIR>   d--------   C:\Program Files\Trend Micro
2008-06-09 13:50 . 2008-06-09 13:50   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Teleca
2008-06-09 13:49 . 2008-06-09 13:49   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Sony Ericsson
2008-06-08 22:41 . 2008-06-09 17:43   <DIR>   d--------   C:\WINDOWS\system32\6715
2008-06-08 22:41 . 2008-06-08 22:41   55,808   --a------   C:\WINDOWS\portsv.exe
2008-06-08 21:56 . 2008-06-08 21:56   55,564   --a------   C:\WINDOWS\FontData.fdb
2008-06-08 21:42 . 2008-06-08 21:42   <DIR>   d--------   C:\WINDOWS\system32\vntiho06
2008-06-08 21:42 . 2008-06-08 21:43   <DIR>   d--------   C:\WINDOWS\system32\izo
2008-06-08 21:41 . 2008-06-08 21:41   <DIR>   dr-------   C:\Documents and Settings\LocalService\Ulubione
2008-06-08 21:41 . 2008-06-08 21:41   87,511   --a------   C:\WINDOWS\system32\iftuyszv.exe
2008-06-08 21:41 . 2008-06-08 21:41   49,158   --a------   C:\WINDOWS\444.0
2008-06-08 21:23 . 2008-06-09 18:40   2,516   --ahs----   C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys
2008-06-08 21:23 . 2008-06-09 18:40   88   -r-hs----   C:\Documents and Settings\All Users\Dane aplikacji\[u]0[/u]35A723127.sys
2008-06-08 21:16 . 2008-06-08 21:16   <DIR>   d--------   C:\Program Files\Common Files\Protexis
2008-06-08 21:10 . 2008-06-08 21:10   <DIR>   d--------   C:\Program Files\Common Files\Corel
2008-06-08 21:07 . 2008-06-08 21:07   <DIR>   d--------   C:\Program Files\Corel
2008-06-08 18:14 . 2008-06-08 18:14   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-06-08 18:02 . 2008-06-08 18:02   <DIR>   d--------   C:\Program Files\Bonjour
2008-06-08 17:49 . 2008-06-08 17:49   <DIR>   d--------   C:\Program Files\Common Files\Macrovision Shared
2008-06-08 14:56 . 2008-06-08 18:19   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-06-08 14:56 . 2008-06-08 14:56   1,409   --a------   C:\WINDOWS\QTFont.for
2008-06-08 08:48 . 2008-06-08 08:48   <DIR>   d--------   C:\WINDOWS\Adobe Illustrator CS
2008-06-06 13:53 . 2008-06-06 13:53   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Media Player Classic
2008-06-06 13:53 . 2008-01-10 14:15   755,027   --a------   C:\WINDOWS\system32\xvidcore.dll
2008-06-06 13:53 . 2008-03-31 23:25   682,496   --a------   C:\WINDOWS\system32\divx.dll
2008-06-06 13:53 . 2006-09-24 17:11   389,120   --a------   C:\WINDOWS\system32\lameACM.acm
2008-06-06 13:53 . 2004-01-25 18:18   217,088   --a------   C:\WINDOWS\system32\yv12vfw.dll
2008-06-06 13:53 . 2008-01-10 14:16   159,839   --a------   C:\WINDOWS\system32\xvidvfw.dll
2008-06-06 13:53 . 2007-09-21 02:52   118,784   --a------   C:\WINDOWS\system32\ac3acm.acm
2008-06-06 13:53 . 2008-03-21 22:28   81,920   --a------   C:\WINDOWS\system32\dpl100.dll
2008-06-06 13:53 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-06-06 13:53 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-06-06 13:53 . 2007-10-03 17:03   414   --a------   C:\WINDOWS\system32\lame_acm.xml
2008-06-06 13:52 . 2008-06-06 13:53   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-06-04 20:06 . 2008-06-04 20:06   <DIR>   d----c---   C:\totalcmdd
2008-06-04 18:10 . 2008-06-04 18:10   <DIR>   d--------   C:\Program Files\FreshWebmaster
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Program Files\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft
2008-06-02 23:42 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a--c---   C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-02 23:42 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2008-06-02 21:20 . 2008-06-02 21:20   30   --a------   C:\WINDOWS\iedit.INI
2008-05-30 23:17 . 2008-05-30 23:17   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2008-05-30 17:54 . 2008-05-30 20:25   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-05-20 23:05 . 2008-05-20 23:05   32,768   --a------   C:\WINDOWS\system32\vntiho06\vntiho061083.exe
2008-05-11 17:50 . 2008-05-13 11:12   <DIR>   d--------   C:\Program Files\DAEMON Tools Lite
2008-05-11 14:48 . 2004-04-30 09:37   160,640   --a------   C:\WINDOWS\system32\drivers\a347bus.sys
2008-05-11 14:48 . 2004-04-30 09:33   5,248   --a------   C:\WINDOWS\system32\drivers\a347scsi.sys
2008-05-10 20:27 . 2008-05-10 20:28   <DIR>   d--------   C:\Program Files\Disk Images
2008-05-09 15:31 . 2008-05-09 15:31   <DIR>   d--------   C:\Program Files\Mediafour
2008-05-09 07:32 . 2008-05-17 21:42   <DIR>   d--------   C:\Program Files\EA GAMES

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 16:17   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\OpenOffice.org2
2008-06-09 15:32   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\uTorrent
2008-06-09 15:09   ---------   d-----w   C:\Program Files\Odkurzacz
2008-06-09 13:59   ---------   d-----w   C:\Documents and Settings\Kasik\Dane aplikacji\OpenOffice.org2
2008-06-09 13:43   ---------   d-----w   C:\Program Files\Adware Away
2008-06-09 11:25   ---------   d-----w   C:\Program Files\SkanerOnline
2008-06-08 20:07   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\GanymedeNet
2008-06-08 19:23   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Corel
2008-06-08 19:16   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Corel
2008-06-08 16:02   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-06-08 06:51   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-05-21 01:00   ---------   d-----w   C:\Program Files\Microsoft Silverlight
2008-05-19 11:16   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\LimeWire
2008-05-17 19:46   ---------   d-----w   C:\Program Files\Maxis
2008-05-13 09:22   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Kingston
2008-05-11 08:23   ---------   d-----w   C:\Program Files\Tweak-XP Pro 4
2008-05-11 07:55   ---------   d-----w   C:\Program Files\Paragon Software
2008-05-07 15:25   ---------   d-----w   C:\Program Files\Wiedźmin
2008-05-07 15:24   ---------   d-----w   C:\Program Files\e-Kiosk Reader
2008-05-07 15:17   ---------   d-----w   C:\Program Files\Ontrack
2008-04-29 18:09   ---------   d-----w   C:\Program Files\Binboy
2008-04-19 21:24   ---------   d-----w   C:\Documents and Settings\Kasiuś\Dane aplikacji\OpenOffice.org2
2008-04-19 17:28   ---------   d-----w   C:\Program Files\Alcohol Soft
2008-04-18 20:23   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Teleca
2008-04-18 20:22   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Sony Ericsson
2008-04-18 18:42   ---------   d-----w   C:\Documents and Settings\Kasiuś\Dane aplikacji\Kingston
2008-03-25 04:52   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52   178,976   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-22 07:38   5,642   -csha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-21 20:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2007-12-25 18:10   192,544   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\antivirusinstallfreenm_en[1].exe
2007-12-02 18:10   150   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\wklnhst.dat
2006-06-24 06:03   0   -c-ha-w   C:\Program Files\Toolbar888
2006-06-20 06:07   14   -c--a-w   C:\Documents and Settings\Kas\getfile.dat
2006-05-31 08:56   14   -c--a-w   C:\Documents and Settings\Kasik\getfile.dat
2005-08-17 15:10   457   -c--a-w   C:\Program Files\INSTALL.LOG
2005-08-08 19:25   36   -c--a-w   C:\Documents and Settings\Kas\klextlock.dat
2005-05-31 12:50   36   -c--a-w   C:\Documents and Settings\Kasik\klextlock.dat
2004-10-01 13:00   40,960   -c--a-w   C:\Program Files\Uninstall_CDS.exe
2006-05-24 15:38   233,472   -c--a-w   C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 16:00   204,895   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41   77,824   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 15:59   426,081   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19   458,752   -c--a-w   C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35   139,264   -c--a-w   C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10   204,800   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42   106,496   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22   212,992   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21   167,936   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2007-09-21 14:55   88   --sha-r   C:\WINDOWS\system32\3821D0B0CB.sys
2006-02-24 22:46   56   -csha-r   C:\WINDOWS\system32\CBB0D02138.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 16:03 1957888]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 11:02 264704]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-12-18 15:20 401408]
"Search Defender"="C:\Program Files\Speeditup Free\SearchDefender.exe" [2007-08-02 02:54 541696]
"SpeedItUpEX"="C:\Program Files\Speeditup Free\SpeedItUp.exe" [2008-02-27 02:30 896000]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]
"EdHTML"="C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 17:38 1443328]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-30 21:10 344064]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"eTrustPPAP"="C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe" [2007-12-18 16:16 131072]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 14:48 69632 C:\WINDOWS\SOUNDMAN.EXE]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-21 19:25 180269]
"e-Kiosk"="C:\Program Files\e-Kiosk Reader\eGazetaST.exe" [2007-11-15 20:30 552448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-24 14:23 282624]
"PC-Checkup"="C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe" [2008-03-04 18:46 1500672]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 09:16 528384]
"atwtusb"="atwtusb.exe" [2006-09-18 11:25 303104 C:\WINDOWS\system32\ATWTUSB.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 14:00 44544]

C:\Documents and Settings\Kas\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-24 10:19:45 110592]

C:\Documents and Settings\Kasiu˜\Menu Start\Programy\Autostart\
OpenOffice.org 2.0.2.lnk - C:\Program Files\OpenOffice.org 2.0.2\program\quickstart.exe [2006-03-12 01:12:44 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 23:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a--c--- 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\system32\\ccapp.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Gadulec\\gg.exe"=
"C:\\totalcmd\\WINCMD32.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Soldat\\Soldat.exe"=
"C:\\usr\\SMTP Server\\localsrv.exe"=
"C:\\usr\\apache\\Apache.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\ESTsoft\\ALFTP\\ALFTP.exe"=
"C:\\totalcmdd\\TOTALCMD.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 04:17]
R0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdsk.sys [2004-09-28 04:00]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 PlugPlayRPC;Plug and Play (RPC);C:\WINDOWS\portsv.exe service []
R2 PSI_SVC_2;Protexis Licensing V2;"c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 11:15]
S1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51]
S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys []
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 10:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 10:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 10:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 10:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 10:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 10:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 10:51]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c647462a-f910-11dc-8233-00016cdbdd68}]
\Shell\AutoRun\command - J:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f743a044-25a5-11dd-8255-00016cdbdd68}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 20:33:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql]
"ImagePath"="c:\usr/MYSQL/bin/mysqld.exe"
.
Completion time: 2008-06-09 20:36:03
ComboFix-quarantined-files.txt  2008-06-09 18:35:54
ComboFix2.txt  2008-06-09 16:01:52

Pre-Run: 5,722,308,608 bajtów wolnych
Post-Run: 5,717,852,160 bajtów wolnych

239   --- E O F ---   2008-05-28 05:49:01


hj:

Kod: Zaznacz wszystko


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:40:02, on 2008-06-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
c:\usr\MYSQL\bin\mysqld.exe
C:\WINDOWS\portsv.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Speeditup Free\SearchDefender.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\OpenOffice.org 2.0.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0.2\program\soffice.BIN
C:\Program Files\Tlen.pl\tlen.exe
C:\Gadulec\gg.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search.php?sa=Search+Here&client=pub-4642981363251965&forid=1&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [e-Kiosk] "C:\Program Files\e-Kiosk Reader\eGazetaST.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [Search Defender] "C:\Program Files\Speeditup Free\SearchDefender.exe"
O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\Speeditup Free\SpeedItUp.exe -MINI
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [EdHTML] C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kas\Menu Start\Programy\IMVU\Run IMVU.lnk
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206133173281
O16 - DPF: {A6916797-7ABD-4F07-93AE-098B6F543129} (CO2Player Class) - http://www.lemontv.pl/lmctrlp.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_38.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player Word Games) - http://67.15.101.3/g_bin/pl/wordssingle_2_0_0_34.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70F6FA4F-857B-4A33-ACC9-D751C8CEBED3}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBBEA0E6-3BA9-4A9F-9158-7DADD2C8991C}: NameServer = 69.50.166.94,69.31.80.244
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 11301 bytes


[Okocza]

Ściągnij program Fixwareout i zastosuj go

cały czas masz fałszywe DNS'y w logu.

otwórz notatnik i wklej:

Kod: Zaznacz wszystko

Files::

C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\444.0
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\portsv.exe

Registry::

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c647462a-f910-11dc-8233-00016cdbdd68}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f743a044-25a5-11dd-8255-00016cdbdd68}]


Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Kod: Zaznacz wszystko

R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_38.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player Word Games) - http://67.15.101.3/g_bin/pl/wordssingle_2_0_0_34.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_23.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70F6FA4F-857B-4A33-ACC9-D751C8CEBED3}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBBEA0E6-3BA9-4A9F-9158-7DADD2C8991C}: NameServer = 69.50.166.94,69.31.80.244
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe


to w hijacku fixujesz

[Magik]

hmm że tez się chce komuś to czytać

jak nie ma smsow od ukochanej to sie czyta co sie da

na koniec zrob to

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem


chcialem cos napisac ale lowca postow juz to zrobil

[kasiulks]

po wszystkim prosze bardzo

Kod: Zaznacz wszystko

ComboFix 08-06-08.8 - Kas 2008-06-09 21:24:56.4 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.551 [GMT 2:00]
Running from: C:\Documents and Settings\Kas\Pulpit\sciagane\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kas\Pulpit\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\toolbar888\

.
(((((((((((((((((((((((((   Files Created from 2008-05-09 to 2008-06-09  )))))))))))))))))))))))))))))))
.

2008-06-09 21:09 . 2008-06-09 21:19   <DIR>   d--------   C:\WINDOWS\system32\8671
2008-06-09 18:11 . 2008-06-09 21:20   <DIR>   d----c---   C:\fixwareout
2008-06-09 18:01 . 2008-06-09 18:01   <DIR>   d--------   C:\Documents and Settings\Kasiuť
2008-06-09 17:52 . 2008-06-09 20:38   <DIR>   d--------   C:\WINDOWS\system32\2729
2008-06-09 17:15 . 2008-06-09 17:34   3,166   --a------   C:\WINDOWS\system32\tmp.reg
2008-06-09 17:14 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-06-09 17:14 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-06-09 17:14 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\404Fix.exe
2008-06-09 17:14 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-06-09 17:14 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-06-09 17:14 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 15:55 . 2008-06-09 15:55   <DIR>   d--------   C:\Program Files\Trend Micro
2008-06-09 13:50 . 2008-06-09 13:50   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Teleca
2008-06-09 13:49 . 2008-06-09 13:49   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Sony Ericsson
2008-06-08 22:41 . 2008-06-09 17:43   <DIR>   d--------   C:\WINDOWS\system32\6715
2008-06-08 22:41 . 2008-06-08 22:41   55,808   --a------   C:\WINDOWS\portsv.exe
2008-06-08 21:56 . 2008-06-08 21:56   55,564   --a------   C:\WINDOWS\FontData.fdb
2008-06-08 21:42 . 2008-06-08 21:42   <DIR>   d--------   C:\WINDOWS\system32\vntiho06
2008-06-08 21:42 . 2008-06-08 21:43   <DIR>   d--------   C:\WINDOWS\system32\izo
2008-06-08 21:41 . 2008-06-08 21:41   <DIR>   dr-------   C:\Documents and Settings\LocalService\Ulubione
2008-06-08 21:41 . 2008-06-08 21:41   87,511   --a------   C:\WINDOWS\system32\iftuyszv.exe
2008-06-08 21:41 . 2008-06-08 21:41   49,158   --a------   C:\WINDOWS\444.0
2008-06-08 21:23 . 2008-06-09 18:40   2,516   --ahs----   C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys
2008-06-08 21:23 . 2008-06-09 18:40   88   -r-hs----   C:\Documents and Settings\All Users\Dane aplikacji\[u]0[/u]35A723127.sys
2008-06-08 21:16 . 2008-06-08 21:16   <DIR>   d--------   C:\Program Files\Common Files\Protexis
2008-06-08 21:10 . 2008-06-08 21:10   <DIR>   d--------   C:\Program Files\Common Files\Corel
2008-06-08 21:07 . 2008-06-08 21:07   <DIR>   d--------   C:\Program Files\Corel
2008-06-08 18:14 . 2008-06-08 18:14   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-06-08 18:02 . 2008-06-08 18:02   <DIR>   d--------   C:\Program Files\Bonjour
2008-06-08 17:49 . 2008-06-08 17:49   <DIR>   d--------   C:\Program Files\Common Files\Macrovision Shared
2008-06-08 14:56 . 2008-06-08 18:19   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-06-08 14:56 . 2008-06-08 14:56   1,409   --a------   C:\WINDOWS\QTFont.for
2008-06-08 08:48 . 2008-06-08 08:48   <DIR>   d--------   C:\WINDOWS\Adobe Illustrator CS
2008-06-06 13:53 . 2008-06-06 13:53   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Media Player Classic
2008-06-06 13:53 . 2008-01-10 14:15   755,027   --a------   C:\WINDOWS\system32\xvidcore.dll
2008-06-06 13:53 . 2008-03-31 23:25   682,496   --a------   C:\WINDOWS\system32\divx.dll
2008-06-06 13:53 . 2006-09-24 17:11   389,120   --a------   C:\WINDOWS\system32\lameACM.acm
2008-06-06 13:53 . 2004-01-25 18:18   217,088   --a------   C:\WINDOWS\system32\yv12vfw.dll
2008-06-06 13:53 . 2008-01-10 14:16   159,839   --a------   C:\WINDOWS\system32\xvidvfw.dll
2008-06-06 13:53 . 2007-09-21 02:52   118,784   --a------   C:\WINDOWS\system32\ac3acm.acm
2008-06-06 13:53 . 2008-03-21 22:28   81,920   --a------   C:\WINDOWS\system32\dpl100.dll
2008-06-06 13:53 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-06-06 13:53 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-06-06 13:53 . 2007-10-03 17:03   414   --a------   C:\WINDOWS\system32\lame_acm.xml
2008-06-06 13:52 . 2008-06-06 13:53   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-06-04 20:06 . 2008-06-04 20:06   <DIR>   d----c---   C:\totalcmdd
2008-06-04 18:10 . 2008-06-04 18:10   <DIR>   d--------   C:\Program Files\FreshWebmaster
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Program Files\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft
2008-06-02 23:42 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a--c---   C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-02 23:42 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2008-06-02 21:20 . 2008-06-02 21:20   30   --a------   C:\WINDOWS\iedit.INI
2008-05-30 23:17 . 2008-05-30 23:17   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2008-05-30 17:54 . 2008-05-30 20:25   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-05-20 23:05 . 2008-05-20 23:05   32,768   --a------   C:\WINDOWS\system32\vntiho06\vntiho061083.exe
2008-05-11 17:50 . 2008-05-13 11:12   <DIR>   d--------   C:\Program Files\DAEMON Tools Lite
2008-05-11 14:48 . 2004-04-30 09:37   160,640   --a------   C:\WINDOWS\system32\drivers\a347bus.sys
2008-05-11 14:48 . 2004-04-30 09:33   5,248   --a------   C:\WINDOWS\system32\drivers\a347scsi.sys
2008-05-10 20:27 . 2008-05-10 20:28   <DIR>   d--------   C:\Program Files\Disk Images
2008-05-09 15:31 . 2008-05-09 15:31   <DIR>   d--------   C:\Program Files\Mediafour
2008-05-09 07:32 . 2008-05-17 21:42   <DIR>   d--------   C:\Program Files\EA GAMES

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 16:17   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\OpenOffice.org2
2008-06-09 15:32   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\uTorrent
2008-06-09 15:09   ---------   d-----w   C:\Program Files\Odkurzacz
2008-06-09 13:59   ---------   d-----w   C:\Documents and Settings\Kasik\Dane aplikacji\OpenOffice.org2
2008-06-09 13:43   ---------   d-----w   C:\Program Files\Adware Away
2008-06-09 11:25   ---------   d-----w   C:\Program Files\SkanerOnline
2008-06-08 20:07   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\GanymedeNet
2008-06-08 19:23   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Corel
2008-06-08 19:16   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Corel
2008-06-08 16:02   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-06-08 06:51   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-05-21 01:00   ---------   d-----w   C:\Program Files\Microsoft Silverlight
2008-05-19 11:16   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\LimeWire
2008-05-17 19:46   ---------   d-----w   C:\Program Files\Maxis
2008-05-13 09:22   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Kingston
2008-05-11 08:23   ---------   d-----w   C:\Program Files\Tweak-XP Pro 4
2008-05-11 07:55   ---------   d-----w   C:\Program Files\Paragon Software
2008-05-07 15:25   ---------   d-----w   C:\Program Files\Wiedźmin
2008-05-07 15:24   ---------   d-----w   C:\Program Files\e-Kiosk Reader
2008-05-07 15:17   ---------   d-----w   C:\Program Files\Ontrack
2008-04-29 18:09   ---------   d-----w   C:\Program Files\Binboy
2008-04-19 21:24   ---------   d-----w   C:\Documents and Settings\Kasiuś\Dane aplikacji\OpenOffice.org2
2008-04-19 17:28   ---------   d-----w   C:\Program Files\Alcohol Soft
2008-04-18 20:23   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Teleca
2008-04-18 20:22   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Sony Ericsson
2008-04-18 18:42   ---------   d-----w   C:\Documents and Settings\Kasiuś\Dane aplikacji\Kingston
2008-03-25 04:52   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52   178,976   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-22 07:38   5,642   -csha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-21 20:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2007-12-25 18:10   192,544   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\antivirusinstallfreenm_en[1].exe
2007-12-02 18:10   150   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\wklnhst.dat
2006-06-24 06:03   0   -c-ha-w   C:\Program Files\Toolbar888
2006-06-20 06:07   14   -c--a-w   C:\Documents and Settings\Kas\getfile.dat
2006-05-31 08:56   14   -c--a-w   C:\Documents and Settings\Kasik\getfile.dat
2005-08-17 15:10   457   -c--a-w   C:\Program Files\INSTALL.LOG
2005-08-08 19:25   36   -c--a-w   C:\Documents and Settings\Kas\klextlock.dat
2005-05-31 12:50   36   -c--a-w   C:\Documents and Settings\Kasik\klextlock.dat
2004-10-01 13:00   40,960   -c--a-w   C:\Program Files\Uninstall_CDS.exe
2006-05-24 15:38   233,472   -c--a-w   C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 16:00   204,895   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41   77,824   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 15:59   426,081   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19   458,752   -c--a-w   C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35   139,264   -c--a-w   C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10   204,800   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42   106,496   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22   212,992   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21   167,936   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2007-09-21 14:55   88   --sha-r   C:\WINDOWS\system32\3821D0B0CB.sys
2006-02-24 22:46   56   -csha-r   C:\WINDOWS\system32\CBB0D02138.sys
.

(((((((((((((((((((((((((((((   snapshot@2008-06-09_18.01.25.12   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-09 15:51:02   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-09 19:18:22   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-09 19:18:41   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 16:03 1957888]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 11:02 264704]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-12-18 15:20 401408]
"Search Defender"="C:\Program Files\Speeditup Free\SearchDefender.exe" [2007-08-02 02:54 541696]
"SpeedItUpEX"="C:\Program Files\Speeditup Free\SpeedItUp.exe" [2008-02-27 02:30 896000]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]
"EdHTML"="C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 17:38 1443328]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-30 21:10 344064]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"eTrustPPAP"="C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe" [2007-12-18 16:16 131072]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 14:48 69632 C:\WINDOWS\SOUNDMAN.EXE]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-21 19:25 180269]
"e-Kiosk"="C:\Program Files\e-Kiosk Reader\eGazetaST.exe" [2007-11-15 20:30 552448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-24 14:23 282624]
"PC-Checkup"="C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe" [2008-03-04 18:46 1500672]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 09:16 528384]
"atwtusb"="atwtusb.exe" [2006-09-18 11:25 303104 C:\WINDOWS\system32\ATWTUSB.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]

C:\Documents and Settings\Kas\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-24 10:19:45 110592]

C:\Documents and Settings\Kasiu˜\Menu Start\Programy\Autostart\
OpenOffice.org 2.0.2.lnk - C:\Program Files\OpenOffice.org 2.0.2\program\quickstart.exe [2006-03-12 01:12:44 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 23:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a--c--- 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\system32\\ccapp.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Gadulec\\gg.exe"=
"C:\\totalcmd\\WINCMD32.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Soldat\\Soldat.exe"=
"C:\\usr\\SMTP Server\\localsrv.exe"=
"C:\\usr\\apache\\Apache.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\ESTsoft\\ALFTP\\ALFTP.exe"=
"C:\\totalcmdd\\TOTALCMD.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 04:17]
R0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdsk.sys [2004-09-28 04:00]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 PlugPlayRPC;Plug and Play (RPC);C:\WINDOWS\portsv.exe service []
R2 PSI_SVC_2;Protexis Licensing V2;"c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 11:15]
S1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51]
S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys []
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 10:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 10:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 10:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 10:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 10:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 10:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 10:51]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 21:28:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql]
"ImagePath"="c:\usr/MYSQL/bin/mysqld.exe"
.
Completion time: 2008-06-09 21:32:30
ComboFix-quarantined-files.txt  2008-06-09 19:31:43
ComboFix2.txt  2008-06-09 18:36:04
ComboFix3.txt  2008-06-09 16:01:52

Pre-Run: 5,720,821,760 bajtów wolnych
Post-Run: 5,711,642,624 bajtów wolnych

243   --- E O F ---   2008-05-28 05:49:01


z hijacku naprwilam to wszystko. odsapne i zrobie ta optymalizacje.
hm a takie pytanie z ciekawosci. po czym rozpoznajecie np te falszywe dnsy itd?

[Okocza]

otwórz notatnik i wklej:

Files::

C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\444.0
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\portsv.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa. odczekaj az wygeneruje sie nowy log i go daj na forum

po czym rozpoznajecie np te falszywe dnsy itd?

po konkretnych nr a szkodliwe wpisy najczęściej charakteryzują się dziwną nazwą a niektóre są znane po prostu np infekcja amvo - to pliki amvo.dll i amva.dll na dysku

[kasiulks]

Kod: Zaznacz wszystko

Username "Kas" - 2008-06-09 21:16:21 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray"
"DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe"
"eTrustPPAP"="\"C:\\Program Files\\CA\\eTrust PestPatrol\\PPActiveDetection.exe\""
"SoundMan"="SOUNDMAN.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"e-Kiosk"="\"C:\\Program Files\\e-Kiosk Reader\\eGazetaST.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"PC-Checkup"="\"C:\\Program Files\\Speeditup Free\\PCCheckUp\\PCCheckUp.exe\" -mini"
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"Sony Ericsson PC Suite"="\"C:\\Program Files\\Sony Ericsson\\Mobile2\\Application Launcher\\Application Launcher.exe\" /startoptions"
"atwtusb"="atwtusb.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"Odkurzacz-MCD"="C:\\Program Files\\Odkurzacz\\odk_mcd.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"CTZDetec.exe"="C:\\Program Files\\Creative\\Creative Media Lite\\CTZDetec.exe"
"Search Defender"="\"C:\\Program Files\\Speeditup Free\\SearchDefender.exe\""
"SpeedItUpEX"="C:\\Program Files\\Speeditup Free\\SpeedItUp.exe -MINI"
"MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"
"EdHTML"="C:\\Program Files\\Binboy\\EdHTMLv5.0\\EdHTML.exe /none"
"DAEMON Tools Lite"="\"C:\\Program Files\\DAEMON Tools Lite\\daemon.exe\" -autorun"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~


snic mi sie to po nocach bedzie:P

[Magik]

snic mi sie to po nocach bedzie:P

nie marnuj snow na myslenie o logach:)

wszystko gra........przestan tylko uzywac INternet Explorera i przesiadz sie na Firefox;a a unikniesz problemow w przyszlosci lub trudniej je "zlapiesz"

Pozdro

[kasiulks]

używam tylko firefoxa. nie wiem czemu ale teraz tylko jak to wszystko robiłam to explorera wlaczałam
naprawde tylko firefoxa uzywam;)

hm w koncu jest ok no to sio z powrotem na linuxa

hm nie wiem czemu pokazuje mi sie ikonka explorera jeszcze

[wojtas]

wklej do notatnika:

Folder::
C:\WINDOWS\system32\8671
C:\WINDOWS\system32\2729
C:\WINDOWS\system32\6715
C:\WINDOWS\system32\vntiho06
C:\WINDOWS\system32\izo

File::
C:\Program Files\Toolbar888
C:\WINDOWS\portsv.exe
C:\WINDOWS\FontData.fdb
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\444.0

Driver::
PlugPlayRPC

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[kasiulks]

Kod: Zaznacz wszystko

ComboFix 08-06-08.8 - Kas 2008-06-10  6:43:00.6 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.383 [GMT 2:00]
Running from: C:\Documents and Settings\Kas\Pulpit\sciagane\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kas\Pulpit\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\Program Files\Toolbar888
C:\WINDOWS\444.0
C:\WINDOWS\FontData.fdb
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\iftuyszv.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Toolbar888
C:\Program Files\toolbar888\
C:\WINDOWS\444.0
C:\WINDOWS\FontData.fdb
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\2729
C:\WINDOWS\system32\6715
C:\WINDOWS\system32\6715\~!41p.spt
C:\WINDOWS\system32\8671
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\system32\izo
C:\WINDOWS\system32\vntiho06
C:\WINDOWS\system32\vntiho06\vntiho061083.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PLUGPLAYRPC
-------\Service_PlugPlayRPC


(((((((((((((((((((((((((   Files Created from 2008-05-10 to 2008-06-10  )))))))))))))))))))))))))))))))
.

2008-06-09 18:11 . 2008-06-09 21:20   <DIR>   d----c---   C:\fixwareout
2008-06-09 18:01 . 2008-06-09 18:01   <DIR>   d--------   C:\Documents and Settings\Kasiuś
2008-06-09 18:01 .    <DIR>      C:\Documents and Settings\Kasiuť\Ustawienia lokalne
2008-06-09 18:01 .    <DIR>      C:\Documents and Settings\Kasiuť\Ustawienia lokalne
2008-06-09 17:15 . 2008-06-09 17:34   3,166   --a------   C:\WINDOWS\system32\tmp.reg
2008-06-09 17:14 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-06-09 17:14 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-06-09 17:14 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-06-09 17:14 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\404Fix.exe
2008-06-09 17:14 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-06-09 17:14 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-06-09 17:14 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-06-09 15:55 . 2008-06-09 15:55   <DIR>   d--------   C:\Program Files\Trend Micro
2008-06-09 13:50 . 2008-06-09 13:50   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Teleca
2008-06-09 13:49 . 2008-06-09 13:49   <DIR>   d--------   C:\Documents and Settings\Kasik\Dane aplikacji\Sony Ericsson
2008-06-08 21:41 . 2008-06-08 21:41   <DIR>   dr-------   C:\Documents and Settings\LocalService\Ulubione
2008-06-08 21:23 . 2008-06-09 18:40   2,516   --ahs----   C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys
2008-06-08 21:23 . 2008-06-09 18:40   88   -r-hs----   C:\Documents and Settings\All Users\Dane aplikacji\[u]0[/u]35A723127.sys
2008-06-08 21:16 . 2008-06-08 21:16   <DIR>   d--------   C:\Program Files\Common Files\Protexis
2008-06-08 21:10 . 2008-06-08 21:10   <DIR>   d--------   C:\Program Files\Common Files\Corel
2008-06-08 21:07 . 2008-06-08 21:07   <DIR>   d--------   C:\Program Files\Corel
2008-06-08 18:14 . 2008-06-08 18:14   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-06-08 18:02 . 2008-06-08 18:02   <DIR>   d--------   C:\Program Files\Bonjour
2008-06-08 17:49 . 2008-06-08 17:49   <DIR>   d--------   C:\Program Files\Common Files\Macrovision Shared
2008-06-08 14:56 . 2008-06-08 18:19   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-06-08 14:56 . 2008-06-08 14:56   1,409   --a------   C:\WINDOWS\QTFont.for
2008-06-08 08:48 . 2008-06-08 08:48   <DIR>   d--------   C:\WINDOWS\Adobe Illustrator CS
2008-06-06 13:53 . 2008-06-06 13:53   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Media Player Classic
2008-06-06 13:53 . 2008-01-10 14:15   755,027   --a------   C:\WINDOWS\system32\xvidcore.dll
2008-06-06 13:53 . 2008-03-31 23:25   682,496   --a------   C:\WINDOWS\system32\divx.dll
2008-06-06 13:53 . 2006-09-24 17:11   389,120   --a------   C:\WINDOWS\system32\lameACM.acm
2008-06-06 13:53 . 2004-01-25 18:18   217,088   --a------   C:\WINDOWS\system32\yv12vfw.dll
2008-06-06 13:53 . 2008-01-10 14:16   159,839   --a------   C:\WINDOWS\system32\xvidvfw.dll
2008-06-06 13:53 . 2007-09-21 02:52   118,784   --a------   C:\WINDOWS\system32\ac3acm.acm
2008-06-06 13:53 . 2008-03-21 22:28   81,920   --a------   C:\WINDOWS\system32\dpl100.dll
2008-06-06 13:53 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-06-06 13:53 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-06-06 13:53 . 2007-10-03 17:03   414   --a------   C:\WINDOWS\system32\lame_acm.xml
2008-06-06 13:52 . 2008-06-06 13:53   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-06-04 20:06 . 2008-06-04 20:06   <DIR>   d----c---   C:\totalcmdd
2008-06-04 18:10 . 2008-06-04 18:10   <DIR>   d--------   C:\Program Files\FreshWebmaster
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Program Files\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\ESTsoft
2008-06-04 18:07 . 2008-06-04 18:07   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft
2008-06-02 23:42 . 2004-08-04 00:44   159,232   --a------   C:\WINDOWS\system32\ptpusd.dll
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a------   C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-02 23:42 . 2004-08-03 22:58   15,104   --a--c---   C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-02 23:42 . 2001-10-26 17:29   5,632   --a------   C:\WINDOWS\system32\ptpusb.dll
2008-06-02 21:20 . 2008-06-02 21:20   30   --a------   C:\WINDOWS\iedit.INI
2008-05-30 23:17 . 2008-05-30 23:17   <DIR>   d--------   C:\Documents and Settings\Kas\Dane aplikacji\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Ulead Systems
2008-05-30 17:59 . 2008-05-30 17:59   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2008-05-30 17:54 . 2008-05-30 20:25   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-05-11 17:50 . 2008-05-13 11:12   <DIR>   d--------   C:\Program Files\DAEMON Tools Lite
2008-05-11 14:48 . 2004-04-30 09:37   160,640   --a------   C:\WINDOWS\system32\drivers\a347bus.sys
2008-05-11 14:48 . 2004-04-30 09:33   5,248   --a------   C:\WINDOWS\system32\drivers\a347scsi.sys
2008-05-10 20:27 . 2008-05-10 20:28   <DIR>   d--------   C:\Program Files\Disk Images

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 16:17   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\OpenOffice.org2
2008-06-09 15:32   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\uTorrent
2008-06-09 15:09   ---------   d-----w   C:\Program Files\Odkurzacz
2008-06-09 13:59   ---------   d-----w   C:\Documents and Settings\Kasik\Dane aplikacji\OpenOffice.org2
2008-06-09 13:43   ---------   d-----w   C:\Program Files\Adware Away
2008-06-09 11:25   ---------   d-----w   C:\Program Files\SkanerOnline
2008-06-08 20:07   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\GanymedeNet
2008-06-08 19:23   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Corel
2008-06-08 19:16   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Corel
2008-06-08 16:02   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-06-08 06:51   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-05-21 01:00   ---------   d-----w   C:\Program Files\Microsoft Silverlight
2008-05-19 11:16   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\LimeWire
2008-05-17 19:46   ---------   d-----w   C:\Program Files\Maxis
2008-05-17 19:42   ---------   d-----w   C:\Program Files\EA GAMES
2008-05-13 09:22   ---------   d-----w   C:\Documents and Settings\Kas\Dane aplikacji\Kingston
2008-05-11 08:23   ---------   d-----w   C:\Program Files\Tweak-XP Pro 4
2008-05-11 07:55   ---------   d-----w   C:\Program Files\Paragon Software
2008-05-09 13:31   ---------   d-----w   C:\Program Files\Mediafour
2008-05-07 15:25   ---------   d-----w   C:\Program Files\Wiedźmin
2008-05-07 15:24   ---------   d-----w   C:\Program Files\e-Kiosk Reader
2008-05-07 15:17   ---------   d-----w   C:\Program Files\Ontrack
2008-04-29 18:09   ---------   d-----w   C:\Program Files\Binboy
2008-04-19 17:28   ---------   d-----w   C:\Program Files\Alcohol Soft
2008-04-18 20:23   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Teleca
2008-04-18 20:22   ---------   d-----w   C:\Documents and Settings\oem\Dane aplikacji\Sony Ericsson
2007-12-25 18:10   192,544   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\antivirusinstallfreenm_en[1].exe
2007-12-02 18:10   150   -c--a-w   C:\Documents and Settings\Kas\Dane aplikacji\wklnhst.dat
2006-06-20 06:07   14   -c--a-w   C:\Documents and Settings\Kas\getfile.dat
2006-05-31 08:56   14   -c--a-w   C:\Documents and Settings\Kasik\getfile.dat
2005-08-17 15:10   457   -c--a-w   C:\Program Files\INSTALL.LOG
2005-08-08 19:25   36   -c--a-w   C:\Documents and Settings\Kas\klextlock.dat
2005-05-31 12:50   36   -c--a-w   C:\Documents and Settings\Kasik\klextlock.dat
2004-10-01 13:00   40,960   -c--a-w   C:\Program Files\Uninstall_CDS.exe
2006-05-24 15:38   233,472   -c--a-w   C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 16:00   204,895   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41   77,824   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 15:59   426,081   -c--a-w   C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19   458,752   -c--a-w   C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35   139,264   -c--a-w   C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10   204,800   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42   106,496   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22   212,992   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21   167,936   -c--a-w   C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2007-09-21 14:55   88   --sha-r   C:\WINDOWS\system32\3821D0B0CB.sys
2006-02-24 22:46   56   -csha-r   C:\WINDOWS\system32\CBB0D02138.sys
.

(((((((((((((((((((((((((((((   snapshot@2008-06-09_18.01.25.12   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-09 15:51:02   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-10 04:49:33   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-10 04:49:51   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_598.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 16:03 1957888]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 11:02 264704]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-12-18 15:20 401408]
"Search Defender"="C:\Program Files\Speeditup Free\SearchDefender.exe" [2007-08-02 02:54 541696]
"SpeedItUpEX"="C:\Program Files\Speeditup Free\SpeedItUp.exe" [2008-02-27 02:30 896000]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]
"EdHTML"="C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 17:38 1443328]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-30 21:10 344064]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"eTrustPPAP"="C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe" [2007-12-18 16:16 131072]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 14:48 69632 C:\WINDOWS\SOUNDMAN.EXE]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-21 19:25 180269]
"e-Kiosk"="C:\Program Files\e-Kiosk Reader\eGazetaST.exe" [2007-11-15 20:30 552448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-24 14:23 282624]
"PC-Checkup"="C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe" [2008-03-04 18:46 1500672]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 09:16 528384]
"atwtusb"="atwtusb.exe" [2006-09-18 11:25 303104 C:\WINDOWS\system32\ATWTUSB.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]

C:\Documents and Settings\Kas\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-24 10:19:45 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 23:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a--c--- 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\system32\\ccapp.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Gadulec\\gg.exe"=
"C:\\totalcmd\\WINCMD32.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Soldat\\Soldat.exe"=
"C:\\usr\\SMTP Server\\localsrv.exe"=
"C:\\usr\\apache\\Apache.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\ESTsoft\\ALFTP\\ALFTP.exe"=
"C:\\totalcmdd\\TOTALCMD.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 04:17]
R0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdsk.sys [2004-09-28 04:00]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 PSI_SVC_2;Protexis Licensing V2;"c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 11:15]
S1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51]
S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys []
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 10:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 10:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 10:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 10:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 10:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 10:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 10:51]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 06:52:06
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="c:\usr/MYSQL/bin/mysqld.exe"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\usr\mysql\bin\mysqld.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Completion time: 2008-06-10  7:01:09 - machine was rebooted
ComboFix-quarantined-files.txt  2008-06-10 05:01:04
ComboFix2.txt  2008-06-09 20:18:40
ComboFix3.txt  2008-06-09 19:32:30
ComboFix4.txt  2008-06-09 18:36:04
ComboFix5.txt  2008-06-09 16:01:52

Pre-Run: 5,838,647,296 bajtów wolnych
Post-Run: 5,838,196,736 bajt˘w wolnych

269   --- E O F ---   2008-05-28 05:49:01


[wojtas]

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem