Mocno zaśmiecony system, jakieś antyviry się włączają

[miral_trunks]

Witam!
Proszę o sprawdzenie loga. Kliknięcie nieuważne w jeden plik i mnie od razu zasypała sterta informacji o tym jaki to mój komputer nie jest zawirusowany i ileż to różnych programów mi poleca (Micro Antivirus 2009!). Normalnie łał.

Hijack

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:32, on 2008-09-21
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WapSter\WapSter AQQ\AQQ.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Paint Shop Pro 9\Paint Shop Pro 9.exe
C:\Downloads\Queen + Paul Rodgers - The Cosmos Rocks\Queen + Paul Rodgers - The Cosmos Rocks\Password-HERE.exe
C:\Users\Mateusz\AppData\Local\Temp\IXP000.TMP\IOCBXF~1.EXE
C:\Program Files\PCHealthCenter\0.exe
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\MicroAV\MicroAV.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Windows\explorer.exe
C:\Installki\bezpieczeńśtwa\HiJackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.sgh.waw.pl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {048DD695-13A7-4061-AB7A-F555AF3512AB} - C:\Windows\system32\rqRKASmN.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIB37E~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: QXK Olive - {8B93A89B-7332-4B4B-830C-72EB6323D0DB} - C:\Windows\vmgspntbvlw.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: fqbewlna - {32678B97-2C98-4D22-A8F6-55C35572E946} - C:\Windows\fqbewlna.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [pdfFactory Dyspozytor v3] "C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [\YUR3279.exe] C:\Windows\system32\YUR3279.exe
O4 - HKLM\..\Run: [\YUR3FD1.exe] C:\Windows\system32\YUR3FD1.exe
O4 - HKLM\..\Run: [\YUR4415.exe] C:\Windows\system32\YUR4415.exe
O4 - HKLM\..\Run: [\YUR4F5B.exe] C:\Windows\system32\YUR4F5B.exe
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Mateusz\AppData\Local\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Run] C:\Users\Mateusz\AppData\Roaming\Adobe\Player.exe
O4 - HKCU\..\Run: [\YUR3279.exe] C:\Windows\system32\YUR3279.exe
O4 - HKCU\..\Run: [\YUR3FD1.exe] C:\Windows\system32\YUR3FD1.exe
O4 - HKCU\..\Run: [\YUR4415.exe] C:\Windows\system32\YUR4415.exe
O4 - HKCU\..\Run: [\YUR4F5B.exe] C:\Windows\system32\YUR4F5B.exe
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIB37E~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIB37E~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIB37E~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MIB37E~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DeviceNP - C:\Windows\SYSTEM32\DeviceNP.dll
O21 - SSODL: mgxfebsq - {7AB92ED9-0AEB-475C-9507-1C7343A115B9} - C:\Windows\mgxfebsq.dll
O21 - SSODL: dtseqrxk - {02BECE42-5605-43EF-821D-2E49AE5BEDEC} - C:\Windows\dtseqrxk.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\Windows\system32\flcdlock.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 13166 bytes


[Okocza]

Kod: Zaznacz wszystko

C:\Program Files\PCHealthCenter\0.exe
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\MicroAV\MicroAV.exe
O2 - BHO: (no name) - {048DD695-13A7-4061-AB7A-F555AF3512AB} - C:\Windows\system32\rqRKASmN.dll (file missing)
O2 - BHO: QXK Olive - {8B93A89B-7332-4B4B-830C-72EB6323D0DB} - C:\Windows\vmgspntbvlw.dll
O3 - Toolbar: fqbewlna - {32678B97-2C98-4D22-A8F6-55C35572E946} - C:\Windows\fqbewlna.dll
O4 - HKLM\..\Run: [\YUR3279.exe] C:\Windows\system32\YUR3279.exe
O4 - HKLM\..\Run: [\YUR3FD1.exe] C:\Windows\system32\YUR3FD1.exe
O4 - HKLM\..\Run: [\YUR4415.exe] C:\Windows\system32\YUR4415.exe
O4 - HKLM\..\Run: [\YUR4F5B.exe] C:\Windows\system32\YUR4F5B.exe
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe
O4 - HKCU\..\Run: [\YUR3279.exe] C:\Windows\system32\YUR3279.exe
O4 - HKCU\..\Run: [\YUR3FD1.exe] C:\Windows\system32\YUR3FD1.exe
O4 - HKCU\..\Run: [\YUR4415.exe] C:\Windows\system32\YUR4415.exe
O4 - HKCU\..\Run: [\YUR4F5B.exe] C:\Windows\system32\YUR4F5B.exe
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe


fix w hj

Kod: Zaznacz wszystko

O21 - SSODL: mgxfebsq - {7AB92ED9-0AEB-475C-9507-1C7343A115B9} - C:\Windows\mgxfebsq.dll
O21 - SSODL: dtseqrxk - {02BECE42-5605-43EF-821D-2E49AE5BEDEC} - C:\Windows\dtseqrxk.dll

przeskanuj na www.virustotal.com i daj raporty i log z combofixa

[djarta]

U Ciebie sytuacja jest bardzo zła.

Pobierz ComboFix,ale nie uruchamiaj


Wklej do Notatnika:

Kod: Zaznacz wszystko

File::
C:\Users\Mateusz\AppData\Local\Temp\IXP000.TMP\IOCBXF~1.EXE
C:\Windows\system32\rqRKASmN.dll
C:\Windows\vmgspntbvlw.dll
C:\Windows\fqbewlna.dll
C:\Windows\system32\YUR3279.exe
C:\Windows\system32\YUR3FD1.exe
C:\Windows\system32\YUR4415.exe
C:\Windows\system32\YUR4F5B.exe
C:\Program Files\MicroAV\MicroAV.exe
C:\Windows\system32\YUR3279.exe
C:\Windows\system32\YUR3FD1.exe
C:\Windows\system32\YUR4415.exe
C:\Windows\mgxfebsq.dll
C:\Windows\dtseqrxk.dll

Folder::
C:\Program Files\MicroAV
C:\Program Files\PCHealthCenter


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.


===================================
K.

[miral_trunks]

Po drobnych problemach udało mi się zrobić co napisaliście. Oto logi:

Hijack:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:50, on 2008-09-22
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\wuauclt.exe
C:\Installki\bezpieczeńśtwa\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.sgh.waw.pl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIB37E~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [pdfFactory Dyspozytor v3] "C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe"
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIB37E~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIB37E~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIB37E~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MIB37E~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DeviceNP - C:\Windows\SYSTEM32\DeviceNP.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\Windows\system32\flcdlock.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 11180 bytes


Combofix

Kod: Zaznacz wszystko

ComboFix 08-09-20.05 - Mateusz 2008-09-22 11:56:19.1 - NTFSx86
Microsoft® Windows Vista™ Business   6.0.6000.0.1250.1.1045.18.265 [GMT 2:00]
Uruchomiony z: C:\Installki\bezpieczeä˜twa\ComboFix.exe
Użyto następujących komend :: C:\Installki\bezpieczeä˜twa\CFScript.txt

FILE ::
C:\Program Files\MicroAV\MicroAV.exe
C:\Users\Mateusz\AppData\Local\Temp\IXP000.TMP\IOCBXF~1.EXE
C:\Windows\dtseqrxk.dll
C:\Windows\fqbewlna.dll
C:\Windows\mgxfebsq.dll
C:\Windows\system32\rqRKASmN.dll
C:\Windows\system32\YUR3279.exe
C:\Windows\system32\YUR3FD1.exe
C:\Windows\system32\YUR4415.exe
C:\Windows\system32\YUR4F5B.exe
C:\Windows\vmgspntbvlw.dll
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\MicroAV
C:\Program Files\MicroAV\MicroAV.cpl
C:\Program Files\MicroAV\MicroAV.exe
C:\Program Files\MicroAV\MicroAV.ooo
C:\Program Files\MicroAV\MicroAV0.dat
C:\Program Files\MicroAV\MicroAV1.dat
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\[u]0[/u].exe
C:\Program Files\PCHealthCenter\[u]0[/u].gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\1.ico
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\2.ico
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCHealthCenter\sc.html
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Users\Mateusz\AppData\Local\Temp\IXP000.TMP\IOCBXF~1.EXE
C:\Users\Mateusz\AppData\Roaming\Adobe\crc.dat
C:\Windows\dtseqrxk.dll
C:\Windows\eflx.exe
C:\Windows\fqbewlna.dll
C:\Windows\mgxfebsq.dll
C:\Windows\mqgldfvo.exe
C:\Windows\system32\1.ico
C:\Windows\system32\2.ico
C:\Windows\system32\fccaBQGX.dll
C:\Windows\system32\tdssadw.dll
C:\Windows\system32\tdssinit.dll
C:\Windows\system32\tdssl.dll
C:\Windows\system32\tdsslog.dll
C:\Windows\system32\tdssmain.dll
C:\Windows\system32\tdssserf.dll
C:\Windows\system32\tdssservers.dat
C:\Windows\system32\x64
C:\Windows\system32\YUR3279.exe
C:\Windows\system32\YUR3FD1.exe
C:\Windows\system32\YUR4415.exe
C:\Windows\system32\YUR4F5B.exe
C:\Windows\vmgspntbvlw.dll
C:\x

----- BITS: Możliwe zainfekowane strony -----

http://78.157.143.198
.
(((((((((((((((((((((((((   Pliki utworzone od 2008-08-22 do 2008-09-22  )))))))))))))))))))))))))))))))
.

Nie utworzono żadnych nowych plików w tym okresie

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 10:08   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\skypePM
2008-09-22 10:08   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\Skype
2008-09-21 16:00   ---------   d-----w   C:\Program Files\Norton Security Scan
2008-09-21 14:30   ---------   d-----w   C:\ProgramData\eMule
2008-09-21 14:29   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\eMule
2008-09-21 14:29   ---------   d-----w   C:\Program Files\eMule
2008-09-17 17:31   ---------   d-----w   C:\ProgramData\Roxio
2008-09-14 15:02   ---------   d-----w   C:\Program Files\English Translator 3
2008-09-14 08:02   ---------   d-----w   C:\Program Files\CDisplay
2008-09-01 19:17   ---------   d-----w   C:\Program Files\EditPlus 2
2008-08-30 10:38   ---------   d-----w   C:\ProgramData\Microsoft Help
2008-08-20 15:58   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\OpenOffice.org2
2008-08-15 11:51   ---------   d-----w   C:\Program Files\MSBuild
2008-08-15 11:51   ---------   d-----w   C:\Program Files\Microsoft Office Enterprise
2008-08-15 11:42   ---------   d-----w   C:\Program Files\Microsoft Visual Studio 8
2008-08-15 09:39   ---------   d-----w   C:\Program Files\Total Commander
2008-08-14 11:04   7,872   ----a-w   C:\Windows\System32\tmp.reg
2008-08-14 10:59   2,560   ----a-w   C:\Windows\System32\bitcometres.dll
2008-08-13 22:02   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\Winamp
2008-08-13 22:02   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
2008-08-13 18:07   ---------   d-----w   C:\Program Files\WapSter
2008-08-13 16:54   ---------   d-----w   C:\ProgramData\Symantec
2008-08-11 16:07   82,432   ----a-w   C:\Windows\System32\IEDFix.C.exe
2008-08-09 13:37   82,432   ----a-w   C:\Windows\System32\404Fix.exe
2008-08-08 09:11   ---------   d-----w   C:\Program Files\CDex
2008-08-07 15:40   ---------   d---a-w   C:\ProgramData\TEMP
2008-07-23 21:47   ---------   d-----w   C:\Program Files\Wkuwacz
2008-01-14 00:09   32   ----a-w   C:\ProgramData\ezsid.dat
2007-10-21 13:28   174   --sha-w   C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 21686568]
"AQQ"="C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe" [2008-09-18 1674736]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 2194744]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]
"\YUR4CE7.exe"="C:\Windows\system32\YUR4CE7.exe" [2008-09-19 25088]
"\YUR54C3.exe"="C:\Windows\system32\YUR54C3.exe" [2008-09-19 25088]
"\YUR8B0F.exe"="C:\Windows\system32\YUR8B0F.exe" [2008-09-19 24064]
"\YURCD8B.exe"="C:\Windows\system32\YURCD8B.exe" [2008-09-19 74752]
"\YUR565C.exe"="C:\Windows\system32\YUR565C.exe" [2008-09-19 74752]
"\YURD34C.exe"="C:\Windows\system32\YURD34C.exe" [2008-09-19 74752]
"\YUR4F13.exe"="C:\Windows\system32\YUR4F13.exe" [2008-09-19 74752]
"\YURCAF9.exe"="C:\Windows\system32\YURCAF9.exe" [2008-09-19 74752]
"\YUR63C2.exe"="C:\Windows\system32\YUR63C2.exe" [2008-09-19 74752]
"\YURF96F.exe"="C:\Windows\system32\YURF96F.exe" [2008-09-19 74752]
"\YUR7FE0.exe"="C:\Windows\system32\YUR7FE0.exe" [2008-09-19 74752]
"\YURFFDC.exe"="C:\Windows\system32\YURFFDC.exe" [2008-09-19 74752]
"\YUR2D75.exe"="C:\Windows\system32\YUR2D75.exe" [2008-09-19 25088]
"\YUR3F02.exe"="C:\Windows\system32\YUR3F02.exe" [2008-09-19 24064]
"\YUR8CF3.exe"="C:\Windows\system32\YUR8CF3.exe" [2008-09-19 74752]
"\YUR892B.exe"="C:\Windows\system32\YUR892B.exe" [2008-09-19 25088]
"\YUR9D28.exe"="C:\Windows\system32\YUR9D28.exe" [2008-09-19 25088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-06-13 138008]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-06-13 154392]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-06-13 133912]
"PDF Complete"="C:\Program Files\PDF Complete\pdfsty.exe" [2007-05-08 331552]
"PTHOSTTR"="C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1021224]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-06-11 163840]
"HP Software Update"="c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376]
"pdfFactory Dyspozytor v3"="C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2008-03-05 516096]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]
"GrooveMonitor"="C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"ANTIVIRUS"="C:\Program Files\MicroAV\MicroAV.exe" [2008-09-19 418816]
"\YURD33A.exe"="C:\Windows\system32\YURD33A.exe" [2008-09-19 74752]
"\YUR4CE7.exe"="C:\Windows\system32\YUR4CE7.exe" [2008-09-19 25088]
"\YUR54C3.exe"="C:\Windows\system32\YUR54C3.exe" [2008-09-19 25088]
"\YUR8B0F.exe"="C:\Windows\system32\YUR8B0F.exe" [2008-09-19 24064]
"\YURCD8B.exe"="C:\Windows\system32\YURCD8B.exe" [2008-09-19 74752]
"\YUR565C.exe"="C:\Windows\system32\YUR565C.exe" [2008-09-19 74752]
"\YURD34C.exe"="C:\Windows\system32\YURD34C.exe" [2008-09-19 74752]
"\YUR4F13.exe"="C:\Windows\system32\YUR4F13.exe" [2008-09-19 74752]
"\YURCAF9.exe"="C:\Windows\system32\YURCAF9.exe" [2008-09-19 74752]
"\YUR63C2.exe"="C:\Windows\system32\YUR63C2.exe" [2008-09-19 74752]
"\YURF96F.exe"="C:\Windows\system32\YURF96F.exe" [2008-09-19 74752]
"\YUR7FE0.exe"="C:\Windows\system32\YUR7FE0.exe" [2008-09-19 74752]
"\YURFFDC.exe"="C:\Windows\system32\YURFFDC.exe" [2008-09-19 74752]
"\YUR2D75.exe"="C:\Windows\system32\YUR2D75.exe" [2008-09-19 25088]
"\YUR3F02.exe"="C:\Windows\system32\YUR3F02.exe" [2008-09-19 24064]
"\YUR8CF3.exe"="C:\Windows\system32\YUR8CF3.exe" [2008-09-19 74752]
"\YUR892B.exe"="C:\Windows\system32\YUR892B.exe" [2008-09-19 25088]
"\YUR9D28.exe"="C:\Windows\system32\YUR9D28.exe" [2008-09-19 25088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="C:\Windows\SMINST\launcher.exe" [2007-06-06 44168]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2007-10-13 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 09:04 49152 C:\WINDOWS\System32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A7B8A069-5764-4CEB-97F1-BFE1BFBDA745}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{3E5AF6DA-A96F-429E-A83D-75A5607AF701}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{21819622-50BB-402F-83AB-5D1E920D96C8}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{09025FF6-75F9-4192-9030-6917C02C5FAF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{640C48F9-4521-4792-91E8-9A4D1B608D75}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{E9DAD2E6-9041-4B9E-AA31-BACD84A7874E}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{2D0E0094-8480-41B7-9C27-60B73937D071}"= UDP:8938:BitComet 8938 TCP
"{98D31908-3E9D-42B7-A659-154A478AEA9A}"= TCP:8938:BitComet 8938 UDP
"{2036B64F-13DE-492B-8208-A286120163CC}"= UDP:8938:BitComet 8938 TCP
"{9A846A30-DFDF-4728-86DC-F129906D3954}"= TCP:8938:BitComet 8938 UDP
"{684E1299-E41B-4C68-A092-08C824CD61B9}"= TCP:6004|C:\Program Files\Microsoft Office Enterprise\Office12\outlook.exe:Microsoft Office Outlook
"{B5F0EC59-CB2E-4A0E-A211-8D292E054842}"= UDP:C:\Program Files\Microsoft Office Enterprise\Office12\GROOVE.EXE:Microsoft Office Groove
"{B2B2B932-2494-475A-A2E5-075EDFB75BCF}"= TCP:C:\Program Files\Microsoft Office Enterprise\Office12\GROOVE.EXE:Microsoft Office Groove
"{ECB4A228-FD08-43CC-A96E-6EC0D1FFA173}"= UDP:C:\Program Files\Microsoft Office Enterprise\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC806217-6B25-4598-BEE3-6F665C7ACE91}"= TCP:C:\Program Files\Microsoft Office Enterprise\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{214BA5A4-E04F-4E7C-A072-E58674A82557}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{8CFADE59-EDD3-4F00-9586-CC75EE613C56}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{9615EB57-C599-478C-94AD-2A010BF516F8}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{94DE7A5B-3B55-4648-A96F-83190BC0EB91}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071204.001\IDSvix86.sys [2007-11-06 180272]
R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632]
R2 BcmSqlStartupSvc;Usługa startowa serwera SQL dodatku Business Contact Manager;C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-01-29 554616]
R2 pdfcDispatcher;PDF Document Manager;C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 37936]
S3 DAMDrv;DAMDrv;C:\Windows\system32\DRIVERS\DAMDrv.sys [2007-06-08 30008]
S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;C:\Windows\system32\flcdlock.exe [2007-06-08 172131]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork   REG_MULTI_SZ      PLA DPS BFE mpssvc
bthsvcs   REG_MULTI_SZ      BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8babd7f3-955b-11dc-ba94-001a4b683b6d}]
\shell\AutoRun\command - F:\Setupx.exe

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Zawartość folderu 'Zaplanowane zadania'
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-\YUR3279.exe - C:\Windows\system32\YUR3279.exe
HKLM-Run-\YUR3FD1.exe - C:\Windows\system32\YUR3FD1.exe
HKLM-Run-\YUR4415.exe - C:\Windows\system32\YUR4415.exe
HKLM-Run-\YUR4F5B.exe - C:\Windows\system32\YUR4F5B.exe



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 12:07:05
Windows 6.0.6000  NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
C:\WINDOWS\System32\audiodg.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\System32\agrsmsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\PCHealthCenter\[u]0[/u].exe
C:\Program Files\PCHealthCenter\[u]0[/u].exe
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\RacAgent.exe
C:\WINDOWS\System32\lpremove.exe
.
**************************************************************************
.
Czas ukończenia: 2008-09-22 12:20:18 - komputer został uruchomiony ponownie [Mateusz]
ComboFix-quarantined-files.txt  2008-09-22 10:19:33

Przed: System nie moľe znale«† komunikatu dla numeru komunikatu 0x2379 w pliku komunikat˘w dla Application.
Po: 9,949,483,008 bajt˘w wolnych

298   --- E O F ---   2008-02-22 00:35:11


[djarta]

Wklej do Notatnika:

Kod: Zaznacz wszystko

File::
C:\Windows\system32\YUR4CE7.exe
C:\Windows\system32\YUR54C3.exe
C:\Windows\system32\YUR8B0F.exe
C:\Windows\system32\YURCD8B.exe
C:\Windows\system32\YUR565C.exe
C:\Windows\system32\YURD34C.exe
C:\Windows\system32\YUR4F13.exe
C:\Windows\system32\YURCAF9.exe
C:\Windows\system32\YUR63C2.exe
C:\Windows\system32\YURF96F.exe
C:\Windows\system32\YUR7FE0.exe
C:\Windows\system32\YURFFDC.exe
C:\Windows\system32\YUR2D75.exe
C:\Windows\system32\YUR3F02.exe
C:\Windows\system32\YUR8CF3.exe
C:\Windows\system32\YUR892B.exe
C:\Windows\system32\YUR9D28.exe
C:\Windows\system32\YURD33A.exe
C:\Windows\system32\YUR4CE7.exe
C:\Windows\system32\YUR54C3.exe
C:\Windows\system32\YUR8B0F.exe
C:\Windows\system32\YURCD8B.exe
C:\Windows\system32\YUR565C.exe
C:\Windows\system32\YURD34C.exe
C:\Windows\system32\YUR4F13.exe
C:\Windows\system32\YURCAF9.exe
C:\Windows\system32\YUR63C2.exe
C:\Windows\system32\YURF96F.exe
C:\Windows\system32\YUR7FE0.exe
C:\Windows\system32\YURFFDC.exe
C:\Windows\system32\YUR2D75.exe
C:\Windows\system32\YUR3F02.exe
C:\Windows\system32\YUR8CF3.exe
C:\Windows\system32\YUR892B.exe
C:\Windows\system32\YUR9D28.exe

Registry::
"ANTIVIRUS"=-
"\YURD33A.exe"=-
"\YUR4CE7.exe"=-
"\YUR54C3.exe"=-
"\YUR8B0F.exe"=-
"\YURCD8B.exe"=-
"\YUR565C.exe"=-
"\YURD34C.exe"=-
"\YUR4F13.exe"=-
"\YURCAF9.exe"=-
"\YUR63C2.exe"=-
"\YURF96F.exe"=-
"\YUR7FE0.exe"=-
"\YURFFDC.exe"=-
"\YUR2D75.exe"=-
"\YUR3F02.exe"=-
"\YUR8CF3.exe"=-
"\YUR892B.exe"=-
"YUR9D28.exe"=-
"\YUR4CE7.exe"=-
"\YUR54C3.exe"=-
"\YUR8B0F.exe"=-
"\YURCD8B.exe"=-
"\YUR565C.exe"=-
"\YURD34C.exe"=-
"\YUR4F13.exe"=-
"\YURCAF9.exe"=-
"\YUR63C2.exe"=-
"\YURF96F.exe"=-
"\YUR7FE0.exe"=-
"\YURFFDC.exe"=-
"\YUR2D75.exe"=-
"\YUR3F02.exe"=-
"\YUR8CF3.exe"=-
"\YUR892B.exe"=-
"\YUR9D28.exe"=-


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.



===================================
K.

[miral_trunks]

Kod: Zaznacz wszystko

ComboFix 08-09-20.05 - Mateusz 2008-09-22 15:10:33.2 - NTFSx86
Uruchomiony z: C:\Installki\bezpieczeä˜twa\ComboFix.exe
Użyto następujących komend :: C:\Installki\bezpieczeä˜twa\CFScript.txt

FILE ::
C:\Windows\system32\YUR2D75.exe
C:\Windows\system32\YUR3F02.exe
C:\Windows\system32\YUR4CE7.exe
C:\Windows\system32\YUR4F13.exe
C:\Windows\system32\YUR54C3.exe
C:\Windows\system32\YUR565C.exe
C:\Windows\system32\YUR63C2.exe
C:\Windows\system32\YUR7FE0.exe
C:\Windows\system32\YUR892B.exe
C:\Windows\system32\YUR8B0F.exe
C:\Windows\system32\YUR8CF3.exe
C:\Windows\system32\YUR9D28.exe
C:\Windows\system32\YURCAF9.exe
C:\Windows\system32\YURCD8B.exe
C:\Windows\system32\YURD33A.exe
C:\Windows\system32\YURD34C.exe
C:\Windows\system32\YURF96F.exe
C:\Windows\system32\YURFFDC.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\MicroAV
C:\Program Files\MicroAV\MicroAV.cpl
C:\Program Files\MicroAV\MicroAV.exe
C:\Program Files\MicroAV\MicroAV.ooo
C:\Program Files\MicroAV\MicroAV0.dat
C:\Program Files\MicroAV\MicroAV1.dat
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\[u]0[/u].exe
C:\Program Files\PCHealthCenter\[u]0[/u].gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\1.ico
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\2.ico
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCHealthCenter\sc.html
C:\Windows\system32\1.ico
C:\Windows\system32\2.ico
C:\Windows\system32\YUR2D75.exe
C:\Windows\system32\YUR3F02.exe
C:\Windows\system32\YUR4CE7.exe
C:\Windows\system32\YUR4F13.exe
C:\Windows\system32\YUR54C3.exe
C:\Windows\system32\YUR565C.exe
C:\Windows\system32\YUR63C2.exe
C:\Windows\system32\YUR7FE0.exe
C:\Windows\system32\YUR892B.exe
C:\Windows\system32\YUR8B0F.exe
C:\Windows\system32\YUR8CF3.exe
C:\Windows\system32\YUR9D28.exe
C:\Windows\system32\YURCAF9.exe
C:\Windows\system32\YURCD8B.exe
C:\Windows\system32\YURD33A.exe
C:\Windows\system32\YURD34C.exe
C:\Windows\system32\YURF96F.exe
C:\Windows\system32\YURFFDC.exe
C:\x

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-08-22 do 2008-09-22  )))))))))))))))))))))))))))))))
.

Nie utworzono żadnych nowych plików w tym okresie

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 10:09   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\Skype
2008-09-22 10:08   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\skypePM
2008-09-21 16:00   ---------   d-----w   C:\Program Files\Norton Security Scan
2008-09-21 14:30   ---------   d-----w   C:\ProgramData\eMule
2008-09-21 14:29   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\eMule
2008-09-21 14:29   ---------   d-----w   C:\Program Files\eMule
2008-09-17 17:31   ---------   d-----w   C:\ProgramData\Roxio
2008-09-14 15:02   ---------   d-----w   C:\Program Files\English Translator 3
2008-09-14 08:02   ---------   d-----w   C:\Program Files\CDisplay
2008-09-01 19:17   ---------   d-----w   C:\Program Files\EditPlus 2
2008-08-30 10:38   ---------   d-----w   C:\ProgramData\Microsoft Help
2008-08-20 15:58   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\OpenOffice.org2
2008-08-15 11:51   ---------   d-----w   C:\Program Files\MSBuild
2008-08-15 11:51   ---------   d-----w   C:\Program Files\Microsoft Office Enterprise
2008-08-15 11:42   ---------   d-----w   C:\Program Files\Microsoft Visual Studio 8
2008-08-15 09:39   ---------   d-----w   C:\Program Files\Total Commander
2008-08-14 11:04   7,872   ----a-w   C:\Windows\System32\tmp.reg
2008-08-14 10:59   2,560   ----a-w   C:\Windows\System32\bitcometres.dll
2008-08-13 22:02   ---------   d-----w   C:\Users\Mateusz\AppData\Roaming\Winamp
2008-08-13 22:02   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
2008-08-13 18:07   ---------   d-----w   C:\Program Files\WapSter
2008-08-13 16:54   ---------   d-----w   C:\ProgramData\Symantec
2008-08-11 16:07   82,432   ----a-w   C:\Windows\System32\IEDFix.C.exe
2008-08-09 13:37   82,432   ----a-w   C:\Windows\System32\404Fix.exe
2008-08-08 09:11   ---------   d-----w   C:\Program Files\CDex
2008-08-07 15:40   ---------   d---a-w   C:\ProgramData\TEMP
2008-07-23 21:47   ---------   d-----w   C:\Program Files\Wkuwacz
2008-01-14 00:09   32   ----a-w   C:\ProgramData\ezsid.dat
2007-10-21 13:28   174   --sha-w   C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((   snapshot@2008-09-22_12.18.12.18   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-22 13:09:38   6,119,424   ----a-w   C:\Windows\erdnt\Hiv-backup\schema.dat
- 2008-09-22 09:48:05   262,144   ----a-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-09-22 12:19:48   262,144   ----a-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-09-22 10:04:57   262,144   --sha-w   C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-09-22 10:09:31   262,144   --sha-w   C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-09-22 10:09:31   262,144   ---ha-w   C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-09-22 09:54:16   262,144   ----a-w   C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-09-22 13:08:38   262,144   ----a-w   C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-09-22 10:04:57   262,144   --sha-w   C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-09-22 10:09:25   262,144   --sha-w   C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
- 2008-09-22 09:49:05   32,768   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-09-22 12:15:46   32,768   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-22 09:49:05   49,152   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-22 12:15:46   49,152   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-09-22 09:49:05   16,384   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-22 12:15:46   16,384   --sha-w   C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-07-09 22:13:55   6,291,456   ----a-w   C:\Windows\System32\SMI\Store\Machine\schema.dat
+ 2008-09-22 10:24:48   6,291,456   ----a-w   C:\Windows\System32\SMI\Store\Machine\schema.dat
- 2008-09-21 15:34:40   6,686   ----a-w   C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-570106569-3094072672-863909242-1006_UserData.bin
+ 2008-09-22 10:06:58   6,946   ----a-w   C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-570106569-3094072672-863909242-1006_UserData.bin
- 2008-09-21 15:34:39   92,510   ----a-w   C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-22 10:06:58   92,760   ----a-w   C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 21686568]
"AQQ"="C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe" [2008-09-18 1674736]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-02-01 2194744]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-06-13 138008]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-06-13 154392]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-06-13 133912]
"PDF Complete"="C:\Program Files\PDF Complete\pdfsty.exe" [2007-05-08 331552]
"PTHOSTTR"="C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1021224]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-06-11 163840]
"HP Software Update"="c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376]
"pdfFactory Dyspozytor v3"="C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2008-03-05 516096]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]
"GrooveMonitor"="C:\Program Files\Microsoft Office Enterprise\Office12\GrooveMonitor.exe" [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="C:\Windows\SMINST\launcher.exe" [2007-06-06 44168]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2007-10-13 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 09:04 49152 C:\WINDOWS\System32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A7B8A069-5764-4CEB-97F1-BFE1BFBDA745}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{3E5AF6DA-A96F-429E-A83D-75A5607AF701}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{21819622-50BB-402F-83AB-5D1E920D96C8}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{09025FF6-75F9-4192-9030-6917C02C5FAF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{640C48F9-4521-4792-91E8-9A4D1B608D75}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{E9DAD2E6-9041-4B9E-AA31-BACD84A7874E}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{2D0E0094-8480-41B7-9C27-60B73937D071}"= UDP:8938:BitComet 8938 TCP
"{98D31908-3E9D-42B7-A659-154A478AEA9A}"= TCP:8938:BitComet 8938 UDP
"{2036B64F-13DE-492B-8208-A286120163CC}"= UDP:8938:BitComet 8938 TCP
"{9A846A30-DFDF-4728-86DC-F129906D3954}"= TCP:8938:BitComet 8938 UDP
"{684E1299-E41B-4C68-A092-08C824CD61B9}"= TCP:6004|C:\Program Files\Microsoft Office Enterprise\Office12\outlook.exe:Microsoft Office Outlook
"{B5F0EC59-CB2E-4A0E-A211-8D292E054842}"= UDP:C:\Program Files\Microsoft Office Enterprise\Office12\GROOVE.EXE:Microsoft Office Groove
"{B2B2B932-2494-475A-A2E5-075EDFB75BCF}"= TCP:C:\Program Files\Microsoft Office Enterprise\Office12\GROOVE.EXE:Microsoft Office Groove
"{ECB4A228-FD08-43CC-A96E-6EC0D1FFA173}"= UDP:C:\Program Files\Microsoft Office Enterprise\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC806217-6B25-4598-BEE3-6F665C7ACE91}"= TCP:C:\Program Files\Microsoft Office Enterprise\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{214BA5A4-E04F-4E7C-A072-E58674A82557}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{8CFADE59-EDD3-4F00-9586-CC75EE613C56}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{9615EB57-C599-478C-94AD-2A010BF516F8}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{94DE7A5B-3B55-4648-A96F-83190BC0EB91}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071204.001\IDSvix86.sys [2007-11-06 180272]
R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632]
R2 BcmSqlStartupSvc;Usługa startowa serwera SQL dodatku Business Contact Manager;C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-01-29 554616]
R2 pdfcDispatcher;PDF Document Manager;C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 37936]
S3 DAMDrv;DAMDrv;C:\Windows\system32\DRIVERS\DAMDrv.sys [2007-06-08 30008]
S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;C:\Windows\system32\flcdlock.exe [2007-06-08 172131]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork   REG_MULTI_SZ      PLA DPS BFE mpssvc
bthsvcs   REG_MULTI_SZ      BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8babd7f3-955b-11dc-ba94-001a4b683b6d}]
\shell\AutoRun\command - F:\Setupx.exe

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Zawartość folderu 'Zaplanowane zadania'
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 15:16:11
Windows 6.0.6000  NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-22 15:21:32
ComboFix-quarantined-files.txt  2008-09-22 13:21:26
ComboFix2.txt  2008-09-22 10:20:20

Przed: System nie moľe znale«† komunikatu dla numeru komunikatu 0x2379 w pliku komunikat˘w dla Application.
Po: 8,763,650,048 bajt˘w wolnych

251   --- E O F ---   2008-02-22 00:35:11


[djarta]

Czysto.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.


===========================
K.