My web search - dziwne kłopoty przy starcie systemu

[mirekg1963]

Witam, to prawdopodobnie znowu ja! Ostatnio miałem problemy z dość leciwym już kompem, który przy starcie systemu daje mi taką owo komendę : c\PROGRAMY 1\MYWEBS \bar\2bin\MWSBAR.DLL Nie wiem czy dobrze zrobiłem ale usunąłem takie pliki ręcznie i niby sie już nie pokazuje ale pliku 2bin się nie da usunąć i z panelu sterowania oczywiście też nie. A i jeszcze nie wiem zqa bardzo jak mam wyłączyć opcje : za każdym startem systemu włącza mi się kreator znajdowania nowego sprzętu?
A tu profilaktycznie logi z OTListIt2

Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-06-05 10:13:37 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = C:\Documents and Settings\Właściciel\Pulpit
Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

223,48 Mb Total Physical Memory | 20,51 Mb Available Physical Memory | 9,18% Memory free
546,73 Mb Paging File | 383,21 Mb Available in Paging File | 70,09% Paging File free
Paging file location(s): C:\pagefile.sys 336 672 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111,78 Gb Total Space | 106,18 Gb Free Space | 94,99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: XPN10
Current User Name: Właściciel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2006-03-02 14:00:00 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008-02-22 05:25:21 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
PRC - [2008-11-09 11:20:48 | 00,086,016 | ---- | M] (alch) -- C:\Program Files\ClamWin\bin\ClamTray.exe
PRC - [2006-03-02 14:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2009-04-29 13:53:38 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-06-05 10:13:28 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Właściciel\Pulpit\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2006-03-02 14:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-05-08 16:17:52 | 00,028,762 | ---- | M] (MyWebSearch.com) -- C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE -- (MyWebSearchService [Disabled | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2001-08-17 22:13:08 | 00,027,165 | ---- | M] (VIA Technologies, Inc.              ) -- C:\WINDOWS\system32\DRIVERS\fetnd5.sys -- (FETNDIS [On_Demand | Stopped])
DRV - [2002-10-29 08:20:30 | 00,040,960 | R--- | M] (VIA Technologies, Inc.              ) -- C:\WINDOWS\system32\DRIVERS\fetnd5b.sys -- (FETNDISB [On_Demand | Running])
DRV - [2006-03-02 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2003-05-26 07:57:50 | 00,166,912 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\DRIVERS\s3gnbm.sys -- (S3Psddr [On_Demand | Running])
DRV - [2003-05-26 07:57:50 | 00,166,912 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\DRIVERS\s3gnbm.sys -- (S3SavageNB [On_Demand | Stopped])
DRV - [2006-03-02 14:00:00 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2003-07-02 05:42:00 | 00,027,904 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1 [Boot | Running])
DRV - [2003-02-26 10:04:00 | 00,370,048 | R--- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\drivers\viaudios.sys -- (VIAudio [On_Demand | Stopped])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
IE - URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=orange]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.google.pl"
FF - prefs.js..extensions.enabledItems: {7c5c0f58-e061-457d-9033-77307f5ed00c}:1.5.39.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10
FF - prefs.js..keyword.URL: "http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=5aPl2WZPIma8OkmEHabyVQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor="

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-05-07 17:11:50 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-05-08 16:17:54 | 00,000,000 | ---D | M]

[2009-02-03 16:18:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Właściciel\Dane aplikacji\mozilla\Extensions
[2009-02-03 16:18:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Właściciel\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-06-03 15:30:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Właściciel\Dane aplikacji\mozilla\Firefox\Profiles\3g767uhu.default\extensions
[2009-04-20 14:59:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Właściciel\Dane aplikacji\mozilla\Firefox\Profiles\3g767uhu.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}
[2009-05-08 16:51:45 | 00,009,895 | ---- | M] () -- C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\FireFox\Profiles\3g767uhu.default\searchplugins\mywebsearch.xml
[2009-04-20 14:59:31 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-04-29 13:53:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-04-29 13:53:37 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-04-29 13:53:37 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009-04-25 13:39:09 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2008-05-27 16:45:02 | 00,000,912 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\conduit.xml
[2009-04-25 13:39:09 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2009-04-25 13:39:09 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009-04-25 13:39:09 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2009-04-25 13:39:09 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2009-04-25 13:39:09 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2009-04-25 13:39:09 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - Reg Error: Key error. File not found
O3 - HKLM\..\Toolbar: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL File not found
O4 - HKLM..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon (alch)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000 File not found
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html File not found
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588 (Java Plug-in 1.6.0_05)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-01-31 15:58:39 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009-06-05 10:13:55 | 00,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{1a49943c-2d84-11de-9ba7-000d87990ff0}\Shell - "" = AutoRun
O33 - MountPoints2\{1a49943c-2d84-11de-9ba7-000d87990ff0}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{5a0ffb12-f441-11dd-9ac0-000d87990ff0}\Shell - "" = AutoRun
O33 - MountPoints2\{5a0ffb12-f441-11dd-9ac0-000d87990ff0}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{c8b1ffbe-0f00-11de-9b32-000d87990ff0}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{c8b1ffbe-0f00-11de-9b32-000d87990ff0}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{d3a32eda-08bf-11de-9b1c-000d87990ff0}\Shell\AutoRun\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe -- File not found
O33 - MountPoints2\{d3a32eda-08bf-11de-9b1c-000d87990ff0}\Shell\open\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe -- File not found
O33 - MountPoints2\{d3a32edb-08bf-11de-9b1c-000d87990ff0}\Shell\AutoRun\command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{d3a32edb-08bf-11de-9b1c-000d87990ff0}\Shell\open\Command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{f0c06c26-3ef2-11de-9bed-000d87990ff0}\Shell\AutoRun\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe -- File not found
O33 - MountPoints2\{f0c06c26-3ef2-11de-9bed-000d87990ff0}\Shell\open\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe -- File not found
O33 - MountPoints2\{f27e28db-4172-11de-9bfa-000d87990ff0}\Shell\AutoRun\command - "" = D:\hkn6k.bat -- File not found
O33 - MountPoints2\{f27e28db-4172-11de-9bfa-000d87990ff0}\Shell\open\Command - "" = D:\hkn6k.bat -- File not found
O33 - MountPoints2\{f27e28dc-4172-11de-9bfa-000d87990ff0}\Shell\AutoRun\command - "" = E:\hkn6k.bat -- File not found
O33 - MountPoints2\{f27e28dc-4172-11de-9bfa-000d87990ff0}\Shell\open\Command - "" = E:\hkn6k.bat -- File not found
O33 - MountPoints2\{fbe50684-efa3-11dd-a300-806d6172696f}\Shell\AutoRun\command - "" = C:\gclwpivc.cmd -- [2009-06-04 10:36:21 | 00,103,180 | RHS- | M] ()
O33 - MountPoints2\{fbe50684-efa3-11dd-a300-806d6172696f}\Shell\open\Command - "" = C:\gclwpivc.cmd -- [2009-06-04 10:36:21 | 00,103,180 | RHS- | M] ()
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-06-05 10:13:28 | 00,000,000 | ---D | M]

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-06-05 10:13:25 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Właściciel\Pulpit\OTListIt2.exe
[2009-06-05 10:06:46 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009-06-04 17:07:52 | 00,000,063 | RHS- | C] () -- C:\autorun.inf
[2009-06-04 16:52:23 | 00,000,841 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk
[2009-06-04 15:51:39 | 00,308,627 | ---- | C] () -- C:\Documents and Settings\Właściciel\Moje dokumenty\tekwondo.jpg
[2009-06-04 14:48:46 | 00,058,826 | ---- | C] () -- C:\Documents and Settings\Właściciel\Moje dokumenty\0011408605.jpg
[2009-06-04 10:36:48 | 00,103,180 | RHS- | C] () -- C:\gclwpivc.cmd
[2009-05-30 10:41:50 | 00,105,244 | RHS- | C] () -- C:\q9.cmd
[2009-05-28 16:28:54 | 00,104,475 | RHS- | C] () -- C:\yhh.bat
[2009-05-27 14:43:56 | 00,186,005 | ---- | C] () -- C:\Documents and Settings\Właściciel\Pulpit\ipchanger.rar
[2009-05-27 14:43:40 | 00,000,638 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk
[2009-05-27 14:40:31 | 20,398,051 | ---- | C] (CipSoft GmbH                                                ) -- C:\Documents and Settings\Właściciel\Pulpit\tibiasoft_com_tibia842.exe
[2009-05-27 10:52:23 | 00,104,357 | RHS- | C] () -- C:\2a.exe
[2009-05-25 10:01:04 | 00,106,104 | RHS- | C] () -- C:\n68mqcra.exe
[2009-05-23 11:45:31 | 00,104,693 | RHS- | C] () -- C:\3.cmd
[2009-05-21 16:59:42 | 00,000,697 | ---- | C] () -- C:\Documents and Settings\Właściciel\Pulpit\Metin2 PL.lnk
[2009-05-21 16:58:51 | 00,000,000 | ---D | C] -- C:\Program Files\Metin2_PL
[2009-05-21 16:05:08 | 21,423,7184 | ---- | C] () -- C:\Documents and Settings\Właściciel\Pulpit\Metin2_PL_20080908.exe
[2009-05-21 11:28:06 | 00,105,236 | RHS- | C] () -- C:\xh319r9b.bat
[2009-05-19 17:51:45 | 00,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2009-05-19 17:51:45 | 00,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar3.dll
[2009-05-19 17:51:45 | 00,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2009-05-19 17:51:45 | 00,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2009-05-19 17:51:45 | 00,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2009-05-19 17:51:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Właściciel\Dane aplikacji\Simply Super Software
[2009-05-19 17:51:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
[2009-05-19 14:27:57 | 00,105,436 | RHS- | C] () -- C:\ukvr.bat
[2009-05-15 19:42:56 | 00,107,378 | RHS- | C] () -- C:\icxpa.cmd
[2009-05-15 19:42:30 | 00,093,184 | RHS- | C] () -- C:\WINDOWS\System32\nmdfgds1.dll
[2009-05-15 19:42:08 | 00,107,947 | RHS- | C] () -- C:\hkn6k.bat
[2009-05-15 19:41:40 | 00,103,180 | RHS- | C] () -- C:\WINDOWS\System32\olhrwef.exe
[2009-05-15 19:41:40 | 00,093,184 | RHS- | C] () -- C:\WINDOWS\System32\nmdfgds0.dll
[2009-05-08 16:17:53 | 00,028,672 | ---- | C] (FunWebProducts.com) -- C:\WINDOWS\System32\f3PSSavr.scr
[2009-02-05 21:32:57 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006-03-02 14:00:00 | 00,164,746 | RHS- | C] () -- C:\WINDOWS\System32\xrezqh.dll
[2006-03-02 14:00:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2006-03-02 14:00:00 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2006-03-02 14:00:00 | 00,000,477 | ---- | C] () -- C:\WINDOWS\win.ini
[2006-03-02 14:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[2009-06-05 10:14:45 | 00,000,063 | RHS- | M] () -- C:\autorun.inf
[2009-06-05 10:13:28 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Właściciel\Pulpit\OTListIt2.exe
[2009-06-05 10:12:33 | 00,000,477 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-06-05 10:12:33 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-06-05 10:12:33 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-06-05 10:09:42 | 00,093,184 | RHS- | M] () -- C:\WINDOWS\System32\nmdfgds0.dll
[2009-06-05 10:08:40 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-05 10:08:39 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Właściciel\Ustawienia lokalne\desktop.ini
[2009-06-05 10:08:38 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-05 10:08:36 | 23,440,9984 | -HS- | M] () -- C:\hiberfil.sys
[2009-06-04 16:52:23 | 00,000,841 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk
[2009-06-04 15:51:41 | 00,308,627 | ---- | M] () -- C:\Documents and Settings\Właściciel\Moje dokumenty\tekwondo.jpg
[2009-06-04 14:48:48 | 00,058,826 | ---- | M] () -- C:\Documents and Settings\Właściciel\Moje dokumenty\0011408605.jpg
[2009-06-04 10:36:22 | 00,093,184 | RHS- | M] () -- C:\WINDOWS\System32\nmdfgds1.dll
[2009-06-04 10:36:21 | 00,103,180 | RHS- | M] () -- C:\WINDOWS\System32\olhrwef.exe
[2009-06-04 10:36:21 | 00,103,180 | RHS- | M] () -- C:\gclwpivc.cmd
[2009-06-03 11:35:48 | 00,105,244 | RHS- | M] () -- C:\q9.cmd
[2009-06-01 12:50:53 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-28 16:28:26 | 00,104,475 | RHS- | M] () -- C:\yhh.bat
[2009-05-27 14:43:57 | 00,186,005 | ---- | M] () -- C:\Documents and Settings\Właściciel\Pulpit\ipchanger.rar
[2009-05-27 14:43:40 | 00,000,638 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk
[2009-05-27 14:43:25 | 20,398,051 | ---- | M] (CipSoft GmbH                                                ) -- C:\Documents and Settings\Właściciel\Pulpit\tibiasoft_com_tibia842.exe
[2009-05-27 12:29:39 | 00,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk
[2009-05-27 10:51:56 | 00,104,357 | RHS- | M] () -- C:\2a.exe
[2009-05-25 10:00:36 | 00,106,104 | RHS- | M] () -- C:\n68mqcra.exe
[2009-05-23 11:45:03 | 00,104,693 | RHS- | M] () -- C:\3.cmd
[2009-05-21 17:06:22 | 21,423,7184 | ---- | M] () -- C:\Documents and Settings\Właściciel\Pulpit\Metin2_PL_20080908.exe
[2009-05-21 16:59:42 | 00,000,697 | ---- | M] () -- C:\Documents and Settings\Właściciel\Pulpit\Metin2 PL.lnk
[2009-05-21 11:27:38 | 00,105,236 | RHS- | M] () -- C:\xh319r9b.bat
[2009-05-19 14:27:28 | 00,105,436 | RHS- | M] () -- C:\ukvr.bat
[2009-05-18 15:35:53 | 00,107,378 | RHS- | M] () -- C:\icxpa.cmd
[2009-05-08 17:52:28 | 00,107,947 | RHS- | M] () -- C:\hkn6k.bat
[2009-05-08 16:17:51 | 00,028,672 | ---- | M] (FunWebProducts.com) -- C:\WINDOWS\System32\f3PSSavr.scr
< End of report >


[wojtas]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

[mirekg1963]

....się robi ! Log combofix , proszę bardzo!

Kod: Zaznacz wszystko

ComboFix 09-06-04.08 - Właściciel 2009-06-05 11:32.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.223.124 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Właściciel\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2.bat
C:\2a.exe
C:\3.cmd
C:\Autorun.inf
C:\cb.exe
c:\documents and settings\Właściciel\file.exe
C:\em8tqm.cmd
C:\gclwpivc.cmd
C:\hkn6k.bat
C:\i.com
C:\icxpa.cmd
C:\luk1ylq.com
C:\n68mqcra.exe
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\2.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
C:\q0dhfjf.exe
C:\q9.cmd
C:\u.com
C:\ukvr.bat
C:\uxkl0apt.bat
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
C:\xh319r9b.bat
C:\yh.cmd
C:\yhh.bat

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_AVPsys
-------\Service_MyWebSearchService


(((((((((((((((((((((((((   Pliki utworzone od 2009-05-05 do 2009-06-05  )))))))))))))))))))))))))))))))
.

2009-05-21 14:58 . 2009-05-21 14:59   --------   d-----w-   c:\program files\Metin2_PL
2009-05-19 15:51 . 2006-06-19 11:01   69632   ----a-w-   c:\windows\system32\ztvcabinet.dll
2009-05-19 15:51 . 2006-05-25 13:52   162304   ----a-w-   c:\windows\system32\ztvunrar36.dll
2009-05-19 15:51 . 2005-08-25 23:50   77312   ----a-w-   c:\windows\system32\ztvunace26.dll
2009-05-19 15:51 . 2003-02-02 18:06   153088   ----a-w-   c:\windows\system32\unrar3.dll
2009-05-19 15:51 . 2002-03-05 23:00   75264   ----a-w-   c:\windows\system32\unacev2.dll
2009-05-19 15:51 . 2009-05-19 15:51   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 12:43 . 2009-02-20 16:18   --------   d-----w-   c:\program files\Tibia
2009-05-21 13:53 . 2009-04-16 12:02   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-05-09 12:11 . 2009-02-06 11:31   --------   d-----w-   c:\program files\Valve
2009-04-20 15:19 . 2009-04-20 15:19   0   ----a-w-   c:\windows\Infob.dat
2009-04-20 15:19 . 2009-04-20 15:19   0   ----a-w-   c:\windows\Infoa.dat
2009-04-15 09:57 . 2009-04-15 09:57   --------   d-----w-   c:\program files\Common Files\Adobe
2009-04-11 07:52 . 2009-04-11 07:52   --------   d-----w-   c:\program files\Gadu-Gadu
2009-04-10 16:17 . 2009-01-31 14:06   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-04-10 16:17 . 2009-03-13 10:28   --------   d-----w-   c:\program files\Counter-Strike
2009-04-06 11:22 . 2009-04-06 11:21   --------   d-----w-   c:\program files\Opera
2009-03-30 11:31 . 2006-03-02 12:00   49492   ----a-w-   c:\windows\system32\perfc015.dat
2009-03-30 11:31 . 2006-03-02 12:00   355486   ----a-w-   c:\windows\system32\perfh015.dat
2009-03-19 15:08 . 2009-03-19 15:08   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2009-03-19 15:08 . 2009-03-19 15:08   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2006-03-02 12:00 . 2006-03-02 12:00   164746   --sha-r-   c:\windows\system32\xrezqh.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ClamWin"="c:\program files\ClamWin\bin\ClamTray.exe" [2008-11-09 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MyWebSearchService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Documents and Settings\\Właściciel\\Haburel.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1890:TCP"= 1890:TCP:rirrtipi

S2 bnwdun;Driver Boot;c:\windows\system32\svchost.exe -k netsvcs [2006-03-02 14336]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - LDYRBCXJ
*Deregistered* - ldyrbcxj

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
bnwdun
.
- - - - USUNIĘTO PUSTE WPISY - - - -

BHO-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
SafeBoot-procexp90.Sys


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.75\AMVConverter\grab.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.75\MediaManager\grab.html
FF - ProfilePath - c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\3g767uhu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=5aPl2WZPIma8OkmEHabyVQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=
FF - component: c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\3g767uhu.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 11:35
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bnwdun]
"ServiceDll"="c:\windows\system32\xrezqh.dll"
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-05 11:36 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-06-05 09:36

Przed: 113 965 506 560 bajtów wolnych
Po: 113 993 048 064 bajtów wolnych

WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

182   --- E O F ---   2009-02-27 10:37


[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\xrezqh.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MyWebSearchService"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

[mirekg1963]

już daje

Kod: Zaznacz wszystko

ComboFix 09-06-04.08 - Właściciel 2009-06-05 12:02.2 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.223.94 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Właściciel\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Właściciel\Pulpit\CFScript.txt

FILE ::
"c:\windows\system32\xrezqh.dll"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\xrezqh.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_bnwdun
-------\Service_bnwdun


(((((((((((((((((((((((((   Pliki utworzone od 2009-05-05 do 2009-06-05  )))))))))))))))))))))))))))))))
.

2009-05-21 14:58 . 2009-05-21 14:59   --------   d-----w-   c:\program files\Metin2_PL
2009-05-19 15:51 . 2006-06-19 11:01   69632   ----a-w-   c:\windows\system32\ztvcabinet.dll
2009-05-19 15:51 . 2006-05-25 13:52   162304   ----a-w-   c:\windows\system32\ztvunrar36.dll
2009-05-19 15:51 . 2005-08-25 23:50   77312   ----a-w-   c:\windows\system32\ztvunace26.dll
2009-05-19 15:51 . 2003-02-02 18:06   153088   ----a-w-   c:\windows\system32\unrar3.dll
2009-05-19 15:51 . 2002-03-05 23:00   75264   ----a-w-   c:\windows\system32\unacev2.dll
2009-05-19 15:51 . 2009-05-19 15:51   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 12:43 . 2009-02-20 16:18   --------   d-----w-   c:\program files\Tibia
2009-05-21 13:53 . 2009-04-16 12:02   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-05-09 12:11 . 2009-02-06 11:31   --------   d-----w-   c:\program files\Valve
2009-04-20 15:19 . 2009-04-20 15:19   0   ----a-w-   c:\windows\Infob.dat
2009-04-20 15:19 . 2009-04-20 15:19   0   ----a-w-   c:\windows\Infoa.dat
2009-04-15 09:57 . 2009-04-15 09:57   --------   d-----w-   c:\program files\Common Files\Adobe
2009-04-11 07:52 . 2009-04-11 07:52   --------   d-----w-   c:\program files\Gadu-Gadu
2009-04-10 16:17 . 2009-01-31 14:06   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-04-10 16:17 . 2009-03-13 10:28   --------   d-----w-   c:\program files\Counter-Strike
2009-04-06 11:22 . 2009-04-06 11:21   --------   d-----w-   c:\program files\Opera
2009-03-30 11:31 . 2006-03-02 12:00   49492   ----a-w-   c:\windows\system32\perfc015.dat
2009-03-30 11:31 . 2006-03-02 12:00   355486   ----a-w-   c:\windows\system32\perfh015.dat
2009-03-19 15:08 . 2009-03-19 15:08   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2009-03-19 15:08 . 2009-03-19 15:08   348160   ----a-w-   c:\windows\system32\msvcr71.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ClamWin"="c:\program files\ClamWin\bin\ClamTray.exe" [2008-11-09 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Documents and Settings\\Właściciel\\Haburel.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1890:TCP"= 1890:TCP:rirrtipi

S2 bnwdun;Driver Boot;c:\windows\system32\svchost.exe -k netsvcs [2006-03-02 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
bnwdun
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.75\AMVConverter\grab.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.75\MediaManager\grab.html
FF - ProfilePath - c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\3g767uhu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=5aPl2WZPIma8OkmEHabyVQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=
FF - component: c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\3g767uhu.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 12:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bnwdun]
"ServiceDll"="c:\windows\system32\xrezqh.dll"
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-05 12:06 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-06-05 10:06
ComboFix2.txt  2009-06-05 09:36

Przed: 113 997 508 608 bajtów wolnych
Po: 113 989 533 696 bajtów wolnych

111   --- E O F ---   2009-02-27 10:37


[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bnwdun]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....
i bedzie ok

Autor postu otrzymał pochwałę