podejrzenie o wirusy

[junji]

Czy mógłbym prosić o sprawdzenie poniższego loga?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:29, on 2008-02-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\hijackthis.com
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: {b769cec3-78ec-b59b-7ba4-858c10c9aa40} - {04aa9c01-c858-4ab7-b95b-ce873cec967b} - C:\WINDOWS\system32\tegbnxwj.dll
O2 - BHO: (no name) - {07C7156E-D651-4ACC-9AD3-498C916E9651} - C:\WINDOWS\system32\jkkkjkj.dll
O2 - BHO: (no name) - {1ED1D8FF-4B0B-4C42-9222-A673DF323A5F} - C:\WINDOWS\system32\ssqro.dll
O2 - BHO: Gamburg provider - {6607E676-1BDE-4cb3-9913-4DC5EBCAE35E} - unifff.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1203354821.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [svchost] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [68484585] rundll32.exe "C:\WINDOWS\system32\xdkeanrt.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201951499781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: jkkkjkj - C:\WINDOWS\SYSTEM32\jkkkjkj.dll
O21 - SSODL: zip - {68e06538-4d51-41f7-9ff3-206c774a6c81} - C:\WINDOWS\Installer\{68e06538-4d51-41f7-9ff3-206c774a6c81}\zip.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8482 bytes

[Avenger]

prosze podac przyczyne wklejania loga jakie sa objawy ?

[junji]

Dziękuję za porady. Dostosowałem się do zaleceń i przedstawiam następujące logi:

SmitFraudFix:

SmitFraudFix v2.291

Scan done at 18:50:11,20, 2008-02-19
Run from C:\Documents and Settings\TOMEK\Pulpit\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 212.76.33.138
DNS Server Search Order: 212.76.33.137

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F9918380-CC18-4D74-BF28-7F70BF343521}: DhcpNameServer=212.76.33.138 212.76.33.137
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F9918380-CC18-4D74-BF28-7F70BF343521}: DhcpNameServer=212.76.33.138 212.76.33.137
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F9918380-CC18-4D74-BF28-7F70BF343521}: DhcpNameServer=212.76.33.138 212.76.33.137
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.138 212.76.33.137
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.138 212.76.33.137
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.138 212.76.33.137


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

VirtmundoBeGone:

[02/19/2008, 19:01:35] - VirtumundoBeGone v1.5 ( "D:\VirtumundoBeGone.exe" )
[02/19/2008, 19:01:42] - Detected System Information:
[02/19/2008, 19:01:42] - Windows Version: 5.1.2600, Dodatek Service Pack 2
[02/19/2008, 19:01:42] - Current Username: TOMEK (Admin)
[02/19/2008, 19:01:43] - Windows is in NORMAL mode.
[02/19/2008, 19:01:43] - Searching for Browser Helper Objects:
[02/19/2008, 19:01:43] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[02/19/2008, 19:01:43] - BHO 2: {6607E676-1BDE-4cb3-9913-4DC5EBCAE35E} (Gamburg provider)
[02/19/2008, 19:01:43] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/19/2008, 19:01:43] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/19/2008, 19:01:43] - Finished Searching Browser Helper Objects
[02/19/2008, 19:01:43] - Finishing up...
[02/19/2008, 19:01:43] - Nothing found! Exiting...

Hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:29, on 2008-02-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\hijackthis.com
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: {b769cec3-78ec-b59b-7ba4-858c10c9aa40} - {04aa9c01-c858-4ab7-b95b-ce873cec967b} - C:\WINDOWS\system32\tegbnxwj.dll
O2 - BHO: (no name) - {07C7156E-D651-4ACC-9AD3-498C916E9651} - C:\WINDOWS\system32\jkkkjkj.dll
O2 - BHO: (no name) - {1ED1D8FF-4B0B-4C42-9222-A673DF323A5F} - C:\WINDOWS\system32\ssqro.dll
O2 - BHO: Gamburg provider - {6607E676-1BDE-4cb3-9913-4DC5EBCAE35E} - unifff.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1203354821.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [svchost] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [68484585] rundll32.exe "C:\WINDOWS\system32\xdkeanrt.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201951499781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: jkkkjkj - C:\WINDOWS\SYSTEM32\jkkkjkj.dll
O21 - SSODL: zip - {68e06538-4d51-41f7-9ff3-206c774a6c81} - C:\WINDOWS\Installer\{68e06538-4d51-41f7-9ff3-206c774a6c81}\zip.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8482 bytes

Combofix:

ComboFix 08-02-20.1 - TOMEK 2008-02-19 19:15:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1166 [GMT 1:00]
Running from: C:\Documents and Settings\TOMEK\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\orqss.ini2
C:\WINDOWS\system32\trnaekdx.ini
C:\WINDOWS\system32\trnaekdx.ini2
C:\WINDOWS\system32\trnaekdx.tmp

.
((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-19 18:55 . 2008-02-19 18:55 <DIR> d-------- C:\VundoFix Backups
2008-02-19 18:50 . 2008-02-19 18:50 1,210 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-19 18:49 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-19 18:49 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-19 18:49 . 2008-02-16 19:46 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-19 18:49 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-19 18:49 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-19 18:49 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-19 18:49 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-19 17:30 . 2008-02-19 18:01 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\PC Tools
2008-02-19 17:30 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-19 17:30 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-19 17:30 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-19 17:30 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-19 16:57 . 2008-02-20 19:18 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-19 10:26 . 2008-02-19 10:26 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Grisoft
2008-02-19 10:26 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-19 10:25 . 2008-02-19 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-19 09:45 . 2008-02-19 16:49 18,368 --a------ C:\WINDOWS\system32\service.sys
2008-02-19 09:42 . 2008-02-19 09:42 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-19 09:39 . 2008-01-24 10:42 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-02-19 09:39 . 2008-01-24 10:43 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-18 19:21 . 2008-02-18 19:21 1 --a------ C:\WINDOWS\system32\rc.dat
2008-02-18 19:21 . 2008-02-18 19:21 1 --a------ C:\WINDOWS\system32\ps1.dat
2008-02-18 19:21 . 2008-02-18 19:21 1 --a------ C:\WINDOWS\system32\cs.dat
2008-02-18 18:11 . 2008-02-18 19:17 58,368 --a------ C:\wpohl.exe
2008-02-18 18:11 . 2008-02-18 18:11 54,762 --a------ C:\WINDOWS\system32\jkghje.dll
2008-02-18 18:11 . 2008-02-18 18:11 53,760 --a------ C:\WINDOWS\system32\unifff.dll
2008-02-18 18:11 . 2008-02-18 18:11 53,760 --a------ C:\WINDOWS\system32\condt32.dll
2008-02-18 18:11 . 2008-02-18 18:11 29,696 --a------ C:\jupss.exe~
2008-02-18 18:11 . 2008-02-18 18:12 29,696 --a------ C:\jupss.exe
2008-02-18 18:11 . 2008-02-18 18:11 11 --a------ C:\WINDOWS\uid.dat
2008-02-18 18:11 . 2008-02-18 19:17 2 --a------ C:\1749566762
2008-02-17 19:53 . 2008-02-17 19:53 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DisplayTune
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Portrait Displays
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Common Files\Portrait Displays
2008-02-17 15:28 . 2008-02-17 15:28 <DIR> dr-h----- C:\Documents and Settings\TOMEK\Dane aplikacji\SecuROM
2008-02-17 15:28 . 2008-02-17 15:28 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-17 15:20 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2008-02-17 15:20 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-02-17 15:01 . 2008-02-17 15:01 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-17 14:57 . 2008-02-17 14:57 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DAEMON Tools
2008-02-17 14:57 . 2008-02-17 14:57 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-17 14:53 . 2008-02-19 14:12 <DIR> d-------- C:\Program Files\eMule
2008-02-17 14:14 . 2008-02-17 14:33 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Creative
2008-02-10 17:53 . 2008-02-10 17:53 <DIR> d-------- C:\Program Files\ScanSoft
2008-02-10 17:52 . 2008-02-10 17:52 <DIR> d-------- C:\Program Files\Microsoft AutoRoute
2008-02-10 17:50 . 2008-02-10 17:51 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Program Files\Real Alternative
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Media Player Classic
2008-02-08 13:04 . 2008-02-08 13:04 <DIR> d-------- C:\WINDOWS\Sun
2008-02-06 15:07 . 2008-02-06 15:07 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 14:19 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 16:18 <DIR> d-------- C:\Documents and Settings\TOMEK\Gadu-Gadu
2008-02-06 14:08 . 2008-02-06 14:08 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-06 14:08 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-06 14:08 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-06 14:08 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-06 14:08 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-06 14:08 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-06 14:08 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-06 14:08 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-06 14:08 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-02-03 15:45 . 2008-02-03 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-02-03 15:45 . 2008-02-03 15:45 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-02-03 15:45 . 2007-12-20 07:11 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-02-03 15:44 . 2008-02-17 10:22 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-02-03 15:43 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-03 15:27 . 2008-02-03 15:27 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-03 12:56 . 2008-02-03 12:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-02-03 10:07 . 2008-02-03 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-02-03 10:04 . 2008-02-04 16:26 <DIR> d-------- C:\Program Files\Azureus
2008-02-03 10:04 . 2008-02-20 19:16 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Azureus
2008-02-03 09:42 . 2008-02-03 09:42 <DIR> d-------- C:\Program Files\Java
2008-02-03 09:42 . 2008-02-17 21:39 <DIR> d-------- C:\Program Files\Google
2008-02-03 09:42 . 2007-09-24 20:01 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-03 09:41 . 2008-02-03 09:41 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-03 09:15 . 2008-02-03 09:15 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-02-03 08:45 . 2008-02-03 08:45 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\TuneUp Software
2008-02-02 18:01 . 2008-02-02 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-02-02 14:46 . 2008-02-19 17:29 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\skypePM
2008-02-02 14:46 . 2008-02-02 14:46 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-02 14:45 . 2008-02-19 18:52 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Common Files\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 18:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-02 12:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-02 12:42 --------- d-----w C:\Program Files\Marvell
2008-02-02 12:39 --------- d-----w C:\Program Files\DIFX
2008-02-02 12:16 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 6.0
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-02 12:14 --------- d-----w C:\Program Files\Usługi online
2008-02-02 12:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-24 10:04 86,073 ----a-w C:\WINDOWS\system32\usrfaxa.dll
2008-01-24 09:59 95,744 ----a-w C:\WINDOWS\system32\mqsec.dll
2008-01-24 09:58 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll
2008-01-24 09:58 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2008-01-24 09:58 2,139,136 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-01-24 09:58 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll
2008-01-24 09:58 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2008-01-24 09:57 981,760 ----a-w C:\WINDOWS\system32\mfc42u.dll
2008-01-24 09:57 927,504 ----a-w C:\WINDOWS\system32\mfc40u.dll
2008-01-24 09:57 714,240 ----a-w C:\WINDOWS\system32\sxs.dll
2008-01-24 09:57 600,576 ----a-w C:\WINDOWS\system32\mstsc.exe
2008-01-24 09:57 579,584 ----a-w C:\WINDOWS\system32\user32.dll
2008-01-24 09:57 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2008-01-24 09:57 36,352 ----a-w C:\WINDOWS\system32\tsgqec.dll
2008-01-24 09:57 288,768 ----a-w C:\WINDOWS\system32\rhttpaa.dll
2008-01-24 09:57 123,392 ----a-w C:\WINDOWS\system32\oledlg.dll
2008-01-24 09:57 116,736 ----a-w C:\WINDOWS\system32\aaclient.dll
2008-01-24 09:57 1,866,240 ----a-w C:\WINDOWS\system32\mstscax.dll
2008-01-24 09:55 80,896 ----a-w C:\WINDOWS\system32\fontsub.dll
2008-01-24 09:55 68,096 ----a-w C:\WINDOWS\system32\webclnt.dll
2008-01-24 09:55 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
2008-01-24 09:55 28,672 ----a-w C:\WINDOWS\system32\verclsid.exe
2008-01-24 09:55 197,632 ----a-w C:\WINDOWS\system32\netman.dll
2008-01-24 09:55 123,904 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
2008-01-24 09:55 117,760 ----a-w C:\WINDOWS\system32\t2embed.dll
2008-01-24 09:52 351,744 ----a-w C:\WINDOWS\system32\hypertrm.dll
2008-01-24 09:47 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll
2008-01-24 09:47 8,277,504 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-01-24 09:47 603,648 ----a-w C:\WINDOWS\system32\wmspdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmod.dll
2008-01-24 09:47 314,880 ----a-w C:\WINDOWS\system32\wmpdxm.dll
2008-01-24 09:47 242,688 ----a-w C:\WINDOWS\system32\wmpasf.dll
2008-01-24 09:47 1,329,152 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
2008-01-24 09:43 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll
2008-01-24 09:43 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll
2007-12-07 01:58 825,344 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 22:23 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:31 551,936 ----a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6607E676-1BDE-4cb3-9913-4DC5EBCAE35E}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-03 10:38 171448]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 00:09 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-04 22:11 8523776]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 21:41 132496]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2007-09-28 15:52 81920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 02:58 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative MediaSource Go]
--------- 2006-11-09 06:49 204800 d:\programy\MediaSource5\Go\CTCMSGoU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
-ra------ 2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-10 21:30 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse]
--a------ 2006-02-17 10:14 163840 d:\programy\Mouse\Amoumain.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
"PWRISOVM.EXE"=d:\Program Files\PowerISO\PWRISOVM.EXE

R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 12:17]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 09:27]
R3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-11-03 23:45]
S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 12:17]
S3 service.sys;service.sys;C:\WINDOWS\system32\service.sys [2008-02-19 16:49]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-03 15:45]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47c56b63-d474-11dc-9f8e-001bfc683ec8}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 16:15:20 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 19:17:59
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-02-20 19:19:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-20 18:19:06
.
2008-02-19 09:08:36 --- E O F ---

[wojtas]

prosze opisac problem jaki Pan ma z kompem o dac nowy log z hijack this pozdrawiam. Na tym forum logow bez podania przyczyny nie sprawdzamy

[junji]

Ok:)
Jako, że to problem mojego kolegi - to spróbuję nieco rozjaśnić obraz.

Po otwarciu strony internetowej- nie pojawia się całe okno i wyskakuje komunikat, tak jak na obrazku

Ponadto komputer znacznie spowolnił swoją pracę.

Poniżej log z hijacka:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:40, on 2008-02-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Azureus\Azureus.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
D:\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Gamburg provider - {6607E676-1BDE-4cb3-9913-4DC5EBCAE35E} - unifff.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201951499781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7426 bytes

Za okazałą pomoc i wyrozumiałość z góry dziękuję

[wojtas]

Wykonaj to co jest podane w tym temacie

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\service.sys
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\cs.dat
C:\wpohl.exe
C:\WINDOWS\system32\jkghje.dll
C:\WINDOWS\system32\unifff.dll
C:\WINDOWS\system32\condt32.dll
C:\jupss.exe~
C:\jupss.exe
C:\WINDOWS\uid.dat
C:\1749566762

Folder:
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6607E676-1BDE-4cb3-9913-4DC5EBCAE35E}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47c56b63-d474-11dc-9f8e-001bfc683ec8}]

Driver::
service.sys

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz nowy log z hijacka

[junji]

Ok
Tak uczyniłem.
Oto logi:

ComboFix 08-02-20.1 - TOMEK 2008-02-20 20:36:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1441 [GMT 1:00]
Running from: C:\Documents and Settings\TOMEK\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\TOMEK\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\1749566762
C:\jupss.exe
C:\jupss.exe~
C:\WINDOWS\system32\condt32.dll
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\jkghje.dll
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\service.sys
C:\WINDOWS\system32\unifff.dll
C:\WINDOWS\uid.dat
C:\wpohl.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\jkghje.dll
C:\1749566762
C:\jupss.exe
C:\jupss.exe~
C:\WINDOWS\system32\condt32.dll
C:\WINDOWS\system32\cs.dat
C:\WINDOWS\system32\jkghje.dll
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\service.sys
C:\WINDOWS\system32\unifff.dll
C:\WINDOWS\uid.dat
C:\wpohl.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SERVICE.SYS
-------\service.sys


((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-19 18:55 . 2008-02-19 18:55 <DIR> d-------- C:\VundoFix Backups
2008-02-19 18:50 . 2008-02-19 18:50 1,210 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-19 18:49 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-19 18:49 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-19 18:49 . 2008-02-16 19:46 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-19 18:49 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-19 18:49 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-19 18:49 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-19 18:49 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-19 17:30 . 2008-02-19 18:01 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\PC Tools
2008-02-19 17:30 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-19 17:30 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-19 17:30 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-19 17:30 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-19 16:57 . 2008-02-20 20:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-19 10:26 . 2008-02-19 10:26 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Grisoft
2008-02-19 10:26 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-19 10:25 . 2008-02-19 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-19 09:42 . 2008-02-19 09:42 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-19 09:39 . 2008-01-24 10:42 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-02-19 09:39 . 2008-01-24 10:43 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-17 19:53 . 2008-02-17 19:53 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DisplayTune
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Portrait Displays
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Common Files\Portrait Displays
2008-02-17 19:51 . 2004-08-04 01:56 1,392,671 --a------ C:\WINDOWS\msvbvm60.dll
2008-02-17 15:28 . 2008-02-17 15:28 <DIR> dr-h----- C:\Documents and Settings\TOMEK\Dane aplikacji\SecuROM
2008-02-17 15:28 . 2008-02-17 15:28 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-17 15:20 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2008-02-17 15:20 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-02-17 15:01 . 2008-02-17 15:01 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-17 14:57 . 2008-02-17 14:57 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DAEMON Tools
2008-02-17 14:57 . 2008-02-17 14:57 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-17 14:53 . 2008-02-19 14:12 <DIR> d-------- C:\Program Files\eMule
2008-02-17 14:14 . 2008-02-17 14:33 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Creative
2008-02-10 17:53 . 2008-02-10 17:53 <DIR> d-------- C:\Program Files\ScanSoft
2008-02-10 17:52 . 2008-02-10 17:52 <DIR> d-------- C:\Program Files\Microsoft AutoRoute
2008-02-10 17:50 . 2008-02-10 17:51 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Program Files\Real Alternative
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Media Player Classic
2008-02-08 13:04 . 2008-02-08 13:04 <DIR> d-------- C:\WINDOWS\Sun
2008-02-06 15:07 . 2008-02-06 15:07 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 14:19 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 16:18 <DIR> d-------- C:\Documents and Settings\TOMEK\Gadu-Gadu
2008-02-06 14:08 . 2008-02-06 14:08 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-06 14:08 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-06 14:08 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-06 14:08 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-06 14:08 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-06 14:08 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-06 14:08 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-06 14:08 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-06 14:08 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-02-03 15:45 . 2008-02-03 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-02-03 15:45 . 2008-02-03 15:45 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-02-03 15:45 . 2007-12-20 07:11 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-02-03 15:44 . 2008-02-17 10:22 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-02-03 15:43 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-03 15:27 . 2008-02-03 15:27 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-03 12:56 . 2008-02-03 12:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-02-03 10:07 . 2008-02-03 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-02-03 10:04 . 2008-02-04 16:26 <DIR> d-------- C:\Program Files\Azureus
2008-02-03 10:04 . 2008-02-20 20:31 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Azureus
2008-02-03 09:42 . 2008-02-03 09:42 <DIR> d-------- C:\Program Files\Java
2008-02-03 09:42 . 2008-02-17 21:39 <DIR> d-------- C:\Program Files\Google
2008-02-03 09:42 . 2007-09-24 20:01 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-03 09:41 . 2008-02-03 09:41 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-03 09:15 . 2008-02-03 09:15 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-02-03 08:45 . 2008-02-03 08:45 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\TuneUp Software
2008-02-02 18:01 . 2008-02-02 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-02-02 14:46 . 2008-02-20 19:21 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\skypePM
2008-02-02 14:46 . 2008-02-02 14:46 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-02 14:45 . 2008-02-20 20:38 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-02-02 14:32 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-02-02 14:32 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-02-02 14:32 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-02-02 14:18 . 2008-02-02 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-02-02 14:18 . 2008-02-02 14:18 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-02 14:18 . 2008-02-02 14:18 584 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-02 14:14 . 2003-06-12 19:55 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-02-02 14:13 . 2000-05-22 09:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-02-02 14:13 . 2006-10-06 07:17 53,248 --------- C:\WINDOWS\Ctregrun.exe
2008-02-02 14:11 . 2008-02-02 14:13 <DIR> d--h----- C:\Program Files\Creative Installation Information

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 18:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-02 12:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-02 12:42 --------- d-----w C:\Program Files\Marvell
2008-02-02 12:39 --------- d-----w C:\Program Files\DIFX
2008-02-02 12:16 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 6.0
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-02 12:14 --------- d-----w C:\Program Files\Usługi online
2008-02-02 12:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-24 10:04 86,073 ----a-w C:\WINDOWS\system32\usrfaxa.dll
2008-01-24 09:59 95,744 ----a-w C:\WINDOWS\system32\mqsec.dll
2008-01-24 09:58 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll
2008-01-24 09:58 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2008-01-24 09:58 2,139,136 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-01-24 09:58 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll
2008-01-24 09:58 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2008-01-24 09:57 981,760 ----a-w C:\WINDOWS\system32\mfc42u.dll
2008-01-24 09:57 927,504 ----a-w C:\WINDOWS\system32\mfc40u.dll
2008-01-24 09:57 714,240 ----a-w C:\WINDOWS\system32\sxs.dll
2008-01-24 09:57 600,576 ----a-w C:\WINDOWS\system32\mstsc.exe
2008-01-24 09:57 579,584 ----a-w C:\WINDOWS\system32\user32.dll
2008-01-24 09:57 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2008-01-24 09:57 36,352 ----a-w C:\WINDOWS\system32\tsgqec.dll
2008-01-24 09:57 288,768 ----a-w C:\WINDOWS\system32\rhttpaa.dll
2008-01-24 09:57 123,392 ----a-w C:\WINDOWS\system32\oledlg.dll
2008-01-24 09:57 116,736 ----a-w C:\WINDOWS\system32\aaclient.dll
2008-01-24 09:57 1,866,240 ----a-w C:\WINDOWS\system32\mstscax.dll
2008-01-24 09:55 80,896 ----a-w C:\WINDOWS\system32\fontsub.dll
2008-01-24 09:55 68,096 ----a-w C:\WINDOWS\system32\webclnt.dll
2008-01-24 09:55 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
2008-01-24 09:55 28,672 ----a-w C:\WINDOWS\system32\verclsid.exe
2008-01-24 09:55 197,632 ----a-w C:\WINDOWS\system32\netman.dll
2008-01-24 09:55 123,904 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
2008-01-24 09:55 117,760 ----a-w C:\WINDOWS\system32\t2embed.dll
2008-01-24 09:52 351,744 ----a-w C:\WINDOWS\system32\hypertrm.dll
2008-01-24 09:47 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll
2008-01-24 09:47 8,277,504 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-01-24 09:47 603,648 ----a-w C:\WINDOWS\system32\wmspdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmod.dll
2008-01-24 09:47 314,880 ----a-w C:\WINDOWS\system32\wmpdxm.dll
2008-01-24 09:47 242,688 ----a-w C:\WINDOWS\system32\wmpasf.dll
2008-01-24 09:47 1,329,152 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
2008-01-24 09:43 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll
2008-01-24 09:43 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll
2007-12-07 01:58 825,344 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 22:23 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:31 551,936 ----a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-03 10:38 171448]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 00:09 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-04 22:11 8523776]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 21:41 132496]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2007-09-28 15:52 81920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 02:58 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative MediaSource Go]
--------- 2006-11-09 06:49 204800 d:\programy\MediaSource5\Go\CTCMSGoU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
-ra------ 2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-10 21:30 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse]
--a------ 2006-02-17 10:14 163840 d:\programy\Mouse\Amoumain.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
"PWRISOVM.EXE"=d:\Program Files\PowerISO\PWRISOVM.EXE

R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 12:17]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 09:27]
R3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-11-03 23:45]
S1 wer32;wer32;C:\WINDOWS\system32\jkghje.dll []
S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 12:17]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-03 15:45]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 16:15:20 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 20:39:38
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-02-20 20:40:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-20 19:40:30
ComboFix2.txt 2008-02-20 18:36:05
ComboFix3.txt 2008-02-20 18:19:11
.
2008-02-19 09:08:36 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:41:34, on 2008-02-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201951499781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7123 bytes

[wojtas]

wklej do notatnika:

Driver::
wer32

Folder::
C:\VundoFix Backups

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[junji]

ok

ComboFix 08-02-20.1 - TOMEK 2008-02-20 21:10:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1367 [GMT 1:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\Documents and Settings\TOMEK\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-19 19:00 . 2008-02-20 21:08 1,597,814 --a------ C:\ComboFix.exe
2008-02-19 18:55 . 2008-02-19 18:55 <DIR> d-------- C:\VundoFix Backups
2008-02-19 18:50 . 2008-02-19 18:50 1,210 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-19 18:49 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-19 18:49 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-19 18:49 . 2008-02-16 19:46 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-19 18:49 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-19 18:49 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-19 18:49 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-19 18:49 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-19 17:30 . 2008-02-19 18:01 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-19 17:30 . 2008-02-19 17:30 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\PC Tools
2008-02-19 17:30 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-19 17:30 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-19 17:30 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-19 17:30 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-19 16:57 . 2008-02-20 21:03 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-19 10:26 . 2008-02-19 10:26 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Grisoft
2008-02-19 10:26 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-19 10:25 . 2008-02-19 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-02-19 09:42 . 2008-02-19 09:42 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-19 09:39 . 2008-01-24 10:42 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-02-19 09:39 . 2008-01-24 10:43 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-18 20:38 . 2008-02-18 20:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-17 19:53 . 2008-02-17 19:53 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DisplayTune
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Portrait Displays
2008-02-17 19:51 . 2008-02-17 19:51 <DIR> d-------- C:\Program Files\Common Files\Portrait Displays
2008-02-17 19:51 . 2004-08-04 01:56 1,392,671 --a------ C:\WINDOWS\msvbvm60.dll
2008-02-17 15:28 . 2008-02-17 15:28 <DIR> dr-h----- C:\Documents and Settings\TOMEK\Dane aplikacji\SecuROM
2008-02-17 15:28 . 2008-02-17 15:28 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-17 15:20 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2008-02-17 15:20 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-02-17 15:19 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-02-17 15:01 . 2008-02-17 15:01 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-17 14:57 . 2008-02-17 14:57 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\DAEMON Tools
2008-02-17 14:57 . 2008-02-17 14:57 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-17 14:53 . 2008-02-19 14:12 <DIR> d-------- C:\Program Files\eMule
2008-02-17 14:14 . 2008-02-17 14:33 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Creative
2008-02-10 17:53 . 2008-02-10 17:53 <DIR> d-------- C:\Program Files\ScanSoft
2008-02-10 17:52 . 2008-02-10 17:52 <DIR> d-------- C:\Program Files\Microsoft AutoRoute
2008-02-10 17:50 . 2008-02-10 17:51 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Program Files\Real Alternative
2008-02-10 14:27 . 2008-02-10 14:27 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Media Player Classic
2008-02-08 13:04 . 2008-02-08 13:04 <DIR> d-------- C:\WINDOWS\Sun
2008-02-06 15:07 . 2008-02-06 15:07 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 14:19 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-02-06 15:06 . 2008-02-07 16:18 <DIR> d-------- C:\Documents and Settings\TOMEK\Gadu-Gadu
2008-02-06 14:08 . 2008-02-06 14:08 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-06 14:08 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-06 14:08 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-06 14:08 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-06 14:08 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-06 14:08 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-06 14:08 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-06 14:08 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-06 14:08 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:14 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-02-05 05:30 . 2004-08-03 21:08 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-05 05:29 . 2004-08-03 19:38 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-02-05 05:29 . 2001-10-26 13:27 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-02-05 05:29 . 2001-08-17 18:32 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-02-03 15:45 . 2008-02-03 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-02-03 15:45 . 2008-02-03 15:45 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-02-03 15:45 . 2007-12-20 07:11 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-02-03 15:44 . 2008-02-17 10:22 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-02-03 15:43 . 2008-02-17 15:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-03 15:27 . 2008-02-03 15:27 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-03 12:56 . 2008-02-03 12:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-02-03 10:07 . 2008-02-03 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-02-03 10:04 . 2008-02-04 16:26 <DIR> d-------- C:\Program Files\Azureus
2008-02-03 10:04 . 2008-02-20 21:11 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Azureus
2008-02-03 09:42 . 2008-02-03 09:42 <DIR> d-------- C:\Program Files\Java
2008-02-03 09:42 . 2008-02-17 21:39 <DIR> d-------- C:\Program Files\Google
2008-02-03 09:42 . 2007-09-24 20:01 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-03 09:41 . 2008-02-03 09:41 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-03 09:15 . 2008-02-03 09:15 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-02-03 08:45 . 2008-02-03 08:45 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\TuneUp Software
2008-02-02 18:01 . 2008-02-02 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-02-02 14:46 . 2008-02-20 19:21 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\skypePM
2008-02-02 14:46 . 2008-02-02 14:46 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-02 14:45 . 2008-02-20 21:04 <DIR> d-------- C:\Documents and Settings\TOMEK\Dane aplikacji\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-02-02 14:44 . 2008-02-02 14:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-02-02 14:32 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-02-02 14:32 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-02-02 14:32 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-02-02 14:18 . 2008-02-02 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-02-02 14:18 . 2008-02-02 14:18 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-02-02 14:18 . 2008-02-02 14:18 584 --a------ C:\WINDOWS\system32\settings.sfm
2008-02-02 14:14 . 2003-06-12 19:55 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-02-02 14:13 . 2000-05-22 09:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-02-02 14:13 . 2006-10-06 07:17 53,248 --------- C:\WINDOWS\Ctregrun.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 18:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-02 12:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-02 12:42 --------- d-----w C:\Program Files\Marvell
2008-02-02 12:39 --------- d-----w C:\Program Files\DIFX
2008-02-02 12:16 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 6.0
2008-02-02 12:15 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-02 12:14 --------- d-----w C:\Program Files\Usługi online
2008-02-02 12:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-24 10:04 86,073 ----a-w C:\WINDOWS\system32\usrfaxa.dll
2008-01-24 09:59 95,744 ----a-w C:\WINDOWS\system32\mqsec.dll
2008-01-24 09:58 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll
2008-01-24 09:58 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2008-01-24 09:58 2,139,136 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-01-24 09:58 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll
2008-01-24 09:58 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2008-01-24 09:57 981,760 ----a-w C:\WINDOWS\system32\mfc42u.dll
2008-01-24 09:57 927,504 ----a-w C:\WINDOWS\system32\mfc40u.dll
2008-01-24 09:57 714,240 ----a-w C:\WINDOWS\system32\sxs.dll
2008-01-24 09:57 600,576 ----a-w C:\WINDOWS\system32\mstsc.exe
2008-01-24 09:57 579,584 ----a-w C:\WINDOWS\system32\user32.dll
2008-01-24 09:57 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2008-01-24 09:57 36,352 ----a-w C:\WINDOWS\system32\tsgqec.dll
2008-01-24 09:57 288,768 ----a-w C:\WINDOWS\system32\rhttpaa.dll
2008-01-24 09:57 123,392 ----a-w C:\WINDOWS\system32\oledlg.dll
2008-01-24 09:57 116,736 ----a-w C:\WINDOWS\system32\aaclient.dll
2008-01-24 09:57 1,866,240 ----a-w C:\WINDOWS\system32\mstscax.dll
2008-01-24 09:55 80,896 ----a-w C:\WINDOWS\system32\fontsub.dll
2008-01-24 09:55 68,096 ----a-w C:\WINDOWS\system32\webclnt.dll
2008-01-24 09:55 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
2008-01-24 09:55 28,672 ----a-w C:\WINDOWS\system32\verclsid.exe
2008-01-24 09:55 197,632 ----a-w C:\WINDOWS\system32\netman.dll
2008-01-24 09:55 123,904 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
2008-01-24 09:55 117,760 ----a-w C:\WINDOWS\system32\t2embed.dll
2008-01-24 09:52 351,744 ----a-w C:\WINDOWS\system32\hypertrm.dll
2008-01-24 09:47 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll
2008-01-24 09:47 8,277,504 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-01-24 09:47 603,648 ----a-w C:\WINDOWS\system32\wmspdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmvdmod.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
2008-01-24 09:47 4,096 ----a-w C:\WINDOWS\system32\wmsdmod.dll
2008-01-24 09:47 314,880 ----a-w C:\WINDOWS\system32\wmpdxm.dll
2008-01-24 09:47 242,688 ----a-w C:\WINDOWS\system32\wmpasf.dll
2008-01-24 09:47 1,329,152 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
2008-01-24 09:43 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll
2008-01-24 09:43 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll
2007-12-07 01:58 825,344 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 22:23 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:31 551,936 ----a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-03 10:38 171448]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 00:09 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-04 22:11 8523776]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 21:41 132496]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2007-09-28 15:52 81920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 02:58 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative MediaSource Go]
--------- 2006-11-09 06:49 204800 d:\programy\MediaSource5\Go\CTCMSGoU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
-ra------ 2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-10 21:30 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse]
--a------ 2006-02-17 10:14 163840 d:\programy\Mouse\Amoumain.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
"PWRISOVM.EXE"=d:\Program Files\PowerISO\PWRISOVM.EXE

R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 12:17]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 09:27]
R3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-11-03 23:45]
S3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\System32\drivers\pivotmou.sys [2007-02-09 12:17]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-03 15:45]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 16:15:20 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 21:11:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-20 21:12:23
ComboFix-quarantined-files.txt 2008-02-20 20:12:20
ComboFix2.txt 2008-02-20 19:40:35
ComboFix3.txt 2008-02-20 18:36:05
ComboFix4.txt 2008-02-20 18:19:11
.
2008-02-19 09:08:36 --- E O F ---

[wojtas]

wydaje sie byc czysto

skasuj folder:

C:\VundoFix Backups

[junji]

Bardzo, bardzo dziękuję za pomoc