problem z wirusami

**Posty:** 177 · przez **roonnii** 23 Sty 2008, 16:24

komputer mi sie zawiesza i procesor ciagle chodzi na 100%

Logfile of HijackThis v1.99.1
Scan saved at 15:19:21, on 2008-01-23
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\Explorer.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\System32\ctfmon.exe
D:\PROGRA~1\WapSter\AQQ\AQQ.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\svchost.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\HPZipm12.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\TEMP\ADEC8C15.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\svchost.exe
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\drivers\spool.exe D:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {144EA744-17FE-2705-FABF-61A391F6F1C6} - D:\WINDOWS\System32\nvpoeggj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - D:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe
O4 - HKLM\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe
O4 - HKCU\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe
O23 - Service: FFI - Unknown owner - D:\WINDOWS\System32\svchost.exe:exm.exe
O23 - Service: Generic Host Process for Win-32 Service - Unknown owner - D:\WINDOWS\svchost.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - d:\windows\system32\msvcrtd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - D:\WINDOWS\system32\drivers\spool.exe

**Posty:** 18165 · przez **wojtas** 23 Sty 2008, 16:42

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 177 · przez **roonnii** 25 Sty 2008, 14:30

SDFix: Version 1.111

Run by roni on 2008-01-25 at 12:32

Microsoft Windows XP [Wersja 5.1.2600]

Running From: D:\SDFix

Safe Mode:
Checking Services:

Name:
msupdate
runtime
smtpdrv

ImagePath:
d:\windows\system32\msvcrtd.exe
\??\D:\WINDOWS\System32\drivers\runtime.sys
System32\DRIVERS\smtpdrv.sys

msupdate - Deleted
runtime - Deleted
smtpdrv - Deleted

D:\WINDOWS\system32\Microsoft\backup.ftp Found
D:\WINDOWS\system32\Microsoft\backup.tftp Found

Checking files:

Genuine:
D:\WINDOWS\system32\Microsoft\backup.ftp
D:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:
D:\WINDOWS\system32\ftp.exe
D:\WINDOWS\system32\tftp.exe
D:\WINDOWS\system32\dllcache\ftp.exe
D:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:
D:\WINDOWS\system32\Microsoft\backup.ftp
D:\WINDOWS\system32\Microsoft\backup.tftp
D:\WINDOWS\system32\ftp.exe
D:\WINDOWS\system32\tftp.exe
D:\WINDOWS\system32\dllcache\ftp.exe
D:\WINDOWS\system32\dllcache\tftp.exe

Dummy:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

D:\DOCUME~1\roni\USTAWI~1\Temp\eraseme_58150.exe - Deleted
D:\Program Files\Common Files\Yazzle1560OinAdmin.exe - Deleted
D:\Program Files\Common Files\Yazzle1560OinUninstaller.exe - Deleted
D:\Program Files\Common Files\Carlson\carlton - Deleted
D:\WINDOWS\W0034_jpg.zip - Deleted
D:\WINDOWS\b122.exe - Deleted
D:\WINDOWS\b128.exe - Deleted
D:\WINDOWS\img28515.zip - Deleted
D:\WINDOWS\svchost.exe - Deleted
D:\WINDOWS\system32\4_exception.nls - Deleted
D:\WINDOWS\system32\drivers\smtpdrv.sys - Deleted
D:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
D:\WINDOWS\system32\Microsoft\backup.tftp - Deleted
D:\WINDOWS\system32\msvcrtd.exe - Deleted

Folder D:\Program Files\InetGet2 - Removed
Folder D:\Program Files\Temporary - Removed
Folder D:\Program Files\Common Files\Carlson - Removed

Removing Temp Files...

ADS Check:

D:\WINDOWS
No streams found.

D:\WINDOWS\system32
No streams found.

D:\WINDOWS\system32\svchost.exe
: ADS Found!

svchost.exe: deleted 28180 bytes in 1 streams.

Checking for remaining Streams

D:\WINDOWS\system32\svchost.exe
No streams found.

D:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\Program Files\\FlashFXP\\FlashFXP.exe"="D:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"D:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"="D:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ"
"D:\\Program Files\\WapSter\\AQQ\\AQQ.exe"="D:\\Program Files\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ"
"D:\\WINDOWS\\System32\\svchost.exe"="D:\\WINDOWS\\System32\\svchost.exe:*:Enabled:svchost"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"D:\\Program Files\\FlashFXP\\FlashFXP.exe"="D:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"

Remaining Files:
---------------

File Backups: - D:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 12 Jan 2008 42,941 ..SHR --- "D:\WINDOWS\servicestub.exe"
Fri 18 Jan 2008 154,979 ..SHR --- "D:\WINDOWS\wfdmgr.exe"
Tue 22 Jan 2008 22,395 ..SHR --- "D:\WINDOWS\wksmgr.exe"
Tue 11 Dec 2007 4,348 ..SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 11 Jan 2008 400 ..SH. --- "D:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Fri 11 Jan 2008 48 ..SH. --- "D:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Sat 19 Jan 2008 12,288 ..SH. --- "D:\WINDOWS\system32\drivers\spool.exe"
Tue 15 Jan 2008 230,400 ..SHR --- "D:\WINDOWS\system32\?ssembly\l?gonui.exe"
Tue 15 Jan 2008 72,704 ..SHR --- "D:\Documents and Settings\roni\Moje dokumenty\?racle\nopdb.exe"
Sat 26 Aug 2000 995,383 A..H. --- "D:\instalki\programy do telefon˘w\PAN\GD88\mfc42.dll"
Fri 4 May 2001 290,869 A..H. --- "D:\instalki\programy do telefon˘w\PAN\GD88\msvcrt.dll"
Wed 23 Jan 2008 4,077 ...HR --- "D:\Documents and Settings\roni\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

Finished!

Logfile of HijackThis v1.99.1
Scan saved at 13:30:45, on 2008-01-25
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\HPZipm12.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\TEMP\912E1E0F.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\System32\ctfmon.exe
D:\PROGRA~1\WapSter\AQQ\AQQ.exe
D:\WINDOWS\system32\drivers\spool.exe
C:\Program Files\Opera\Opera.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\drivers\spool.exe D:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {144EA744-17FE-2705-FABF-61A391F6F1C6} - D:\WINDOWS\System32\nvpoeggj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - D:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe
O4 - HKLM\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe
O4 - HKCU\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe
O23 - Service: FFI - Unknown owner - D:\WINDOWS\System32\svchost.exe:exm.exe (file missing)
O23 - Service: Generic Host Process for Win-32 Service - Unknown owner - D:\WINDOWS\svchost.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - D:\WINDOWS\system32\drivers\spool.exe

**Posty:** 18165 · przez **wojtas** 25 Sty 2008, 17:14

skasuj te wpisy w hijacku:

Kod: Zaznacz wszystko: F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\drivers\spool.exe D:\WINDOWS\system32\userinit.exe O2 - BHO: (no name) - {144EA744-17FE-2705-FABF-61A391F6F1C6} - D:\WINDOWS\System32\nvpoeggj.dll O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - D:\Program Files\Helper\superfindout.dll O4 - HKLM\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe O4 - HKLM\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe O4 - HKCU\..\Run: [autoload] D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe O4 - HKCU\..\Run: [ntuser] D:\WINDOWS\system32\drivers\spool.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O23 - Service: FFI - Unknown owner - D:\WINDOWS\System32\svchost.exe:exm.exe (file missing) O23 - Service: Generic Host Process for Win-32 Service - Unknown owner - D:\WINDOWS\svchost.exe (file missing) O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - D:\WINDOWS\system32\drivers\spool.exe

Otworz notatnik i wklej w nim to:

File::
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\System32\nvpoeggj.dll
D:\WINDOWS\servicestub.exe
D:\WINDOWS\wfdmgr.exe
D:\Documents and Settings\roni\Moje dokumenty\?racle\nopdb.exe
D:\WINDOWS\wksmgr.exe
D:\WINDOWS\system32\?ssembly\l?gonui.exe
D:\Program Files\Helper\superfindout.dll
D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
D:\WINDOWS\web\related.htm
D:\WINDOWS\TEMP\912E1E0F.exe

Folder::
D:\WINDOWS\system32\?ssembly
D:\Program Files\Helper
D:\Documents and Settings\roni\Moje dokumenty\?racle

Driver::
FFI
Generic Host Process for Win-32 Service
Schedule

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 177 · przez **roonnii** 29 Sty 2008, 19:16

ComboFix 08-01-29.3 - roni 2008-01-29 18:04:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.550 [GMT 1:00]
Running from: D:\instalki\ComboFix.exe
Command switches used :: D:\Documents and Settings\roni\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
D:\Documents and Settings\roni\Local Settings\Application Data\cftmon.exe
D:\Program Files\Helper\superfindout.dll
D:\WINDOWS\servicestub.exe
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\System32\nvpoeggj.dll
D:\WINDOWS\TEMP\912E1E0F.exe
D:\WINDOWS\web\related.htm
D:\WINDOWS\wfdmgr.exe
D:\WINDOWS\wksmgr.exe
.
ADS - svchost.exe: deleted 28180 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Documents and Settings\LocalService\msftp.dll
D:\Documents and Settings\roni\Moje dokumenty\RACLE~1
D:\Documents and Settings\roni\Moje dokumenty\RACLE~1\?racle\
D:\Documents and Settings\roni\Moje dokumenty\RACLE~1\nopdb.exe
D:\Documents and Settings\roni\msftp.dll
D:\Program Files\Common Files\Yazzle1560OinAdmin.exe
D:\Program Files\Common Files\Yazzle1560OinUninstaller.exe
D:\Program Files\Helper
D:\Program Files\Helper\superfindout.dll
D:\Program Files\Router
D:\Program Files\Router\UnInstall.exe
D:\WINDOWS\b122.exe
D:\WINDOWS\b128.exe
D:\WINDOWS\b151.exe
D:\WINDOWS\crosof~1
D:\WINDOWS\mrofinu1148.exe
D:\WINDOWS\servicestub.exe
D:\WINDOWS\system32\drivers\Agm41.sys
D:\WINDOWS\system32\drivers\smtpdrv.sys
D:\WINDOWS\system32\drivers\spool.exe
D:\WINDOWS\system32\msftp.dll
D:\WINDOWS\system32\msvcrtd.exe
D:\WINDOWS\system32\ssembl~1
D:\WINDOWS\system32\ssembl~1\l?gonui.exe
D:\WINDOWS\system32\wnsapisu32.exe
D:\WINDOWS\Temp\00032073.exe
D:\WINDOWS\Temp\45593694.exe
D:\WINDOWS\Temp\54309715.exe
D:\WINDOWS\TEMP\912E1E0F.exe
D:\WINDOWS\W0034_jpg.zip
D:\WINDOWS\web\related.htm
D:\WINDOWS\wfdmgr.exe
D:\WINDOWS\wksmgr.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_GENERIC_HOST_PROCESS_FOR_WIN-32_SERVICE
-------\LEGACY_SCHEDULE
-------\Generic Host Process for Win-32 Service
-------\Schedule

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-29 17:48 . 2008-01-29 17:48 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\skypePM
2008-01-29 17:48 . 2008-01-29 17:48 32 --a------ D:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-29 17:46 . 2008-01-29 18:02 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Common Files\Skype
2008-01-29 17:35 . 2008-01-29 17:36 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-28 16:33 . 2008-01-29 08:10 <DIR> d--h----- D:\WINDOWS\$hf_mig$
2008-01-28 10:45 . 2007-07-30 19:19 549,720 --a------ D:\WINDOWS\system32\wuapi.dll
2008-01-28 10:45 . 2007-07-30 19:19 325,976 --a------ D:\WINDOWS\system32\wucltui.dll
2008-01-28 10:45 . 2007-07-30 19:19 216,408 --a------ D:\WINDOWS\system32\wuaucpl.cpl
2008-01-28 10:45 . 2007-07-30 19:19 203,096 --a------ D:\WINDOWS\system32\wuweb.dll
2008-01-28 10:45 . 2004-08-03 14:04 187,160 --a------ D:\WINDOWS\system32\wuaueng1.dll
2008-01-28 10:45 . 2004-08-03 14:03 170,264 --a------ D:\WINDOWS\system32\wuauclt1.exe
2008-01-28 10:45 . 2007-07-30 19:18 33,624 --a------ D:\WINDOWS\system32\wups.dll
2008-01-28 10:39 . 2008-01-28 10:39 <DIR> d--h----- D:\Program Files\Common Files\Carlson
2008-01-26 19:37 . 2008-01-29 18:03 16 --a------ D:\WINDOWS\system32\coh.cache
2008-01-25 19:29 . 2007-10-24 18:31 3,478 --ahs---- D:\pagefile.sys.vbs
2008-01-25 19:29 . 2001-07-05 17:19 164 --a------ D:\WINDOWS\avrack.ini
2008-01-25 19:27 . 2008-01-25 19:29 <DIR> d--h----- D:\ErdUndoCache
2008-01-25 19:03 . 2008-01-25 20:42 10,740 --a------ D:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-01-25 19:03 . 2008-01-25 20:42 805 --a------ D:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-01-25 18:46 . 2008-01-26 11:51 <DIR> d-------- D:\Program Files\Norton AntiVirus
2008-01-25 18:45 . 2008-01-25 20:42 <DIR> d-------- D:\Program Files\Symantec
2008-01-25 18:45 . 2008-01-25 19:04 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-25 18:45 . 2008-01-25 20:42 123,952 --a------ D:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-25 18:45 . 2008-01-25 20:42 60,800 --a------ D:\WINDOWS\system32\S32EVNT1.DLL
2008-01-25 18:32 . 2008-01-25 20:43 <DIR> d-------- D:\Program Files\Common Files\Symantec Shared
2008-01-25 14:35 . 2008-01-25 16:22 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-25 14:35 . 2008-01-25 14:35 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-25 14:35 . 2008-01-25 14:35 2,550 --a------ D:\WINDOWS\system32\Uninstall.ico
2008-01-25 14:35 . 2008-01-25 14:35 1,406 --a------ D:\WINDOWS\system32\Help.ico
2008-01-25 12:32 . 2008-01-25 12:32 <DIR> d-------- D:\WINDOWS\ERUNT
2008-01-24 18:34 . 2008-01-24 18:34 <DIR> d-------- D:\Program Files\HT NETWORKS
2008-01-23 11:21 . 2008-01-23 11:21 54,764 --a------ D:\WINDOWS\system32\fvelwow.sys
2008-01-23 09:25 . 2008-01-23 09:25 37,632 --a------ D:\WINDOWS\system32\drivers\ntio922.sys
2008-01-23 09:25 . 2008-01-23 09:25 7,040 --a------ D:\WINDOWS\system32\drivers\ndisaluo.sys
2008-01-22 18:08 . 2008-01-22 18:08 54,764 --a------ D:\WINDOWS\system32\ztx86.sys
2008-01-20 22:11 . 2008-01-26 19:37 <DIR> d-------- D:\Program Files\Dot1XCfg
2008-01-20 15:55 . 2008-01-20 19:01 48,512 --a------ D:\WINDOWS\system32\drivers\nkv2.sys
2008-01-19 22:19 . 2008-01-19 22:19 54,764 --a------ D:\WINDOWS\system32\drivers\sysldr
2008-01-18 11:25 . 2008-01-18 11:25 <DIR> d-------- D:\Program Files\Ares
2008-01-17 22:55 . 2008-01-17 22:55 <DIR> d---s---- D:\Documents and Settings\roni\UserData
2008-01-17 22:49 . 2008-01-17 22:49 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\HP
2008-01-17 22:05 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\Common Files\HP
2008-01-17 22:03 . 2008-01-17 22:03 <DIR> d-------- D:\Program Files\Hewlett-Packard
2008-01-17 22:02 . 2008-01-17 22:02 <DIR> d-------- D:\Program Files\Common Files\Hewlett-Packard
2008-01-17 21:57 . 2005-03-08 05:43 51,120 -ra------ D:\WINDOWS\system32\drivers\HPZid412.sys
2008-01-17 21:57 . 2005-03-08 05:43 21,744 -ra------ D:\WINDOWS\system32\drivers\HPZius12.sys
2008-01-17 21:57 . 2005-03-08 05:43 16,496 -ra------ D:\WINDOWS\system32\drivers\HPZipr12.sys
2008-01-17 21:56 . 1998-10-29 16:45 306,688 --a------ D:\WINDOWS\IsUninst.exe
2008-01-17 21:56 . 2004-09-29 12:12 278,584 --a------ D:\WINDOWS\system32\HPZidr12.dll
2008-01-17 21:56 . 2004-09-29 12:15 204,800 --a------ D:\WINDOWS\system32\HPZipr12.dll
2008-01-17 21:56 . 2004-09-29 12:09 94,208 --a------ D:\WINDOWS\system32\HPZipt12.dll
2008-01-17 21:56 . 2004-09-29 12:14 69,632 --a------ D:\WINDOWS\system32\HPZipm12.exe
2008-01-17 21:56 . 2004-09-29 12:08 61,440 --a------ D:\WINDOWS\system32\HPZinw12.exe
2008-01-17 21:56 . 2004-09-29 12:09 57,344 --a------ D:\WINDOWS\system32\HPZisn12.dll
2008-01-17 21:56 . 2002-08-29 01:48 14,208 --a------ D:\WINDOWS\system32\drivers\usbscan.sys
2008-01-17 21:54 . 2003-07-03 17:49 138,752 --a------ D:\WINDOWS\system32\drivers\usbport.sys
2008-01-17 21:54 . 2003-07-03 17:52 53,120 --a------ D:\WINDOWS\system32\drivers\usbhub.sys
2008-01-17 21:54 . 2003-07-03 17:53 28,160 --a------ D:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-17 21:54 . 2003-07-03 17:50 25,216 --a------ D:\WINDOWS\system32\drivers\usbehci.sys
2008-01-17 21:54 . 2003-07-03 17:51 16,000 --a------ D:\WINDOWS\system32\drivers\usbohci.sys
2008-01-17 21:54 . 2003-07-03 17:50 5,632 --a------ D:\WINDOWS\system32\hccoin.dll
2008-01-17 21:49 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\HP
2008-01-17 21:45 . 2008-01-17 21:45 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\HP
2008-01-17 21:44 . 2002-08-29 01:50 24,960 --a------ D:\WINDOWS\system32\drivers\usbprint.sys
2008-01-17 21:43 . 2008-01-17 21:43 <DIR> d-------- D:\WUTemp
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\UC.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\RAR.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKUNZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\NOCLOSE.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\LHA.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\ARJ.PIF
2008-01-17 04:07 . 2008-01-17 04:08 387 --a------ D:\WINDOWS\wincmd.ini
2008-01-17 03:41 . 2008-01-17 03:41 <DIR> d-------- D:\Program Files\Realtek AC97
2008-01-17 03:41 . 2004-12-22 10:06 17,584,128 --a------ D:\WINDOWS\system32\ALSNDMGR.CPL
2008-01-17 03:41 . 2004-12-22 10:07 2,304,320 --a------ D:\WINDOWS\system32\drivers\ALCXWDM.SYS
2008-01-17 03:41 . 2002-02-05 06:54 141,016 --a------ D:\WINDOWS\system32\ALSNDMGR.WAV
2008-01-17 03:41 . 2004-09-01 13:04 139,264 --a------ D:\WINDOWS\alcrmv.exe
2008-01-17 03:41 . 2002-08-29 02:01 134,272 --a------ D:\WINDOWS\system32\drivers\portcls.sys
2008-01-17 03:41 . 2002-08-29 01:32 57,856 --a------ D:\WINDOWS\system32\drivers\drmk.sys
2008-01-17 03:27 . 2008-01-25 19:27 <DIR> d-------- D:\Program Files\BearShare
2008-01-17 03:27 . 2008-01-17 03:27 <DIR> d-------- D:\My Downloads
2008-01-16 13:41 . 2008-01-16 13:42 <DIR> d-------- D:\Program Files\Winamp
2008-01-16 13:41 . 2008-01-25 19:29 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Winamp
2008-01-15 19:31 . 2008-01-15 19:31 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\vlc
2008-01-15 19:30 . 2008-01-15 19:30 <DIR> d-------- D:\Program Files\VideoLAN
2008-01-15 13:48 . 2008-01-15 13:48 <DIR> d--hs---- D:\WINDOWS\ftpcache
2008-01-14 21:52 . 2004-08-03 13:59 185,624 --a------ D:\WINDOWS\system32\iuengine.dll
2008-01-11 21:09 . 2008-01-23 14:22 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited
2008-01-11 20:30 . 2008-01-11 20:30 <DIR> d-------- D:\Program Files\Electronic Arts
2008-01-11 17:30 . 2005-06-24 16:24 438,272 -ra------ D:\WINDOWS\system32\vp6vfw.dll
2008-01-11 17:30 . 2004-12-10 09:06 327,680 --a------ D:\WINDOWS\system32\vp6dec.ax
2008-01-11 02:14 . 2008-01-11 02:14 <DIR> d-------- D:\Program Files\IrfanView
2008-01-11 02:11 . 2008-01-11 02:11 <DIR> d-------- D:\Program Files\Sony Ericsson
2008-01-11 00:52 . 2008-01-11 00:52 <DIR> dr-h----- D:\Documents and Settings\roni\Dane aplikacji\SecuROM
2008-01-11 00:52 . 2008-01-23 14:26 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Bioshock
2008-01-11 00:52 . 2006-11-01 14:42 33,280 --a------ D:\WINDOWS\system32\drivers\AmdLLD.sys
2008-01-11 00:46 . 2008-01-17 03:30 <DIR> d-------- D:\Program Files\DC++

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 17:00 42,496 ----a-w D:\WINDOWS\system32\ftp.exe
2008-01-29 17:00 16,896 ----a-w D:\WINDOWS\system32\tftp.exe
2008-01-25 15:18 --------- d-----w D:\Program Files\VDOTool
2008-01-25 15:15 --------- d-----w D:\Program Files\FlashFXP
2008-01-25 15:06 --------- d-----w D:\Program Files\DAEMON Tools
2008-01-22 17:08 12,800 ----a-w D:\WINDOWS\system32\svchost.exe
2008-01-15 13:00 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-01-15 12:48 --------- d-----w D:\Program Files\Common Files\InstallShield
2008-01-11 12:21 133,632 ----a-w D:\WINDOWS\system32\sfc_os.dll
2008-01-10 23:52 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll
2008-01-10 23:52 --------- d-----w D:\Program Files\AMD
2007-12-16 12:53 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Talkback
2007-12-16 12:52 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\FlashFXP
2007-12-14 15:02 --------- d-----w D:\Program Files\SystemRequirementsLab
2007-12-14 15:02 --------- d-----w D:\Program Files\Java
2007-12-14 14:59 --------- d-----w D:\Program Files\Common Files\Java
2007-12-13 16:59 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\InstallShield Installation Information
2007-12-13 16:56 --------- d-----w D:\Program Files\ToniArts
2007-12-13 16:48 --------- d-----w D:\Program Files\AGEIA Technologies
2007-12-13 16:47 --------- d-----w D:\Program Files\Common Files\Wise Installation Wizard
2007-12-13 16:30 --------- d-----w D:\Program Files\AIDA32 - Personal System Information
2007-12-12 14:04 --------- d-----w D:\Program Files\MarBit
2007-12-11 17:13 --------- d-----w D:\Program Files\Microsoft.NET
2007-12-11 16:57 639,224 ----a-w D:\WINDOWS\system32\drivers\sptd.sys
2007-12-11 16:19 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Media Player Classic
2007-12-11 15:50 --------- d-----w D:\Program Files\Common Files\Adobe
2007-12-11 15:41 --------- d-----w D:\Program Files\K-Lite Codec Pack
2007-12-11 15:03 --------- d-----w D:\Program Files\WapSter
2007-12-11 11:36 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Gadu-Gadu
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\MSN6
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\MSN6
2007-12-11 11:17 --------- d-----w D:\Program Files\Realtek Sound Manager
2007-12-11 11:17 --------- d-----w D:\Program Files\AvRack
2007-12-11 11:13 --------- d--h--w D:\Program Files\Uninstall Information
2007-12-11 11:09 --------- d-----w D:\Program Files\microsoft frontpage
2007-12-11 11:08 558,142 ----a-w D:\WINDOWS\java\Packages\N7VLZVJ5.ZIP
2007-12-11 11:08 155,995 ----a-w D:\WINDOWS\java\Packages\QLBDVP3R.ZIP
2007-12-11 11:05 --------- d-----w D:\Program Files\Usługi online
2007-11-30 22:57 43,696 ----a-w D:\WINDOWS\system32\drivers\srtspx.sys
2007-11-30 22:57 317,616 ----a-w D:\WINDOWS\system32\drivers\srtspl.sys
2007-11-30 22:57 279,088 ----a-w D:\WINDOWS\system32\drivers\srtsp.sys
2007-10-30 18:55 625,032 ----a-w D:\WINDOWS\system32\SymNeti.dll
2007-10-30 18:55 242,056 ----a-w D:\WINDOWS\system32\SymRedir.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"AQQ"="D:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864]
"ares"="D:\Program Files\Ares\Ares.exe" [2007-07-16 22:54 961536]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11 21803304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 10:09 77824 D:\WINDOWS\SOUNDMAN.EXE]
"Gainward"="D:\Program Files\VDOTool\TBPanel.exe" [2007-06-26 14:58 2165272]
"NvCplDaemon"="D:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 D:\WINDOWS\system32\nwiz.exe]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NvMediaCenter"="D:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"amd_dc_opt"="D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824]
"servicestub.exe"="D:\WINDOWS\servicestub.exe" [ ]
"ccApp"="D:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 08:04 84640]
"osCheck"="D:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-06 02:22 26248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05 13312]

*Newly Created Service* - UPNPHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 19:00:00 D:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - roni.job"
- D:\PROGRA~1\NORTON~1\Navw32.exef/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 18:09:26
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
D:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\WapSter\AQQ\AQQ.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\Winamp\winamp.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_0_0_89\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe
D:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-01-29 18:14:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-29 17:13:44

[ Dodano: Dzisiaj o 18:16 ]

Logfile of HijackThis v1.99.1
Scan saved at 18:16:24, on 2008-01-29
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\WINDOWS\System32\ctfmon.exe
D:\PROGRA~1\WapSter\AQQ\AQQ.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Winamp\winamp.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_0_0_89\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe
D:\WINDOWS\system32\msiexec.exe
C:\Program Files\Opera\Opera.exe
D:\WINDOWS\system32\MsiExec.exe
D:\WINDOWS\system32\MsiExec.exe
D:\instalki\hijackthis_199\HijackThis.exe
D:\PROGRA~1\COMMON~1\SYMANT~1\Sevinst.exe
D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [amd_dc_opt] D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [servicestub.exe] D:\WINDOWS\servicestub.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "D:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

**Posty:** 18165 · przez **wojtas** 29 Sty 2008, 21:10

Otworz notatnik i wklej w nim to:

File::
D:\pagefile.sys.vbs
D:\WINDOWS\avrack.ini
D:\WINDOWS\system32\drivers\ntio922.sys
D:\WINDOWS\system32\fvelwow.sys
D:\WINDOWS\system32\drivers\ndisaluo.sys
D:\WINDOWS\system32\ztx86.sys
D:\WINDOWS\system32\drivers\sysldr

Folder::
D:\Program Files\Dot1XCfg

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"servicestub.exe"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 177 · przez **roonnii** 01 Lut 2008, 11:00

ComboFix 08-01-29.3 - roni 2008-02-01 9:50:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.617 [GMT 1:00]
Running from: D:\instalki\ComboFix.exe
Command switches used :: D:\Documents and Settings\roni\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
D:\pagefile.sys.vbs
D:\WINDOWS\avrack.ini
D:\WINDOWS\system32\drivers\ndisaluo.sys
D:\WINDOWS\system32\drivers\ntio922.sys
D:\WINDOWS\system32\drivers\sysldr
D:\WINDOWS\system32\fvelwow.sys
D:\WINDOWS\system32\ztx86.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\pagefile.sys.vbs
D:\Program Files\Dot1XCfg
D:\WINDOWS\system32\drivers\ndisaluo.sys
D:\WINDOWS\system32\drivers\ntio922.sys
D:\WINDOWS\system32\drivers\sysldr
D:\WINDOWS\system32\fvelwow.sys
D:\WINDOWS\system32\ztx86.sys

.
((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-02-01 09:46 . 2008-02-01 09:46 25 --a------ D:\WINDOWS\Ya.com
2008-02-01 09:42 . 2008-02-01 09:46 1,048,776 -r-hs---- D:\WINDOWS\himem.exe
2008-02-01 09:20 . 2008-02-01 09:20 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia Multimedia Player
2008-02-01 09:09 . 2008-02-01 09:22 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia
2008-02-01 09:09 . 2008-02-01 09:09 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\PC Connectivity Solution
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Nokia
2008-02-01 09:08 . 2008-02-01 09:09 <DIR> d-------- D:\Program Files\DIFX
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Common Files\PCSuite
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Common Files\Nokia
2008-02-01 09:08 . 2008-02-01 09:09 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\PC Suite
2008-02-01 09:08 . 2007-02-22 10:15 137,216 --a------ D:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-01 09:08 . 2007-02-22 10:15 65,536 --a------ D:\WINDOWS\system32\nmwcdcocls.dll
2008-02-01 09:08 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-01 09:08 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-02-01 09:08 . 2007-02-22 10:15 8,320 --a------ D:\WINDOWS\system32\drivers\nmwcdc.sys
2008-01-30 21:32 . 2007-10-26 11:20 4,124,352 -ra------ D:\WINDOWS\system32\drivers\alcxwdm.sys
2008-01-30 21:32 . 2007-04-16 15:28 577,536 --a------ D:\WINDOWS\soundman.exe
2008-01-30 21:32 . 2002-08-29 02:01 134,272 --a------ D:\WINDOWS\system32\drivers\portcls.sys
2008-01-30 21:32 . 2002-08-29 02:01 134,272 --a--c--- D:\WINDOWS\system32\dllcache\portcls.sys
2008-01-30 21:32 . 2002-08-29 01:32 57,856 --a------ D:\WINDOWS\system32\drivers\drmk.sys
2008-01-30 21:32 . 2002-08-29 01:32 57,856 --a--c--- D:\WINDOWS\system32\dllcache\drmk.sys
2008-01-30 21:31 . 2008-01-30 21:32 <DIR> d-------- D:\Program Files\Realtek AC97
2008-01-30 21:31 . 2006-11-17 05:40 18,804,736 --a------ D:\WINDOWS\system32\alsndmgr.cpl
2008-01-30 21:31 . 2006-12-08 15:20 10,528,768 --a------ D:\WINDOWS\system32\RTLCPL.exe
2008-01-30 21:31 . 2006-07-31 11:27 217,088 --a------ D:\WINDOWS\Alcrmv.exe
2008-01-30 21:31 . 2006-10-18 02:53 147,456 --a------ D:\WINDOWS\system32\RtlCPAPI.dll
2008-01-30 21:31 . 2002-02-05 13:54 141,016 --a------ D:\WINDOWS\system32\alsndmgr.wav
2008-01-30 16:27 . 2008-01-30 16:27 19 --a------ D:\WINDOWS\SoundConverter.INI
2008-01-30 09:04 . 2008-02-01 09:10 <DIR> d-------- D:\Documents and Settings\roni\Phone Browser
2008-01-29 18:32 . 2008-01-29 18:32 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-01-29 17:48 . 2008-02-01 08:59 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\skypePM
2008-01-29 17:48 . 2008-01-29 17:48 32 --a------ D:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-29 17:46 . 2008-02-01 08:59 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Common Files\Skype
2008-01-29 17:35 . 2008-01-29 17:36 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-28 16:33 . 2008-01-29 18:16 <DIR> d--h----- D:\WINDOWS\$hf_mig$
2008-01-28 10:45 . 2007-07-30 19:19 549,720 --a------ D:\WINDOWS\system32\wuapi.dll
2008-01-28 10:45 . 2007-07-30 19:19 325,976 --a------ D:\WINDOWS\system32\wucltui.dll
2008-01-28 10:45 . 2007-07-30 19:19 216,408 --a------ D:\WINDOWS\system32\wuaucpl.cpl
2008-01-28 10:45 . 2007-07-30 19:19 203,096 --a------ D:\WINDOWS\system32\wuweb.dll
2008-01-28 10:45 . 2004-08-03 14:04 187,160 --a------ D:\WINDOWS\system32\wuaueng1.dll
2008-01-28 10:45 . 2004-08-03 14:03 170,264 --a------ D:\WINDOWS\system32\wuauclt1.exe
2008-01-28 10:45 . 2007-07-30 19:18 33,624 --a------ D:\WINDOWS\system32\wups.dll
2008-01-28 10:39 . 2008-01-28 10:39 <DIR> d--h----- D:\Program Files\Common Files\Carlson
2008-01-26 19:37 . 2008-01-29 18:03 16 --a------ D:\WINDOWS\system32\coh.cache
2008-01-25 19:27 . 2008-01-25 19:29 <DIR> d--h----- D:\ErdUndoCache
2008-01-25 18:46 . 2008-01-30 09:04 <DIR> d-------- D:\Program Files\Norton AntiVirus
2008-01-25 18:45 . 2008-01-30 09:04 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-25 18:32 . 2008-01-29 18:20 <DIR> d-------- D:\Program Files\Common Files\Symantec Shared
2008-01-25 14:35 . 2008-01-25 16:22 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-25 14:35 . 2008-01-25 14:35 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-25 14:35 . 2008-01-25 14:35 2,550 --a------ D:\WINDOWS\system32\Uninstall.ico
2008-01-25 14:35 . 2008-01-25 14:35 1,406 --a------ D:\WINDOWS\system32\Help.ico
2008-01-25 12:32 . 2008-01-25 12:32 <DIR> d-------- D:\WINDOWS\ERUNT
2008-01-24 18:34 . 2008-01-24 18:34 <DIR> d-------- D:\Program Files\HT NETWORKS
2008-01-20 15:55 . 2008-01-20 19:01 48,512 --a------ D:\WINDOWS\system32\drivers\nkv2.sys
2008-01-18 11:25 . 2008-01-18 11:25 <DIR> d-------- D:\Program Files\Ares
2008-01-17 22:55 . 2008-01-17 22:55 <DIR> d---s---- D:\Documents and Settings\roni\UserData
2008-01-17 22:49 . 2008-01-17 22:49 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\HP
2008-01-17 22:05 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\Common Files\HP
2008-01-17 22:03 . 2008-01-17 22:03 <DIR> d-------- D:\Program Files\Hewlett-Packard
2008-01-17 22:02 . 2008-01-17 22:02 <DIR> d-------- D:\Program Files\Common Files\Hewlett-Packard
2008-01-17 21:57 . 2005-03-08 05:43 51,120 -ra------ D:\WINDOWS\system32\drivers\HPZid412.sys
2008-01-17 21:57 . 2005-03-08 05:43 21,744 -ra------ D:\WINDOWS\system32\drivers\HPZius12.sys
2008-01-17 21:57 . 2005-03-08 05:43 16,496 -ra------ D:\WINDOWS\system32\drivers\HPZipr12.sys
2008-01-17 21:56 . 1998-10-29 16:45 306,688 --a------ D:\WINDOWS\IsUninst.exe
2008-01-17 21:56 . 2004-09-29 12:12 278,584 --a------ D:\WINDOWS\system32\HPZidr12.dll
2008-01-17 21:56 . 2004-09-29 12:15 204,800 --a------ D:\WINDOWS\system32\HPZipr12.dll
2008-01-17 21:56 . 2004-09-29 12:09 94,208 --a------ D:\WINDOWS\system32\HPZipt12.dll
2008-01-17 21:56 . 2004-09-29 12:14 69,632 --a------ D:\WINDOWS\system32\HPZipm12.exe
2008-01-17 21:56 . 2004-09-29 12:08 61,440 --a------ D:\WINDOWS\system32\HPZinw12.exe
2008-01-17 21:56 . 2004-09-29 12:09 57,344 --a------ D:\WINDOWS\system32\HPZisn12.dll
2008-01-17 21:56 . 2002-08-29 01:48 14,208 --a------ D:\WINDOWS\system32\drivers\usbscan.sys
2008-01-17 21:54 . 2003-07-03 17:49 138,752 --a------ D:\WINDOWS\system32\drivers\usbport.sys
2008-01-17 21:54 . 2003-07-03 17:52 53,120 --a------ D:\WINDOWS\system32\drivers\usbhub.sys
2008-01-17 21:54 . 2003-07-03 17:53 28,160 --a------ D:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-17 21:54 . 2003-07-03 17:50 25,216 --a------ D:\WINDOWS\system32\drivers\usbehci.sys
2008-01-17 21:54 . 2003-07-03 17:51 16,000 --a------ D:\WINDOWS\system32\drivers\usbohci.sys
2008-01-17 21:54 . 2003-07-03 17:50 5,632 --a------ D:\WINDOWS\system32\hccoin.dll
2008-01-17 21:49 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\HP
2008-01-17 21:45 . 2008-01-17 21:45 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\HP
2008-01-17 21:44 . 2002-08-29 01:50 24,960 --a------ D:\WINDOWS\system32\drivers\usbprint.sys
2008-01-17 21:43 . 2008-01-17 21:43 <DIR> d-------- D:\WUTemp
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\UC.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\RAR.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKUNZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\NOCLOSE.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\LHA.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\ARJ.PIF
2008-01-17 04:07 . 2008-01-17 04:08 387 --a------ D:\WINDOWS\wincmd.ini
2008-01-17 03:27 . 2008-01-25 19:27 <DIR> d-------- D:\Program Files\BearShare
2008-01-17 03:27 . 2008-01-17 03:27 <DIR> d-------- D:\My Downloads
2008-01-16 13:41 . 2008-01-16 13:42 <DIR> d-------- D:\Program Files\Winamp
2008-01-16 13:41 . 2008-01-25 19:29 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Winamp
2008-01-15 19:31 . 2008-01-15 19:31 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\vlc
2008-01-15 19:30 . 2008-01-15 19:30 <DIR> d-------- D:\Program Files\VideoLAN
2008-01-15 13:48 . 2008-01-15 13:48 <DIR> d--hs---- D:\WINDOWS\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 15:33 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-01-25 15:18 --------- d-----w D:\Program Files\VDOTool
2008-01-25 15:15 --------- d-----w D:\Program Files\FlashFXP
2008-01-25 15:06 --------- d-----w D:\Program Files\DAEMON Tools
2008-01-15 12:48 --------- d-----w D:\Program Files\Common Files\InstallShield
2008-01-10 23:52 --------- d-----w D:\Program Files\AMD
2007-12-16 12:53 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Talkback
2007-12-16 12:52 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\FlashFXP
2007-12-14 15:02 --------- d-----w D:\Program Files\SystemRequirementsLab
2007-12-14 15:02 --------- d-----w D:\Program Files\Java
2007-12-14 14:59 --------- d-----w D:\Program Files\Common Files\Java
2007-12-13 16:59 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\InstallShield Installation Information
2007-12-13 16:56 --------- d-----w D:\Program Files\ToniArts
2007-12-13 16:48 --------- d-----w D:\Program Files\AGEIA Technologies
2007-12-13 16:47 --------- d-----w D:\Program Files\Common Files\Wise Installation Wizard
2007-12-13 16:30 --------- d-----w D:\Program Files\AIDA32 - Personal System Information
2007-12-12 14:04 --------- d-----w D:\Program Files\MarBit
2007-12-11 17:13 --------- d-----w D:\Program Files\Microsoft.NET
2007-12-11 16:57 639,224 ----a-w D:\WINDOWS\system32\drivers\sptd.sys
2007-12-11 16:19 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Media Player Classic
2007-12-11 15:50 --------- d-----w D:\Program Files\Common Files\Adobe
2007-12-11 15:41 --------- d-----w D:\Program Files\K-Lite Codec Pack
2007-12-11 15:03 --------- d-----w D:\Program Files\WapSter
2007-12-11 11:36 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Gadu-Gadu
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\MSN6
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\MSN6
2007-12-11 11:17 --------- d-----w D:\Program Files\Realtek Sound Manager
2007-12-11 11:17 --------- d-----w D:\Program Files\AvRack
2007-12-11 11:13 --------- d--h--w D:\Program Files\Uninstall Information
2007-12-11 11:09 --------- d-----w D:\Program Files\microsoft frontpage
2007-12-11 11:08 558,142 ----a-w D:\WINDOWS\java\Packages\N7VLZVJ5.ZIP
2007-12-11 11:08 155,995 ----a-w D:\WINDOWS\java\Packages\QLBDVP3R.ZIP
2007-12-11 11:05 --------- d-----w D:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"AQQ"="D:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11 21803304]
"ares"="D:\Program Files\Ares\Ares.exe" [2007-07-16 22:54 961536]
"himem"="d:\windows\himem.exe" [2008-02-01 09:46 1048776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="D:\Program Files\VDOTool\TBPanel.exe" [2007-06-26 14:58 2165272]
"NvCplDaemon"="D:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NvMediaCenter"="D:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920]
"amd_dc_opt"="D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 D:\WINDOWS\soundman.exe]
"PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05 13312]
"Nokia.PCSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 09:54:36
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Ares\Ares.exe
D:\windows\himem.exe
C:\Program Files\Opera\Opera.exe
.
**************************************************************************
.
Completion time: 2008-02-01 9:59:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-01 08:59:30
ComboFix2.txt 2008-01-29 17:14:04

[ Dodano: Dzisiaj o 10:00 ]

Logfile of HijackThis v1.99.1
Scan saved at 10:26:57, on 2008-02-01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Ares\Ares.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Documents and Settings\roni\Ustawienia lokalne\Dane aplikacji\Ares\My Shared Folder\find nokia 6151 temas using emule multimedia toolbar.exe
D:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe

**Posty:** 3854 · przez **Dzi@dek** 01 Lut 2008, 11:12

O4 - HKCU\..\Run: [himem] "d:\windows\himem.exe" 3fff 8ffff
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm (file missing)

Usuń te wpisy w hijackthis.

Otwórz notatnik i wklej:

File::
d:\windows\himem.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"himem"=-

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w
takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zresetuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

Ponadto sprawdź te dane, jeśli jest jak opisane poniżej - zastosuj sie do opisu.:

# Usuń wszystkie zainfekowane wiadomości z wszystkich folderów pocztowych.
# Uruchom ponownie komputer.
# Usuń następujące pliki:

%System%\diagisr.dll
%System%\isrprf32.dll
%System%\isrprov.exe
%System%\117X4sHrH5C.dll

Otwórz notatnik i wklej:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = " "

Plik zapisz jako -> zmien rozszerzenie z *.txt na Wszystkie pliki *.* -> i zapisz jako FIX.REG

Klikasz dwa razy na utworzony plik FIX.REG i potwierdzasz dodanie go do rejestru.

**Posty:** 177 · przez **roonnii** 01 Lut 2008, 11:23

ComboFix 08-01-29.3 - roni 2008-02-01 10:19:58.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.664 [GMT 1:00]
Running from: D:\Documents and Settings\roni\Pulpit\ComboFix.exe
Command switches used :: D:\Documents and Settings\roni\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
d:\windows\himem.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\himem.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-02-01 09:56 . 2008-02-01 09:56 <DIR> d-------- D:\WINDOWS\LastGood
2008-02-01 09:46 . 2008-02-01 10:21 25 --a------ D:\WINDOWS\Ya.com
2008-02-01 09:20 . 2008-02-01 09:20 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia Multimedia Player
2008-02-01 09:09 . 2008-02-01 10:16 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia
2008-02-01 09:09 . 2008-02-01 09:09 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\PC Connectivity Solution
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Nokia
2008-02-01 09:08 . 2008-02-01 09:09 <DIR> d-------- D:\Program Files\DIFX
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Common Files\PCSuite
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Common Files\Nokia
2008-02-01 09:08 . 2008-02-01 09:09 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\PC Suite
2008-02-01 09:08 . 2007-02-22 10:15 137,216 --a------ D:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-01 09:08 . 2007-02-22 10:15 65,536 --a------ D:\WINDOWS\system32\nmwcdcocls.dll
2008-02-01 09:08 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-01 09:08 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-02-01 09:08 . 2007-02-22 10:15 8,320 --a------ D:\WINDOWS\system32\drivers\nmwcdc.sys
2008-01-30 21:32 . 2007-10-26 11:20 4,124,352 -ra------ D:\WINDOWS\system32\drivers\alcxwdm.sys
2008-01-30 21:32 . 2007-04-16 15:28 577,536 --a------ D:\WINDOWS\soundman.exe
2008-01-30 21:32 . 2002-08-29 02:01 134,272 --a------ D:\WINDOWS\system32\drivers\portcls.sys
2008-01-30 21:32 . 2002-08-29 02:01 134,272 --a--c--- D:\WINDOWS\system32\dllcache\portcls.sys
2008-01-30 21:32 . 2002-08-29 01:32 57,856 --a------ D:\WINDOWS\system32\drivers\drmk.sys
2008-01-30 21:32 . 2002-08-29 01:32 57,856 --a--c--- D:\WINDOWS\system32\dllcache\drmk.sys
2008-01-30 21:31 . 2008-01-30 21:32 <DIR> d-------- D:\Program Files\Realtek AC97
2008-01-30 21:31 . 2006-11-17 05:40 18,804,736 --a------ D:\WINDOWS\system32\alsndmgr.cpl
2008-01-30 21:31 . 2006-12-08 15:20 10,528,768 --a------ D:\WINDOWS\system32\RTLCPL.exe
2008-01-30 21:31 . 2006-07-31 11:27 217,088 --a------ D:\WINDOWS\Alcrmv.exe
2008-01-30 21:31 . 2006-10-18 02:53 147,456 --a------ D:\WINDOWS\system32\RtlCPAPI.dll
2008-01-30 21:31 . 2002-02-05 13:54 141,016 --a------ D:\WINDOWS\system32\alsndmgr.wav
2008-01-30 16:27 . 2008-01-30 16:27 19 --a------ D:\WINDOWS\SoundConverter.INI
2008-01-30 09:04 . 2008-02-01 09:10 <DIR> d-------- D:\Documents and Settings\roni\Phone Browser
2008-01-29 18:32 . 2008-01-29 18:32 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-01-29 17:48 . 2008-02-01 08:59 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\skypePM
2008-01-29 17:48 . 2008-01-29 17:48 32 --a------ D:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-29 17:46 . 2008-02-01 09:56 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Common Files\Skype
2008-01-29 17:35 . 2008-01-29 17:36 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-28 16:33 . 2008-01-29 18:16 <DIR> d--h----- D:\WINDOWS\$hf_mig$
2008-01-28 10:45 . 2007-07-30 19:19 549,720 --a------ D:\WINDOWS\system32\wuapi.dll
2008-01-28 10:45 . 2007-07-30 19:19 325,976 --a------ D:\WINDOWS\system32\wucltui.dll
2008-01-28 10:45 . 2007-07-30 19:19 216,408 --a------ D:\WINDOWS\system32\wuaucpl.cpl
2008-01-28 10:45 . 2007-07-30 19:19 203,096 --a------ D:\WINDOWS\system32\wuweb.dll
2008-01-28 10:45 . 2004-08-03 14:04 187,160 --a------ D:\WINDOWS\system32\wuaueng1.dll
2008-01-28 10:45 . 2004-08-03 14:03 170,264 --a------ D:\WINDOWS\system32\wuauclt1.exe
2008-01-28 10:45 . 2007-07-30 19:18 33,624 --a------ D:\WINDOWS\system32\wups.dll
2008-01-28 10:39 . 2008-01-28 10:39 <DIR> d--h----- D:\Program Files\Common Files\Carlson
2008-01-26 19:37 . 2008-01-29 18:03 16 --a------ D:\WINDOWS\system32\coh.cache
2008-01-25 19:27 . 2008-01-25 19:29 <DIR> d--h----- D:\ErdUndoCache
2008-01-25 18:46 . 2008-01-30 09:04 <DIR> d-------- D:\Program Files\Norton AntiVirus
2008-01-25 18:45 . 2008-01-30 09:04 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-25 18:32 . 2008-01-29 18:20 <DIR> d-------- D:\Program Files\Common Files\Symantec Shared
2008-01-25 14:35 . 2008-01-25 16:22 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-25 14:35 . 2008-01-25 14:35 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-25 14:35 . 2008-01-25 14:35 2,550 --a------ D:\WINDOWS\system32\Uninstall.ico
2008-01-25 14:35 . 2008-01-25 14:35 1,406 --a------ D:\WINDOWS\system32\Help.ico
2008-01-25 12:32 . 2008-01-25 12:32 <DIR> d-------- D:\WINDOWS\ERUNT
2008-01-24 18:34 . 2008-01-24 18:34 <DIR> d-------- D:\Program Files\HT NETWORKS
2008-01-20 15:55 . 2008-01-20 19:01 48,512 --a------ D:\WINDOWS\system32\drivers\nkv2.sys
2008-01-18 11:25 . 2008-01-18 11:25 <DIR> d-------- D:\Program Files\Ares
2008-01-17 22:55 . 2008-01-17 22:55 <DIR> d---s---- D:\Documents and Settings\roni\UserData
2008-01-17 22:49 . 2008-01-17 22:49 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\HP
2008-01-17 22:05 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\Common Files\HP
2008-01-17 22:03 . 2008-01-17 22:03 <DIR> d-------- D:\Program Files\Hewlett-Packard
2008-01-17 22:02 . 2008-01-17 22:02 <DIR> d-------- D:\Program Files\Common Files\Hewlett-Packard
2008-01-17 21:57 . 2005-03-08 05:43 51,120 -ra------ D:\WINDOWS\system32\drivers\HPZid412.sys
2008-01-17 21:57 . 2005-03-08 05:43 21,744 -ra------ D:\WINDOWS\system32\drivers\HPZius12.sys
2008-01-17 21:57 . 2005-03-08 05:43 16,496 -ra------ D:\WINDOWS\system32\drivers\HPZipr12.sys
2008-01-17 21:56 . 1998-10-29 16:45 306,688 --a------ D:\WINDOWS\IsUninst.exe
2008-01-17 21:56 . 2004-09-29 12:12 278,584 --a------ D:\WINDOWS\system32\HPZidr12.dll
2008-01-17 21:56 . 2004-09-29 12:15 204,800 --a------ D:\WINDOWS\system32\HPZipr12.dll
2008-01-17 21:56 . 2004-09-29 12:09 94,208 --a------ D:\WINDOWS\system32\HPZipt12.dll
2008-01-17 21:56 . 2004-09-29 12:14 69,632 --a------ D:\WINDOWS\system32\HPZipm12.exe
2008-01-17 21:56 . 2004-09-29 12:08 61,440 --a------ D:\WINDOWS\system32\HPZinw12.exe
2008-01-17 21:56 . 2004-09-29 12:09 57,344 --a------ D:\WINDOWS\system32\HPZisn12.dll
2008-01-17 21:56 . 2002-08-29 01:48 14,208 --a------ D:\WINDOWS\system32\drivers\usbscan.sys
2008-01-17 21:54 . 2003-07-03 17:49 138,752 --a------ D:\WINDOWS\system32\drivers\usbport.sys
2008-01-17 21:54 . 2003-07-03 17:52 53,120 --a------ D:\WINDOWS\system32\drivers\usbhub.sys
2008-01-17 21:54 . 2003-07-03 17:53 28,160 --a------ D:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-17 21:54 . 2003-07-03 17:50 25,216 --a------ D:\WINDOWS\system32\drivers\usbehci.sys
2008-01-17 21:54 . 2003-07-03 17:51 16,000 --a------ D:\WINDOWS\system32\drivers\usbohci.sys
2008-01-17 21:54 . 2003-07-03 17:50 5,632 --a------ D:\WINDOWS\system32\hccoin.dll
2008-01-17 21:49 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\HP
2008-01-17 21:45 . 2008-01-17 21:45 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\HP
2008-01-17 21:44 . 2002-08-29 01:50 24,960 --a------ D:\WINDOWS\system32\drivers\usbprint.sys
2008-01-17 21:43 . 2008-01-17 21:43 <DIR> d-------- D:\WUTemp
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\UC.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\RAR.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKUNZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\NOCLOSE.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\LHA.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\ARJ.PIF
2008-01-17 04:07 . 2008-01-17 04:08 387 --a------ D:\WINDOWS\wincmd.ini
2008-01-17 03:27 . 2008-01-25 19:27 <DIR> d-------- D:\Program Files\BearShare
2008-01-17 03:27 . 2008-01-17 03:27 <DIR> d-------- D:\My Downloads
2008-01-16 13:41 . 2008-01-16 13:42 <DIR> d-------- D:\Program Files\Winamp
2008-01-16 13:41 . 2008-01-25 19:29 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Winamp
2008-01-15 19:31 . 2008-01-15 19:31 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\vlc
2008-01-15 19:30 . 2008-01-15 19:30 <DIR> d-------- D:\Program Files\VideoLAN
2008-01-15 13:48 . 2008-01-15 13:48 <DIR> d--hs---- D:\WINDOWS\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 15:33 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-01-29 17:00 42,496 ----a-w D:\WINDOWS\system32\ftp.exe
2008-01-29 17:00 16,896 ----a-w D:\WINDOWS\system32\tftp.exe
2008-01-25 15:18 --------- d-----w D:\Program Files\VDOTool
2008-01-25 15:15 --------- d-----w D:\Program Files\FlashFXP
2008-01-25 15:06 --------- d-----w D:\Program Files\DAEMON Tools
2008-01-22 17:08 12,800 ----a-w D:\WINDOWS\system32\svchost.exe
2008-01-15 12:48 --------- d-----w D:\Program Files\Common Files\InstallShield
2008-01-11 12:21 133,632 ----a-w D:\WINDOWS\system32\sfc_os.dll
2008-01-10 23:52 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll
2008-01-10 23:52 --------- d-----w D:\Program Files\AMD
2007-12-16 12:53 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Talkback
2007-12-16 12:52 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\FlashFXP
2007-12-14 15:02 --------- d-----w D:\Program Files\SystemRequirementsLab
2007-12-14 15:02 --------- d-----w D:\Program Files\Java
2007-12-14 14:59 --------- d-----w D:\Program Files\Common Files\Java
2007-12-13 16:59 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\InstallShield Installation Information
2007-12-13 16:56 --------- d-----w D:\Program Files\ToniArts
2007-12-13 16:48 --------- d-----w D:\Program Files\AGEIA Technologies
2007-12-13 16:47 --------- d-----w D:\Program Files\Common Files\Wise Installation Wizard
2007-12-13 16:30 --------- d-----w D:\Program Files\AIDA32 - Personal System Information
2007-12-12 14:04 --------- d-----w D:\Program Files\MarBit
2007-12-11 17:13 --------- d-----w D:\Program Files\Microsoft.NET
2007-12-11 16:57 639,224 ----a-w D:\WINDOWS\system32\drivers\sptd.sys
2007-12-11 16:19 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Media Player Classic
2007-12-11 15:50 --------- d-----w D:\Program Files\Common Files\Adobe
2007-12-11 15:41 --------- d-----w D:\Program Files\K-Lite Codec Pack
2007-12-11 15:03 --------- d-----w D:\Program Files\WapSter
2007-12-11 11:36 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Gadu-Gadu
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\MSN6
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\MSN6
2007-12-11 11:17 --------- d-----w D:\Program Files\Realtek Sound Manager
2007-12-11 11:17 --------- d-----w D:\Program Files\AvRack
2007-12-11 11:13 --------- d--h--w D:\Program Files\Uninstall Information
2007-12-11 11:09 --------- d-----w D:\Program Files\microsoft frontpage
2007-12-11 11:08 558,142 ----a-w D:\WINDOWS\java\Packages\N7VLZVJ5.ZIP
2007-12-11 11:08 155,995 ----a-w D:\WINDOWS\java\Packages\QLBDVP3R.ZIP
2007-12-11 11:05 --------- d-----w D:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"AQQ"="D:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11 21803304]
"ares"="D:\Program Files\Ares\Ares.exe" [2007-07-16 22:54 961536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="D:\Program Files\VDOTool\TBPanel.exe" [2007-06-26 14:58 2165272]
"NvCplDaemon"="D:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NvMediaCenter"="D:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920]
"amd_dc_opt"="D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 D:\WINDOWS\soundman.exe]
"PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05 13312]
"Nokia.PCSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

*Newly Created Service* - SERVICELAYER
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 10:22:09
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-01 10:22:45
ComboFix-quarantined-files.txt 2008-02-01 09:22:22
ComboFix2.txt 2008-02-01 08:59:48
ComboFix3.txt 2008-01-29 17:14:04

[ Dodano: Dzisiaj o 10:24 ]

Logfile of HijackThis v1.99.1
Scan saved at 10:23:16, on 2008-02-01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Ares\Ares.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Documents and Settings\roni\Ustawienia lokalne\Dane aplikacji\Ares\My Shared Folder\find nokia 6151 temas using emule multimedia toolbar.exe
D:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe

[ Dodano: Dzisiaj o 10:24 ]

Logfile of HijackThis v1.99.1
Scan saved at 10:23:16, on 2008-02-01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Ares\Ares.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Documents and Settings\roni\Ustawienia lokalne\Dane aplikacji\Ares\My Shared Folder\find nokia 6151 temas using emule multimedia toolbar.exe
D:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] D:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe

**Posty:** 3854 · przez **Dzi@dek** 01 Lut 2008, 11:26

Dzi@dek napisał(a):Cytat:
Ponadto sprawdź te dane, jeśli jest jak opisane poniżej - zastosuj sie do opisu.:

# Usuń wszystkie zainfekowane wiadomości z wszystkich folderów pocztowych.
# Uruchom ponownie komputer.
# Usuń następujące pliki:

%System%\diagisr.dll
%System%\isrprf32.dll
%System%\isrprov.exe
%System%\117X4sHrH5C.dll

Otwórz notatnik i wklej:

Cytat:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = " "

Plik zapisz jako -> zmien rozszerzenie z *.txt na Wszystkie pliki *.* -> i zapisz jako FIX.REG

Klikasz dwa razy na utworzony plik FIX.REG i potwierdzasz dodanie go do rejestru.

Wykonaj jeszcze to j.w.

**Posty:** 177 · przez **roonnii** 01 Lut 2008, 11:32

a te pliki gdzie mam znaleść i jest ciągle problem z słuchaniem muzyki co łacze odwarzacz to wyskakuje problem i sie wyłącza

**Posty:** 3854 · przez **Dzi@dek** 01 Lut 2008, 11:38

Start-ustawienia-panel sterowania-opcje folderów
Zakładka widok-odznacz-nie pokazuj ukrytych plików systemu operacyjnego i zaznacz - pokaz ukryte pliki/foldery
Start-wyszukaj-pliki lub foldery.

**Posty:** 177 · przez **roonnii** 02 Lut 2008, 10:12

szukałem tych plikow i nie ma ich dalej wyskakuja mi błedy jak uruchamiam rozne aplikacje

**Posty:** 18165 · przez **wojtas** 02 Lut 2008, 12:22

jakie bledy? daj nowy log z hijacka oraz combofixa

**Posty:** 177 · przez **roonnii** 05 Lut 2008, 01:36

Logfile of HijackThis v1.99.1
Scan saved at 00:36, on 2008-02-05
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\PROGRA~1\WapSter\AQQ\AQQ.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Opera\Opera.exe
D:\Program Files\Winamp\winamp.exe
D:\instalki\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Gainward] D:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DXDllRegExe] D:\WINDOWS\System32\dxdllreg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe

[ Dodano: Dzisiaj o 0:43 ]

ComboFix 08-01-29.3 - roni 2008-02-05 0:38:08.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.481 [GMT 1:00]
Running from: D:\Documents and Settings\roni\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-02 14:36 . 2008-02-05 00:24 <DIR> d-------- D:\WINDOWS\LastGood
2008-02-02 14:36 . 2008-02-02 14:36 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-02-02 14:36 . 2007-02-22 10:15 137,216 --a------ D:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-02 14:36 . 2007-02-22 10:15 65,536 --a------ D:\WINDOWS\system32\nmwcdcocls.dll
2008-02-02 14:36 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-02 14:36 . 2007-02-22 10:15 12,288 --a------ D:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-02-02 14:36 . 2007-02-22 10:15 8,320 --a------ D:\WINDOWS\system32\drivers\nmwcdc.sys
2008-02-02 09:05 . 2008-02-02 09:05 <DIR> d-------- D:\Program Files\ImTOO
2008-02-01 13:54 . 2007-04-16 15:28 577,536 --a------ D:\WINDOWS\soundman.exe
2008-02-01 13:53 . 2008-02-01 13:53 <DIR> d-------- D:\Program Files\Realtek AC97
2008-02-01 10:40 . 2008-02-01 10:40 <DIR> d-------- D:\Program Files\Alwil Software
2008-02-01 10:40 . 2007-12-04 14:04 837,496 --a------ D:\WINDOWS\system32\aswBoot.exe
2008-02-01 10:40 . 2004-01-09 10:13 380,928 --a------ D:\WINDOWS\system32\actskin4.ocx
2008-02-01 10:40 . 2007-12-04 13:54 95,608 --a------ D:\WINDOWS\system32\AvastSS.scr
2008-02-01 10:40 . 2007-12-04 15:55 94,544 --a------ D:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-01 10:40 . 2007-12-04 15:56 93,264 --a------ D:\WINDOWS\system32\drivers\aswmon.sys
2008-02-01 10:40 . 2007-12-04 15:51 42,912 --a------ D:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-01 10:40 . 2007-12-04 15:49 26,624 --a------ D:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-01 10:40 . 2007-12-04 15:53 23,152 --a------ D:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-01 09:46 . 2008-02-01 10:37 25 --a------ D:\WINDOWS\Ya.com
2008-02-01 09:34 . 2008-02-01 10:37 11,417,476 -r-hs---- D:\WINDOWS\himem.exe
2008-02-01 09:20 . 2008-02-03 09:58 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia Multimedia Player
2008-02-01 09:09 . 2008-02-01 19:21 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Nokia
2008-02-01 09:09 . 2008-02-01 09:09 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\PC Connectivity Solution
2008-02-01 09:08 . 2008-02-02 14:36 <DIR> d-------- D:\Program Files\Nokia
2008-02-01 09:08 . 2008-02-01 09:09 <DIR> d-------- D:\Program Files\DIFX
2008-02-01 09:08 . 2008-02-01 09:08 <DIR> d-------- D:\Program Files\Common Files\PCSuite
2008-02-01 09:08 . 2008-02-02 14:35 <DIR> d-------- D:\Program Files\Common Files\Nokia
2008-02-01 09:08 . 2008-02-02 00:04 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\PC Suite
2008-01-30 16:27 . 2008-01-30 16:27 19 --a------ D:\WINDOWS\SoundConverter.INI
2008-01-30 09:04 . 2008-02-01 09:10 <DIR> d-------- D:\Documents and Settings\roni\Phone Browser
2008-01-29 18:32 . 2008-02-02 14:34 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-01-29 17:48 . 2008-02-05 00:08 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\skypePM
2008-01-29 17:48 . 2008-01-29 17:48 32 --a------ D:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-29 17:46 . 2008-02-05 00:12 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Skype
2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- D:\Program Files\Common Files\Skype
2008-01-29 17:35 . 2008-01-29 17:36 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-28 16:33 . 2008-01-29 18:16 <DIR> d--h----- D:\WINDOWS\$hf_mig$
2008-01-28 10:45 . 2007-07-30 19:19 549,720 --a------ D:\WINDOWS\system32\wuapi.dll
2008-01-28 10:45 . 2007-07-30 19:19 325,976 --a------ D:\WINDOWS\system32\wucltui.dll
2008-01-28 10:45 . 2007-07-30 19:19 216,408 --a------ D:\WINDOWS\system32\wuaucpl.cpl
2008-01-28 10:45 . 2007-07-30 19:19 203,096 --a------ D:\WINDOWS\system32\wuweb.dll
2008-01-28 10:45 . 2004-08-03 14:04 187,160 --a------ D:\WINDOWS\system32\wuaueng1.dll
2008-01-28 10:45 . 2004-08-03 14:03 170,264 --a------ D:\WINDOWS\system32\wuauclt1.exe
2008-01-28 10:45 . 2007-07-30 19:18 33,624 --a------ D:\WINDOWS\system32\wups.dll
2008-01-28 10:39 . 2008-01-28 10:39 <DIR> d--h----- D:\Program Files\Common Files\Carlson
2008-01-26 19:37 . 2008-01-29 18:03 16 --a------ D:\WINDOWS\system32\coh.cache
2008-01-25 19:27 . 2008-01-25 19:29 <DIR> d--h----- D:\ErdUndoCache
2008-01-25 18:46 . 2008-01-30 09:04 <DIR> d-------- D:\Program Files\Norton AntiVirus
2008-01-25 18:45 . 2008-01-30 09:04 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-25 18:32 . 2008-02-02 16:12 <DIR> d-------- D:\Program Files\Common Files\Symantec Shared
2008-01-25 14:35 . 2008-01-25 16:22 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-25 14:35 . 2008-01-25 14:35 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-25 14:35 . 2008-01-25 14:35 2,550 --a------ D:\WINDOWS\system32\Uninstall.ico
2008-01-25 14:35 . 2008-01-25 14:35 1,406 --a------ D:\WINDOWS\system32\Help.ico
2008-01-25 12:32 . 2008-01-25 12:32 <DIR> d-------- D:\WINDOWS\ERUNT
2008-01-24 18:34 . 2008-01-24 18:34 <DIR> d-------- D:\Program Files\HT NETWORKS
2008-01-20 15:55 . 2008-01-20 19:01 48,512 --a------ D:\WINDOWS\system32\drivers\nkv2.sys
2008-01-18 11:25 . 2008-01-18 11:25 <DIR> d-------- D:\Program Files\Ares
2008-01-17 22:55 . 2008-01-17 22:55 <DIR> d---s---- D:\Documents and Settings\roni\UserData
2008-01-17 22:49 . 2008-01-17 22:49 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\HP
2008-01-17 22:05 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\Common Files\HP
2008-01-17 22:03 . 2008-01-17 22:03 <DIR> d-------- D:\Program Files\Hewlett-Packard
2008-01-17 22:02 . 2008-01-17 22:02 <DIR> d-------- D:\Program Files\Common Files\Hewlett-Packard
2008-01-17 21:57 . 2005-03-08 05:43 51,120 -ra------ D:\WINDOWS\system32\drivers\HPZid412.sys
2008-01-17 21:57 . 2005-03-08 05:43 21,744 -ra------ D:\WINDOWS\system32\drivers\HPZius12.sys
2008-01-17 21:57 . 2005-03-08 05:43 16,496 -ra------ D:\WINDOWS\system32\drivers\HPZipr12.sys
2008-01-17 21:56 . 1998-10-29 16:45 306,688 --a------ D:\WINDOWS\IsUninst.exe
2008-01-17 21:56 . 2004-09-29 12:12 278,584 --a------ D:\WINDOWS\system32\HPZidr12.dll
2008-01-17 21:56 . 2004-09-29 12:15 204,800 --a------ D:\WINDOWS\system32\HPZipr12.dll
2008-01-17 21:56 . 2004-09-29 12:09 94,208 --a------ D:\WINDOWS\system32\HPZipt12.dll
2008-01-17 21:56 . 2004-09-29 12:14 69,632 --a------ D:\WINDOWS\system32\HPZipm12.exe
2008-01-17 21:56 . 2004-09-29 12:08 61,440 --a------ D:\WINDOWS\system32\HPZinw12.exe
2008-01-17 21:56 . 2004-09-29 12:09 57,344 --a------ D:\WINDOWS\system32\HPZisn12.dll
2008-01-17 21:56 . 2002-08-29 01:48 14,208 --a------ D:\WINDOWS\system32\drivers\usbscan.sys
2008-01-17 21:54 . 2003-07-03 17:49 138,752 --a------ D:\WINDOWS\system32\drivers\usbport.sys
2008-01-17 21:54 . 2003-07-03 17:52 53,120 --a------ D:\WINDOWS\system32\drivers\usbhub.sys
2008-01-17 21:54 . 2003-07-03 17:53 28,160 --a------ D:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-17 21:54 . 2003-07-03 17:50 25,216 --a------ D:\WINDOWS\system32\drivers\usbehci.sys
2008-01-17 21:54 . 2003-07-03 17:51 16,000 --a------ D:\WINDOWS\system32\drivers\usbohci.sys
2008-01-17 21:54 . 2003-07-03 17:50 5,632 --a------ D:\WINDOWS\system32\hccoin.dll
2008-01-17 21:49 . 2008-01-17 22:05 <DIR> d-------- D:\Program Files\HP
2008-01-17 21:45 . 2008-01-17 21:45 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\HP
2008-01-17 21:44 . 2002-08-29 01:50 24,960 --a------ D:\WINDOWS\system32\drivers\usbprint.sys
2008-01-17 21:43 . 2008-01-17 21:43 <DIR> d-------- D:\WUTemp
2008-01-17 04:07 . 2008-02-01 22:24 1,216 --a------ D:\WINDOWS\wincmd.ini
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\UC.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\RAR.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\PKUNZIP.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\NOCLOSE.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\LHA.PIF
2008-01-17 04:07 . 2007-05-03 07:00 545 --a------ D:\WINDOWS\ARJ.PIF
2008-01-17 03:27 . 2008-01-25 19:27 <DIR> d-------- D:\Program Files\BearShare
2008-01-17 03:27 . 2008-01-17 03:27 <DIR> d-------- D:\My Downloads
2008-01-16 13:41 . 2008-01-16 13:42 <DIR> d-------- D:\Program Files\Winamp
2008-01-16 13:41 . 2008-01-25 19:29 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\Winamp
2008-01-15 19:31 . 2008-01-15 19:31 <DIR> d-------- D:\Documents and Settings\roni\Dane aplikacji\vlc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 21:26 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-02-01 09:39 --------- d-----w D:\Program Files\AMD
2008-01-29 17:00 42,496 ----a-w D:\WINDOWS\system32\ftp.exe
2008-01-29 17:00 16,896 ----a-w D:\WINDOWS\system32\tftp.exe
2008-01-25 15:18 --------- d-----w D:\Program Files\VDOTool
2008-01-25 15:15 --------- d-----w D:\Program Files\FlashFXP
2008-01-25 15:06 --------- d-----w D:\Program Files\DAEMON Tools
2008-01-22 17:08 12,800 ----a-w D:\WINDOWS\system32\svchost.exe
2008-01-15 12:48 --------- d-----w D:\Program Files\Common Files\InstallShield
2008-01-11 12:21 133,632 ----a-w D:\WINDOWS\system32\sfc_os.dll
2008-01-10 23:52 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll
2008-01-03 18:04 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\GanymedeNet
2007-12-16 12:53 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Talkback
2007-12-16 12:52 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\FlashFXP
2007-12-14 15:02 --------- d-----w D:\Program Files\SystemRequirementsLab
2007-12-14 15:02 --------- d-----w D:\Program Files\Java
2007-12-14 14:59 --------- d-----w D:\Program Files\Common Files\Java
2007-12-13 16:59 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\InstallShield Installation Information
2007-12-13 16:56 --------- d-----w D:\Program Files\ToniArts
2007-12-13 16:48 --------- d-----w D:\Program Files\AGEIA Technologies
2007-12-13 16:47 --------- d-----w D:\Program Files\Common Files\Wise Installation Wizard
2007-12-13 16:30 --------- d-----w D:\Program Files\AIDA32 - Personal System Information
2007-12-12 14:04 --------- d-----w D:\Program Files\MarBit
2007-12-11 17:13 --------- d-----w D:\Program Files\Microsoft.NET
2007-12-11 16:57 639,224 ----a-w D:\WINDOWS\system32\drivers\sptd.sys
2007-12-11 16:19 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Media Player Classic
2007-12-11 15:50 --------- d-----w D:\Program Files\Common Files\Adobe
2007-12-11 15:41 --------- d-----w D:\Program Files\K-Lite Codec Pack
2007-12-11 15:03 --------- d-----w D:\Program Files\WapSter
2007-12-11 11:36 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\Gadu-Gadu
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\roni\Dane aplikacji\MSN6
2007-12-11 11:24 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\MSN6
2007-12-11 11:17 --------- d-----w D:\Program Files\Realtek Sound Manager
2007-12-11 11:17 --------- d-----w D:\Program Files\AvRack
2007-12-11 11:13 --------- d--h--w D:\Program Files\Uninstall Information
2007-12-11 11:09 --------- d-----w D:\Program Files\microsoft frontpage
2007-12-11 11:08 558,142 ----a-w D:\WINDOWS\java\Packages\N7VLZVJ5.ZIP
2007-12-11 11:08 155,995 ----a-w D:\WINDOWS\java\Packages\QLBDVP3R.ZIP
2007-12-11 11:05 --------- d-----w D:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"AQQ"="D:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11 21803304]
"ares"="D:\Program Files\Ares\Ares.exe" [2007-07-16 22:54 961536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="D:\Program Files\VDOTool\TBPanel.exe" [2007-06-26 14:58 2165272]
"NvCplDaemon"="D:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"NvMediaCenter"="D:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920]
"PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 D:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05 13312]
"Nokia.PCSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 00:41:48
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-05 0:43:10
ComboFix-quarantined-files.txt 2008-02-04 23:42:13
ComboFix2.txt 2008-02-01 09:22:46
ComboFix3.txt 2008-02-01 08:59:48
ComboFix4.txt 2008-01-29 17:14:04

[ Dodano: Dzisiaj o 0:49 ]
winamp mi nie chce chodzic mysle ze to problem z karta dzwiekaowa

**Posty:** 466 · przez **Kenji** 05 Lut 2008, 02:46

Nie chodzi Ci winamp tak? Podaj jaki komunikat. Czy w ogóle nic się nie pokazuje?

**Posty:** 3854 · przez **Dzi@dek** 05 Lut 2008, 10:49

Usuń w HJ:

O20 - AppInit_DLLs:

Otwórz notatnik i wklej:

File::
D:\WINDOWS\himem.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

problem z wirusami

Problem z wirusami

Kto jest na forum