prośba o pomoc usuwaniu wirusa amvo

[mpl]

Proszę o pomoc w usunięciu wirusa amvo. Jestem zupełnie zielony a więc prosze o instrukcje oa A do Z.
Z góry wielkie dzięki.

[Lukesh]

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
Zrob skan on-line www.ewido.com
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[mpl]

Czy w trakcie skanowania pliki określane jako zainfekowane usuwać?

[Magik]

Czy w trakcie skanowania pliki określane jako zainfekowane usuwać?

tak

[mpl]

Dopiero dzisiaj miałem czas żeby dalej działać. Dziękuję za wszystkie podpowiedzi do tej pory. Po uruchomieniu programu ComboFix i po utworzenia loga mam pusty pulpit. Czy to normalne? Poniżej zamieszczam loga utworzonego w ComboFix. Proszę o dalsze wskazówki.


Przepraszam dopiero teraz doczytałem jak to zrobić.
OK?

ComboFix 08-06-05.3 - Właściciel 2008-06-06 18:41:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.88 [GMT 2:00]
Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\kmd.exe
C:\Program Files\MyWay
C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
C:\Program Files\MyWay\myBar\History\search
C:\Program Files\MyWay\myBar\Settings\prevcfg.htm
C:\Program Files\MyWay\myBar\Settings\settings.dat
C:\Program Files\MyWay\myBar\Settings\settings.htm
C:\WINDOWS\Downloaded Program Files\rave
C:\WINDOWS\Downloaded Program Files\rave\avirexe.vdm
C:\WINDOWS\Downloaded Program Files\rave\avirscr.vdm
C:\WINDOWS\Downloaded Program Files\rave\base.vdm
C:\WINDOWS\Downloaded Program Files\rave\daily.vdm
C:\WINDOWS\Downloaded Program Files\rave\daily.vdt
C:\WINDOWS\Downloaded Program Files\rave\filters.vdm
C:\WINDOWS\Downloaded Program Files\rave\kernel.vdk
C:\WINDOWS\Downloaded Program Files\rave\keyring.vdk
C:\WINDOWS\Downloaded Program Files\rave\mapi_vdm.vdm
C:\WINDOWS\Downloaded Program Files\rave\modules.vdk
C:\WINDOWS\Downloaded Program Files\rave\rav8def.vdm
C:\WINDOWS\Downloaded Program Files\rave\rufs.vdm
C:\WINDOWS\Downloaded Program Files\rave\rufsplg.vdm
C:\WINDOWS\Downloaded Program Files\rave\unarch.vdm
C:\WINDOWS\Downloaded Program Files\rave\unmail.vdm
C:\WINDOWS\Downloaded Program Files\rave\unpack.vdm
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\system32\mdm.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))
.

2008-06-06 17:52 . 2008-06-06 17:53 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-06 17:46 . 2008-06-06 18:31 <DIR> d-------- C:\SDFix
2008-06-05 22:50 . 2008-06-05 22:50 <DIR> d-------- C:\Program Files\PrevxCSI
2008-06-05 22:50 . 2008-06-05 22:50 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-06-05 22:49 . 2008-06-05 23:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI
2008-06-05 22:39 . 2008-06-05 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AdobeUM
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Program Files\Avira
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-05-13 22:09 . 2008-05-29 07:22 <DIR> d-------- C:\Program Files\CDRipper
2008-05-13 22:09 . 2008-05-13 22:09 0 --a------ C:\WINDOWS\system32\CDRipper.key

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 05:22 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-17 05:20 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\AdobeUM
2008-05-13 19:08 --------- d-----w C:\Program Files\Winamp
2008-04-27 13:57 --------- d-----w C:\Program Files\eMule
2008-04-26 14:52 --------- d-----w C:\Program Files\Call of Duty
2008-04-26 13:53 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-26 13:53 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-23 18:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-22 15:02 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Skype
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2001-02-23 18:22 299,008 ----a-w C:\Program Files\Best Player 1.0.exe
1999-05-17 12:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 01:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 01:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 01:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 01:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 01:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{42230B61-2670-4E64-9E11-407D1A294031}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{541E1568-8CDC-4143-9C72-4459B6B9FEC0}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\{7093877A-9363-4C3D-BED5-E2E3CE3A866D}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\{8B0304F0-CFC4-4E47-872E-A23444B88D55}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{D4BDF1BF-7980-4FF7-88C9-F850D33CCC16}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\{D5F34B42-13E5-49CD-8C30-2C3EA03ECF40}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\system32\{2E27A52C-3473-447A-B118-8E941DB45749}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\system32\{5118AB8F-09B6-4AAB-8510-657AF286C4FB}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\system32\{79709EC1-03AB-44BA-B819-D9FB5137CF2E}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E062D96E-3C6B-4ED9-8729-B35C2A2D6546}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E44BDE36-726D-4933-8EFA-45AC90540159}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E75836F8-E333-4E78-B2CC-426D22CB6FF1}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
2004-03-12 13:52 45056 --a------ C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 11:20 188416]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07 7110656]
"nwiz"="nwiz.exe" [2005-07-20 21:07 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 21:07 86016]
"QD FastAndSafe"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.DIVF"= DivX412.dll
"msacm.divxa32"= DivXa32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Call of Duty\\CoDMP.exe"=
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15352:TCP"= 15352:TCP:*:Disabled:BitComet 15352 TCP
"15352:UDP"= 15352:UDP:*:Disabled:BitComet 15352 UDP

R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-06-05 22:50]
R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2001-11-21 19:29]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\prevxcsi.exe" /service []
S3 iteio;iteio;C:\WINDOWS\System32\drivers\iteio.sys [1999-08-30 20:49]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-03-26 21:55]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-03-26 21:55]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-03-26 21:55]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-03-26 21:55]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-03-26 21:55]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a8eede1-97fb-11da-81d5-00e04c8e5571}]
\Shell\AutoRun\command - F:\invwft2h.com
\Shell\explore\Command - F:\invwft2h.com
\Shell\open\Command - F:\invwft2h.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9825bdc0-9463-11dc-84fe-00e04c8e5571}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 15:30:02 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2005-08-06 10:40:48 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 18:46:30
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-06 18:53:15
ComboFix-quarantined-files.txt 2008-06-06 16:53:09

Pre-Run: 20,979,335,168 bajtów wolnych
Post-Run: 20,990,337,024 bajtów wolnych

165 --- E O F --- 2008-05-28 13:32:12

[ Dodano: Dzisiaj o 18:36 ]
Dodaję log z programu HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:34:24, on 2008-06-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Właściciel\Pulpit\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.amg.gda.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://153.19.64.65/proxy-bg.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: PerfectNavBHO Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1B9441D-7BF2-4788-B1E3-38EA380CA8BD}: NameServer = 10.250.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8017 bytes

[Magik]

Przepraszam dopiero teraz doczytałem jak to zrobić.
OK?

jasne

Log z HJT

Kod: Zaznacz wszystko

R3 - URLSearchHook: PerfectNavBHO Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll

te wpisy dajesz na fix i wygeneruj jeszcze raz log z combofix'a

Autor postu otrzymał pochwałę

[mpl]

Dzięki za dotychczasową pomoc.
Przesyłam nowy log z ComboFixa.

ComboFix 08-06-05.3 - Właściciel 2008-06-07 8:00:03.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.78 [GMT 2:00]
Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Właściciel\Pulpit\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.

2008-06-06 17:52 . 2008-06-06 17:53 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-06 17:46 . 2008-06-06 18:31 <DIR> d-------- C:\SDFix
2008-06-05 22:39 . 2008-06-05 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AdobeUM
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Program Files\Avira
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-05-13 22:09 . 2008-05-29 07:22 <DIR> d-------- C:\Program Files\CDRipper
2008-05-13 22:09 . 2008-05-13 22:09 0 --a------ C:\WINDOWS\system32\CDRipper.key

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 05:22 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-17 05:20 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\AdobeUM
2008-05-13 19:08 --------- d-----w C:\Program Files\Winamp
2008-04-27 13:57 --------- d-----w C:\Program Files\eMule
2008-04-26 14:52 --------- d-----w C:\Program Files\Call of Duty
2008-04-26 13:53 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-26 13:53 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-23 18:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-22 15:02 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Skype
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2001-02-23 18:22 299,008 ----a-w C:\Program Files\Best Player 1.0.exe
1999-05-17 12:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 01:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 01:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 01:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 01:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 01:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{42230B61-2670-4E64-9E11-407D1A294031}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{541E1568-8CDC-4143-9C72-4459B6B9FEC0}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\{7093877A-9363-4C3D-BED5-E2E3CE3A866D}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\{8B0304F0-CFC4-4E47-872E-A23444B88D55}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{D4BDF1BF-7980-4FF7-88C9-F850D33CCC16}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\{D5F34B42-13E5-49CD-8C30-2C3EA03ECF40}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\system32\{2E27A52C-3473-447A-B118-8E941DB45749}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\system32\{5118AB8F-09B6-4AAB-8510-657AF286C4FB}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\system32\{79709EC1-03AB-44BA-B819-D9FB5137CF2E}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E062D96E-3C6B-4ED9-8729-B35C2A2D6546}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E44BDE36-726D-4933-8EFA-45AC90540159}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E75836F8-E333-4E78-B2CC-426D22CB6FF1}.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-06_18.52.42,60 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-06 16:09:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 05:39:07 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
2004-03-12 13:52 45056 --a------ C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 11:20 188416]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07 7110656]
"nwiz"="nwiz.exe" [2005-07-20 21:07 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 21:07 86016]
"QD FastAndSafe"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.DIVF"= DivX412.dll
"msacm.divxa32"= DivXa32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Call of Duty\\CoDMP.exe"=
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15352:TCP"= 15352:TCP:*:Disabled:BitComet 15352 TCP
"15352:UDP"= 15352:UDP:*:Disabled:BitComet 15352 UDP

R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2001-11-21 19:29]
S3 iteio;iteio;C:\WINDOWS\System32\drivers\iteio.sys [1999-08-30 20:49]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-03-26 21:55]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-03-26 21:55]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-03-26 21:55]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-03-26 21:55]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-03-26 21:55]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a8eede1-97fb-11da-81d5-00e04c8e5571}]
\Shell\AutoRun\command - F:\invwft2h.com
\Shell\explore\Command - F:\invwft2h.com
\Shell\open\Command - F:\invwft2h.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9825bdc0-9463-11dc-84fe-00e04c8e5571}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 15:30:02 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2005-08-06 10:40:48 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 08:05:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-07 8:12:54
ComboFix-quarantined-files.txt 2008-06-07 06:12:41
ComboFix2.txt 2008-06-06 16:53:16

Pre-Run: 20,972,204,032 bajtów wolnych
Post-Run: 20,973,600,768 bajtów wolnych

138 --- E O F --- 2008-05-28 13:32:12

[Okocza]

Otwórz notanik I wklej w nim:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a8eede1-97fb-11da-81d5-00e04c8e5571}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9825bdc0-9463-11dc-84fe-00e04c8e5571}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....


Potem nowy log z CF

[mpl]

Dzięki za wskazówki.
Nowy log z CF.

ComboFix 08-06-05.3 - Właściciel 2008-06-07 11:28:49.3 - NTFSx86
Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.

2008-06-06 17:52 . 2008-06-06 17:53 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-06 17:46 . 2008-06-06 18:31 <DIR> d-------- C:\SDFix
2008-06-05 22:39 . 2008-06-05 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AdobeUM
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Program Files\Avira
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-05-13 22:09 . 2008-05-29 07:22 <DIR> d-------- C:\Program Files\CDRipper
2008-05-13 22:09 . 2008-05-13 22:09 0 --a------ C:\WINDOWS\system32\CDRipper.key

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 05:22 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-17 05:20 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\AdobeUM
2008-05-13 19:08 --------- d-----w C:\Program Files\Winamp
2008-04-27 13:57 --------- d-----w C:\Program Files\eMule
2008-04-26 14:52 --------- d-----w C:\Program Files\Call of Duty
2008-04-26 13:53 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-26 13:53 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-23 18:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-22 15:02 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Skype
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2007-05-28 22:03 36 ----a-w C:\Documents and Settings\Właściciel\klextlock.dat
2001-02-23 18:22 299,008 ----a-w C:\Program Files\Best Player 1.0.exe
1999-05-17 12:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 01:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 01:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 01:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 01:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 01:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{42230B61-2670-4E64-9E11-407D1A294031}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{541E1568-8CDC-4143-9C72-4459B6B9FEC0}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\{7093877A-9363-4C3D-BED5-E2E3CE3A866D}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\{8B0304F0-CFC4-4E47-872E-A23444B88D55}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\{D4BDF1BF-7980-4FF7-88C9-F850D33CCC16}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\{D5F34B42-13E5-49CD-8C30-2C3EA03ECF40}.dat
2004-02-11 21:22 32 --sha-w C:\WINDOWS\system32\{2E27A52C-3473-447A-B118-8E941DB45749}.dat
2004-02-11 21:23 32 --sha-w C:\WINDOWS\system32\{5118AB8F-09B6-4AAB-8510-657AF286C4FB}.dat
2004-02-11 21:24 32 --sha-w C:\WINDOWS\system32\{79709EC1-03AB-44BA-B819-D9FB5137CF2E}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E062D96E-3C6B-4ED9-8729-B35C2A2D6546}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E44BDE36-726D-4933-8EFA-45AC90540159}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E75836F8-E333-4E78-B2CC-426D22CB6FF1}.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-06_18.52.42,60 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-06 16:09:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 09:08:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-03-24 17:33:02 1,527,056 ----a-w C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
+ 2008-03-25 02:32:44 218,496 ----a-r C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
+ 2008-06-07 06:26:24 74,649 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
2004-03-12 13:52 45056 --a------ C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 11:20 188416]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07 7110656]
"nwiz"="nwiz.exe" [2005-07-20 21:07 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 21:07 86016]
"QD FastAndSafe"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.DIVF"= DivX412.dll
"msacm.divxa32"= DivXa32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Call of Duty\\CoDMP.exe"=
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15352:TCP"= 15352:TCP:*:Disabled:BitComet 15352 TCP
"15352:UDP"= 15352:UDP:*:Disabled:BitComet 15352 UDP

R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2001-11-21 19:29]
S3 iteio;iteio;C:\WINDOWS\System32\drivers\iteio.sys [1999-08-30 20:49]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-03-26 21:55]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-03-26 21:55]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-03-26 21:55]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-03-26 21:55]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-03-26 21:55]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 15:30:02 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2005-08-06 10:40:48 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 11:34:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-07 11:41:53
ComboFix-quarantined-files.txt 2008-06-07 09:41:34
ComboFix2.txt 2008-06-07 06:12:55
ComboFix3.txt 2008-06-06 16:53:16

Pre-Run: 20,974,804,992 bajtów wolnych
Post-Run: 20,966,887,424 bajtów wolnych

131 --- E O F --- 2008-05-28 13:32:12

[Okocza]

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Wykonaj to co jest podane w tym temacie

[mpl]

OK wykonałem wszystkie zalecane czynności.
Czy to już wszystko?

[Okocza]

tak, jest ok

Autor postu otrzymał pochwałę

[mpl]

WIELKIE DZIĘKI.

[ Dodano: Dzisiaj o 20:30 ]
Po paru dniach zrobiłem skan on-line mks-virem. Znalazł 2 zainfekowane pliki. Wykonałem log z Combo Fixa. Proszę o rzucenie okiem. Dzieki.

ComboFix 08-06-05.3 - Właściciel 2008-06-13 21:10:18.4 - NTFSx86
Running from: C:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))
.

2008-06-13 19:18 . 2008-06-13 19:18 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-11 14:45 . 2008-04-14 17:53 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-07 19:15 . 2008-06-07 19:15 <DIR> d-------- C:\Program Files\Odkurzacz
2008-06-07 11:26 . 2008-06-07 11:26 290 --a------ C:\FIX.REG
2008-06-06 19:33 . 2008-06-06 19:33 401,720 --a------ C:\hijackthis.com
2008-06-06 17:52 . 2008-06-06 17:53 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-05 23:46 . 2008-06-05 23:46 51,232 --a------ C:\wwdc.exe
2008-06-05 23:11 . 2008-06-05 23:11 1,825,317 --a------ C:\ComboFix.exe
2008-06-05 22:39 . 2008-06-05 22:39 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AdobeUM
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Program Files\Avira
2008-06-05 22:35 . 2008-06-05 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-05-13 22:09 . 2008-05-29 07:22 <DIR> d-------- C:\Program Files\CDRipper
2008-05-13 22:09 . 2008-05-13 22:09 0 --a------ C:\WINDOWS\system32\CDRipper.key

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 17:23 --------- d-----w C:\Program Files\SkanerOnline
2008-06-07 17:27 --------- d-----w C:\Program Files\eMule
2008-05-17 05:22 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-17 05:20 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\AdobeUM
2008-05-13 19:08 --------- d-----w C:\Program Files\Winamp
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-26 14:52 --------- d-----w C:\Program Files\Call of Duty
2008-04-26 13:53 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-26 13:53 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-23 18:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-22 15:02 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Skype
2008-04-14 15:53 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-05-28 22:03 36 -c--a-w C:\Documents and Settings\Właściciel\klextlock.dat
2007-05-28 22:03 36 -c--a-w C:\Documents and Settings\Właściciel\klextlock.dat
2001-02-23 18:22 299,008 ----a-w C:\Program Files\Best Player 1.0.exe
1999-05-17 12:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 01:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 01:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 01:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 01:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 01:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
2004-02-11 21:21 32 -csha-w C:\WINDOWS\{42230B61-2670-4E64-9E11-407D1A294031}.dat
2004-02-11 21:21 32 -csha-w C:\WINDOWS\{541E1568-8CDC-4143-9C72-4459B6B9FEC0}.dat
2004-02-11 21:22 32 -csha-w C:\WINDOWS\{7093877A-9363-4C3D-BED5-E2E3CE3A866D}.dat
2004-02-11 21:24 32 -csha-w C:\WINDOWS\{8B0304F0-CFC4-4E47-872E-A23444B88D55}.dat
2004-02-11 21:21 32 -csha-w C:\WINDOWS\{D4BDF1BF-7980-4FF7-88C9-F850D33CCC16}.dat
2004-02-11 21:23 32 -csha-w C:\WINDOWS\{D5F34B42-13E5-49CD-8C30-2C3EA03ECF40}.dat
2004-02-11 21:22 32 -csha-w C:\WINDOWS\system32\{2E27A52C-3473-447A-B118-8E941DB45749}.dat
2004-02-11 21:23 32 -csha-w C:\WINDOWS\system32\{5118AB8F-09B6-4AAB-8510-657AF286C4FB}.dat
2004-02-11 21:24 32 -csha-w C:\WINDOWS\system32\{79709EC1-03AB-44BA-B819-D9FB5137CF2E}.dat
2004-02-11 21:21 32 -csha-w C:\WINDOWS\system32\{E062D96E-3C6B-4ED9-8729-B35C2A2D6546}.dat
2004-02-11 21:21 32 --sha-w C:\WINDOWS\system32\{E44BDE36-726D-4933-8EFA-45AC90540159}.dat
2004-02-11 21:21 32 -csha-w C:\WINDOWS\system32\{E75836F8-E333-4E78-B2CC-426D22CB6FF1}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00D6A7E7-4A97-456f-848A-3B75BF7554D7}]
C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 11:20 188416]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07 7110656]
"nwiz"="nwiz.exe" [2005-07-20 21:07 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 21:07 86016]
"QD FastAndSafe"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.DIVF"= DivX412.dll
"msacm.divxa32"= DivXa32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Call of Duty\\CoDMP.exe"=
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15352:TCP"= 15352:TCP:*:Disabled:BitComet 15352 TCP
"15352:UDP"= 15352:UDP:*:Disabled:BitComet 15352 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2001-11-21 19:29]
S3 iteio;iteio;C:\WINDOWS\System32\drivers\iteio.sys [1999-08-30 20:49]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-03-26 21:55]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-03-26 21:55]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-03-26 21:55]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-03-26 21:55]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-03-26 21:55]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 15:30:02 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2005-08-06 10:40:48 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 21:14:21
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************.
Completion time: 2008-06-13 21:21:47
ComboFix-quarantined-files.txt 2008-06-13 19:21:32

Pre-Run: 22,703,403,008 bajtów wolnych
Post-Run: 22,693,380,096 bajtów wolnych

134 --- E O F --- 2008-06-11 19:38:38