proszę o sprawdzenie log-a

[tm72]

Witam,

pożyczyłem od znajomego dysk twardy w celu przegrania gry. Kolega zapewnił, że dysk jest czysty od jakichkolwiek wirusów! OK podłączyłem, odpaliłem komputer i o matko...mój NOD-32 dostał poważnej zadyszki natomiast kolega prawie w zęby. Co się dziej? Otóż NOD32 pokazał, że wykasował wszystko...mnie natomiast martwi to, że komputer strasznie długo startuje (wcześniej tego nie było) oraz otwieranie jakichkolwiek programów trwa strasznie długo! Dlatego ogromna prośba jak w temacie.

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:09:09, on 2007-12-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\RFA\rfagent.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\PopTray\PopTray.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Symantec\Ghost\bin\rteng6.exe
C:\Documents and Settings\tomi\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NGServer] C:\Program Files\Symantec\Ghost\ngserver.exe
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [msservice] D:\Zssawka\driver.dll\svhosts.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-2000478354-776561741-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-2000478354-776561741-839522115-1003 Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe (User '?')
O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) - http://67.15.101.3/g_bin/pl/hunter_2_0_0_19.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_22.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.3/g_bin/pl/breakout_2_0_0_21.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Ghost Database Service (ngdbserv) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGServer) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7790 bytes


[wojtas]

O4 - HKLM\..\Run: [msservice] D:\Zssawka\driver.dll\svhosts.exe

znane CI jest to?


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[tm72]

nie chciał wejść w tryb awaryjny (30min zanim uruchomił)

znane CI jest to?

Tak

Report.txt

Kod: Zaznacz wszystko

SDFix: Version 1.120

Run by Administrator on 2007-12-31 at 17:54

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-31 18:05:38
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

IPC error: 2 Nie można odnaleźć określonego pliku.
scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools"
"h0"=dword:00000000
"khjeh"=hex:62,c6,9d,1e,9c,18,02,37,bf,9c,c6,35,7e,43,d7,4a,ab,47,21,fc,4b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1e,a4,2a,a5,c7,75,d4,dd,5a,6f,41,f5,de,30,44,af,50,..
"khjeh"=hex:11,a5,c7,a7,d7,66,3b,ce,dd,70,ff,08,53,46,fd,e9,7e,97,06,88,c4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:64,62,02,00,00,c7,2c,00,51,77,f1,d9,60,ff,ff,ff,5a,00,61,00,70,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools"
"h0"=dword:00000000
"khjeh"=hex:c3,42,4b,e4,d0,35,d7,d0,42,df,b3,9b,17,85,e3,d2,a0,1a,fd,96,c7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1e,a4,2a,a5,c7,75,d4,dd,5a,6f,41,f5,de,30,44,af,50,..
"khjeh"=hex:11,a5,c7,a7,d7,66,3b,ce,dd,70,ff,08,53,46,fd,e9,7e,97,06,88,c4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:c9,61,28,cb,5e,58,60,14,a2,fd,f0,58,4a,e2,d4,f7,53,41,37,63,8e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools"
"h0"=dword:00000000
"khjeh"=hex:62,c6,9d,1e,9c,18,02,37,bf,9c,c6,35,7e,43,d7,4a,ab,47,21,fc,4b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1e,a4,2a,a5,c7,75,d4,dd,5a,6f,41,f5,de,30,44,af,50,..
"khjeh"=hex:11,a5,c7,a7,d7,66,3b,ce,dd,70,ff,08,53,46,fd,e9,7e,97,06,88,c4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:11,4b,7e,ad,dc,14,ae,58,99,a3,a9,05,03,90,b8,ed,d2,4f,2a,53,e8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools"
"h0"=dword:00000000
"khjeh"=hex:c3,42,4b,e4,d0,35,d7,d0,42,df,b3,9b,17,85,e3,d2,a0,1a,fd,96,c7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1e,a4,2a,a5,c7,75,d4,dd,5a,6f,41,f5,de,30,44,af,50,..
"khjeh"=hex:11,a5,c7,a7,d7,66,3b,ce,dd,70,ff,08,53,46,fd,e9,7e,97,06,88,c4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:87,58,13,12,cf,8c,8d,bd,94,d7,88,10,c0,2e,a2,19,2a,c3,82,91,d7,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:0000264c
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:bfb84797
"s2"=dword:a8ae5e50
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120"
"h0"=dword:00000001
"ujdew"=hex:0c,9b,c6,b5,db,08,bf,82,51,c6,ec,22,e0,f5,77,79,e2,fa,db,b0,e4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:49,f7,25,3d,a7,0c,8c,fb,e3,a3,fd,bd,42,be,4b,04,53,4f,f4,44,47,..
"p0"="C:\Program Files\DAEMON Tools"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:b2,69,41,15,b7,fc,7e,55,f3,ef,29,15,a5,93,7c,e2,3a,b6,b9,06,53,..
"a0"=hex:20,01,00,00,20,24,60,32,31,31,1b,56,18,4a,4f,d2,74,b2,7b,06,b6,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,01,ee,85,63,7d,48,ef,0b,5f,8a,ea,56,9a,9e,71,49,eb,6d,fa,b2,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Control\Session Manager\Memory Management\PrefetchParameters]
"VideoInitTime"=dword:00001359
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Control\Watchdog\Display]
"ShutdownCount"=dword:0000099e
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\ACPI\PNP0A03\1\LogConf]
"BasicConfigVector"=hex(a):e8,03,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,1e,00,00,00,06,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\ACPI\PNP0C01\2&daba3ff&0\LogConf]
"BasicConfigVector"=hex(a):c8,01,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,0d,00,00,00,03,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\ACPI\PNPA000\4&4d1b4cdc&0]
"Service"="ajo56zjb"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\ACPI\PNPA000\4&4d1b4cdc&1]
"Service"="aa9718pn"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\T\1\1\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Hardware Profiles\0001\System\CurrentControlSet\Enum\X\1\1\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\Eventlog\Application]
"Sources"=str(7):"WSH\0WMIAdapter\0WmdmPmSN\0WinMgmt\0Winlogon\0Windows Product Activation\0Windows 3.1 Migration\0WebClient\0VSS\0VBRuntime\0Userinit\0Userenv\0UploadM\0Tlntsvr\0SysmonLog\0SpoolerCtrs\0Software Restriction Policies\0Software Installation\0SecurityCenter\0SclgNtfy\0SceSrv\0SceCli\0Sandra\0safrslv\0SAFrdms\0Remote Assistance\0PerfProc\0PerfOS\0PerfNet\0Perfmon\0Perflib\0PerfDisk\0Perfctrs\0Offline Files\0Oakley\0ntbackup\0NeroCheck\0MSSQLSERVER/MSDE\0MsiInstaller\0MSDTC Client\0MSDTC\0mnmsrvc\0MksNetMon\0Microsoft H.323 Telephony Service Provider\0Microsoft (R) Visual C# 2005 Compiler\0LoadPerf\0KOCH Update\0Java VM\0HelpSvc\0FrontPage 4.0\0Folder Redirection\0File Deployment\0EventSystem\0ESENT\0EAPOL\0DrWatson\0DiskQuota\0crypt32\0COM+\0COM\0Ci\0Chkdsk\0AutoEnrollment\0Autochk\0ATI Smart\0ASP.NET 2.0.50727.0\0Application Management\0Application Hang\0Application Error\0apphelp\0.NET Runtime Optimization Service\0.NET Runtime 2.0 Error Reporting\0.NET Runtime\0Application\0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\Eventlog\Application\Microsoft H.323 Telephony Service Provider]
"EventMessageFile"="C:\WINDOWS\System32\h323.tsp"
"TypesSupported"=dword:00000007
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\SharedAccess\Epoch]
"Epoch"=dword:00002649
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120"
"h0"=dword:00000001
"ujdew"=hex:0c,9b,c6,b5,db,08,bf,82,51,c6,ec,22,e0,f5,77,79,e2,fa,db,b0,e4,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:49,f7,25,3d,a7,0c,8c,fb,e3,a3,fd,bd,42,be,4b,04,53,4f,f4,44,47,..
"p0"="C:\Program Files\DAEMON Tools"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:b2,69,41,15,b7,fc,7e,55,f3,ef,29,15,a5,93,7c,e2,3a,b6,b9,06,53,..
"a0"=hex:20,01,00,00,20,24,60,32,31,31,1b,56,18,4a,4f,d2,74,b2,7b,06,b6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,01,ee,85,63,7d,48,ef,0b,5f,8a,ea,56,9a,9e,71,49,eb,6d,fa,b2,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\Tcpip\Parameters\Interfaces\{A792E04E-60B6-427A-ADFC-5A6BA30D0AA6}]
"LeaseObtainedTime"=dword:47791c6e
"T1"=dword:4779c52e
"T2"=dword:477a43be
"LeaseTerminatesTime"=dword:477a6dee
"DhcpRetryTime"=dword:0000a8bd
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\{A792E04E-60B6-427A-ADFC-5A6BA30D0AA6}\Parameters\Tcpip]
"LeaseObtainedTime"=dword:47791c6e
"T1"=dword:4779c52e
"T2"=dword:477a43be
"LeaseTerminatesTime"=dword:477a6dee

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Microsoft Office\\Office\\EXCEL.EXE"="C:\\Program Files\\Microsoft Office\\Office\\EXCEL.EXE:*:Enabled:Microsoft Excel for Windows"
"C:\\Program Files\\FreshWebmaster\\FreshFTP\\freshftp.exe"="C:\\Program Files\\FreshWebmaster\\FreshFTP\\freshftp.exe:*:Enabled:freshftp"
"C:\\Program Files\\MobileSurfer\\iPhoneNk72\\MobFldSvr.exe"="C:\\Program Files\\MobileSurfer\\iPhoneNk72\\MobFldSvr.exe:*:Disabled:MobFldSvr"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"="C:\\Program Files\\NAPI-PROJEKT\\napisy.exe:*:Enabled:Napi-projekt"
"D:\\Rise of Nations\\rise.exe"="D:\\Rise of Nations\\rise.exe:*:Disabled:Rise of Nations"
"C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm"
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"D:\\FEAR\\FEAR.exe"="D:\\FEAR\\FEAR.exe:*:Enabled:FEAR"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------


Files with Hidden Attributes:

Thu 29 Mar 2007            88 ..SHR --- "C:\WINDOWS\system32\04497414DE.sys"
Mon 12 Jun 2006            56 ..SHR --- "C:\WINDOWS\system32\DE14744904.sys"
Wed 26 Sep 2007        15,022 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri  7 Jul 2006         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 31 Jul 2007         1,301 ...HR --- "C:\Documents and Settings\tomi\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"
Mon 12 Mar 2001         8,544 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\CATC USB Ethernet\Elndis.sys"
Mon 12 Mar 2001        33,149 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\CATC USB Ethernet\Usbd.sys"
Mon 12 Mar 2001        35,340 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\ASPI2DOS.SYS"
Mon 12 Mar 2001        14,378 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\ASPI4DOS.SYS"
Mon 12 Mar 2001        37,984 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\ASPI8DOS.SYS"
Mon 12 Mar 2001        44,828 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\ASPI8U2.SYS"
Mon 12 Mar 2001        29,628 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\ASPICD.SYS"
Mon 12 Mar 2001       161,792 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\bootsrv.sys"
Mon 12 Mar 2001        21,971 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\BTCDROM.SYS"
Mon 12 Mar 2001        30,955 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\BTDOSM.SYS"
Mon 12 Mar 2001       202,517 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\CMDS.EXE"
Mon 12 Mar 2001        53,541 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\command.com"
Mon 12 Mar 2001        22,158 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\COUNTRY.SYS"
Mon 12 Mar 2001         1,608 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\DEVICE.COM"
Mon 12 Mar 2001        15,345 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\DISPLAY.SYS"
Mon 12 Mar 2001         7,840 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\DLSHELP.SYS"
Mon 12 Mar 2001        56,821 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\E.EXE"
Mon 12 Mar 2001        64,425 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\FLASHPT.SYS"
Mon 12 Mar 2001        14,160 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\himem.sys"
Mon 12 Mar 2001        43,773 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\IBMBIO.COM"
Mon 12 Mar 2001        42,550 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\IBMDOS.COM"
Mon 12 Mar 2001        10,898 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\KEYB.COM"
Mon 12 Mar 2001        53,556 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\KEYBOARD.SYS"
Mon 12 Mar 2001        15,777 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\MODE.COM"
Mon 12 Mar 2001        37,681 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\MOUSE.COM"
Mon 12 Mar 2001        21,180 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\mscdex.exe"
Mon 12 Mar 2001       354,263 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\Net.exe"
Mon 12 Mar 2001         8,513 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\netbind.com"
Mon 12 Mar 2001        41,302 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\OAKCDROM.SYS"
Mon 12 Mar 2001       128,664 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\OHCI.EXE"
Mon 12 Mar 2001        28,439 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\Paralink.com"
Mon 12 Mar 2001        13,770 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\protman.exe"
Mon 12 Mar 2001       129,972 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Common\UHCI.EXE"
Mon 12 Mar 2001        11,491 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DMF560-TX Packet\Lmpd.com"
Mon 12 Mar 2001        17,791 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DT620 Packet\Dt620pd.com"
Mon 12 Mar 2001        17,043 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DE400 Packet\De400pd.com"
Mon 12 Mar 2001        11,786 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\IBM Crystal LAN Packet\Epktisa.com"
Mon 12 Mar 2001        18,300 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Kingston KNE110TX Packet\Ktc110p.com"
Mon 12 Mar 2001         9,190 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD-PCI2TL\Ldpcil.com"
Mon 12 Mar 2001        48,224 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD 10-100AL\L100al.com"
Mon 12 Mar 2001        13,360 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD-CDF\Ldcdt.com"
Mon 12 Mar 2001        12,567 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Melco LPC2-T\Lpchkat2.com"
Mon 12 Mar 2001        44,640 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\fetpkt.com"
Mon 12 Mar 2001        56,896 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\Rtspkt.com"
Mon 12 Mar 2001        44,640 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FNW9x00T - ENW8300T\fetpkt.com"
Mon 12 Mar 2001         9,692 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\PXE Packet Driver\Undipd.com"
Mon 12 Mar 2001        32,484 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\WaveLAN Packet\Wvlan42.com"
Mon 12 Mar 2001         4,469 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom RealPort\cxcfg.exe"
Mon 12 Mar 2001        50,405 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom RE10 - RE100 Packet\Ce3pd.com"
Mon 12 Mar 2001        48,491 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom RE10BT NDIS\Ce3ndis.exe"
Mon 12 Mar 2001        49,015 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Ethernet II PS Packet\Xpspd.com"
Mon 12 Mar 2001        33,860 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe"
Mon 12 Mar 2001        50,795 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom CBE10-100BTX NDIS\Cbendis.exe"
Mon 12 Mar 2001        48,223 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom CBE10-100BTX Packet\Cbepd.com"
Mon 12 Mar 2001         4,469 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom CE310-100 + RE-100TX\cxcfg.exe"
Mon 12 Mar 2001        48,641 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe"

Finished!

combofix

Kod: Zaznacz wszystko

ComboFix 07-12-31.4 - tomi 2007-12-31 18:31:28.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.605 [GMT 1:00]
Running from: C:\Documents and Settings\tomi\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\tomi\Dane aplikacji\macromedia\Flash Player\#SharedObjects\7AMRQDUB\www.broadcaster.com
C:\Documents and Settings\tomi\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\tomi\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol

.
(((((((((((((((((((((((((   Files Created from 2007-11-28 to 2007-12-31  )))))))))))))))))))))))))))))))
.

2007-12-31 18:30 . 2000-08-31 08:00   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-12-31 18:07 . 2007-07-30 19:19   38,232   --a------   C:\WINDOWS\system32\wucltui.dll.mui
2007-12-31 18:07 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-31 18:07 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuapi.dll.mui
2007-12-31 18:07 . 2007-07-30 19:18   21,336   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-31 18:06 .    <DIR>      C:\WINDOWS\LastGood.Tmp
2007-12-31 17:53 . 2007-12-31 17:53   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-30 11:38 . 1996-12-17 15:12   57,344   --a------   C:\WINDOWS\system32\Chkv3_32.dll
2007-12-28 13:05 . 2007-12-31 18:12   66   --a------   C:\svhosts
2007-12-21 22:17 . 1997-01-16 00:00   191,248   --a------   C:\WINDOWS\system32\TABCTL32.OCX
2007-12-21 22:15 . 1997-01-16 00:00   71,680   --a------   C:\WINDOWS\ST5UNST.EXE
2007-12-21 22:15 . 1997-01-16 00:00   29,696   --a------   C:\WINDOWS\system32\VB5StKit.dll
2007-12-21 19:40 . 2007-12-25 16:33   85   --a------   C:\WINDOWS\FxLoaderPL.INI
2007-12-05 18:55 . 2007-12-05 18:55   0   --a------   C:\WINDOWS\ativpsrm.bin
2007-12-05 18:53 . 2007-09-28 21:05   593,920   ---------   C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 18:05 . 2007-12-05 18:05   <DIR>   d--------   C:\WINDOWS\system32\Futuremark
2007-12-05 18:05 . 1999-10-21 09:12   20,400   ---------   C:\WINDOWS\system32\drivers\Entech.sys
2007-12-05 18:05 . 2001-11-19 18:05   3,972   ---------   C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-29 15:42 . 2007-11-29 15:42   <DIR>   d--------   C:\Program Files\ReflexiveArcade
2007-11-23 20:37 . 2007-07-02 11:27   338,304   --a------   C:\WINDOWS\system32\_AxShlEx.dll
2007-11-21 15:56 . 2007-11-21 15:56   1,432   --a------   C:\WINDOWS\cfzh_z16.ini
2007-11-21 15:55 . 2007-11-21 15:56   <DIR>   d--------   C:\Program Files\PhotoZoom Pro 2
2007-11-15 17:32 . 2007-11-15 17:31   512,096   --a------   C:\WINDOWS\system32\drivers\amon.sys
2007-11-15 17:32 . 2007-11-15 17:31   298,104   --a------   C:\WINDOWS\system32\imon.dll
2007-11-15 17:32 . 2007-11-15 17:31   15,424   --a------   C:\WINDOWS\system32\drivers\nod32drv.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-31 17:32   ---------   d-----w   C:\Program Files\FlashGet
2007-12-23 18:01   ---------   d-----w   C:\Documents and Settings\tomi\Dane aplikacji\Skype
2007-12-08 10:33   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-04 13:20   ---------   d-----w   C:\Program Files\Winamp
2007-11-23 19:27   685,816   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2007-11-22 17:06   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-11-17 12:18   ---------   d-----w   C:\Program Files\eMule
2007-11-05 13:48   ---------   d-----w   C:\Program Files\PITy
2007-10-31 15:41   ---------   d-----w   C:\Program Files\Winamp Toolbar
2007-10-31 15:41   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-10-29 15:41   ---------   d-----w   C:\Documents and Settings\tomi\Dane aplikacji\FileZilla
2001-06-29 09:33   21,842   ----a-w   C:\Program Files\Common Files\tppupd2k.dll
2007-03-29 11:28   88   --sh--r   C:\WINDOWS\system32\[u]0[/u]4497414DE.sys
2006-06-12 18:18   56   --sh--r   C:\WINDOWS\system32\DE14744904.sys
2007-09-26 13:43   15,022   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06   1135968   --a------   C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 15:35 7110656]
"nwiz"="nwiz.exe" [2005-08-02 15:35 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 15:35 86016]
"SoundMan"="SOUNDMAN.EXE" [2003-12-18 07:00 64512 C:\WINDOWS\SOUNDMAN.EXE]
"NGServer"="C:\Program Files\Symantec\Ghost\ngserver.exe" [2001-03-22 17:02 1040650]
"rfagent"="C:\Program Files\RFA\rfagent.exe" [2005-04-23 01:23 330240]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 15:15 221184]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-07-25 11:22 1998896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-15 17:31 949376]
"msservice"="D:\Zssawka\driver.dll\svhosts.exe" [2004-11-27 21:18 622592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\tomi\Menu Start\Programy\Autostart\
PopTray.lnk - C:\Program Files\PopTray\PopTray.exe [2004-12-16 16:01:02]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
         C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
         C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
         C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

R2 A4SII300;A4SII300;C:\WINDOWS\system32\drivers\A4SII300.SYS [1998-02-26 14:10]
R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys [2006-05-14 15:16]
R2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2002-04-26 11:04]
R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2006-05-14 15:16]
R2 port_nt;port_nt;c:\windows\system32\drivers\port_nt.sys [2002-10-18 12:26]
R3 Ma730Pt;MA730 Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\Ma730Pt.sys [2006-09-21 12:23]
S3 BTNetFilter;Bluetooth Network Filter;C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys [2006-04-14 09:14]
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2006-02-18 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57193438-a973-11dc-9db4-806d6172696f}]
\Shell\AutoRun\command - setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-31 18:35:10
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2007-12-31 18:37:31 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt  2007-12-31 17:37:28

hijackThis

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:39:23, on 2007-12-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\RFA\rfagent.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\PopTray\PopTray.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Symantec\Ghost\bin\rteng6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\tomi\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NGServer] C:\Program Files\Symantec\Ghost\ngserver.exe
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [msservice] D:\Zssawka\driver.dll\svhosts.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) - http://67.15.101.3/g_bin/pl/hunter_2_0_0_19.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_22.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.3/g_bin/pl/breakout_2_0_0_21.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Ghost Database Service (ngdbserv) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGServer) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7693 bytes


coś niepokojącego?

[wojtas]

skasuj:

C:\svhosts

te pliki :

C:\WINDOWS\system32\Chkv3_32.dll
C:\WINDOWS\system32\VB5StKit.dll
C:\WINDOWS\cfzh_z16.ini
C:\Program Files\Common Files\tppupd2k.dll
C:\WINDOWS\system32\04497414DE.sys
C:\WINDOWS\system32\DE14744904.sys
C:\WINDOWS\ST5UNST.EXE

przeskanuj na tych stronach:

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty kazdego z plikow:

Jeśli nie będą widoczne, to najpierw usuń atrybuty ochronne:
>>Start>>Panel Sterowania>>Opcje Folderów>>Widok>>usuń zaznaczenie przy "Ukryj chronione pliki systemowe">
>zaznacz przy "Pokaż ukryte pliki">>Zastosuj>>OK.

[tm72]

C:\WINDOWS\system32\Chkv3_32.dll

Kod: Zaznacz wszystko

Scan taken on 01 Jan 2008 12:52:26 (GMT)
A-Squared    
Found nothing
AntiVir    
Found nothing
ArcaVir    
Found nothing
Avast    
Found nothing
AVG Antivirus    
Found nothing
BitDefender    
Found nothing
ClamAV    
Found nothing
CPsecure    
Found nothing
Dr.Web    
Found nothing
F-Prot Antivirus    
Found nothing
F-Secure Anti-Virus    
Found nothing
Fortinet    
Found nothing
Ikarus    
Found nothing
Kaspersky Anti-Virus    
Found nothing
NOD32    
Found nothing
Norman Virus Control    
Found nothing
Panda Antivirus    
Found nothing
Rising Antivirus    
Found nothing
Sophos Antivirus    
Found nothing
VirusBuster    
Found nothing
VBA32    
Found nothing

C:\WINDOWS\system32\VB5StKit.dll
j.w.

C:\WINDOWS\system32\04497414DE.sys
j.w.

C:\WINDOWS\system32\DE14744904.sys
j.w.

C:\WINDOWS\cfzh_z16.ini
j.w.

C:\WINDOWS\ST5UNST.EXE
j.w

C:\Program Files\Common Files\tppupd2k.dll
j.w.

z tego, co widać z raportu chyba jest ok

[wojtas]

to daj jeszcze loga nowego z hj oraz combo

[tm72]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:46:37, on 2008-01-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\RFA\rfagent.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\PopTray\PopTray.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Symantec\Ghost\bin\rteng6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\win98\kazaa\narzędzia bezpieczeństwa\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NGServer] C:\Program Files\Symantec\Ghost\ngserver.exe
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [msservice] D:\Zssawka\driver.dll\svhosts.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: PopTray.lnk = C:\Program Files\PopTray\PopTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) - http://67.15.101.3/g_bin/pl/hunter_2_0_0_19.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_22.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.3/g_bin/pl/breakout_2_0_0_21.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Ghost Database Service (ngdbserv) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGServer) - Symantec New Zealand Limited - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7697 bytes



ComboFix 07-12-31.4 - tomi 2008-01-01 14:47:39.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.560 [GMT 1:00]
Running from: D:\win98\kazaa\narzędzia bezpieczeństwa\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-12-01 to 2008-01-01  )))))))))))))))))))))))))))))))
.

2007-12-31 18:30 . 2000-08-31 08:00   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-12-31 18:07 . 2007-07-30 19:19   38,232   --a------   C:\WINDOWS\system32\wucltui.dll.mui
2007-12-31 18:07 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-31 18:07 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuapi.dll.mui
2007-12-31 18:07 . 2007-07-30 19:18   21,336   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-31 17:53 . 2007-12-31 17:53   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-30 11:38 . 1996-12-17 15:12   57,344   --a------   C:\WINDOWS\system32\Chkv3_32.dll
2007-12-28 13:05 . 2008-01-01 12:17   76   --a------   C:\svhosts
2007-12-21 22:17 . 1997-01-16 00:00   191,248   --a------   C:\WINDOWS\system32\TABCTL32.OCX
2007-12-21 22:15 . 1997-01-16 00:00   71,680   --a------   C:\WINDOWS\ST5UNST.EXE
2007-12-21 22:15 . 1997-01-16 00:00   29,696   --a------   C:\WINDOWS\system32\VB5StKit.dll
2007-12-21 19:40 . 2007-12-25 16:33   85   --a------   C:\WINDOWS\FxLoaderPL.INI
2007-12-05 18:55 . 2007-12-05 18:55   0   --a------   C:\WINDOWS\ativpsrm.bin
2007-12-05 18:53 . 2007-09-28 21:05   593,920   ---------   C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 18:05 . 2007-12-05 18:05   <DIR>   d--------   C:\WINDOWS\system32\Futuremark
2007-12-05 18:05 . 1999-10-21 09:12   20,400   ---------   C:\WINDOWS\system32\drivers\Entech.sys
2007-12-05 18:05 . 2001-11-19 18:05   3,972   ---------   C:\WINDOWS\system32\drivers\PciBus.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 13:45   ---------   d-----w   C:\Program Files\FlashGet
2007-12-31 17:46   ---------   d-----w   C:\Program Files\PITy
2007-12-23 18:01   ---------   d-----w   C:\Documents and Settings\tomi\Dane aplikacji\Skype
2007-12-08 10:33   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-04 13:20   ---------   d-----w   C:\Program Files\Winamp
2007-11-29 14:42   ---------   d-----w   C:\Program Files\ReflexiveArcade
2007-11-23 19:27   685,816   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2007-11-22 17:06   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-11-21 14:56   ---------   d-----w   C:\Program Files\PhotoZoom Pro 2
2007-11-17 12:18   ---------   d-----w   C:\Program Files\eMule
2007-11-15 16:31   512,096   ----a-w   C:\WINDOWS\system32\drivers\amon.sys
2007-11-15 16:31   298,104   ----a-w   C:\WINDOWS\system32\imon.dll
2007-11-15 16:31   15,424   ----a-w   C:\WINDOWS\system32\drivers\nod32drv.sys
2001-06-29 09:33   21,842   ----a-w   C:\Program Files\Common Files\tppupd2k.dll
2007-03-29 11:28   88   --sh--r   C:\WINDOWS\system32\[u]0[/u]4497414DE.sys
2006-06-12 18:18   56   --sh--r   C:\WINDOWS\system32\DE14744904.sys
2007-09-26 13:43   15,022   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06   1135968   --a------   C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 15:35 7110656]
"nwiz"="nwiz.exe" [2005-08-02 15:35 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 15:35 86016]
"SoundMan"="SOUNDMAN.EXE" [2003-12-18 07:00 64512 C:\WINDOWS\SOUNDMAN.EXE]
"NGServer"="C:\Program Files\Symantec\Ghost\ngserver.exe" [2001-03-22 17:02 1040650]
"rfagent"="C:\Program Files\RFA\rfagent.exe" [2005-04-23 01:23 330240]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 15:15 221184]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-07-25 11:22 1998896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-15 17:31 949376]
"msservice"="D:\Zssawka\driver.dll\svhosts.exe" [2004-11-27 21:18 622592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\tomi\Menu Start\Programy\Autostart\
PopTray.lnk - C:\Program Files\PopTray\PopTray.exe [2004-12-16 16:01:02]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
         C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
         C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
         C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

R2 A4SII300;A4SII300;C:\WINDOWS\system32\drivers\A4SII300.SYS [1998-02-26 14:10]
R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys [2006-05-14 15:16]
R2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2002-04-26 11:04]
R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2006-05-14 15:16]
R2 port_nt;port_nt;c:\windows\system32\drivers\port_nt.sys [2002-10-18 12:26]
R3 Ma730Pt;MA730 Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\Ma730Pt.sys [2006-09-21 12:23]
S3 BTNetFilter;Bluetooth Network Filter;C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys [2006-04-14 09:14]
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2006-02-18 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57193438-a973-11dc-9db4-806d6172696f}]
\Shell\AutoRun\command - setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 14:49:40
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-01-01 14:50:29
C:\qoobox\ComboFix-quarantined-files.txt  2008-01-01 13:50:20
C:\qoobox\ComboFix2.txt  2007-12-31 17:37:31


[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\svhosts

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

[tm72]

Otworz notatnik i wklej w nim to:

Cytat:
File::
C:\svhosts

znam ten plik więc nim się nie martwię. Jeżeli reszta ok, to potwierdź (osobiście przypuszczam, ze system już się rozsypał. Mam go postawionego już ok2lat). Ale zawsze lepiej upewnić się u fachowca

[wojtas]

w logach nic nie ma a mozesz powiedziec co to za plik? tak z ciekawosci:)

Autor postu otrzymał pochwałę

[tm72]

plik programu (którego zresztą nie wykrywa żaden antywir), za pomocą którego mam kontrolę nad poczynaniami mojej córki. Dziękuję za pomoc, pozdrawiam Tomek