Proszę o sprawdzenie loga - błąd svchost,problem z lanem,wir

[andig]

Jakiś czas temu miałem wira i go usunąłem. Ostatnio znów się pojawił, to znowu go usunąłem. Nie jestem pewien, ale ma on chyba jeszcze jakiś plik albo mam konia, bo się zainstalował z powrotem. Poza tym, nie mogę włączyć sieci lan. Mam Macbook'a Pro i Winde Xp Prof. Pomimo wielu prób konfiguracji, zmiany usług itp. nie udało mi się tego włączyć. Teraz ( dosłownie przed chwilą ), Winda zaczęła mi wyrzucać, że ma nie prawidłowy adres ip, czy powtarzający się adres ip, jakoś tak. Ostatnia sprawa, to komunikat przy włączaniu Windy, który jest na zdjęciu poniżej. Proszę o pomoc i z góry dziękuję .

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:45, on 2008-11-29
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
E:\Programy\Lavasoft\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
E:\Programy\Diskeeper\DkService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Programy\iTunes\iTunesHelper.exe
C:\Program Files\Gateway\EzTune\DTHtml.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
E:\Programy\CursorXP\CursorXP.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
E:\Programy\Drużyna odsyfiania\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programy\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\Programy\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Easy Gif Animator Toolbar Helper - {96372AB6-15EB-4316-B497-71C741BC548C} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programy\FlashGet\getflash.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVP] "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programy\Quick Time\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programy\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxwj.exe] C:\WINDOWS\system32\kdxwj.exe
O4 - HKCU\..\Run: [CursorXP] E:\Programy\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Stáhnout všechno FlashGetem - E:\Programy\FlashGet\jc_all.htm
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_all.htm
O8 - Extra context menu item: Dodaj do blokowanych banerów - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://F:\xcvxvd\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Programy\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Programy\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201177734634
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201184849812
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: e:\programy\kasper~1\kasper~1.0\adialhk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Programy\Lavasoft\aawservice.exe
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - E:\Programy\Diskeeper\DkService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 14762 bytes


Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CursorXP" = "E:\Programy\CursorXP\CursorXP.exe" [" "]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"iKeyWorks" = "C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" ["A4Tech Co.,Ltd."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WheelMouse" = "C:\Program Files\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co.,Ltd."]
"AVP" = ""E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"" ["Kaspersky Lab"]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"]
"PivotSoftware" = ""C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"" ["Portrait Displays, Inc."]
"DT GWY" = "C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY" [null data]
"GrooveMonitor" = ""C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"" [MS]
"ATIPTA" = "atiptaxx.exe" ["ATI Technologies, Inc."]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"QuickTime Task" = ""E:\Programy\Quick Time\QTTask.exe" -atboottime" ["Apple Inc."]
"iTunesHelper" = ""E:\Programy\iTunes\iTunesHelper.exe"" ["Apple Inc."]
"AppleSyncNotifier" = "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" ["Apple Inc."]
"C:\WINDOWS\system32\kdxwj.exe" = "C:\WINDOWS\system32\kdxwj.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = "AcroIEHelperStub"
  -> {HKLM...CLSID} = "Adobe PDF Link Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll" ["Adobe Systems Incorporated"]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch"
  -> {HKLM...CLSID} = "FGCatchUrl"
                   \InProcServer32\(Default) = "E:\Programy\FlashGet\jccatch.dll" ["www.flashget.com"]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture"
  -> {HKLM...CLSID} = "BitComet Helper"
                   \InProcServer32\(Default) = "E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll" ["BitComet"]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Megaupload Toolbar"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD                                   "]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Spybot-S&D IE Protection"
                   \InProcServer32\(Default) = "E:\Programy\SPYBOT~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Groove GFS Browser Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."]
{96372AB6-15EB-4316-B497-71C741BC548C}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Easy Gif Animator Toolbar Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll" [null data]
{C333CF63-767F-4831-94AC-E683D962C63C}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "CoTGT_BHO Class"
                   \InProcServer32\(Default) = "C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll" [null data]
{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl"
  -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."]
{F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "FlashGet GetFlash Class"
                   \InProcServer32\(Default) = "E:\Programy\FlashGet\getflash.dll" ["www.flashget.com"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{30D02401-6A81-11d0-8274-00C04FD5AE38}" = "IE Search Band"
  -> {HKLM...CLSID} = "IE Search Band"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" = "Shell DocObject Viewer"
  -> {HKLM...CLSID} = "Shell DocObject Viewer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}" = "InternetShortcut"
  -> {HKLM...CLSID} = "Internet Shortcut"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" = "Microsoft Url History Service"
  -> {HKLM...CLSID} = "Microsoft Url History Service"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{FF393560-C2A7-11CF-BFF4-444553540000}" = "History"
  -> {HKLM...CLSID} = "History"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}" = "Temporary Internet Files"
  -> {HKLM...CLSID} = "Temporary Internet Files"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}" = "Temporary Internet Files"
  -> {HKLM...CLSID} = "Temporary Internet Files"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" = "Microsoft Url Search Hook"
  -> {HKLM...CLSID} = "Microsoft Url Search Hook"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}" = "The Internet"
  -> {HKLM...CLSID} = "The Internet"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{871C5380-42A0-1069-A2EA-08002B30309D}" = "Internet Name Space"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
  -> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
                   \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
  -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
                   \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
  -> {HKLM...CLSID} = "Portable Media Devices"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices"
  -> {HKLM...CLSID} = "Portable Devices"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]
"{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu"
  -> {HKLM...CLSID} = "Portable Devices Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
  -> {HKLM...CLSID} = "ShellLink for Application References"
                   \InProcServer32\(Default) = "c:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
  -> {HKLM...CLSID} = "Shell Icon Handler for Application References"
                   \InProcServer32\(Default) = "c:\WINDOWS\system32\dfshim.dll" [MS]
"{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1"
  -> {HKLM...CLSID} = "Windows XPS Document Metadata Handler"
                   \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS]
"{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1"
  -> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler"
                   \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS]
"{07C45BB1-4A8C-4642-A1F5-237E7215FF66}" = "IE Microsoft BrowserBand"
  -> {HKLM...CLSID} = "IE Microsoft BrowserBand"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{1C1EDB47-CE22-4bbb-B608-77B48F83C823}" = "IE Fade Task"
  -> {HKLM...CLSID} = "IE Fade Task"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{205D7A97-F16D-4691-86EF-F3075DCCA57D}" = "IE Menu Desk Bar"
  -> {HKLM...CLSID} = "IE Menu Desk Bar"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE AutoComplete"
  -> {HKLM...CLSID} = "IE AutoComplete"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{43886CD5-6529-41c4-A707-7B3C92C05E68}" = "IE Navigation Bar"
  -> {HKLM...CLSID} = "IE Navigation Bar"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{44C76ECD-F7FA-411c-9929-1B77BA77F524}" = "IE Menu Site"
  -> {HKLM...CLSID} = "IE Menu Site"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{4B78D326-D922-44f9-AF2A-07805C2A3560}" = "IE Menu Band"
  -> {HKLM...CLSID} = "IE Menu Band"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{6038EF75-ABFC-4e59-AB6F-12D397F6568D}" = "IE Microsoft History AutoComplete List"
  -> {HKLM...CLSID} = "IE Microsoft History AutoComplete List"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}" = "IE Tracking Shell Menu"
  -> {HKLM...CLSID} = "IE Tracking Shell Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{6CF48EF8-44CD-45d2-8832-A16EA016311B}" = "IE IShellFolderBand"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{73CFD649-CD48-4fd8-A272-2070EA56526B}" = "IE BandProxy"
  -> {HKLM...CLSID} = "IE BandProxy"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}" = "IE MRU AutoComplete List"
  -> {HKLM...CLSID} = "IE MRU AutoComplete List"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E}" = "IE RSS Feeder Folder"
  -> {HKLM...CLSID} = "IE RSS Feeds Folder"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{9D958C62-3954-4b44-8FAB-C4670C1DB4C2}" = "IE Microsoft Shell Folder AutoComplete List"
  -> {HKLM...CLSID} = "IE Microsoft Shell Folder AutoComplete List"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{B31C5FAE-961F-415b-BAF0-E697A5178B94}" = "IE Microsoft Multiple AutoComplete List Container"
  -> {HKLM...CLSID} = "IE Microsoft Multiple AutoComplete List Container"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{BC476F4C-D9D7-4100-8D4E-E043F6DEC409}" = "Microsoft Browser Architecture"
  -> {HKLM...CLSID} = "Microsoft Browser Architecture"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}" = "IE Shell Rebar BandSite"
  -> {HKLM...CLSID} = "IE Shell Rebar BandSite"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{E6EE9AAC-F76B-4947-8260-A9F136138E11}" = "IE Shell Band Site Menu"
  -> {HKLM...CLSID} = "IE Shell Band Site Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{F2CF5485-4E02-4f68-819C-B92DE9277049}" = "&Links"
  -> {HKLM...CLSID} = "&Links"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E}" = "IE Registry Tree Options Utility"
  -> {HKLM...CLSID} = "IE Registry Tree Options Utility"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}" = "IE User Assist"
  -> {HKLM...CLSID} = "IE User Assist"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{FDE7673D-2E19-4145-8376-BBD58C4BC7BA}" = "IE Custom MRU AutoCompleted List"
  -> {HKLM...CLSID} = "IE Custom MRU AutoCompleted List"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
  -> {HKLM...CLSID} = "Shell Search Band"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data]
"{692eb3b0-d034-403e-b742-2407bd43bf9b}" = "InCDUdfPerm extension"
  -> {HKLM...CLSID} = "InCDUdfPerm Class"
                   \InProcServer32\(Default) = "E:\Programy\Nero\Nero 8\InCD\InCDUP.dll" [file not found]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
  -> {HKLM...CLSID} = "Nokia Phone Browser"
                   \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{59A3380E-5305-4cea-BD99-4F2FF510C91F}" = "FineReader9ContextMenu"
  -> {HKLM...CLSID} = "FineReader9.FRContextMenu.1"
                   \InProcServer32\(Default) = "E:\Programy\ABBYY FineReader 9.0 Professional Edition\FRIntegration.dll" ["ABBYY Software Ltd"]
"{6af09ec9-b429-11d4-a1fb-0090960218cb}" = "My Bluetooth Places"
  -> {HKLM...CLSID} = "Moje miejsca interfejsu Bluetooth"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\btneighborhood.dll" ["Broadcom Corporation."]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki dla ochrony WWW"
  -> {HKLM...CLSID} = "Statystyki dla ochrony WWW"
                   \InProcServer32\(Default) = "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
  -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
                   \InProcServer32\(Default) = "E:\Programy\Nero\Nero 8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{654D0431-C930-43C4-B8DA-9AA01BA5B486}" = "PDI GUI Engine COM Obj"
  -> {HKLM...CLSID} = "PDI GUI Engine COM Obj"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Portrait Displays\Shared\HtmlEngine.dll" ["Portrait Displays, Inc"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
  -> {HKLM...CLSID} = "Groove GFS Browser Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
  -> {HKLM...CLSID} = "Groove Folder Synchronization"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
  -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
  -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
  -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
  -> {HKLM...CLSID} = "Groove XML Icon Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
  -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
  -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
  -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
  -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
  -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Outlook File Icon Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {HKLM...CLSID} = "Microsoft Office Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
  -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{AB4F43CA-ADCD-4384-B9AF-3CECEA7D6544}" = "Witryny sieci Web"
  -> {HKLM...CLSID} = "Witryny sieci Web"
                   \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\12\BIN\FPNSE.DLL" [MS]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
  -> {HKLM...CLSID} = "iTunes"
                   \InProcServer32\(Default) = "E:\Programy\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."]
INFECTION WARNING! "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
  -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
  -> {HKLM...CLSID} = "WPDShServiceObj Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "e:\programy\kasper~1\kasper~1.0\adialhk.dll" ["Kaspersky Lab"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
INFECTION WARNING! "System" = "kdxwj.exe" [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS]
INFECTION WARNING! klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"]
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
  -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
                   \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

Resztę wkleje, jak ktoś coś napiszę, bo nie mogę wstawić następnego postu, a w jednym się nie mieści .

[Okocza]

Kod: Zaznacz wszystko

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxwj.exe] C:\WINDOWS\system32\[b]kdxwj.exe[/b]


fix w hj - pogrubiony ręcznie z dysku, wklej log z combofixa

[andig]

Nic nie pogrubiłeś, więc jeszcze nic nie robie .

Wklejam resztę z SR:

Kod: Zaznacz wszystko

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
  -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
                   \InProcServer32\(Default) = "E:\Programy\Nero\Nero 8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
FineReader9ContextMenu\(Default) = "{59A3380E-5305-4cea-BD99-4F2FF510C91F}"
  -> {HKLM...CLSID} = "FineReader9.FRContextMenu.1"
                   \InProcServer32\(Default) = "E:\Programy\ABBYY FineReader 9.0 Professional Edition\FRIntegration.dll" ["ABBYY Software Ltd"]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
  -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
  -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
  -> {HKLM...CLSID} = "WinZip"
                   \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."]
XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
  -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\AvastSS.scr" ["ALWIL Software"]


DESKTOP.INI DLL launch in local fixed drive directories:
--------------------------------------------------------

C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Feeds Cache\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Feeds Cache\ATYI1N4Z\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Feeds Cache\GVI18DKU\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Feeds Cache\V8NH24ZB\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Feeds Cache\VSZ75HKH\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Historia\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI
[.ShellClassInfo]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1YHT1G96\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HADBDFRM\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\JT7JW3DT\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\M7QORMT6\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Historia\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\01IN4HQR\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\09M3G9QB\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\KT27C927\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\Default User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\WHYR496J\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\History\History.IE5\DESKTOP.INI
[.ShellClassInfo]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\BLZFG8BC\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\L41C6YEH\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\MSDUODW2\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp\Temporary Internet Files\Content.IE5\TPWUW8OZ\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\8XAB01QF\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\C12RST67\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GHIVW9YB\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GX27896B\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Historia\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\01IN4HQR\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\MNCNCEUZ\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\OWZVJCZL\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SFILPLQ1\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\TU7UW2GJ\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\O7Z9AKC4\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\PQR1KLDW\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\R1TLMWX7\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\ZIJKL4NX\DESKTOP.INI
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
  -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]


Startup items in "Darek" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\Darek\Menu Start\Programy\Autostart
"Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007" -> shortcut to: "C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE /tsr" [MS]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Inc."]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
  -> {HKLM...CLSID} = "Megaupload Toolbar"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" [null data]
"{35065594-9169-4A34-B167-FC4865038E53}"
  -> {HKLM...CLSID} = "Easy Gif Animator Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided)
  -> {HKLM...CLSID} = "Megaupload Toolbar"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD                                   "]
"{35065594-9169-4A34-B167-FC4865038E53}" = "Easy Gif Animator Toolbar"
  -> {HKLM...CLSID} = "Easy Gif Animator Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll" [null data]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS]

HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki dla ochrony WWW"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statystyki dla ochrony WWW"

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
  -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{CCA281CA-C863-46EF-9331-5C8D4460577F}\
"ButtonText" = "@btrez.dll,-4015"
"MenuText" = "@btrez.dll,-4017"
"Script" = "E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm" [null data]

{D18A0B52-D63C-4ED0-AFC6-C1E3DC1AF43A}\
"ButtonText" = "BitComet"
"Script" = "res://E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll/206" ["BitComet"]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "FlashGet"
"Exec" = "E:\Programy\FlashGet\FlashGet.exe" ["FlashGet.com"]

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search & Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
  -> {HKLM...CLSID} = "Spybot-S&D IE Protection"
                   \InProcServer32\(Default) = "E:\Programy\SPYBOT~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
HIJACK WARNING! "NavigationFailure" = "res://ieframe.dll/navcancl.htm" [MS]
HIJACK WARNING! "DesktopItemNavigationFailure" = "res://ieframe.dll/navcancl.htm" [MS]
HIJACK WARNING! "NavigationCanceled" = "res://ieframe.dll/navcancl.htm" [MS]
HIJACK WARNING! "OfflineInformation" = "res://ieframe.dll/offcancl.htm" [null data]
HIJACK WARNING! "PostNotCached" = "res://ieframe.dll/repost.htm" [MS]
HIJACK WARNING! "NoAdd-ons" = "res://ieframe.dll/noaddon.htm" [MS]
HIJACK WARNING! "NoAdd-onsInfo" = "res://ieframe.dll/noaddoninfo.htm" [MS]
HIJACK WARNING! "SecurityRisk" = "res://ieframe.dll/securityatrisk.htm" [MS]
HIJACK WARNING! "Tabs" = "C:\Documents and Settings\Darek\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [null data]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

ABBYY FineReader 9.0 PE Licensing Service, ABBYY.Licensing.FineReader.Professional.9.0, ""C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service" ["ABBYY (BIT Software)"]
Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple Inc."]
Asset Management Daemon, Asset Management Daemon, "C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe" [null data]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."]
Bluetooth Service, btwdins, "E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe" ["Broadcom Corporation."]
Bonjour Service, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Inc."]
Crypkey License, Crypkey License, "crypserv.exe" ["CrypKey (Canada) Ltd."]
Diskeeper, Diskeeper, "E:\Programy\Diskeeper\DkService.exe" ["Diskeeper Corporation"]
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."]
Kaspersky Internet Security 7.0, AVP, ""E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r" ["Kaspersky Lab"]
Lavasoft Ad-Aware Service, aawservice, "E:\Programy\Lavasoft\aawservice.exe" ["Lavasoft"]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "E:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe" ["Nero AG"]
Portrait Displays Display Tune Service, DTSRVC, "C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe" [null data]
Portrait Displays SDK Service, PdiService, "C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe" ["Portrait Displays, Inc."]
ServiceLayer, ServiceLayer, ""C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"" ["Nokia."]
SmartLinkService, SLService, "slserv.exe" [" "]
StyleXPService, StyleXPService, ""C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"" [empty string]
Usługa iPod, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Canon BJ Language Monitor i320\Driver = "CNMLM47.DLL" ["CANON INC."]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
Port drukarki interfejsu Bluetooth\Driver = "bthcrp.dll" ["Broadcom Corporation."]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 1780 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
  took 120 seconds.
---------- (total run time: 2113 seconds)


[Okocza]

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxwj.exe] C:\WINDOWS\system32\kdxwj.exe

ręcznie ten gruby i czerwony...

daj log z combofixa

[andig]

No więc tak. Pliku do usunięcia nie znalazłem. Dalej... Na początku program chciał zainstalować coś tam do przywracania systemu. Potem, z faktu aktywnego antywirusa, który wykazał zarażenie pliku tekstowego, nie mogąc anulować poczynań programu antyw., musiałem go wyłączyć, jednak automatycznie podjął za mnie akcję. Więc po zrobieniu loga przez CF, znowu go puściłem. Tym razem pluł się o aktualizację, której nie udało mu się zrobić. Wlazłem więc na stronę producenta i ściągnąłem najnowszą wersje i zrobiłem nowe logo. Coś wydarzyło się podczas tego loga, nie pamiętam już dokładnie, ale chyba jakieś błędy - chyba pierwszy raz nie miałem błędu svchost w tym momencie. Zrestartowałem kompa i błąd powrócił, ale po za tym było spoko. Wyłączyłem antywirusa i zrobiłem nowe logo. Po tym logu, a dokładnie restarcie przez program komp trochę ze świrował. Włączył mi się Spybot i AVG. Oba miałem od dawna powyłączane, jeśli nie pousuwane ( na 90% jestem pewien, że Spybot'a usuwałem ;P ). Nie włączył mi się jeden z antywirusów, który powinien się włączyć automatycznie. Spybot wywalił, że jakiś key ma być zmieniony, czy jakoś tak. Z faktu nie za miłych wspomnień z tym programem, wyłączyłem go, więc znowu podjął ileś tam za mnie decyzji, blokując te zmiany (było to już po ostatnim logu ). Ostatecznie program uruchomiłem, Spybot'a wywaliłem, a w AVG wyłączyłem uruchamianie podczas systemu. Poniżej zamieszczam wszystkie loga:

Kod: Zaznacz wszystko

ComboFix 08-11-29.02 - Darek 2008-11-29 22:20:00.1 - NTFSx86
Uruchomiony z: e:\programy\Drużyna odsyfiania\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Darek\Dane aplikacji\google\runhh6110411.exe
c:\program files\Mozilla Firefox\components\iamfamous.dll
C:\resycled
c:\windows\system32\_000003_.tmp.dll
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\kdxwj.exe
E:\resycled
e:\resycled\boot.com
F:\resycled
f:\resycled\boot.com
G:\resycled
g:\resycled\boot.com

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-10-28 do 2008-11-29  )))))))))))))))))))))))))))))))
.

2008-11-22 01:35 . 2008-11-22 01:35   1,793   --a------   c:\windows\system32\fxsperf.ini
2008-11-22 01:34 . 2008-11-22 01:33   1,361   --a------   c:\windows\system32\fxscount.h
2008-11-22 01:13 . 2008-11-22 01:13   <DIR>   d--------   c:\windows\system32\msmq
2008-11-22 01:13 . 2008-11-22 01:14   <DIR>   d--------   C:\Inetpub
2008-11-22 01:12 . 2008-11-22 02:22   5,443   --a------   c:\windows\imsins.BAK
2008-11-20 20:15 . 2008-11-20 20:15   <DIR>   d--------   c:\windows\system32\NtmsData
2008-11-17 07:08 . 2008-11-17 07:08   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-16 17:31 . 2008-11-16 17:31   27,904   --a------   c:\windows\system32\drivers\ndisprot.sys
2008-11-16 15:43 . 2008-11-16 15:43   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-16 15:40 . 2008-11-16 15:40   <DIR>   d--------   c:\program files\LSoft Technologies
2008-11-16 15:25 . 1999-06-18 22:49   165,888   --a------   c:\windows\Ckconfig.exe
2008-11-16 15:25 . 2006-03-01 02:10   69,632   --a------   c:\windows\system32\Crypserv.exe
2008-11-16 15:25 . 2006-01-10 03:47   31,846   --a------   c:\windows\system32\Ckldrv.sys
2008-11-16 15:25 . 1996-05-03 18:21   27,648   -ra------   c:\windows\Setup_ck.exe
2008-11-16 15:25 . 1996-05-03 16:36   18,432   --a------   c:\windows\Setup_ck.dll
2008-11-16 15:25 . 1995-07-04 19:33   11,776   --a------   c:\windows\Ckrfresh.exe
2008-11-16 15:25 . 2008-11-17 02:01   3,360   --a------   c:\windows\system32\esnecil.nlp
2008-11-16 15:25 . 2008-11-17 13:00   3,360   --a------   c:\windows\system32\esnecil.ind
2008-11-16 15:25 . 2008-11-17 02:01   237   --a------   c:\windows\Crypkey.ini
2008-11-16 15:25 . 2008-11-17 02:01   4   --a------   c:\windows\vx86036.dat
2008-11-16 15:24 . 1998-06-24 00:00   260,920   --a------   c:\windows\system32\MSDATGRD.OCX
2008-11-12 15:34 . 2008-10-24 12:21   455,296   -----c---   c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 15:33 . 2008-09-04 18:17   1,106,944   -----c---   c:\windows\system32\dllcache\msxml3.dll
2008-11-11 20:17 . 2008-11-11 20:33   95   --a------   c:\windows\system32\productregistry
2008-11-11 20:12 . 2008-11-11 20:12   <DIR>   d--------   C:\Sun
2008-11-11 19:08 . 2008-11-11 19:08   410,976   --a------   c:\windows\system32\deploytk.dll
2008-11-08 22:44 . 2008-11-08 22:44   <DIR>   d--------   c:\program files\iPod
2008-11-08 22:44 . 2008-11-08 22:45   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 22:36 . 2008-10-01 13:01   32,000   --a------   c:\windows\system32\drivers\usbaapl.sys
2008-11-02 19:27 . 2008-11-02 19:27   <DIR>   d--------   c:\program files\Easy Gif Animator Extension
2008-11-02 19:27 . 2008-11-02 19:27   234,418   --a------   c:\windows\EasyGifAnimator_Toolbar_Uninstaller_2906.exe

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 21:36   2,551,584   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-29 21:36   182,095,904   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-29 21:33   242,300   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-29 21:33   2,442,872   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-29 17:01   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-29 03:21   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\MegauploadToolbar
2008-11-17 16:38   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-16 14:40   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-15 19:24   ---------   d-----w   c:\program files\Safari
2008-11-15 17:18   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Skype
2008-11-12 15:11   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-11 18:07   ---------   d-----w   c:\program files\Java
2008-11-09 00:13   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Apple Computer
2008-11-06 00:58   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\FileZilla
2008-11-02 11:19   ---------   d-----w   c:\program files\Common Files\Adobe
2008-10-24 11:21   455,296   ----a-w   c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 21:50   ---------   d-----w   c:\program files\Microsoft Silverlight
2008-10-16 13:13   202,776   ----a-w   c:\windows\system32\wuweb.dll
2008-10-16 13:13   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
2008-10-16 13:12   561,688   ----a-w   c:\windows\system32\wuapi.dll
2008-10-16 13:12   323,608   ----a-w   c:\windows\system32\wucltui.dll
2008-10-16 13:09   92,696   ----a-w   c:\windows\system32\cdm.dll
2008-10-16 13:09   51,224   ----a-w   c:\windows\system32\wuauclt.exe
2008-10-16 13:09   43,544   ----a-w   c:\windows\system32\wups2.dll
2008-10-16 13:08   34,328   ----a-w   c:\windows\system32\wups.dll
2008-10-16 13:06   268,648   ----a-w   c:\windows\system32\mucltui.dll
2008-10-16 13:06   208,744   ----a-w   c:\windows\system32\muweb.dll
2008-10-07 20:34   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Installations
2008-10-07 20:33   ---------   d-----w   c:\program files\Nokia
2008-10-07 20:29   ---------   d-----w   c:\program files\Common Files\Nokia
2008-10-05 19:44   ---------   d-----w   c:\program files\Microsoft CAPICOM 2.1.0.2
2008-09-30 15:43   1,286,152   ----a-w   c:\windows\system32\msxml4.dll
2008-09-15 15:27   1,846,656   ----a-w   c:\windows\system32\win32k.sys
2008-09-10 01:15   1,307,648   ----a-w   c:\windows\system32\msxml6.dll
2008-09-04 17:17   1,106,944   ----a-w   c:\windows\system32\msxml3.dll
2008-08-29 08:18   87,336   ----a-w   c:\windows\system32\dns-sd.exe
2008-08-29 07:53   61,440   ----a-w   c:\windows\system32\dnssd.dll
2008-05-18 19:13   25,240   ----a-w   c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-11 18:47   32,768   --sha-w   c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008051120080512\index.dat
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="e:\programy\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-11 136600]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 188416]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-25 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="e:\programy\Quick Time\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="e:\programy\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"AVP"="e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856]
"ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Darek\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 11:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 e:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
--a------ 2003-03-24 17:38 1443328 e:\programy\EdHtml\EdHTML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 e:\programy\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 08:25 1828136 e:\programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 e:\programy\Quick Time\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-01-04 17:21 2089808 e:\programy\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-24 19:31 1372160 c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 e:\programy\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Programy\\Gadu-Gadu\\gg.exe"=
"e:\\Programy\\iTunes\\iTunes.exe"=
"e:\\Programy\\Quick Time\\QuickTimePlayer.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8454:TCP"= 8454:TCP:BitComet 8454 TCP
"8454:UDP"= 8454:UDP:BitComet 8454 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd360f12-55bb-11dd-9800-4d6564696130}]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

MSConfigStartUp-InCD - e:\programy\Nero\Nero 8\InCD\InCD.exe
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe


.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\adcnbivf.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 22:35:03
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(776)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(832)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll

- - - - - - - > 'explorer.exe'(884)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\windows\system32\ati2evxx.exe
e:\programy\Lavasoft\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Bonjour\mDNSResponder.exe
e:\programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
c:\windows\system32\Crypserv.exe
e:\programy\Diskeeper\DkService.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Gateway\EzTune\dthtml.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
e:\programy\Nero\Nero 8\Nero BackItUp\NBService.exe
c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
c:\program files\Common Files\PCSuite\Services\ServiceLayer.exe
c:\windows\system32\slserv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\verclsid.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-29 22:46:11 - komputer został uruchomiony ponownie [Darek]
ComboFix-quarantined-files.txt  2008-11-29 21:45:41

Przed: 10,317,127,680 bajtów wolnych
Po: 10,702,397,440 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (bootscreen)" /noexecute=optin /fastdetect /KERNEL=kernel1.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

281   --- E O F ---   2008-11-12 15:11:14


Kod: Zaznacz wszystko

ComboFix 08-11-29.02 - Darek 2008-11-29 23:09:27.2 - NTFSx86
Uruchomiony z: e:\programy\Drużyna odsyfiania\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Darek\Dane aplikacji\google\runhh6110411.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-10-28 do 2008-11-29  )))))))))))))))))))))))))))))))
.

2008-11-22 01:35 . 2008-11-22 01:35   1,793   --a------   c:\windows\system32\fxsperf.ini
2008-11-22 01:34 . 2008-11-22 01:33   1,361   --a------   c:\windows\system32\fxscount.h
2008-11-22 01:13 . 2008-11-22 01:13   <DIR>   d--------   c:\windows\system32\msmq
2008-11-22 01:13 . 2008-11-22 01:14   <DIR>   d--------   C:\Inetpub
2008-11-22 01:12 . 2008-11-22 02:22   5,443   --a------   c:\windows\imsins.BAK
2008-11-20 20:15 . 2008-11-20 20:15   <DIR>   d--------   c:\windows\system32\NtmsData
2008-11-17 07:08 . 2008-11-17 07:08   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-16 17:31 . 2008-11-16 17:31   27,904   --a------   c:\windows\system32\drivers\ndisprot.sys
2008-11-16 15:43 . 2008-11-16 15:43   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-16 15:40 . 2008-11-16 15:40   <DIR>   d--------   c:\program files\LSoft Technologies
2008-11-16 15:25 . 1999-06-18 22:49   165,888   --a------   c:\windows\Ckconfig.exe
2008-11-16 15:25 . 2006-03-01 02:10   69,632   --a------   c:\windows\system32\Crypserv.exe
2008-11-16 15:25 . 2006-01-10 03:47   31,846   --a------   c:\windows\system32\Ckldrv.sys
2008-11-16 15:25 . 1996-05-03 18:21   27,648   -ra------   c:\windows\Setup_ck.exe
2008-11-16 15:25 . 1996-05-03 16:36   18,432   --a------   c:\windows\Setup_ck.dll
2008-11-16 15:25 . 1995-07-04 19:33   11,776   --a------   c:\windows\Ckrfresh.exe
2008-11-16 15:25 . 2008-11-17 02:01   3,360   --a------   c:\windows\system32\esnecil.nlp
2008-11-16 15:25 . 2008-11-17 13:00   3,360   --a------   c:\windows\system32\esnecil.ind
2008-11-16 15:25 . 2008-11-17 02:01   237   --a------   c:\windows\Crypkey.ini
2008-11-16 15:25 . 2008-11-17 02:01   4   --a------   c:\windows\vx86036.dat
2008-11-16 15:24 . 1998-06-24 00:00   260,920   --a------   c:\windows\system32\MSDATGRD.OCX
2008-11-12 15:34 . 2008-10-24 12:21   455,296   -----c---   c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 15:33 . 2008-09-04 18:17   1,106,944   -----c---   c:\windows\system32\dllcache\msxml3.dll
2008-11-11 20:17 . 2008-11-11 20:33   95   --a------   c:\windows\system32\productregistry
2008-11-11 20:12 . 2008-11-11 20:12   <DIR>   d--------   C:\Sun
2008-11-11 19:08 . 2008-11-11 19:08   410,976   --a------   c:\windows\system32\deploytk.dll
2008-11-08 22:44 . 2008-11-08 22:44   <DIR>   d--------   c:\program files\iPod
2008-11-08 22:44 . 2008-11-08 22:45   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 22:36 . 2008-10-01 13:01   32,000   --a------   c:\windows\system32\drivers\usbaapl.sys
2008-11-02 19:27 . 2008-11-02 19:27   <DIR>   d--------   c:\program files\Easy Gif Animator Extension
2008-11-02 19:27 . 2008-11-02 19:27   234,418   --a------   c:\windows\EasyGifAnimator_Toolbar_Uninstaller_2906.exe

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 22:26   2,556,960   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-29 22:25   182,165,792   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-29 22:23   242,756   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-29 22:23   2,443,856   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-29 17:01   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-29 03:21   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\MegauploadToolbar
2008-11-17 16:38   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-16 14:40   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-15 19:24   ---------   d-----w   c:\program files\Safari
2008-11-15 17:18   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Skype
2008-11-12 15:11   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-11 18:07   ---------   d-----w   c:\program files\Java
2008-11-09 00:13   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Apple Computer
2008-11-06 00:58   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\FileZilla
2008-11-02 11:19   ---------   d-----w   c:\program files\Common Files\Adobe
2008-10-24 11:21   455,296   ----a-w   c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 21:50   ---------   d-----w   c:\program files\Microsoft Silverlight
2008-10-16 13:13   202,776   ----a-w   c:\windows\system32\wuweb.dll
2008-10-16 13:13   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
2008-10-16 13:12   561,688   ----a-w   c:\windows\system32\wuapi.dll
2008-10-16 13:12   323,608   ----a-w   c:\windows\system32\wucltui.dll
2008-10-16 13:09   92,696   ----a-w   c:\windows\system32\cdm.dll
2008-10-16 13:09   51,224   ----a-w   c:\windows\system32\wuauclt.exe
2008-10-16 13:09   43,544   ----a-w   c:\windows\system32\wups2.dll
2008-10-16 13:08   34,328   ----a-w   c:\windows\system32\wups.dll
2008-10-16 13:06   268,648   ----a-w   c:\windows\system32\mucltui.dll
2008-10-16 13:06   208,744   ----a-w   c:\windows\system32\muweb.dll
2008-10-07 20:34   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Installations
2008-10-07 20:33   ---------   d-----w   c:\program files\Nokia
2008-10-07 20:29   ---------   d-----w   c:\program files\Common Files\Nokia
2008-10-05 19:44   ---------   d-----w   c:\program files\Microsoft CAPICOM 2.1.0.2
2008-09-30 15:43   1,286,152   ----a-w   c:\windows\system32\msxml4.dll
2008-09-15 15:27   1,846,656   ----a-w   c:\windows\system32\win32k.sys
2008-09-10 01:15   1,307,648   ----a-w   c:\windows\system32\msxml6.dll
2008-09-04 17:17   1,106,944   ----a-w   c:\windows\system32\msxml3.dll
2008-08-29 08:18   87,336   ----a-w   c:\windows\system32\dns-sd.exe
2008-08-29 07:53   61,440   ----a-w   c:\windows\system32\dnssd.dll
2008-05-18 19:13   25,240   ----a-w   c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-11 18:47   32,768   --sha-w   c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008051120080512\index.dat
.

(((((((((((((((((((((((((((((   snapshot@2008-11-29_22.42.10.25   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-29 22:24:47   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_730.dat
+ 2008-11-29 22:26:09   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_b7c.dat
+ 2008-11-29 22:26:12   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_c44.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="e:\programy\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-11 136600]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 188416]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-25 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="e:\programy\Quick Time\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="e:\programy\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"AVP"="e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856]
"ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 11:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 e:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
--a------ 2003-03-24 17:38 1443328 e:\programy\EdHtml\EdHTML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 e:\programy\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 08:25 1828136 e:\programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 e:\programy\Quick Time\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-01-04 17:21 2089808 e:\programy\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-24 19:31 1372160 c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 e:\programy\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Programy\\Gadu-Gadu\\gg.exe"=
"e:\\Programy\\iTunes\\iTunes.exe"=
"e:\\Programy\\Quick Time\\QuickTimePlayer.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8454:TCP"= 8454:TCP:BitComet 8454 TCP
"8454:UDP"= 8454:UDP:BitComet 8454 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd360f12-55bb-11dd-9800-4d6564696130}]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\adcnbivf.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 23:24:48
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(776)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(832)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll

- - - - - - - > 'explorer.exe'(688)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\Amhooker.dll
e:\programy\CursorXP\CurXP0.dll
c:\windows\system32\msi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\windows\system32\ati2evxx.exe
e:\programy\Lavasoft\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
c:\program files\Gateway\EzTune\dthtml.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Bonjour\mDNSResponder.exe
e:\programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
c:\windows\system32\Crypserv.exe
e:\programy\Diskeeper\DkService.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
e:\programy\Nero\Nero 8\Nero BackItUp\NBService.exe
c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
c:\program files\Common Files\PCSuite\Services\ServiceLayer.exe
c:\windows\system32\slserv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\Setup\avast.setup
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-29 23:37:59 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2008-11-29 22:37:04
ComboFix2.txt  2008-11-29 21:46:29

Przed: 10 723 463 168 bajtów wolnych
Po: 10,704,596,992 bajtów wolnych

261   --- E O F ---   2008-11-12 15:11:14


Kod: Zaznacz wszystko

ComboFix 08-11-29.03 - Darek 2008-11-30  0:38:46.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.129 [GMT 1:00]
Uruchomiony z: e:\programy\Drużyna odsyfiania\ComboFix.exe
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((   Pliki utworzone od 2008-10-28 do 2008-11-29  )))))))))))))))))))))))))))))))
.

2008-11-22 01:35 . 2008-11-22 01:35   1,793   --a------   c:\windows\system32\fxsperf.ini
2008-11-22 01:34 . 2008-11-22 01:33   1,361   --a------   c:\windows\system32\fxscount.h
2008-11-22 01:13 . 2008-11-22 01:13   <DIR>   d--------   c:\windows\system32\msmq
2008-11-22 01:13 . 2008-11-22 01:14   <DIR>   d--------   C:\Inetpub
2008-11-22 01:12 . 2008-11-22 02:22   5,443   --a------   c:\windows\imsins.BAK
2008-11-20 20:15 . 2008-11-20 20:15   <DIR>   d--------   c:\windows\system32\NtmsData
2008-11-17 07:08 . 2008-11-17 07:08   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-16 17:31 . 2008-11-16 17:31   27,904   --a------   c:\windows\system32\drivers\ndisprot.sys
2008-11-16 15:43 . 2008-11-16 15:43   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-16 15:40 . 2008-11-16 15:40   <DIR>   d--------   c:\program files\LSoft Technologies
2008-11-16 15:25 . 1999-06-18 22:49   165,888   --a------   c:\windows\Ckconfig.exe
2008-11-16 15:25 . 2006-03-01 02:10   69,632   --a------   c:\windows\system32\Crypserv.exe
2008-11-16 15:25 . 2006-01-10 03:47   31,846   --a------   c:\windows\system32\Ckldrv.sys
2008-11-16 15:25 . 1996-05-03 18:21   27,648   -ra------   c:\windows\Setup_ck.exe
2008-11-16 15:25 . 1996-05-03 16:36   18,432   --a------   c:\windows\Setup_ck.dll
2008-11-16 15:25 . 1995-07-04 19:33   11,776   --a------   c:\windows\Ckrfresh.exe
2008-11-16 15:25 . 2008-11-17 02:01   3,360   --a------   c:\windows\system32\esnecil.nlp
2008-11-16 15:25 . 2008-11-17 13:00   3,360   --a------   c:\windows\system32\esnecil.ind
2008-11-16 15:25 . 2008-11-17 02:01   237   --a------   c:\windows\Crypkey.ini
2008-11-16 15:25 . 2008-11-17 02:01   4   --a------   c:\windows\vx86036.dat
2008-11-16 15:24 . 1998-06-24 00:00   260,920   --a------   c:\windows\system32\MSDATGRD.OCX
2008-11-12 15:34 . 2008-10-24 12:21   455,296   -----c---   c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 15:33 . 2008-09-04 18:17   1,106,944   -----c---   c:\windows\system32\dllcache\msxml3.dll
2008-11-11 20:17 . 2008-11-11 20:33   95   --a------   c:\windows\system32\productregistry
2008-11-11 20:12 . 2008-11-11 20:12   <DIR>   d--------   C:\Sun
2008-11-11 19:08 . 2008-11-11 19:08   410,976   --a------   c:\windows\system32\deploytk.dll
2008-11-08 22:44 . 2008-11-08 22:44   <DIR>   d--------   c:\program files\iPod
2008-11-08 22:44 . 2008-11-08 22:45   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 22:36 . 2008-10-01 13:01   32,000   --a------   c:\windows\system32\drivers\usbaapl.sys
2008-11-02 19:27 . 2008-11-02 19:27   <DIR>   d--------   c:\program files\Easy Gif Animator Extension
2008-11-02 19:27 . 2008-11-02 19:27   234,418   --a------   c:\windows\EasyGifAnimator_Toolbar_Uninstaller_2906.exe

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 23:49   2,561,824   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-29 23:49   182,250,016   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-29 22:59   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-29 22:40   242,972   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-29 22:40   2,444,168   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-29 03:21   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\MegauploadToolbar
2008-11-17 16:38   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-16 14:40   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-15 19:24   ---------   d-----w   c:\program files\Safari
2008-11-15 17:18   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Skype
2008-11-12 15:11   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-11 18:07   ---------   d-----w   c:\program files\Java
2008-11-09 00:13   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Apple Computer
2008-11-06 00:58   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\FileZilla
2008-11-02 11:19   ---------   d-----w   c:\program files\Common Files\Adobe
2008-10-24 11:21   455,296   ----a-w   c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 21:50   ---------   d-----w   c:\program files\Microsoft Silverlight
2008-10-16 13:13   202,776   ----a-w   c:\windows\system32\wuweb.dll
2008-10-16 13:13   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
2008-10-16 13:12   561,688   ----a-w   c:\windows\system32\wuapi.dll
2008-10-16 13:12   323,608   ----a-w   c:\windows\system32\wucltui.dll
2008-10-16 13:09   92,696   ----a-w   c:\windows\system32\cdm.dll
2008-10-16 13:09   51,224   ----a-w   c:\windows\system32\wuauclt.exe
2008-10-16 13:09   43,544   ----a-w   c:\windows\system32\wups2.dll
2008-10-16 13:08   34,328   ----a-w   c:\windows\system32\wups.dll
2008-10-16 13:06   268,648   ----a-w   c:\windows\system32\mucltui.dll
2008-10-16 13:06   208,744   ----a-w   c:\windows\system32\muweb.dll
2008-10-07 20:34   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Installations
2008-10-07 20:33   ---------   d-----w   c:\program files\Nokia
2008-10-07 20:29   ---------   d-----w   c:\program files\Common Files\Nokia
2008-10-05 19:44   ---------   d-----w   c:\program files\Microsoft CAPICOM 2.1.0.2
2008-09-30 15:43   1,286,152   ----a-w   c:\windows\system32\msxml4.dll
2008-09-15 15:27   1,846,656   ----a-w   c:\windows\system32\win32k.sys
2008-09-10 01:15   1,307,648   ----a-w   c:\windows\system32\msxml6.dll
2008-09-04 17:17   1,106,944   ----a-w   c:\windows\system32\msxml3.dll
2008-08-29 08:18   87,336   ----a-w   c:\windows\system32\dns-sd.exe
2008-08-29 07:53   61,440   ----a-w   c:\windows\system32\dnssd.dll
2008-05-18 19:13   25,240   ----a-w   c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-11 18:47   32,768   --sha-w   c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008051120080512\index.dat
.

(((((((((((((((((((((((((((((   snapshot@2008-11-29_22.42.10.25   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-29 22:42:02   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_60c.dat
+ 2008-11-29 22:41:53   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_644.dat
+ 2008-11-29 22:41:27   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_770.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="e:\programy\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-11 136600]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 188416]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-25 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="e:\programy\Quick Time\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="e:\programy\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Darek\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 11:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 e:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
--a------ 2003-03-24 17:38 1443328 e:\programy\EdHtml\EdHTML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 e:\programy\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 08:25 1828136 e:\programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 e:\programy\Quick Time\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-01-04 17:21 2089808 e:\programy\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-24 19:31 1372160 c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 e:\programy\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Programy\\Gadu-Gadu\\gg.exe"=
"e:\\Programy\\iTunes\\iTunes.exe"=
"e:\\Programy\\Quick Time\\QuickTimePlayer.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8454:TCP"= 8454:TCP:BitComet 8454 TCP
"8454:UDP"= 8454:UDP:BitComet 8454 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd360f12-55bb-11dd-9800-4d6564696130}]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\adcnbivf.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 00:49:20
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(772)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(828)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll

- - - - - - - > 'explorer.exe'(472)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
.
Czas ukończenia: 2008-11-30  0:55:07
ComboFix-quarantined-files.txt  2008-11-29 23:54:53
ComboFix2.txt  2008-11-29 22:38:31
ComboFix3.txt  2008-11-29 21:46:29

Przed: 10 675 503 104 bajtów wolnych
Po: 10,658,463,744 bajtów wolnych

222   --- E O F ---   2008-11-12 15:11:14


[Okocza]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[andig]

No więc tak. Programiki co mi dałeś uruchomiłem i poszło sprawnie. Podczas czyszczenia był komunikat - ,,Nie można załadować usługi VDM IPX/SPX". Pojawiła mi się opcja przy uruchamianiu systemu - Recovery Console. Przy CF, znowu nie wyłączyłem anty wira, więc dwa razy puściłem program. Komunikat raz jest, a raz go nie ma różnie. Znów mam na pulpicie ikonke IE. Nie wiem od czego to zależy. Pojawił mi się też po wczytywaniu przy uruchomieniu komunikat -

W raportach się już gubie, więc wrzucam all.

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by Darek on 2008-11-30 at 16:15

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 17:21:44
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="E:\Programy\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7a,b8,0c,e7,90,14,8d,ab,cd,b4,80,12,bd,05,9f,55,f7,94,b1,e8,81,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2d,dd,02,a4,aa,94,fa,49,b5,da,42,3b,bb,d8,36,bc,53,..
"khjeh"=hex:f4,6a,22,a3,0c,33,27,fa,d6,f4,0c,9f,c8,c7,f1,e3,93,eb,77,91,b7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:08,e7,ca,17,89,af,1b,6e,29,94,94,2d,36,96,0f,02,d8,e0,50,71,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:05,d7,81,f1,ab,57,20,68,16,b6,60,8f,9a,78,10,58,c0,ba,cb,3b,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\PNP0F13\3&267a616a&0\LogConf]
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,00,02,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:7a,b8,0c,e7,90,14,8d,ab,cd,b4,80,12,bd,05,9f,55,f7,94,b1,e8,81,..
"p0"="E:\Programy\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:f4,6a,22,a3,0c,33,27,fa,d6,f4,0c,9f,c8,c7,f1,e3,93,eb,77,91,b7,..
"a0"=hex:20,01,00,00,3b,a4,e0,7f,71,4f,4e,4b,3f,35,02,7f,5d,9d,35,99,6d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:54,01,68,c3,e7,7e,5f,9b,d4,8c,bc,7d,99,30,91,78,9a,66,a5,fd,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:7e,4f,70,f7,26,59,19,7e,26,8c,04,33,cf,c4,98,40,9e,9b,d3,69,b1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="E:\Programy\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7a,b8,0c,e7,90,14,8d,ab,cd,b4,80,12,bd,05,9f,55,f7,94,b1,e8,81,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2d,dd,02,a4,aa,94,fa,49,b5,da,42,3b,bb,d8,36,bc,53,..
"khjeh"=hex:f4,6a,22,a3,0c,33,27,fa,d6,f4,0c,9f,c8,c7,f1,e3,93,eb,77,91,b7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e6,17,6e,c5,5a,52,42,5e,23,59,f1,89,78,1a,c6,8b,c6,da,4b,84,6b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:05,d7,81,f1,ab,57,20,68,16,b6,60,8f,9a,78,10,58,c0,ba,cb,3b,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\ACPI\PNP0F13\3&267a616a&0\LogConf]
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,00,02,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:7a,b8,0c,e7,90,14,8d,ab,cd,b4,80,12,bd,05,9f,55,f7,94,b1,e8,81,..
"p0"="E:\Programy\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:f4,6a,22,a3,0c,33,27,fa,d6,f4,0c,9f,c8,c7,f1,e3,93,eb,77,91,b7,..
"a0"=hex:20,01,00,00,3b,a4,e0,7f,71,4f,4e,4b,3f,35,02,7f,5d,9d,35,99,6d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:54,01,68,c3,e7,7e,5f,9b,d4,8c,bc,7d,99,30,91,78,9a,66,a5,fd,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:7e,4f,70,f7,26,59,19,7e,26,8c,04,33,cf,c4,98,40,9e,9b,d3,69,b1,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"="C:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"E:\\Programy\\Gadu-Gadu\\gg.exe"="E:\\Programy\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"E:\\Programy\\iTunes\\iTunes.exe"="E:\\Programy\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"E:\\Programy\\Quick Time\\QuickTimePlayer.exe"="E:\\Programy\\Quick Time\\QuickTimePlayer.exe:*:Enabled:QuickTime Player"
"E:\\Programy\\Opera\\opera.exe"="E:\\Programy\\Opera\\opera.exe:*:Enabled:Opera Internet Browser"
"C:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"="C:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"="C:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Mon 11 Jun 2007         2,045 ...H. --- "C:\WINDOWS\system32\whlprd32a.dll"
Thu 24 Jan 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]



Kod: Zaznacz wszystko

ComboFix 08-11-29.03 - Darek 2008-11-30 17:34:31.4 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.166 [GMT 1:00]
Uruchomiony z: e:\programy\Drużyna odsyfiania\ComboFix.exe
.

(((((((((((((((((((((((((   Pliki utworzone od 2008-10-28 do 2008-11-30  )))))))))))))))))))))))))))))))
.

2008-11-30 16:14 . 2008-11-30 16:14   580,096   --a--c---   c:\windows\system32\dllcache\user32.dll
2008-11-30 16:10 . 2008-11-30 16:10   <DIR>   d--------   c:\windows\ERUNT
2008-11-30 16:04 . 2008-11-30 17:27   <DIR>   d--------   C:\SDFix
2008-11-22 01:35 . 2008-11-22 01:35   1,793   --a------   c:\windows\system32\fxsperf.ini
2008-11-22 01:34 . 2008-11-22 01:33   1,361   --a------   c:\windows\system32\fxscount.h
2008-11-22 01:13 . 2008-11-22 01:13   <DIR>   d--------   c:\windows\system32\msmq
2008-11-22 01:13 . 2008-11-22 01:14   <DIR>   d--------   C:\Inetpub
2008-11-22 01:12 . 2008-11-22 02:22   5,443   --a------   c:\windows\imsins.BAK
2008-11-20 20:15 . 2008-11-20 20:15   <DIR>   d--------   c:\windows\system32\NtmsData
2008-11-17 07:08 . 2008-11-17 07:08   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-16 17:31 . 2008-11-16 17:31   27,904   --a------   c:\windows\system32\drivers\ndisprot.sys
2008-11-16 15:43 . 2008-11-16 15:43   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-16 15:40 . 2008-11-16 15:40   <DIR>   d--------   c:\program files\LSoft Technologies
2008-11-16 15:25 . 1999-06-18 22:49   165,888   --a------   c:\windows\Ckconfig.exe
2008-11-16 15:25 . 2006-03-01 02:10   69,632   --a------   c:\windows\system32\Crypserv.exe
2008-11-16 15:25 . 2006-01-10 03:47   31,846   --a------   c:\windows\system32\Ckldrv.sys
2008-11-16 15:25 . 1996-05-03 18:21   27,648   -ra------   c:\windows\Setup_ck.exe
2008-11-16 15:25 . 1996-05-03 16:36   18,432   --a------   c:\windows\Setup_ck.dll
2008-11-16 15:25 . 1995-07-04 19:33   11,776   --a------   c:\windows\Ckrfresh.exe
2008-11-16 15:25 . 2008-11-17 02:01   3,360   --a------   c:\windows\system32\esnecil.nlp
2008-11-16 15:25 . 2008-11-17 13:00   3,360   --a------   c:\windows\system32\esnecil.ind
2008-11-16 15:25 . 2008-11-17 02:01   237   --a------   c:\windows\Crypkey.ini
2008-11-16 15:25 . 2008-11-17 02:01   4   --a------   c:\windows\vx86036.dat
2008-11-16 15:24 . 1998-06-24 00:00   260,920   --a------   c:\windows\system32\MSDATGRD.OCX
2008-11-12 15:34 . 2008-10-24 12:21   455,296   -----c---   c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 15:33 . 2008-09-04 18:17   1,106,944   -----c---   c:\windows\system32\dllcache\msxml3.dll
2008-11-11 20:17 . 2008-11-11 20:33   95   --a------   c:\windows\system32\productregistry
2008-11-11 20:12 . 2008-11-11 20:12   <DIR>   d--------   C:\Sun
2008-11-11 19:08 . 2008-11-11 19:08   410,976   --a------   c:\windows\system32\deploytk.dll
2008-11-08 22:44 . 2008-11-08 22:44   <DIR>   d--------   c:\program files\iPod
2008-11-08 22:44 . 2008-11-08 22:45   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 22:36 . 2008-10-01 13:01   32,000   --a------   c:\windows\system32\drivers\usbaapl.sys
2008-11-02 19:27 . 2008-11-02 19:27   <DIR>   d--------   c:\program files\Easy Gif Animator Extension
2008-11-02 19:27 . 2008-11-02 19:27   234,418   --a------   c:\windows\EasyGifAnimator_Toolbar_Uninstaller_2906.exe
2008-10-25 23:45 . 2008-10-15 17:36   337,408   -----c---   c:\windows\system32\dllcache\netapi32.dll
2008-10-20 23:29 . 1998-10-07 11:54   327,168   --a------   c:\windows\IsUn0415.exe
2008-10-15 21:53 . 2008-10-15 22:00   <DIR>   d--------   C:\Netgear
2008-10-15 11:29 . 2008-09-15 16:27   1,846,656   -----c---   c:\windows\system32\dllcache\win32k.sys
2008-10-15 11:29 . 2008-09-08 11:41   333,824   -----c---   c:\windows\system32\dllcache\srv.sys
2008-10-15 11:28 . 2008-08-14 14:26   2,190,464   -----c---   c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,146,816   -----c---   c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,067,328   -----c---   c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,025,472   -----c---   c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-07 21:33 . 2008-05-07 06:39   1,419,232   --a------   c:\windows\system32\wdfcoinstaller01005.dll
2008-10-07 21:33 . 2008-05-07 06:38   659,968   --a------   c:\windows\system32\nmwcdcocls.dll
2008-10-07 21:33 . 2008-05-07 06:38   20,864   --a------   c:\windows\system32\drivers\ccdcmbo.sys
2008-10-07 21:33 . 2008-05-07 06:38   17,536   --a------   c:\windows\system32\drivers\ccdcmb.sys
2008-10-07 21:33 . 2008-05-07 06:38   8,064   --a------   c:\windows\system32\drivers\usbser_lowerfltj.sys
2008-10-07 21:33 . 2008-06-06 08:24   8,064   --a------   c:\windows\system32\drivers\usbser_lowerflt.sys
2008-10-07 21:32 . 2008-02-01 15:17   138,112   --a------   c:\windows\system32\drivers\nmwcdnsu.sys
2008-10-07 21:32 . 2008-02-01 15:17   8,320   --a------   c:\windows\system32\drivers\nmwcdnsuc.sys
2008-10-05 20:44 . 2008-10-05 20:44   <DIR>   d--------   c:\program files\Microsoft CAPICOM 2.1.0.2

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 16:41   182,418,464   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-30 16:40   2,578,464   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-30 16:29   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-30 15:06   243,812   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-30 15:06   2,445,752   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-30 00:21   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-29 03:21   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\MegauploadToolbar
2008-11-16 14:40   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-15 19:24   ---------   d-----w   c:\program files\Safari
2008-11-15 17:18   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Skype
2008-11-12 15:11   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-11 18:07   ---------   d-----w   c:\program files\Java
2008-11-09 00:13   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Apple Computer
2008-11-06 00:58   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\FileZilla
2008-11-02 11:19   ---------   d-----w   c:\program files\Common Files\Adobe
2008-10-24 11:21   455,296   ----a-w   c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 21:50   ---------   d-----w   c:\program files\Microsoft Silverlight
2008-10-16 13:13   202,776   ----a-w   c:\windows\system32\wuweb.dll
2008-10-16 13:13   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
2008-10-16 13:12   561,688   ----a-w   c:\windows\system32\wuapi.dll
2008-10-16 13:12   323,608   ----a-w   c:\windows\system32\wucltui.dll
2008-10-16 13:09   92,696   ----a-w   c:\windows\system32\cdm.dll
2008-10-16 13:09   51,224   ----a-w   c:\windows\system32\wuauclt.exe
2008-10-16 13:09   43,544   ----a-w   c:\windows\system32\wups2.dll
2008-10-16 13:08   34,328   ----a-w   c:\windows\system32\wups.dll
2008-10-16 13:06   268,648   ----a-w   c:\windows\system32\mucltui.dll
2008-10-16 13:06   208,744   ----a-w   c:\windows\system32\muweb.dll
2008-10-07 20:34   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Installations
2008-10-07 20:33   ---------   d-----w   c:\program files\Nokia
2008-10-07 20:29   ---------   d-----w   c:\program files\Common Files\Nokia
2008-09-30 15:43   1,286,152   ----a-w   c:\windows\system32\msxml4.dll
2008-09-15 15:27   1,846,656   ----a-w   c:\windows\system32\win32k.sys
2008-09-10 01:15   1,307,648   ----a-w   c:\windows\system32\msxml6.dll
2008-09-04 17:17   1,106,944   ----a-w   c:\windows\system32\msxml3.dll
2008-08-29 08:18   87,336   ----a-w   c:\windows\system32\dns-sd.exe
2008-08-29 07:53   61,440   ----a-w   c:\windows\system32\dnssd.dll
2008-08-26 08:27   826,368   ----a-w   c:\windows\system32\wininet.dll
2008-08-14 13:26   2,190,464   ----a-w   c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26   2,067,328   ----a-w   c:\windows\system32\ntkrnlpa.exe
2008-05-18 19:13   25,240   ----a-w   c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-11 18:47   32,768   --sha-w   c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008051120080512\index.dat
.

(((((((((((((((((((((((((((((   snapshot@2008-11-29_22.42.10.25   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-11-30 15:11:20   9,334,784   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-11-30 15:11:20   245,760   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-11-30 15:10:55   9,334,784   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-11-30 15:10:55   245,760   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-11-30 16:08:43   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_540.dat
+ 2008-11-30 16:08:52   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_664.dat
+ 2008-11-30 16:08:01   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_738.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="e:\programy\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="e:\programy\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728]
"SunJavaUpdateSched"="e:\programy\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 188416]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Darek\Menu Start\Programy\Autostart\
ashDisp.exe.lnk - c:\program files\Alwil Software\Avast4\ashDisp.exe [2008-04-09 81000]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 11:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 e:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
--a------ 2003-03-24 17:38 1443328 e:\programy\EdHtml\EdHTML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 e:\programy\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 08:25 1828136 e:\programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 e:\programy\Quick Time\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-24 19:31 1372160 c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 e:\programy\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Programy\\Gadu-Gadu\\gg.exe"=
"e:\\Programy\\iTunes\\iTunes.exe"=
"e:\\Programy\\Quick Time\\QuickTimePlayer.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8454:TCP"= 8454:TCP:BitComet 8454 TCP
"8454:UDP"= 8454:UDP:BitComet 8454 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-09 110160]
R1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2008-07-18 17952]
R1 Pivot;Pivot;c:\windows\system32\drivers\pivot.sys [2008-06-12 17465]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;"c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service [2007-12-06 660768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-09 20560]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2008-01-24 278280]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\BTTUNER.sys [2008-01-24 15200]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [2008-01-24 12632]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-07-12 90112]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2008-02-01 14336]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-16 27904]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-10-07 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-10-07 8320]
S3 pivotmou;Pivot Mouse/Pointers Filter Driver;\??\c:\windows\System32\drivers\pivotmou.sys [2008-06-12 11323]
S3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\DRIVERS\s3sav4m.sys [2008-01-23 77824]
S3 V90drv;v90drv;c:\windows\system32\DRIVERS\v90drv.sys [2001-11-29 1432836]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd360f12-55bb-11dd-9800-4d6564696130}]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-AdVantage - c:\program files\AdVantage\AdVantage.exe
HKLM-Run-avast! - e:\programy\avast\ashDisp.exe
HKLM-Run-AVG7_CC - c:\progra~1\Grisoft\AVG7\avgcc.exe
HKLM-Run-VVSN - c:\program files\VVSN\VVSN.exe
MSConfigStartUp-SpybotSD TeaTimer - e:\programy\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe


.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\adcnbivf.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 17:41:02
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...


c:\docume~1\Darek\USTAWI~1\Temp\RGI9.tmp 7115 bytes

skanowanie pomyślnie ukończone
ukryte pliki: 1

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(756)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(812)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
.
Czas ukończenia: 2008-11-30 17:43:31
ComboFix-quarantined-files.txt  2008-11-30 16:43:24
ComboFix2.txt  2008-11-29 23:55:22
ComboFix3.txt  2008-11-29 22:38:31
ComboFix4.txt  2008-11-29 21:46:29

Przed: 10 524 942 336 bajtów wolnych
Po: 10,508,361,728 bajtów wolnych

256   --- E O F ---   2008-11-12 15:11:14


Kod: Zaznacz wszystko

ComboFix 08-11-30.01 - Darek 2008-11-30 19:19:36.5 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.259 [GMT 1:00]
Uruchomiony z: e:\programy\Drużyna odsyfiania\ComboFix.exe
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((   Pliki utworzone od 2008-10-28 do 2008-11-30  )))))))))))))))))))))))))))))))
.

2008-11-30 16:14 . 2008-11-30 16:14   580,096   --a--c---   c:\windows\system32\dllcache\user32.dll
2008-11-30 16:10 . 2008-11-30 16:10   <DIR>   d--------   c:\windows\ERUNT
2008-11-30 16:04 . 2008-11-30 17:27   <DIR>   d--------   C:\SDFix
2008-11-22 01:35 . 2008-11-22 01:35   1,793   --a------   c:\windows\system32\fxsperf.ini
2008-11-22 01:34 . 2008-11-22 01:33   1,361   --a------   c:\windows\system32\fxscount.h
2008-11-22 01:13 . 2008-11-22 01:13   <DIR>   d--------   c:\windows\system32\msmq
2008-11-22 01:13 . 2008-11-22 01:14   <DIR>   d--------   C:\Inetpub
2008-11-22 01:12 . 2008-11-22 02:22   5,443   --a------   c:\windows\imsins.BAK
2008-11-20 20:15 . 2008-11-20 20:15   <DIR>   d--------   c:\windows\system32\NtmsData
2008-11-17 07:08 . 2008-11-17 07:08   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-16 17:31 . 2008-11-16 17:31   27,904   --a------   c:\windows\system32\drivers\ndisprot.sys
2008-11-16 15:43 . 2008-11-16 15:43   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-16 15:40 . 2008-11-16 15:40   <DIR>   d--------   c:\program files\LSoft Technologies
2008-11-16 15:25 . 1999-06-18 22:49   165,888   --a------   c:\windows\Ckconfig.exe
2008-11-16 15:25 . 2006-03-01 02:10   69,632   --a------   c:\windows\system32\Crypserv.exe
2008-11-16 15:25 . 2006-01-10 03:47   31,846   --a------   c:\windows\system32\Ckldrv.sys
2008-11-16 15:25 . 1996-05-03 18:21   27,648   -ra------   c:\windows\Setup_ck.exe
2008-11-16 15:25 . 1996-05-03 16:36   18,432   --a------   c:\windows\Setup_ck.dll
2008-11-16 15:25 . 1995-07-04 19:33   11,776   --a------   c:\windows\Ckrfresh.exe
2008-11-16 15:25 . 2008-11-17 02:01   3,360   --a------   c:\windows\system32\esnecil.nlp
2008-11-16 15:25 . 2008-11-17 13:00   3,360   --a------   c:\windows\system32\esnecil.ind
2008-11-16 15:25 . 2008-11-17 02:01   237   --a------   c:\windows\Crypkey.ini
2008-11-16 15:25 . 2008-11-17 02:01   4   --a------   c:\windows\vx86036.dat
2008-11-16 15:24 . 1998-06-24 00:00   260,920   --a------   c:\windows\system32\MSDATGRD.OCX
2008-11-12 15:34 . 2008-10-24 12:21   455,296   -----c---   c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 15:33 . 2008-09-04 18:17   1,106,944   -----c---   c:\windows\system32\dllcache\msxml3.dll
2008-11-11 20:17 . 2008-11-11 20:33   95   --a------   c:\windows\system32\productregistry
2008-11-11 20:12 . 2008-11-11 20:12   <DIR>   d--------   C:\Sun
2008-11-11 19:08 . 2008-11-11 19:08   410,976   --a------   c:\windows\system32\deploytk.dll
2008-11-08 22:44 . 2008-11-08 22:44   <DIR>   d--------   c:\program files\iPod
2008-11-08 22:44 . 2008-11-08 22:45   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 22:36 . 2008-10-01 13:01   32,000   --a------   c:\windows\system32\drivers\usbaapl.sys
2008-11-02 19:27 . 2008-11-02 19:27   <DIR>   d--------   c:\program files\Easy Gif Animator Extension
2008-11-02 19:27 . 2008-11-02 19:27   234,418   --a------   c:\windows\EasyGifAnimator_Toolbar_Uninstaller_2906.exe
2008-10-25 23:45 . 2008-10-15 17:36   337,408   -----c---   c:\windows\system32\dllcache\netapi32.dll
2008-10-20 23:29 . 1998-10-07 11:54   327,168   --a------   c:\windows\IsUn0415.exe
2008-10-15 21:53 . 2008-10-15 22:00   <DIR>   d--------   C:\Netgear
2008-10-15 11:29 . 2008-09-15 16:27   1,846,656   -----c---   c:\windows\system32\dllcache\win32k.sys
2008-10-15 11:29 . 2008-09-08 11:41   333,824   -----c---   c:\windows\system32\dllcache\srv.sys
2008-10-15 11:28 . 2008-08-14 14:26   2,190,464   -----c---   c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,146,816   -----c---   c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,067,328   -----c---   c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 11:28 . 2008-08-14 14:26   2,025,472   -----c---   c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-07 21:33 . 2008-05-07 06:39   1,419,232   --a------   c:\windows\system32\wdfcoinstaller01005.dll
2008-10-07 21:33 . 2008-05-07 06:38   659,968   --a------   c:\windows\system32\nmwcdcocls.dll
2008-10-07 21:33 . 2008-05-07 06:38   20,864   --a------   c:\windows\system32\drivers\ccdcmbo.sys
2008-10-07 21:33 . 2008-05-07 06:38   17,536   --a------   c:\windows\system32\drivers\ccdcmb.sys
2008-10-07 21:33 . 2008-05-07 06:38   8,064   --a------   c:\windows\system32\drivers\usbser_lowerfltj.sys
2008-10-07 21:33 . 2008-06-06 08:24   8,064   --a------   c:\windows\system32\drivers\usbser_lowerflt.sys
2008-10-07 21:32 . 2008-02-01 15:17   138,112   --a------   c:\windows\system32\drivers\nmwcdnsu.sys
2008-10-07 21:32 . 2008-02-01 15:17   8,320   --a------   c:\windows\system32\drivers\nmwcdnsuc.sys
2008-10-05 20:44 . 2008-10-05 20:44   <DIR>   d--------   c:\program files\Microsoft CAPICOM 2.1.0.2

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 18:25   2,582,816   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-30 18:25   182,491,936   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-30 17:00   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-30 16:56   244,988   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-30 16:56   2,447,528   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-30 00:21   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-29 03:21   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\MegauploadToolbar
2008-11-16 14:40   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-15 19:24   ---------   d-----w   c:\program files\Safari
2008-11-15 17:18   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Skype
2008-11-12 15:11   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-11 18:07   ---------   d-----w   c:\program files\Java
2008-11-09 00:13   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\Apple Computer
2008-11-06 00:58   ---------   d-----w   c:\documents and settings\Darek\Dane aplikacji\FileZilla
2008-11-02 11:19   ---------   d-----w   c:\program files\Common Files\Adobe
2008-10-24 11:21   455,296   ----a-w   c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 21:50   ---------   d-----w   c:\program files\Microsoft Silverlight
2008-10-16 13:13   202,776   ----a-w   c:\windows\system32\wuweb.dll
2008-10-16 13:13   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
2008-10-16 13:12   561,688   ----a-w   c:\windows\system32\wuapi.dll
2008-10-16 13:12   323,608   ----a-w   c:\windows\system32\wucltui.dll
2008-10-16 13:09   92,696   ----a-w   c:\windows\system32\cdm.dll
2008-10-16 13:09   51,224   ----a-w   c:\windows\system32\wuauclt.exe
2008-10-16 13:09   43,544   ----a-w   c:\windows\system32\wups2.dll
2008-10-16 13:08   34,328   ----a-w   c:\windows\system32\wups.dll
2008-10-16 13:06   268,648   ----a-w   c:\windows\system32\mucltui.dll
2008-10-16 13:06   208,744   ----a-w   c:\windows\system32\muweb.dll
2008-10-07 20:34   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Installations
2008-10-07 20:33   ---------   d-----w   c:\program files\Nokia
2008-10-07 20:29   ---------   d-----w   c:\program files\Common Files\Nokia
2008-09-30 15:43   1,286,152   ----a-w   c:\windows\system32\msxml4.dll
2008-09-15 15:27   1,846,656   ----a-w   c:\windows\system32\win32k.sys
2008-09-10 01:15   1,307,648   ----a-w   c:\windows\system32\msxml6.dll
2008-09-04 17:17   1,106,944   ----a-w   c:\windows\system32\msxml3.dll
2008-08-29 08:18   87,336   ----a-w   c:\windows\system32\dns-sd.exe
2008-08-29 07:53   61,440   ----a-w   c:\windows\system32\dnssd.dll
2008-08-26 08:27   826,368   ----a-w   c:\windows\system32\wininet.dll
2008-08-14 13:26   2,190,464   ----a-w   c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26   2,067,328   ----a-w   c:\windows\system32\ntkrnlpa.exe
2008-05-18 19:13   25,240   ----a-w   c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-11 18:47   32,768   --sha-w   c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008051120080512\index.dat
.

(((((((((((((((((((((((((((((   snapshot@2008-11-29_22.42.10.25   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-11-30 15:11:20   9,334,784   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-11-30 15:11:20   245,760   ----a-w   c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04   163,328   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-11-30 15:10:55   9,334,784   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-11-30 15:10:55   245,760   ----a-w   c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-11-30 16:58:46   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_584.dat
+ 2008-11-30 16:59:04   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_60c.dat
+ 2008-11-30 16:58:31   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_768.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="e:\programy\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="e:\programy\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728]
"SunJavaUpdateSched"="e:\programy\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 188416]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Darek\Menu Start\Programy\Autostart\
ashDisp.exe.lnk - c:\program files\Alwil Software\Avast4\ashDisp.exe [2008-04-09 81000]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 12:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 11:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 e:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
--a------ 2003-03-24 17:38 1443328 e:\programy\EdHtml\EdHTML.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 18:57 289576 e:\programy\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 08:25 1828136 e:\programy\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 e:\programy\Quick Time\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-24 19:31 1372160 c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 e:\programy\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Programy\\Gadu-Gadu\\gg.exe"=
"e:\\Programy\\iTunes\\iTunes.exe"=
"e:\\Programy\\Quick Time\\QuickTimePlayer.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\Programy\\Komunikatory\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8454:TCP"= 8454:TCP:BitComet 8454 TCP
"8454:UDP"= 8454:UDP:BitComet 8454 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-09 110160]
R1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2008-07-18 17952]
R1 Pivot;Pivot;c:\windows\system32\drivers\pivot.sys [2008-06-12 17465]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;"c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service [2007-12-06 660768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-09 20560]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2008-01-24 278280]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\BTTUNER.sys [2008-01-24 15200]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [2008-01-24 12632]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-07-12 90112]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2008-02-01 14336]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-16 27904]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-10-07 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-10-07 8320]
S3 pivotmou;Pivot Mouse/Pointers Filter Driver;\??\c:\windows\System32\drivers\pivotmou.sys [2008-06-12 11323]
S3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\DRIVERS\s3sav4m.sys [2008-01-23 77824]
S3 V90drv;v90drv;c:\windows\system32\DRIVERS\v90drv.sys [2001-11-29 1432836]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd360f12-55bb-11dd-9800-4d6564696130}]
\Shell\AutoRun\command - I:\DTSP_Launcher.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\adcnbivf.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 19:25:09
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(756)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(812)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll

- - - - - - - > 'explorer.exe'(1628)
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
e:\programy\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
.
Czas ukończenia: 2008-11-30 19:27:50
ComboFix-quarantined-files.txt  2008-11-30 18:27:41
ComboFix2.txt  2008-11-30 16:43:42
ComboFix3.txt  2008-11-29 23:55:22
ComboFix4.txt  2008-11-29 22:38:31
ComboFix5.txt  2008-11-30 18:18:07

Przed: 10 477 273 088 bajtów wolnych
Po: 10,460,278,784 bajtów wolnych

255   --- E O F ---   2008-11-12 15:11:14


Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:29:29, on 2008-12-01
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
E:\Programy\Lavasoft\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
E:\Programy\Diskeeper\DkService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
E:\Programy\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
E:\Programy\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
E:\Programy\Opera\Opera.exe
E:\Programy\Drużyna odsyfiania\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = č 



'Â
xƒż
č Xp   Hţ
ÍÖM
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programy\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Easy Gif Animator Toolbar Helper - {96372AB6-15EB-4316-B497-71C741BC548C} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programy\FlashGet\getflash.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Programy\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVP] "E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [CursorXP] E:\Programy\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Programy\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: ashDisp.exe.lnk = C:\Program Files\Alwil Software\Avast4\ashDisp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Programy\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Stáhnout všechno FlashGetem - E:\Programy\FlashGet\jc_all.htm
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_all.htm
O8 - Extra context menu item: Dodaj do blokowanych banerów - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://F:\xcvxvd\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Programy\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201177734634
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201184849812
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Programy\Lavasoft\aawservice.exe
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - E:\Programy\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programy\MSI\BToes Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - E:\Programy\Diskeeper\DkService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Programy\Nero\Nero 8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 12887 bytes


[wojtas]

skasuj:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = č 



'Â
xƒż
č Xp Hţ
ÍÖM

te plik/i :

c:\windows\system32\fxsperf.ini
c:\windows\system32\fxscount.h

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow oraz Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

[andig]

Sorka, że tak długo, ale Tata wyłączył mi kompa i musiałem jeszcze raz skanować , a każdy skan po około 11h . Do rzeczy:

c:\windows\system32\fxsperf.ini
c:\windows\system32\fxscount.h

Oba czyste,

Skan przeprowadziłem wykorzystując Operę, gdyż w IE nie mogłem dojść do okna ze skanowaniem - zawieszał się na regulaminie . Log:

Kod: Zaznacz wszystko

--------------------------------------------------------------------------------
RAPORT KASPERSKY ONLINE SCANNER 7.0
środa, 3 grudzień 2008
System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 3 (build 2600)
Wersja Kaspersky Online Scanner: 7.0.26.12
Data ostatniej aktualizacji bazy danych: Tuesday, December 02, 2008 12:23:52
Liczba wpisów: 1431613
--------------------------------------------------------------------------------

Ustawienia skanowania:
   Typ bazy danych użytej do skanowania: rozszerzona
   Skanuj archiwa: tak
   Skanuj pocztowe bazy danych: tak

Obszar skanowania - Mój komputer:
   A:\
   C:\
   D:\
   E:\
   F:\
   G:\
   H:\
   K:\
   S:\

Statystyki skanowania:
   Przeskanowanych plików: 327636
   Nazwa zagrożenia: 1
   Zainfekowanych obiektów: 1
   Podejrzanych obiektów: 0
   Czas skanowania: 10:54:20


Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń
E:\Programy\Drużyna odsyfiania\SmitfraudFix(fałszywe ikon,tapety itp.).zip   Zainfekowany: not-a-virus:RiskTool.Win32.Reboot.f   1

Wybrany obszar został przeskanowany.


[wojtas]

czyli jest ok.. pozdro

[andig]

Cały czas mam ten błąd svchost. Da się coś z tym zrobić??

[wojtas]

wejdź do konsoli odzyskiwania

i wpisz:

expand X:\i386\svchost.ex_ C:\Windows\sytem32\svchost.exe

X- literka Twojego cd romu

[andig]

Jest tylko mały probelm. Przy instalacji, nie mam żadnego zapytania. Okno samo się zamyka. Po drugie, jak startuję z płyty, to mi chce windowsa instalować, albo partycje robić . Może płytę mam złą??

[wojtas]

to nie dawaj enteru tylko literke R i wtedy o ile dobrze pamietam uda sie wejsc

[andig]

Nie bardzo wiem, o którym momęcie w mojej sytuacji piszesz. Według tego linku co mi dałeś, najpierw istaluje się coś wykorzystując ,,uruchom". W tej instalacji nie mam żadnych opcji. Okno się otwiera wyrzuca jakiś tekst i w ciągu ~1s., zamyka się.

Przy odpaleniu kompa z płyt, wyżuca mi najpierw przygotowanie do instalacji ( możliwa opcja f6 i f2 ). Potem ładuje, sprawdza czy jest zanistalowany windows... i wyrzuca opcje z partycją i instalalacją Windows'a. Próbowałem wciskać w tym momencie R, ale nic się nie działo. Sprubuję jeszcze z inna płytką, którą musze najpierw zciągnąć z serwera PW, a to trochę mi zajmie .

PS. O widzę, że też masz Maczka , hehe... Wiesz co dobre .

Edit: No więc tak. Doszedłem do tego okna, gdzie się komendy wpisuje i :

po pierwsze --> jedyne polecenie, które chce jako tako działać to expand X:\i386\svchost.ex_ C:\Windows\system32\svchost.exe ( literke zjadłeś ) ; dopisze tylko, że dopiero po x razach, czytaniu i spr. zauważyłem, że tam się wstawia spacje... xD

po drugie --> wyskakuje następujący błąd

Nie można utworzyć pliku svchost.exe. Zdekompresowano 0 plik(ów).

Svchost ma prawa -a------. Plik z płyty dekompresuje się.

Plz. help .

[wojtas]

a wpisz taka komende:

expand X:\i386\svchost.ex_ C:\Windows\system32

[sgsman]

A czy przypadkiem katalogu docelowego nie powinno się zakończyć "beksleszem"?

expand X:\i386\svchost.ex_ C:\Windows\system32\

I literka nie jest zjedzona, winno być *.ex_. Sam zobacz, tak jest w katalogu na płycie.

[andig]

sgsman - nie o to chodzi. Zamiast system32, wojas podał sytem32 . Przejęzyczył się .

Nadal to samo. Przypuszczam, że to nie svchost sam z siebie generuje ten błąd, tylko coś go do tego ,,zmusza".

A co oznacza ten błąd - ??

[wojtas]

a wpisz w konsoli polecenie :

chkdsk x: /p

gdzie x to litera partycji systemowej.. a jesli nie pomoze to nie wiem co zrobic.

[andig]

Nadal to samo. Dodam, że avast znalazł wiry i ( ku mojemu zaskoczeniu ), chciał przeprowadzić skan podczas rozruchu... Znalazł jakieś 6 plików w plikach systemówych dysków .

Wniosek z tego taki - musze przeinstalować system - jak ja to kocham . Z tą różnicą, że teraz postaram się najpierw zainstalować Leoparda, a potem Xp xD. Szkoda mi tylko czasu, jaki na to poświęce .

Ps. Lan mi ani razu nie działał. Gdzie nie pójdę, to do innych Xp'eków łączę się od razu, tylko u mnie jest problem... ;P.