prosze o sprawdzenie loga i pomoc...

[eMaNeTeWu]

Mam problem z kompem... Otóż ściągałem pewne lekarstwo i okazało się że mialo wirusy... Takie rzeczy dzieją się z kompem:




I inne podobne errory itp , na pulpicie pojawiły się ikonki Spyware&Malware Protection, Error Cleaner i Privacy Protector. Gdy je usune to po restarcie kompa znowu sie pojawiają... Użycie procka niemal ciągle 100%, komp zamulony ze gg i winamp sie zacina...

Log z hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:20:23, on 2007-12-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BDEX System - {87EF7048-8905-4E82-862E-65004D4DFA80} - C:\WINDOWS\domnftwwrn.dll
O3 - Toolbar: The emlkdvo - {13EDA0D4-F00D-43B9-8EF2-6313909D3143} - C:\WINDOWS\emlkdvo.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.05\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [Stefan] C:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F753D6E6-B4A9-4D89-A7BA-4A851A47CCF6}: NameServer = 194.204.159.1 217.98.63.164
O21 - SSODL: alxvdvm - {1C376926-2072-47B6-98BC-B378AB2FD5B8} - C:\WINDOWS\alxvdvm.dll
O21 - SSODL: bvtqfvx - {71D0623E-F5A9-4964-AA92-24431B75F87D} - C:\WINDOWS\bvtqfvx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5556 bytes

Pomożcie!

[Avenger]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
O2 - BHO: BDEX System - {87EF7048-8905-4E82-862E-65004D4DFA80} - C:\WINDOWS\domnftwwrn.dll
O3 - Toolbar: The emlkdvo - {13EDA0D4-F00D-43B9-8EF2-6313909D3143} - C:\WINDOWS\emlkdvo.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O21 - SSODL: alxvdvm - {1C376926-2072-47B6-98BC-B378AB2FD5B8} - C:\WINDOWS\alxvdvm.dll
O21 - SSODL: bvtqfvx - {71D0623E-F5A9-4964-AA92-24431B75F87D} - C:\WINDOWS\bvtqfvx.dll

Usuń pogrubione pliki w trybie awaryjnym i wyłączonym przywracaniem systemu, wpisy kasujesz hijackiem

Zastosuj Smitfraudfix opcja nr 2
Po zabiegach dajesz nowy log z hijacka, log z Combofix oraz raport ze Smitfraudfix

Autor postu otrzymał pochwałę

[eMaNeTeWu]

Zrobiłem tak jak mówiłeś i komp zdecydowanie szybciej chodzi! Ale zobacze jeszcze podczas dłuższej pracy czy nic sie nie dzieje i wtedy odpowiednio Ci podziekuje... A tutaj logi:

Smitfraudfix

SmitFraudFix v2.274

Scan done at 22:40:43,29, 2007-12-27
Run from C:\Documents and Settings\eMaNeTeWu\Pulpit\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:43:05, on 2007-12-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.05\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [Stefan] C:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 3814 bytes

I Combofix:

ComboFix 07-12-21.4 - eMaNeTeWu 2007-12-27 22:47:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1584 [GMT 1:00]
Running from: C:\Bin\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\dat.txt
C:\WINDOWS\rs.txt

.
((((((((((((((((((((((((( Files Created from 2007-11-27 to 2007-12-27 )))))))))))))))))))))))))))))))
.

2007-12-27 22:35 . 2007-12-27 22:40 3,806 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-27 20:48 . 2007-12-27 20:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2007-12-27 20:20 . 2007-12-27 20:48 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-27 08:59 . 2007-12-27 08:59 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-27 08:44 . 2007-12-27 20:49 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Lavasoft
2007-12-26 21:48 . 2007-12-26 21:48 <DIR> d-------- C:\Program Files\ffdshow
2007-12-26 21:48 . 2007-01-01 00:00 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-12-26 21:48 . 2007-12-22 19:07 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-26 21:48 . 2007-01-01 00:00 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-12-26 21:05 . 2002-12-17 16:23 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll
2007-12-26 21:05 . 2002-10-20 14:05 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll
2007-12-26 20:53 . 2007-12-26 20:53 <DIR> d-------- C:\Program Files\Vstplugins
2007-12-26 20:53 . 2007-12-26 20:53 <DIR> d-------- C:\Program Files\Microsoft SQL Server
2007-12-26 20:39 . 2007-12-26 19:33 253,952 --a------ C:\WINDOWS\bvtqfvx.dll
2007-12-26 20:39 . 2007-12-26 19:34 200,704 --a------ C:\WINDOWS\emlkdvo.dll
2007-12-26 20:39 . 2007-12-26 19:33 192,512 --a------ C:\WINDOWS\alxvdvm.dll
2007-12-26 20:39 . 2007-12-26 19:34 90,112 --a------ C:\WINDOWS\fvkwdrt.exe
2007-12-26 20:29 . 2007-12-26 20:29 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Publish Providers
2007-12-26 20:03 . 2007-12-26 20:03 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Sony
2007-12-26 20:02 . 2007-12-26 20:52 <DIR> d-------- C:\Program Files\Sony
2007-12-26 20:02 . 2007-12-26 20:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony
2007-12-26 19:42 . 2007-12-26 19:42 <DIR> d-------- C:\Program Files\Sony Setup
2007-12-26 15:51 . 2007-12-26 15:57 <DIR> d-------- C:\Hip-Hop
2007-12-26 15:47 . 2007-12-26 15:50 <DIR> d-------- C:\Program Files\Winamp
2007-12-26 15:47 . 2007-12-26 16:01 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Winamp
2007-12-26 15:15 . 2007-12-27 10:05 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-26 15:11 . 2007-12-27 11:06 <DIR> d-------- C:\Zdjęcia
2007-12-26 15:08 . 2007-08-06 21:30 16,945 ---hs---- C:\PegeFile.pif
2007-12-24 19:25 . 2007-12-24 19:32 <DIR> d-------- C:\Program Files\Skijumping 2007
2007-12-21 21:36 . 2007-12-21 21:36 <DIR> d-------- C:\Program Files\ReaSoft
2007-12-21 21:36 . 2007-12-21 21:36 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\ReaSoft
2007-12-21 14:50 . 2007-12-21 14:50 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\.jpi_cache
2007-12-21 14:49 . 2007-12-21 14:49 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\.java
2007-12-21 11:22 . 2007-12-21 11:22 <DIR> d-------- C:\Fraps
2007-12-20 10:34 . 2007-12-27 09:18 <DIR> d-------- C:\Program Files\Panzer Elite Action
2007-12-18 14:53 . 2004-06-16 06:03 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2007-12-18 14:50 . 2007-12-18 14:50 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-12-18 14:50 . 2007-12-18 14:50 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-12-18 14:45 . 2007-12-18 14:52 <DIR> d-------- C:\Program Files\Gothic III
2007-12-18 14:42 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-12-18 14:42 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-12-18 14:41 . 2007-12-18 14:41 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-12-18 14:41 . 2007-12-18 14:42 <DIR> d-------- C:\Program Files\Ahead
2007-12-18 14:41 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-12-18 14:41 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-12-18 14:41 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-12-18 14:41 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-12-17 12:51 . 2007-12-17 12:51 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2007-12-17 12:51 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-12-17 12:51 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2007-12-17 12:51 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-12-17 12:51 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-12-17 12:50 . 2007-12-17 12:50 <DIR> d-------- C:\Program Files\Futuremark
2007-12-16 20:19 . 2007-12-16 20:19 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-16 15:56 . 2007-12-17 12:24 <DIR> d-------- C:\Program Files\Hitman Kontrakty
2007-12-16 13:37 . 2007-12-16 13:37 <DIR> d-------- C:\Program Files\RivaTuner v2.05
2007-12-16 13:21 . 2007-12-16 13:21 <DIR> d-------- C:\nVidia Forceware
2007-12-16 12:24 . 2007-12-16 12:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-16 12:12 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-12-16 12:12 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-12-16 12:12 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-12-16 12:08 . 2007-12-16 12:08 <DIR> d-------- C:\Program Files\Electronic Arts
2007-12-15 14:04 . 2007-12-15 14:04 <DIR> d---s---- C:\Documents and Settings\eMaNeTeWu\UserData
2007-12-15 14:03 . 2007-12-15 18:25 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Image Zone Express
2007-12-15 13:49 . 2007-12-15 14:02 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\HP
2007-12-15 13:49 . 2007-12-15 13:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2007-12-15 13:48 . 2007-12-15 13:49 <DIR> d-------- C:\Program Files\Common Files\HP
2007-12-15 13:46 . 2007-12-15 13:47 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-12-15 13:46 . 2007-12-15 13:46 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-12-15 13:43 . 2006-01-03 18:12 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2007-12-15 13:43 . 2006-04-12 11:04 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-12-15 13:43 . 2006-04-10 14:03 48,128 --a------ C:\WINDOWS\system32\hpzll054.dll
2007-12-15 13:43 . 2006-04-12 11:04 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-12-15 13:43 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-15 13:43 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-15 13:42 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-12-15 13:42 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-12-15 13:42 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-12-15 13:42 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-12-15 13:42 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-12-15 13:42 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-12-15 13:41 . 2007-12-15 13:49 <DIR> d-------- C:\Program Files\HP
2007-12-15 13:39 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-15 13:39 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-12-15 13:39 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-12-15 13:39 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-12-15 13:39 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-12-15 13:38 . 2007-12-15 13:50 120,253 --a------ C:\WINDOWS\hpoins11.dat
2007-12-14 21:13 . 2007-12-14 23:02 <DIR> d-------- C:\Program Files\Cheating-Death
2007-12-14 17:31 . 2007-12-26 20:09 <DIR> d-------- C:\Program Files\eMule
2007-12-13 07:13 . 2007-12-13 07:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll
2007-12-13 07:13 . 2007-12-13 07:13 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax
2007-12-13 07:13 . 2007-12-26 21:39 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm
2007-12-13 07:13 . 2007-12-13 07:13 237,568 --a------ C:\WINDOWS\system32\OggDS.dll
2007-12-13 07:11 . 2007-12-13 07:11 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-12-13 07:11 . 2007-12-13 07:11 740,442 --a------ C:\WINDOWS\system32\DivX.dll
2007-12-13 07:11 . 2007-12-13 07:11 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2007-12-13 07:11 . 2007-12-13 07:11 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2007-12-12 21:27 . 2007-12-12 21:27 <DIR> d-------- C:\Documents and Settings\eMaNeTeWu\Dane aplikacji\Gadu-Gadu
2007-12-12 21:25 . 2007-12-12 21:25 <DIR> d-------- C:\Program Files\Gadu-Gadu

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-27 19:49 --------- d-----w C:\Program Files\Lavasoft
2007-12-18 13:52 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-13 06:12 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2007-12-13 06:12 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll
2007-12-13 06:12 45,056 ----a-w C:\WINDOWS\system32\ogg.dll
2007-12-13 06:12 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll
2007-12-13 06:12 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll
2007-12-13 06:12 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll
2007-12-09 17:26 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-09 10:57 --------- d-----w C:\Program Files\INTERIAPL
2007-12-09 10:56 --------- d-----w C:\Program Files\MarBit
2007-12-09 10:55 --------- d-----w C:\Program Files\PC DUAL SHOCK
2007-12-09 10:55 --------- d-----w C:\Program Files\A4Tech
2007-12-09 10:50 --------- d-----w C:\Program Files\Realtek
2007-12-09 10:36 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-09 10:34 --------- d-----w C:\Program Files\Usługi online
2007-12-08 12:43 175 ----a-w C:\WINDOWS\Fonts\README.txt
2007-11-21 18:23 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-20 05:01 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-05 15:28 356,352 ----a-w C:\WINDOWS\system32\nvusmb.exe
2007-10-05 15:28 356,352 ----a-w C:\WINDOWS\system32\nvunrm.exe
2007-10-05 15:28 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-10-05 14:25 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-10-05 14:25 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-10-05 14:25 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-10-05 14:25 6,750,208 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-10-05 14:25 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-10-05 14:25 5,755,520 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-10-05 14:25 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-10-05 14:25 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-10-05 14:25 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-10-05 14:25 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-10-05 14:25 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-10-05 14:25 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-10-05 14:25 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-10-05 14:25 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-10-05 14:25 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-10-05 14:25 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-10-05 14:25 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-10-05 14:25 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-10-05 14:25 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-10-05 14:25 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-10-05 14:25 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-10-05 14:25 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-10-05 14:25 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-10-05 14:25 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll
2007-10-05 14:25 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-10-05 14:25 1,150,976 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-10-05 14:25 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Stefan"="C:\Program Files\INTERIAPL\Stefan\Stefan.exe" [2007-08-29 14:30]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 08:34 C:\WINDOWS\RTHDCPL.exe]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 08:08]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-10-05 15:25 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.05\RivaTuner.exe" [2007-09-27 18:20]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 16:16]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{0EA66AD2-CF26-2E23-532B-B292E22F3266}"= C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll [2007-12-27 22:47 10801]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^eMaNeTeWu^Menu Start^Programy^Autostart^HDDlife.lnk]
path=C:\Documents and Settings\eMaNeTeWu\Menu Start\Programy\Autostart\HDDlife.lnk
backup=C:\WINDOWS\pss\HDDlife.lnkStartup

R3 RivaTuner32;RivaTuner32;C:\Program Files\RivaTuner v2.05\RivaTuner32.sys [2007-09-27 18:20]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\Auto\command - C:\PegeFile.pif
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL PegeFile.pif

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-27 22:49:13
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-27 22:49:44
.
2007-12-27 08:26:31 --- E O F ---

Wszystko działa jak ta lala łap plusika Pozdro typie

[Avenger]

2007-12-26 20:39 . 2007-12-26 19:33 253,952 --a------ C:\WINDOWS\bvtqfvx.dll
2007-12-26 20:39 . 2007-12-26 19:34 200,704 --a------ C:\WINDOWS\emlkdvo.dll
2007-12-26 20:39 . 2007-12-26 19:33 192,512 --a------ C:\WINDOWS\alxvdvm.dll
2007-12-26 20:39 . 2007-12-26 19:34 90,112 --a------ C:\WINDOWS\fvkwdrt.exe

Znajdź i usuń z dysku te pliki. Oczywiście w trybie awaryjnym i wyłączonym przywracaniem systemu.

Otwórz notatnik i wklej w nim to:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

plik>zapisz jako...>zmień rozszerzenie na: wszystkie pliki i zapisz pod nazwą FIX.REG. Odpal plik fix.reg w trybie awaryjnym i wyłączonym przywracaniem systemu