proszę o sprawdzenie loga

[Siaju]

Witam! Chciałbym przedstawić swoją sytuację. Rano włączyłem komputer. Na pulpicie wyskoczyły skróty internetowe, Spyware, i coś tam jeszcze. W sumie było ich 3. I teraz zaczęły się kłopoty . Mianowicie zaczęły wyskakiwać komunikaty ala "usługa posłaniec". Zamieszczam poniżej linki do screenów które udało mi się zrobić. Jest to bardzo uciążliwe. Jak próbowałem skanować włączyła mi się się gra age of empire. A ja jej w ogóle nie włączałem. Proszę o jak najszybszą pomoc

http://img400.imageshack.us/img400/9206/gwnoke9.png

http://img204.imageshack.us/img204/6681/gowno2kg8.png

http://img214.imageshack.us/img214/8721/gowno3nq7.png

[Lukesh]

Po pierwsze - zmien nazwe tematu na taka zgodna z regulaminem: http://forum.programosy.pl/rules.php

Po drugie: zastosuj: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
Po trzecie: wrzuc logi wg opisu: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html oraz z tego programu: http://www.programosy.pl/program,combofix.html

[Siaju]

Oto log:

Logfile of HijackThis v1.99.1
Scan saved at 13:09:19, on 2007-08-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
E:\Program Files\BearFlix\BearFlix.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\ppp\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSVPS System - {F4CF814F-970F-405D-A42C-0CE06EB97373} - C:\WINDOWS\mxduo.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [BearFlix] "e:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: OpenOffice.ux.pl 2.0.2.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.2\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - G:\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - G:\AMVConverter\grab.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - G:\MediaManager\grab.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BED7097-EC42-4E4E-8F39-3704CFE35BFE}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1BED7097-EC42-4E4E-8F39-3704CFE35BFE}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: wmphost - {A14B2D2A-5EFC-40B3-87FA-D3EFE39369D8} - C:\WINDOWS\wmphost.dll
O21 - SSODL: wmpdev - {26A1B1DD-0F85-4F2D-99CD-B27C13014860} - C:\WINDOWS\wmpdev.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

Siaju zastosuj sie do wszystkich porad Lukesha

[Precel]

Po pierwsze - zmien nazwe tematu na taka zgodna z regulaminem

ZROB TO MIGIEM

[Lukesh]

ZROB TO MIGIEM

[Siaju]

Dziękuję! Udało się. Jestem niezmiernie wdzięczny!

PS
Mam nadzieję, że teraz nazwa tematu odpowiada.

[Lukesh]

Co sie udalo? To na razie wstep xD

wrzuc logi wg opisu: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html oraz z tego programu: http://www.programosy.pl/program,combofix.html

[Red]

Usuń:

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [BearFlix] "e:\Program Files\BearFlix\BearFlix.exe" /pause
O21 - SSODL: wmphost - {A14B2D2A-5EFC-40B3-87FA-D3EFE39369D8} - C:\WINDOWS\wmphost.dll

O21 - SSODL: wmpdev - {26A1B1DD-0F85-4F2D-99CD-B27C13014860} - C:\WINDOWS\wmpdev.dll

dodatkowo przeskanuj:

C:\WINDOWS\mxduo.dll

tym

http://virusscan.jotti.org/

i wklej wynik na forum.

[Siaju]

Przesjanowałem cały dysk znalazło jeszcze 4 trojany. Usunąłem, chciałem usunąć jeszcze te co Red mówił ale ich już nie było. Komputer chodzi jak wcześniej.

[Red]

Daj log do sprawdzenia raz jeszcze.

[Siaju]

Ok, LOG:

Logfile of HijackThis v1.99.1
Scan saved at 16:55:12, on 2007-09-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ppp\Pulpit\asas\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - G:\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - G:\AMVConverter\grab.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - G:\MediaManager\grab.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BED7097-EC42-4E4E-8F39-3704CFE35BFE}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1BED7097-EC42-4E4E-8F39-3704CFE35BFE}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{1BED7097-EC42-4E4E-8F39-3704CFE35BFE}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

skasuj wpis

daj loga z combofixa

[Siaju]

Ok. Log z combofixa:

ComboFix 07-08-30.3 - "ppp" 2007-09-04 17:06:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.184 [GMT 2:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\dat.txt
C:\WINDOWS\rs.txt


((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 )))))))))))))))))))))))))))))))


2007-09-01 19:40 172,032 --a------ C:\WINDOWS\system32\cncs32.dll
2007-09-01 19:40 <DIR> d-------- C:\WINDOWS\s2002
2007-08-31 19:03 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-08-31 19:03 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-08-31 18:53 3,246 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-31 13:11 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-10 17:19 <DIR> d-------- C:\DOCUME~1\ppp\DANEAP~1\Media Player Classic
2007-08-10 17:18 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-08-10 17:18 740,442 --a------ C:\WINDOWS\system32\divx.dll
2007-08-10 17:18 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-08-10 17:18 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-08-10 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-08-10 17:18 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-08-10 17:18 163,840 --a------ C:\WINDOWS\system32\unrar.dll
2007-08-10 17:18 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-08-05 20:50 <DIR> d-------- C:\Program Files\Arjaloc


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-04 17:08 --------- d-------- C:\Program Files\Neostrada TP
2007-09-04 15:27 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\MegauploadToolbar
2007-08-30 19:19 --------- d-------- C:\Program Files\Ganymede
2007-08-30 14:31 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\GanymedeNet
2007-08-16 11:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-04 17:52 --------- d-------- C:\Program Files\MegauploadToolbar
2007-08-02 13:51 --------- d-------- C:\Program Files\MGrenda
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-14 12:02 --------- d-------- C:\Program Files\Techland
2007-07-14 12:00 --------- d-------- C:\Program Files\DAEMON Tools
2007-07-14 11:57 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-10 13:23 --------- d-------- C:\Program Files\F1 Challenge 99-02
2007-07-10 13:08 --------- d-------- C:\Program Files\Opera
2007-07-10 13:08 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\Opera
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe
2007-02-12 16:10 9232 --a------ C:\DOCUME~1\ppp\mqdmmdfl.sys
2007-02-12 16:10 92064 --a------ C:\DOCUME~1\ppp\mqdmmdm.sys
2007-02-12 16:10 79328 --a------ C:\DOCUME~1\ppp\mqdmserd.sys
2007-02-12 16:10 66656 --a------ C:\DOCUME~1\ppp\mqdmbus.sys
2007-02-12 16:10 6208 --a------ C:\DOCUME~1\ppp\mqdmcmnt.sys
2007-02-12 16:10 5936 --a------ C:\DOCUME~1\ppp\mqdmwhnt.sys
2007-02-12 16:10 4048 --a------ C:\DOCUME~1\ppp\mqdmcr.sys
2007-02-12 16:10 25600 --a------ C:\DOCUME~1\ppp\usbsermptxp.sys
2007-02-12 16:10 22768 --a------ C:\DOCUME~1\ppp\usbsermpt.sys


((((((((((((((((((((((((((((( snapshot_2007-08-31_131715.71 )))))))))))))))))))))))))))))))))))))))))

----a-w 4,293 2007-09-01 12:56:11 C:\WINDOWS\mozver.dat
----a-w 278,282 2007-09-01 17:40:38 C:\WINDOWS\s2002\s2002.exe
----a-w 40,448 2007-09-01 17:40:37 C:\WINDOWS\s2002\uninstal.exe
----a-w 40,836 2007-09-04 12:19:32 C:\WINDOWS\system32\perfc009.dat
----a-w 50,336 2007-09-04 12:19:32 C:\WINDOWS\system32\perfc015.dat
----a-w 314,508 2007-09-04 12:19:32 C:\WINDOWS\system32\perfh009.dat
----a-w 358,390 2007-09-04 12:19:32 C:\WINDOWS\system32\perfh015.dat

----a-w 4,293 2007-08-30 12:53:02 C:\WINDOWS\mozver.dat
----a-w 40,836 2007-08-31 10:55:32 C:\WINDOWS\system32\perfc009.dat
----a-w 50,336 2007-08-31 10:55:32 C:\WINDOWS\system32\perfc015.dat
----a-w 314,508 2007-08-31 10:55:32 C:\WINDOWS\system32\perfh009.dat
----a-w 358,390 2007-08-31 10:55:32 C:\WINDOWS\system32\perfh015.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 09:08 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22]
"nwiz"="nwiz.exe" [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 C:\WINDOWS\system32\nvmctray.dll]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-26 17:22]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 18:30]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-25 22:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-31 22:42]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^ppp^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.2.lnk]
path=C:\Documents and Settings\ppp\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.2.lnk
backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]
"e:\Program Files\BearFlix\BearFlix.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
"C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\NEOSTR~1\CnxMon.exe

R0 prohlp01;StarForce Protection Helper Driver v1;C:\WINDOWS\system32\drivers\prohlp01.sys
R1 prodrv05;StarForce Protection Environment Driver v5;C:\WINDOWS\system32\drivers\prodrv05.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 17:08:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-04 17:09:08
C:\ComboFix-quarantined-files.txt ... 2007-09-04 17:09
C:\ComboFix2.txt ... 2007-08-31 13:17

--- E O F ---

[wojtas]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearFlix]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....
przeskanuj ten plik:

C:\WINDOWS\system32\cncs32.dll

tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

[Siaju]

To jest raport z mojego antivira:

AntiVir PersonalEdition Classic
Report file date: 5 września 2007 14:11

Scanning for 1044559 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Dodatek Service Pack 2) [5.1.2600]
Username: ppp
Computer name: PPP-1DFAFD1E32F

Version information:
BUILD.DAT : 247 14437 Bytes 2007-05-10 11:55:00
AVSCAN.EXE : 7.0.4.15 282664 Bytes 2007-04-25 20:06:16
AVSCAN.DLL : 7.0.4.4 33832 Bytes 2007-04-25 20:06:16
LUKE.DLL : 7.0.4.11 143400 Bytes 2007-04-25 20:06:16
LUKERES.DLL : 7.0.4.0 10280 Bytes 2007-04-25 20:06:16
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 2006-05-31 15:30:06
ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 2007-07-10 09:31:57
ANTIVIR2.VDF : 6.39.1.74 1637376 Bytes 2007-09-02 16:58:14
ANTIVIR3.VDF : 6.39.1.87 37888 Bytes 2007-09-04 16:56:24
AVEWIN32.DLL : 7.4.1.66 2789888 Bytes 2007-08-30 16:57:15
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-04-25 20:06:16
AVPREF.DLL : 7.0.2.1 24616 Bytes 2007-04-25 20:06:16
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-25 20:06:18
AVPACK32.DLL : 7.3.0.15 360488 Bytes 2007-08-04 13:11:41
AVREG.DLL : 7.0.1.2 31784 Bytes 2007-04-25 20:06:16
AVEVTLOG.DLL : 7.0.0.18 86056 Bytes 2007-04-25 20:06:15
AVARKT.DLL : 1.0.0.17 278568 Bytes 2007-05-08 20:01:04
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-04-25 20:06:16
RCIMAGE.DLL : 7.0.1.15 2228264 Bytes 2007-04-25 20:06:10
RCTEXT.DLL : 7.0.45.0 86056 Bytes 2007-04-25 20:06:10

Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: C:\DOCUME~1\ppp\USTAWI~1\Temp\495ba59c.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 5 września 2007 14:11

Starting the file scan:

Begin scan in 'C:\WINDOWS\system32\cncs32.dll'


End of the scan: 5 września 2007 14:11
Used time: 00:02 min

The scan has been done completely.

0 Scanning directories
1 Files were scanned
0 viruses and/or unwanted programs were found
0 classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
1 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
0 Hidden objects were found

A tutaj z tej pierwszej stronki:

Scanner results
Scan taken on 05 Sep 2007 12:10:22 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

Tutaj raport z drugiej stronki:

Antywirus Wersja Ostatnia aktualizacja Wynik
AhnLab-V3 2007.9.5.0 2007.09.05 -
AntiVir 7.6.0.5 2007.09.05 -
Authentium 4.93.8 2007.09.05 -
Avast 4.7.1029.0 2007.09.04 -
AVG 7.5.0.485 2007.09.05 -
BitDefender 7.2 2007.09.05 -
CAT-QuickHeal 9.00 2007.09.04 -
ClamAV 0.91.2 2007.09.05 -
DrWeb 4.33 2007.09.05 -
eSafe 7.0.15.0 2007.09.04 -
eTrust-Vet 31.1.5111 2007.09.05 -
Ewido 4.0 2007.09.05 -
FileAdvisor 1 2007.09.05 -
Fortinet 3.11.0.0 2007.09.05 -
F-Prot 4.3.2.48 2007.09.05 -
F-Secure 6.70.13030.0 2007.09.05 -
Ikarus T3.1.1.12 2007.09.05 -
Kaspersky 4.0.2.24 2007.09.05 -
McAfee 5112 2007.09.04 -
Microsoft 1.2803 2007.09.05 -
NOD32v2 2506 2007.09.05 -
Norman 5.80.02 2007.09.04 -
Panda 9.0.0.4 2007.09.05 -
Prevx1 V2 2007.09.05 -
Rising 19.39.22.00 2007.09.05 -
Sophos 4.21.0 2007.09.05 -
Sunbelt 2.2.907.0 2007.09.05 -
Symantec 10 2007.09.05 -
TheHacker 6.1.9.178 2007.09.05 -
VBA32 3.12.2.3 2007.09.04 -
VirusBuster 4.3.26:9 2007.09.04 -
Webwasher-Gateway 6.0.1 2007.09.05 -
Dodatkowe informacje
File size: 172032 bytes
MD5: 7caf12ebddbb978c6998c9c946ce9664
SHA1: 509f268ae86260e05c0a4ae44ad7aef876f97a76

[wojtas]

ok daj jeszcze nowego loga

[Siaju]

ok daj jeszcze nowego loga

Oto log z Combo Fix:

ComboFix 07-08-30.3 - "ppp" 2007-09-05 17:28:28.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.182 [GMT 2:00]


((((((((((((((((((((((((( Files Created from 2007-08-05 to 2007-09-05 )))))))))))))))))))))))))))))))


2007-09-01 19:40 172,032 --a------ C:\WINDOWS\system32\cncs32.dll
2007-09-01 19:40 <DIR> d-------- C:\WINDOWS\s2002
2007-08-31 19:03 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-08-31 19:03 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-08-31 18:53 3,246 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-31 13:11 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-10 17:19 <DIR> d-------- C:\DOCUME~1\ppp\DANEAP~1\Media Player Classic
2007-08-10 17:18 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-08-10 17:18 740,442 --a------ C:\WINDOWS\system32\divx.dll
2007-08-10 17:18 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-08-10 17:18 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-08-10 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-08-10 17:18 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-08-10 17:18 163,840 --a------ C:\WINDOWS\system32\unrar.dll
2007-08-10 17:18 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-08-05 20:50 <DIR> d-------- C:\Program Files\Arjaloc


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-05 17:28 --------- d-------- C:\Program Files\Neostrada TP
2007-09-05 17:27 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\MegauploadToolbar
2007-08-30 19:19 --------- d-------- C:\Program Files\Ganymede
2007-08-30 14:31 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\GanymedeNet
2007-08-16 11:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-04 17:52 --------- d-------- C:\Program Files\MegauploadToolbar
2007-08-02 13:51 --------- d-------- C:\Program Files\MGrenda
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-14 12:02 --------- d-------- C:\Program Files\Techland
2007-07-14 12:00 --------- d-------- C:\Program Files\DAEMON Tools
2007-07-14 11:57 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-10 13:23 --------- d-------- C:\Program Files\F1 Challenge 99-02
2007-07-10 13:08 --------- d-------- C:\Program Files\Opera
2007-07-10 13:08 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\Opera
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe
2007-02-12 16:10 9232 --a------ C:\DOCUME~1\ppp\mqdmmdfl.sys
2007-02-12 16:10 92064 --a------ C:\DOCUME~1\ppp\mqdmmdm.sys
2007-02-12 16:10 79328 --a------ C:\DOCUME~1\ppp\mqdmserd.sys
2007-02-12 16:10 66656 --a------ C:\DOCUME~1\ppp\mqdmbus.sys
2007-02-12 16:10 6208 --a------ C:\DOCUME~1\ppp\mqdmcmnt.sys
2007-02-12 16:10 5936 --a------ C:\DOCUME~1\ppp\mqdmwhnt.sys
2007-02-12 16:10 4048 --a------ C:\DOCUME~1\ppp\mqdmcr.sys
2007-02-12 16:10 25600 --a------ C:\DOCUME~1\ppp\usbsermptxp.sys
2007-02-12 16:10 22768 --a------ C:\DOCUME~1\ppp\usbsermpt.sys


((((((((((((((((((((((((((((( snapshot_2007-08-31_131715.71 )))))))))))))))))))))))))))))))))))))))))

----a-w 4,293 2007-09-01 12:56:11 C:\WINDOWS\mozver.dat
----a-w 278,282 2007-09-01 17:40:38 C:\WINDOWS\s2002\s2002.exe
----a-w 40,448 2007-09-01 17:40:37 C:\WINDOWS\s2002\uninstal.exe
----a-w 40,836 2007-09-05 11:48:15 C:\WINDOWS\system32\perfc009.dat
----a-w 50,336 2007-09-05 11:48:15 C:\WINDOWS\system32\perfc015.dat
----a-w 314,508 2007-09-05 11:48:15 C:\WINDOWS\system32\perfh009.dat
----a-w 358,390 2007-09-05 11:48:15 C:\WINDOWS\system32\perfh015.dat

----a-w 4,293 2007-08-30 12:53:02 C:\WINDOWS\mozver.dat
----a-w 40,836 2007-08-31 10:55:32 C:\WINDOWS\system32\perfc009.dat
----a-w 50,336 2007-08-31 10:55:32 C:\WINDOWS\system32\perfc015.dat
----a-w 314,508 2007-08-31 10:55:32 C:\WINDOWS\system32\perfh009.dat
----a-w 358,390 2007-08-31 10:55:32 C:\WINDOWS\system32\perfh015.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 09:08 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22]
"nwiz"="nwiz.exe" [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 C:\WINDOWS\system32\nvmctray.dll]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-26 17:22]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 18:30]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-25 22:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-31 22:42]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^ppp^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.2.lnk]
path=C:\Documents and Settings\ppp\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.2.lnk
backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
"C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\NEOSTR~1\CnxMon.exe

R0 prohlp01;StarForce Protection Helper Driver v1;C:\WINDOWS\system32\drivers\prohlp01.sys
R1 prodrv05;StarForce Protection Environment Driver v5;C:\WINDOWS\system32\drivers\prodrv05.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-05 17:30:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-05 17:30:46
C:\ComboFix-quarantined-files.txt ... 2007-09-05 17:30
C:\ComboFix2.txt ... 2007-09-04 17:09
C:\ComboFix3.txt ... 2007-08-31 13:17

--- E O F ---

[wojtas]

jest ok

Autor postu otrzymał pochwałę

[Siaju]

Problem wrócił tym razem inna "tajemnicza ikonka" na pasku zadań koło godziny. Log z Combofixa:

ComboFix 07-09-20.1 - "ppp" 2007-09-20 22:47:39.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.267 [GMT 2:00]
* Created a new restore point
.
Rootkit driver pe386 is present. ... attempting disinfection
Rootkit driver msguard is present. ... attempting disinfection
Rootkit driver lzx32 is present. ... attempting disinfection
Rootkit driver huy32 is present. ... attempting disinfection
Rootkit driver xpdt is present. ... attempting disinfection
Rootkit driver pe386 is still present. A rootkit scan is required
Rootkit driver msguard is still present. A rootkit scan is required
Rootkit driver lzx32 is still present. A rootkit scan is required
Rootkit driver huy32 is still present. A rootkit scan is required
Rootkit driver xpdt is still present. A rootkit scan is required

((((((((((((((((((((((((( Files Created from 2007-08-20 to 2007-09-20 )))))))))))))))))))))))))))))))
.

2007-09-01 19:40 172,032 --a------ C:\WINDOWS\system32\cncs32.dll
2007-09-01 19:40 <DIR> d-------- C:\WINDOWS\s2002
2007-08-31 19:03 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-08-31 19:03 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-08-31 19:03 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-08-31 19:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-08-31 18:53 2,336 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-31 13:11 51,200 --a------ C:\WINDOWS\nircmd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-20 22:43 --------- d-------- C:\Program Files\Neostrada TP
2007-09-20 21:13 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\MegauploadToolbar
2007-09-17 16:14 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\GanymedeNet
2007-08-30 19:19 --------- d-------- C:\Program Files\Ganymede
2007-08-16 11:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-10 17:19 --------- d-------- C:\DOCUME~1\ppp\DANEAP~1\Media Player Classic
2007-08-10 17:18 --------- d-------- C:\Program Files\K-Lite Codec Pack
2007-08-05 20:50 --------- d-------- C:\Program Files\Arjaloc
2007-08-04 17:52 --------- d-------- C:\Program Files\MegauploadToolbar
2007-08-02 13:51 --------- d-------- C:\Program Files\MGrenda
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-06-28 18:54 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-06-28 18:52 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-02-12 16:10 9232 --a------ C:\DOCUME~1\ppp\mqdmmdfl.sys
2007-02-12 16:10 92064 --a------ C:\DOCUME~1\ppp\mqdmmdm.sys
2007-02-12 16:10 79328 --a------ C:\DOCUME~1\ppp\mqdmserd.sys
2007-02-12 16:10 66656 --a------ C:\DOCUME~1\ppp\mqdmbus.sys
2007-02-12 16:10 6208 --a------ C:\DOCUME~1\ppp\mqdmcmnt.sys
2007-02-12 16:10 5936 --a------ C:\DOCUME~1\ppp\mqdmwhnt.sys
2007-02-12 16:10 4048 --a------ C:\DOCUME~1\ppp\mqdmcr.sys
2007-02-12 16:10 25600 --a------ C:\DOCUME~1\ppp\usbsermptxp.sys
2007-02-12 16:10 22768 --a------ C:\DOCUME~1\ppp\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 09:08 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22]
"nwiz"="nwiz.exe" [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 C:\WINDOWS\system32\nvmctray.dll]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-26 17:22]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 18:30]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-09-08 19:07]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-31 22:42]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"SWHelper"="C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1014020

C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-04-20 14:52:53]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^ppp^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.2.lnk]
path=C:\Documents and Settings\ppp\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.2.lnk
backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"C:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
"C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\NEOSTR~1\CnxMon.exe

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-20 22:51:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-20 22:52:04 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-20 22:52
C:\ComboFix2.txt ... 2007-09-05 17:30
C:\ComboFix3.txt ... 2007-09-04 17:09
.
--- E O F ---