proszę o sprawdzenie loga

[Digital_PRo]

5 dni temu winde postawiłem i już jakiś syf się wbił

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:32, on 2007-10-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
F:\Programy\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\Programy\Kaspersky Internet Security 7.0\avp.exe
F:\Programy\ProShowProducer\ScsiAccess.exe
F:\PROGRAMY\MOZILL~1\FIREFOX.EXE
F:\Programy\JetAudio\jetAudio.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\Programy\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVP] "F:\Programy\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\owaieccx.dll",sitypnow
O4 - HKCU\..\Run: [BitComet] "F:\Programy\BitComet\BitComet.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Dodaj do blokowanych banerów - F:\Programy\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download All by FlashGet - F:\Programy\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - F:\Programy\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Programy\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: F:\Programy\KASPER~1.0\adialhk.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Programy\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ScsiAccess - Unknown owner - F:\Programy\ProShowProducer\ScsiAccess.exe

--
End of file - 3399 bytes


[Kuba1]

O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\owaieccx.dll",sitypnow

Vundo..

Zastosuj ComboFIx

Następnie:

Pobierz narzędzie SDFix


*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

[Digital_PRo]

Kod: Zaznacz wszystko

SDFix: Version 1.109

Run by SonyEricsson on 2007-10-14 at 16:26

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\DOCUME~1\SONYER~1\USTAWI~1\Temp\GLFF52.tmp.dll - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\\Programy\\BitComet\\BitComet.exe"="F:\\Programy\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"F:\\Programy\\Gadu-Gadu\\gg.exe"="F:\\Programy\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"F:\\Programy\\Tlen.pl\\tlen.exe"="F:\\Programy\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\WINDOWS\\system32\\anrmkilv.exe"="C:\\WINDOWS\\system32\\anr"
"C:\\WINDOWS\\system32\\qnicbpbm.exe"="C:\\WINDOWS\\system32\\qni"
"C:\\WINDOWS\\system32\\lcmordxc.exe"="C:\\WINDOWS\\system32\\lcm"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 11 Oct 2007       487,424 ..SHR --- "C:\Program Files\s?curity\w?crtupd.exe"
Sat 13 Oct 2007       351,831 ..SH. --- "C:\WINDOWS\system32\ilnmp.tmp"
Fri 12 Oct 2007       343,273 ..SH. --- "C:\WINDOWS\system32\ilnmp.bak1"
Sun 14 Oct 2007       351,683 ..SH. --- "C:\WINDOWS\system32\ilnmp.bak2"

Finished!


[wojtas]

gdzie log z combofixa?

[Digital_PRo]

Kod: Zaznacz wszystko

ComboFix 07-10-12.4 - SonyEricsson 2007-10-14 16:37:33.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.265 [GMT 2:00]
Running from: C:\Documents and Settings\SonyEricsson\Pulpit\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo
C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo\Terms.lnk
C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\Common Files\wnsxs~1\W?nSxS\
C:\Program Files\outerinfo
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\scurit~1
C:\Program Files\scurit~1\w?crtupd.exe
C:\Program Files\WinAble
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\fjjypgej.exe
C:\WINDOWS\system32\hbylhdui.exe
C:\WINDOWS\system32\huehbuly.exe
C:\WINDOWS\system32\hxpqjair.dll
C:\WINDOWS\system32\hyecjnxq.dll
C:\WINDOWS\system32\icfdxesv.exe
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\ilnmp.ini2
C:\WINDOWS\system32\ilnmp.ini2
C:\WINDOWS\system32\ilnmp.ini2
C:\WINDOWS\system32\ilnmp.tmp
C:\WINDOWS\system32\ilnmp.tmp
C:\WINDOWS\system32\ilnmp.tmp
C:\WINDOWS\system32\kuccvriq.ini
C:\WINDOWS\system32\mhluxmme.exe
C:\WINDOWS\system32\mrjhbecm.dll
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\qirvccuk.dll
C:\WINDOWS\system32\qseaxfar.exe
C:\WINDOWS\system32\qxnjceyh.ini
C:\WINDOWS\system32\wburewqb.exe
C:\WINDOWS\system32\xxulkxts.exe
C:\WINDOWS\system32\yiofbhlk.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


(((((((((((((((((((((((((   Files Created from 2007-09-14 to 2007-10-14  )))))))))))))))))))))))))))))))
.

2007-10-14 16:36   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-10-14 16:25   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-10-14 15:04   <DIR>   d--------   C:\Program Files\Trend Micro
2007-10-14 14:26   <DIR>   d--------   C:\WINDOWS\pss
2007-10-14 00:53   <DIR>   d--------   C:\WINDOWS\Sun
2007-10-14 00:50   <DIR>   d--------   C:\Program Files\Java
2007-10-14 00:48   <DIR>   d--------   C:\Program Files\Common Files\Java
2007-10-13 15:01   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
2007-10-13 15:00   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\DAEMON Tools Pro
2007-10-13 14:56   685,816   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-10-13 13:21   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2007-10-12 23:19   <DIR>   d--------   C:\DOWNLOADS
2007-10-12 15:33   <DIR>   d--------   C:\WINDOWS\system32\AdCache
2007-10-12 12:45   3,152,160   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-10-12 12:45   82,061   --a------   C:\WINDOWS\system32\drivers\klick.dat
2007-10-12 12:45   81,549   --a------   C:\WINDOWS\system32\drivers\klin.dat
2007-10-12 12:44   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2007-10-12 12:44   50,976   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-10-12 12:43   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-10-11 21:16   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\PhotoFrameShow
2007-10-11 21:08   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Vso
2007-10-11 21:08   719,872   --a------   C:\WINDOWS\system32\devil.dll
2007-10-11 21:08   314,368   --a------   C:\WINDOWS\system32\avisynth.dll
2007-10-11 21:08   81,920   --a------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\ezpinst.exe
2007-10-11 21:08   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
2007-10-11 21:08   47,360   --a------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\pcouffin.sys
2007-10-11 21:05   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Ahead
2007-10-11 21:04   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-10-11 21:04   1,568,768   --a------   C:\WINDOWS\system32\imagX7.dll
2007-10-11 21:04   1,060,864   --a------   C:\WINDOWS\system32\MFC71.dll
2007-10-11 21:04   1,047,552   --a------   C:\WINDOWS\system32\mfc71u.dll
2007-10-11 21:04   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2007-10-11 21:04   476,320   --a------   C:\WINDOWS\system32\imagXpr7.dll
2007-10-11 21:04   471,040   --a------   C:\WINDOWS\system32\imagXRA7.dll
2007-10-11 21:04   364,544   --a------   C:\WINDOWS\system32\TwnLib4.dll
2007-10-11 21:04   262,144   --a------   C:\WINDOWS\system32\imagXR7.dll
2007-10-11 21:02   <DIR>   d--------   C:\Program Files\Common Files\Stardock
2007-10-11 20:59   265,216   --a------   C:\WINDOWS\system32\FAXUTIL.DLL
2007-10-11 20:59   181,248   --a------   C:\WINDOWS\system32\faxzrh.DLL
2007-10-11 20:59   156,160   --a------   C:\WINDOWS\system32\unrar3.dll
2007-10-11 20:59   145,920   --a------   C:\WINDOWS\system32\wav2.dll
2007-10-11 20:59   75,264   --a------   C:\WINDOWS\system32\unacev2.dll
2007-10-11 20:59   14   --a------   C:\WINDOWS\system32\fstextv6.dll
2007-10-11 20:54   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Photodex
2007-10-11 20:51   <DIR>   d--------   C:\WINDOWS\Downloaded Installations
2007-10-11 19:44   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Media Player Classic
2007-10-11 19:43   3,596,288   --a------   C:\WINDOWS\system32\qt-dx331.dll
2007-10-11 19:43   1,559,040   --a------   C:\WINDOWS\system32\xvidcore.dll
2007-10-11 19:43   740,442   --a------   C:\WINDOWS\system32\divx.dll
2007-10-11 19:43   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2007-10-11 19:43   282,624   --a------   C:\WINDOWS\system32\xvidvfw.dll
2007-10-11 19:43   217,088   --a------   C:\WINDOWS\system32\yv12vfw.dll
2007-10-11 19:43   163,840   --a------   C:\WINDOWS\system32\unrar.dll
2007-10-11 19:43   73,728   --a------   C:\WINDOWS\system32\dpl100.dll
2007-10-11 19:43   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2007-10-11 18:14   <DIR>   d--------   C:\Program Files\Opera
2007-10-11 18:07   <DIR>   d---s----   C:\Documents and Settings\SonyEricsson\UserData
2007-10-11 17:07   <DIR>   d--------   C:\Documents and Settings\SonyEricsson\Dane aplikacji\COWON
2007-10-11 17:04   58,624   --a------   C:\WINDOWS\system32\drivers\redbook.sys
2007-10-11 17:04   3,072   --a------   C:\WINDOWS\system32\drivers\audstub.sys
2007-10-11 17:03   2,676,672   --a------   C:\WINDOWS\system32\ati3duag.dll
2007-10-11 17:03   1,918,464   --a------   C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-10-11 17:03   1,289,472   --a------   C:\WINDOWS\system32\ativvaxx.dll
2007-10-11 17:03   870,784   --a------   C:\WINDOWS\system32\ati3d1ag.dll
2007-10-11 17:03   315,392   --a------   C:\WINDOWS\system32\ati2cqag.dll
2007-10-11 17:03   263,168   --a------   C:\WINDOWS\system32\ati2dvag.dll
2007-10-11 17:03   77,312   --a------   C:\WINDOWS\system32\usbui.dll
2007-10-11 17:03   46,464   --a------   C:\WINDOWS\system32\drivers\GAGP30KX.SYS
2007-10-11 17:03   10,624   --a------   C:\WINDOWS\system32\drivers\gameenum.sys
2007-10-11 17:02   <DIR>   dr-------   C:\Program Files
2007-10-11 17:01   <DIR>   dr-h-----   C:\Documents and Settings\Default User\Ustawienia lokalne
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings\Default User\Ulubione
2007-10-11 17:01   <DIR>   d--h-----   C:\Documents and Settings\Default User\Szablony
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings\Default User\Pulpit
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings\Default User\Moje dokumenty
2007-10-11 17:01   <DIR>   dr-------   C:\Documents and Settings\Default User\Menu Start
2007-10-11 17:01   <DIR>   dr-h-----   C:\Documents and Settings\Default User\Dane aplikacji
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings\All Users\Ulubione
2007-10-11 17:01   <DIR>   d--h-----   C:\Documents and Settings\All Users\Szablony
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings\All Users\Pulpit
2007-10-11 17:01   <DIR>   dr-------   C:\Documents and Settings\All Users\Menu Start
2007-10-11 17:01   <DIR>   dr-------   C:\Documents and Settings\All Users\Dokumenty
2007-10-11 17:01   <DIR>   dr-h-----   C:\Documents and Settings\All Users\Dane aplikacji
2007-10-11 17:01   <DIR>   d--------   C:\Documents and Settings

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-14 14:23   7,676   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2007-10-14 14:23   45,800   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-14 11:11   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-12 14:55   ---------   d-----w   C:\Program Files\Temporary
2007-10-11 14:29   ---------   d-----w   C:\Program Files\Common Files\COWON
2007-10-11 14:28   32,768   ----a-w   C:\WINDOWS\system32\nnnnmkh.dll
2007-10-11 14:18   ---------   d-----w   C:\Program Files\Ericsson
2007-10-11 14:17   ---------   d-----w   C:\Documents and Settings\SonyEricsson\Dane aplikacji\FMA
2007-10-11 14:16   ---------   d-----w   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Skype
2007-10-11 14:15   ---------   d-----w   C:\Program Files\Skype
2007-10-11 14:15   ---------   d-----w   C:\Program Files\Common Files\Skype
2007-10-11 14:15   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-10-11 14:14   ---------   d-----w   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Tlen.pl
2007-10-11 14:11   ---------   d-----w   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Gadu-Gadu
2007-10-11 13:37   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-10-11 13:36   451,072   ----a-w   C:\WINDOWS\Radeon Omega Drivers v3.8.330 Uninstall.exe
2007-10-11 13:36   ---------   d-----w   C:\Program Files\Radeon Omega Drivers
2007-10-11 13:34   ---------   d-----w   C:\Program Files\SiS7012
2007-10-11 13:32   267,136   ----a-w   C:\WINDOWS\system32\drivers\sis7012.sys
2007-10-11 13:32   115,864   ----a-w   C:\WINDOWS\system32\a3d.dll
2007-10-11 13:31   ---------   d-----w   C:\Documents and Settings\SonyEricsson\Dane aplikacji\Talkback
2007-10-11 13:15   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-10-11 13:13   ---------   d-----w   C:\Program Files\Usługi online
2007-07-19 22:57   267,112   ----a-w   C:\WINDOWS\system32\xactengine2_9.dll
2007-07-19 22:54   18,280   ----a-w   C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 16:14   444,776   ----a-w   C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 16:14   3,727,720   ----a-w   C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 16:14   1,358,192   ----a-w   C:\WINDOWS\system32\D3DCompiler_35.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}]
2007-10-11 16:28   32768   --a------   C:\WINDOWS\system32\nnnnmkh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 C:\WINDOWS\system32\atiptaxx.exe]
"AVP"="F:\Programy\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="F:\Programy\BitComet\BitComet.exe" [2006-06-23 19:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}"= C:\WINDOWS\system32\nnnnmkh.dll [2007-10-11 16:28 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnmkh]
nnnnmkh.dll 2007-10-11 16:28 32768 C:\WINDOWS\system32\nnnnmkh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=F:\Programy\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
"F:\Programy\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
"F:\Programy\DAEMON Tools Pro\DTProAgent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
"F:\Programy\Registry Clean Expert\RCHelper.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
F:\Programy\Clock Tray Skins\ClockTraySkins.exe

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-14 16:43:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-14 16:44:39 - machine was rebooted
.
   --- E O F ---


[wojtas]

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\nnnnmkh.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem nowy log z hijacka oraz combofixa