proszę o sprawdzenie loga

[Tomson]

Ostatnio komp sie muli i co jakiś czas wyskakują mi jakieś bezsensowne komunikaty, errory.
O to log:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:17:04, on 2007-12-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rxcbfimq.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [b41d85ab] rundll32.exe "C:\WINDOWS\system32\xlxvoues.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: XP.lnk = C:\License.reg
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=www.actina.pl
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197677793234
O17 - HKLM\System\CCS\Services\Tcpip\..\{D44CF0DD-3072-4C4D-95B1-1D21BAF6760E}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService -   - C:\WINDOWS\system32\rxcbfimq.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



[wojtas]

Wykonaj to co jest podane w tym temacie


zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Tomson]

SDFix:

Kod: Zaznacz wszystko

SDFix: Version 1.119

Run by Administrator on 2007-12-22 at 12:36

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 14:13:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ee,43,17,92,85,47,f0,79,bd,c7,87,e6,b3,8e,2a,bd,8f,8a,98,be,b1,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,5c,55,b2,48,ad,c2,69,c5,fc,fd,35,78,80,41,29,6f,b2,..
"khjeh"=hex:71,40,71,fe,69,31,12,de,f3,55,c0,37,cd,23,58,30,ea,c8,c5,68,3d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:33,99,3c,e4,08,d1,27,ae,d5,ed,22,7f,4a,f2,ce,26,b6,dc,38,a5,2d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ee,43,17,92,85,47,f0,79,bd,c7,87,e6,b3,8e,2a,bd,8f,8a,98,be,b1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,5c,55,b2,48,ad,c2,69,c5,fc,fd,35,78,80,41,29,6f,b2,..
"khjeh"=hex:71,40,71,fe,69,31,12,de,f3,55,c0,37,cd,23,58,30,ea,c8,c5,68,3d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:33,99,3c,e4,08,d1,27,ae,d5,ed,22,7f,4a,f2,ce,26,b6,dc,38,a5,2d,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,72,00,00,00,01,00,00,00,01,00,00,00,66,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\DOCUME~1\\Tomek\\USTAWI~1\\Temp\\win75.exe"="C:\\DOCUME~1\\Tomek\\USTAWI~1\\Temp\\win75.exe:*:Enabled:win75"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\WINDOWS\\system32\\rxcbfimq.exe"="C:\\WINDOWS\\system32\\rxc"
"C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Hamachi\\hamachi.exe"="C:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client"
"D:\\Gry\\Valve\\hl.exe"="D:\\Gry\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Onet.pl - Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------


Files with Hidden Attributes:

Sat 15 Dec 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT2.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT5.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT1.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5a563fa477cf8fafb8fe0c62db7d73a1\BIT6.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d8b27483d3f365d76169cb326b6d1c4\BIT4.tmp"
Sat 15 Dec 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8213811a47d2bd2f8f612f637816d982\BIT3.tmp"

Finished!

ComboFix:

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Tomek 2007-12-22 14:18:20.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.1.1045.18.156 [GMT 1:00]
Running from: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Tomek\Dane aplikacji\storageprotector
C:\Documents and Settings\Tomek\Dane aplikacji\storageprotector\Logs\update.log
C:\Program Files\StorageProtector
C:\Program Files\StorageProtector\License.rtf
C:\Program Files\StorageProtector\Readme.rtf
C:\Program Files\StorageProtector\rm.url
C:\Program Files\StorageProtector\sr.log
C:\Program Files\StorageProtector\swupd.log
C:\Program Files\StorageProtector\SysRep.exe.cer
C:\Program Files\StorageProtector\SysRep.exe.Log
C:\Program Files\StorageProtector\SysRep.exe.xml
C:\Program Files\StorageProtector\SysRep.url
C:\Program Files\StorageProtector\unins000.dat
C:\WINDOWS\system32\hggeffg.dll
C:\WINDOWS\system32\rxcbfimq.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


(((((((((((((((((((((((((   Files Created from 2007-11-22 to 2007-12-22  )))))))))))))))))))))))))))))))
.

2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-22 11:44 . 2007-12-14 16:33   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-22 11:44 . 2007-12-22 12:07   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-22 11:42 . 2007-12-22 11:42   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-22 00:11 . 2007-12-22 00:11   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-21 23:38 . 2007-12-21 23:38   991,542   ---hs----   C:\WINDOWS\system32\vvvecryn.ini
2007-12-21 23:36 . 2007-12-22 11:42   <DIR>   d--------   C:\VundoFix Backups
2007-12-21 23:31 . 2007-12-22 11:03   1,802   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-21 17:33 . 2007-12-21 23:26   932,304   ---hs----   C:\WINDOWS\system32\skgedkeq.ini
2007-12-21 16:44 . 2007-12-21 17:27   966,514   ---hs----   C:\WINDOWS\system32\kympdpft.ini
2007-12-21 16:26 . 2007-12-21 16:26   14,033   --a------   C:\pos2904.tmp
2007-12-21 15:27 . 2007-12-21 16:38   964,828   ---hs----   C:\WINDOWS\system32\vgisbgdx.ini
2007-12-21 14:03 . 2007-12-21 15:21   964,648   ---hs----   C:\WINDOWS\system32\seuovxlx.ini
2007-12-21 13:41 . 2007-12-21 13:57   964,528   ---hs----   C:\WINDOWS\system32\anhkbdyy.ini
2007-12-21 12:33 . 2007-12-21 13:35   964,408   ---hs----   C:\WINDOWS\system32\aiiwnguu.ini
2007-12-21 10:42 . 2007-12-21 12:27   964,288   ---hs----   C:\WINDOWS\system32\hdhykjhh.ini
2007-12-21 00:53 . 2007-12-21 10:36   964,168   ---hs----   C:\WINDOWS\system32\pcjjjyph.ini
2007-12-21 00:20 . 2007-12-21 00:47   964,048   ---hs----   C:\WINDOWS\system32\vmfhievw.ini
2007-12-21 00:14 . 2007-12-21 00:14   14,033   --a------   C:\pos1952.tmp
2007-12-21 00:13 . 2007-12-21 00:14   7,033   --a------   C:\pos1586.tmp
2007-12-20 22:50 . 2007-12-21 00:17   963,928   ---hs----   C:\WINDOWS\system32\eptwhuaw.ini
2007-12-20 22:42 . 2007-12-20 22:43   14,033   --a------   C:\pos15E4.tmp
2007-12-20 22:25 . 2007-12-20 22:42   963,748   ---hs----   C:\WINDOWS\system32\puwwppjy.ini
2007-12-20 20:49 . 2007-12-20 22:19   963,628   ---hs----   C:\WINDOWS\system32\bsxudwhh.ini
2007-12-20 19:19 . 2007-12-20 19:19   14,033   --a------   C:\pos118D.tmp
2007-12-20 19:18 . 2007-12-20 19:18   14,033   --a------   C:\posFFC.tmp
2007-12-20 18:52 . 2007-12-20 18:52   14,033   --a------   C:\posF9B.tmp
2007-12-20 18:07 . 2007-12-20 20:41   986,896   ---hs----   C:\WINDOWS\system32\xqblppji.ini
2007-12-20 18:04 . 2007-12-20 18:04   165,472   --a------   C:\WINDOWS\system32\vtlphlpx.dll
2007-12-20 17:01 . 2007-12-20 17:01   14,033   --a------   C:\posAFF.tmp
2007-12-20 15:56 . 2007-12-20 15:56   14,033   --a------   C:\pos909.tmp
2007-12-20 14:32 . 2007-12-20 14:32   14,033   --a------   C:\pos3DD.tmp
2007-12-20 13:17 . 2007-12-20 13:17   14,033   --a------   C:\posF8.tmp
2007-12-20 12:50 . 2007-12-20 12:50   14,033   --a------   C:\pos71A.tmp
2007-12-18 01:43 . 2007-12-18 01:43   <DIR>   d--------   C:\Documents and Settings\Tomek\.jpi_cache
2007-12-16 13:41 . 2007-12-20 17:59   970,854   ---hs----   C:\WINDOWS\system32\tmunetug.ini
2007-12-16 13:35 . 2007-12-16 13:37   <DIR>   d--------   C:\WINDOWS\SxsCaPendDel
2007-12-16 11:23 . 2007-12-16 13:38   970,734   ---hs----   C:\WINDOWS\system32\simfcudp.ini
2007-12-15 20:30 . 2007-12-15 20:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-12-15 18:23 . 2007-12-15 18:23   <DIR>   d--------   C:\Program Files\Lavalys
2007-12-15 18:05 . 2007-12-15 18:05   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\DivX
2007-12-15 17:44 . 2007-12-15 17:44   <DIR>   d--------   C:\Program Files\Hamachi
2007-12-15 17:44 . 2007-12-20 18:19   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\Hamachi
2007-12-15 17:44 . 2007-12-15 17:44   25,280   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-15 17:35 . 2007-12-15 17:35   <DIR>   d--------   C:\Program Files\Codec Pack - All In 1
2007-12-15 17:35 . 2007-12-15 17:34   737,280   --a------   C:\WINDOWS\iun6002.exe
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\Codec
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\AVIcodec
2007-12-15 17:21 . 2006-10-26 19:56   32,592   --a------   C:\WINDOWS\system32\msonpmon.dll
2007-12-15 17:19 . 2007-12-15 17:19   <DIR>   d--------   C:\Program Files\Microsoft Works
2007-12-15 17:18 . 2007-12-15 17:18   <DIR>   d--------   C:\Program Files\Microsoft.NET
2007-12-15 17:16 . 2007-12-15 17:16   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 17:14 . 2007-12-15 17:19   <DIR>   d--------   C:\WINDOWS\SHELLNEW
2007-12-15 17:12 . 2007-12-15 17:12   <DIR>   dr-h-----   C:\MSOCache
2007-12-15 17:12 . 2007-12-15 20:04   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-12-15 17:10 . 2007-12-15 17:10   <DIR>   d--------   C:\Program Files\DAEMON Tools
2007-12-15 14:30 . 2007-12-15 14:30   685,816   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 14:20 . 2007-12-15 14:47   <DIR>   d--------   C:\Program Files\Valve
2007-12-15 14:04 . 2007-12-15 14:04   <DIR>   d--------   C:\Program Files\MSXML 6.0
2007-12-15 13:44 . 2007-07-30 19:19   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
2007-12-15 13:44 . 2007-07-30 19:18   30,072   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2007-12-15 13:04 . 2007-12-15 13:04   143   --a------   C:\WINDOWS\system32\mcrh.tmp
2007-12-15 11:29 . 2007-12-15 17:40   116   --a------   C:\WINDOWS\NeroDigital.ini
2007-12-15 10:41 . 2001-06-24 17:32   172,032   --a------   C:\WINDOWS\JAPI2.DLL
2007-12-15 10:41 . 2002-05-28 09:52   106,496   --a------   C:\WINDOWS\JAPI.DLL
2007-12-15 10:41 . 2004-12-03 12:19   102,400   --a------   C:\WINDOWS\MMVEM.EXE
2007-12-15 10:41 . 1999-10-24 10:25   20,992   --a------   C:\WINDOWS\MMVCB.AX
2007-12-15 10:40 . 2007-12-15 10:41   <DIR>   d--------   C:\Program Files\VP-EYE
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a------   C:\WINDOWS\system32\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a--c---   C:\WINDOWS\system32\dllcache\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a------   C:\WINDOWS\system32\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a--c---   C:\WINDOWS\system32\dllcache\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a--c---   C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a------   C:\WINDOWS\system32\ksxbar.ax
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a--c---   C:\WINDOWS\system32\dllcache\ksxbar.ax
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\EffectResources
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\CatRoot
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\Program Files\Vimicro
2007-12-15 10:36 . 2006-03-22 13:54   391,743   --a------   C:\WINDOWS\system32\drivers\usbVM305.sys
2007-12-15 10:36 . 2005-11-08 11:37   155,722   --a------   C:\WINDOWS\system32\VM305Prp.Ax
2007-12-15 10:36 . 2005-08-08 16:36   114,688   --a------   C:\WINDOWS\VM305Cap.exe
2007-12-15 10:36 . 1999-07-26 10:47   109,840   --a------   C:\WINDOWS\VidCap32.exe
2007-12-15 10:36 . 2005-08-05 18:36   81,920   --a------   C:\WINDOWS\system32\VM305STI.dll
2007-12-15 10:36 . 2005-08-05 15:15   61,440   --a------   C:\WINDOWS\VM305_STI.EXE
2007-12-15 10:36 . 2005-05-02 16:45   53,248   --a------   C:\WINDOWS\Sti305.exe
2007-12-15 10:36 . 2002-10-16 09:29   49,152   --a------   C:\WINDOWS\amcap.exe
2007-12-15 10:35 . 2007-12-15 10:35   <DIR>   d--------   C:\Program Files\Common Files\Nero
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Ahead
2007-12-15 10:34 . 2004-07-26 17:16   1,568,768   ---------   C:\WINDOWS\system32\ImagX7.dll
2007-12-15 10:34 . 2004-07-26 17:16   476,320   ---------   C:\WINDOWS\system32\ImagXpr7.dll
2007-12-15 10:34 . 2004-07-26 17:16   471,040   ---------   C:\WINDOWS\system32\ImagXRA7.dll
2007-12-15 10:34 . 2004-07-26 17:16   262,144   ---------   C:\WINDOWS\system32\ImagXR7.dll
2007-12-15 10:34 . 2001-07-09 11:50   155,648   --a------   C:\WINDOWS\system32\NeroCheck.exe
2007-12-15 10:34 . 2000-06-26 11:45   106,496   --a------   C:\WINDOWS\system32\TwnLib20.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 13:21   ---------   d-----w   C:\Program Files\neostrada tp
2007-12-16 13:32   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-15 09:36   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-14 16:17   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-14 16:17   ---------   d-----w   C:\Documents and Settings\Tomek\Dane aplikacji\Gadu-Gadu
2007-12-14 16:12   33   ----a-w   C:\WINDOWS\system32\drivers\adidsl.cfg
2007-12-14 16:12   ---------   d-----w   C:\Program Files\SAGEM
2007-12-14 16:12   ---------   d-----w   C:\Program Files\Java
2007-12-14 15:36   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-14 15:35   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 14:56   93,264   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55   94,544   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D162F6E-EB02-40E8-B5C5-A93998BADCC9}]
         C:\WINDOWS\system32\mljjj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e616c3f4-0cba-4585-8e5d-299b4438e6a9}]
         C:\WINDOWS\system32\asbspdmr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7346460-1B12-4A8C-BBDB-2BDC3AAD43F9}]
         C:\WINDOWS\system32\pmkjk.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-25 16:27]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 C:\WINDOWS\SOUNDMAN.EXE]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2004-06-11 04:15]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-10-14 03:17 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 15:15]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"b41d85ab"="C:\WINDOWS\system32\nyrcevvv.dll" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\
XP.lnk - C:\License.reg [2007-12-15 10:12:21]

R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
R3 ZSMC0305;A4 TECH PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [2006-03-22 13:54]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c64d573-aa60-11dc-9b69-806d6172696f}]
\Shell\AutoRun\command - F:\Setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 14:21:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 14:22:39 - machine was rebooted
.
2007-12-15 19:04:44   --- E O F --- 


Hijack:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:22:57, on 2007-12-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\neostrada tp\Watch.exe
C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1D162F6E-EB02-40E8-B5C5-A93998BADCC9} - C:\WINDOWS\system32\mljjj.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: {9a6e8344-b992-d5e8-5854-abc04f3c616e} - {e616c3f4-0cba-4585-8e5d-299b4438e6a9} - C:\WINDOWS\system32\asbspdmr.dll (file missing)
O2 - BHO: (no name) - {E7346460-1B12-4A8C-BBDB-2BDC3AAD43F9} - C:\WINDOWS\system32\pmkjk.dll (file missing)
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [b41d85ab] rundll32.exe "C:\WINDOWS\system32\nyrcevvv.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: XP.lnk = C:\License.reg
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=www.actina.pl
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197677793234
O17 - HKLM\System\CCS\Services\Tcpip\..\{D44CF0DD-3072-4C4D-95B1-1D21BAF6760E}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe



[Gacek89]

chyba ma coś podobnego: http://www.forum.programosy.pl/pojawianie-sie-okieniek-z-inforamcja-o-wirusie-vt88701.html
tez wyskakuja mi bezsensowne komunikaty o błedzie

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\vvvecryn.ini
C:\WINDOWS\system32\skgedkeq.ini
C:\WINDOWS\system32\kympdpft.ini
C:\pos2904.tmp
C:\WINDOWS\system32\vgisbgdx.ini
C:\WINDOWS\system32\seuovxlx.ini
C:\WINDOWS\system32\anhkbdyy.ini
C:\WINDOWS\system32\aiiwnguu.ini
C:\WINDOWS\system32\hdhykjhh.ini
C:\WINDOWS\system32\pcjjjyph.ini
C:\WINDOWS\system32\vmfhievw.ini
C:\pos1952.tmp
C:\pos1586.tmp
C:\WINDOWS\system32\eptwhuaw.ini
C:\pos15E4.tmp
C:\WINDOWS\system32\puwwppjy.ini
C:\WINDOWS\system32\bsxudwhh.ini
C:\pos118D.tmp
C:\posFFC.tmp
C:\posF9B.tmp
C:\WINDOWS\system32\nyrcevvv.dll
C:\WINDOWS\system32\xqblppji.ini
C:\WINDOWS\system32\vtlphlpx.dll
C:\posAFF.tmp
C:\pos909.tmp
C:\pos3DD.tmp
C:\posF8.tmp
C:\pos71A.tmp
C:\WINDOWS\system32\tmunetug.ini
C:\WINDOWS\system32\simfcudp.ini

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

skasuj te wpisy w hijacku:

O2 - BHO: (no name) - {1D162F6E-EB02-40E8-B5C5-A93998BADCC9} - C:\WINDOWS\system32\mljjj.dll (file missing)
O2 - BHO: {9a6e8344-b992-d5e8-5854-abc04f3c616e} - {e616c3f4-0cba-4585-8e5d-299b4438e6a9} - C:\WINDOWS\system32\asbspdmr.dll (file missing)
O2 - BHO: (no name) - {E7346460-1B12-4A8C-BBDB-2BDC3AAD43F9} - C:\WINDOWS\system32\pmkjk.dll (file missing)
O4 - HKLM\..\Run: [b41d85ab] rundll32.exe "C:\WINDOWS\system32\nyrcevvv.dll",b

Potem nowy log z hijacka oraz combofixa

[Tomson]

Hijack:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 20:48:14, on 2007-12-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: XP.lnk = C:\License.reg
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=www.actina.pl
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197677793234
O17 - HKLM\System\CCS\Services\Tcpip\..\{D44CF0DD-3072-4C4D-95B1-1D21BAF6760E}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe



Combofix:

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Tomek 2007-12-23 20:49:23.3 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.1.1045.18.151 [GMT 1:00]
Running from: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-23 to 2007-12-23  )))))))))))))))))))))))))))))))
.

2007-12-22 11:44 . 2007-12-23 20:41   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-22 11:44 . 2007-12-14 16:33   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-22 11:44 . 2007-12-22 12:07   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-22 11:42 . 2007-12-22 11:42   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-22 00:11 . 2007-12-22 00:11   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-21 23:36 . 2007-12-22 11:42   <DIR>   d--------   C:\VundoFix Backups
2007-12-21 23:31 . 2007-12-22 11:03   1,802   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-21 17:28 . 2007-12-21 17:28   14,033   --a------   C:\pos2CEB.tmp
2007-12-21 16:39 . 2007-12-21 16:39   14,033   --a------   C:\pos2AF5.tmp
2007-12-21 16:26 . 2007-12-21 16:26   14,033   --a------   C:\pos28F9.tmp
2007-12-21 15:21 . 2007-12-21 15:22   14,033   --a------   C:\pos270A.tmp
2007-12-21 13:58 . 2007-12-21 13:58   14,033   --a------   C:\pos251B.tmp
2007-12-21 13:36 . 2007-12-21 13:36   14,033   --a------   C:\pos2325.tmp
2007-12-21 12:28 . 2007-12-21 12:28   14,033   --a------   C:\pos2134.tmp
2007-12-21 10:37 . 2007-12-21 10:37   14,033   --a------   C:\pos1F3E.tmp
2007-12-21 00:48 . 2007-12-21 00:48   14,033   --a------   C:\pos1D44.tmp
2007-12-21 00:18 . 2007-12-21 00:18   14,033   --a------   C:\pos1B54.tmp
2007-12-21 00:14 . 2007-12-21 00:14   14,033   --a------   C:\pos194A.tmp
2007-12-20 22:43 . 2007-12-20 22:43   14,033   --a------   C:\pos176D.tmp
2007-12-20 22:42 . 2007-12-20 22:42   14,033   --a------   C:\pos15DA.tmp
2007-12-20 22:20 . 2007-12-20 22:20   14,033   --a------   C:\pos1572.tmp
2007-12-20 20:41 . 2007-12-20 20:42   14,033   --a------   C:\pos1387.tmp
2007-12-20 19:19 . 2007-12-20 19:19   14,033   --a------   C:\pos1185.tmp
2007-12-20 19:18 . 2007-12-20 19:18   14,033   --a------   C:\posFF9.tmp
2007-12-20 18:52 . 2007-12-20 18:52   14,033   --a------   C:\posF99.tmp
2007-12-20 18:05 . 2007-12-20 18:05   14,033   --a------   C:\posDAB.tmp
2007-12-20 17:25 . 2007-12-20 17:25   14,033   --a------   C:\posBB8.tmp
2007-12-20 17:01 . 2007-12-20 17:01   14,033   --a------   C:\posAE9.tmp
2007-12-20 15:56 . 2007-12-20 15:56   14,033   --a------   C:\pos907.tmp
2007-12-20 14:32 . 2007-12-20 14:32   14,033   --a------   C:\pos3DC.tmp
2007-12-20 13:17 . 2007-12-20 13:17   14,033   --a------   C:\posF5.tmp
2007-12-20 12:50 . 2007-12-20 12:50   14,033   --a------   C:\pos717.tmp
2007-12-18 01:43 . 2007-12-18 01:43   <DIR>   d--------   C:\Documents and Settings\Tomek\.jpi_cache
2007-12-16 13:35 . 2007-12-16 13:37   <DIR>   d--------   C:\WINDOWS\SxsCaPendDel
2007-12-15 20:30 . 2007-12-15 20:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-12-15 18:23 . 2007-12-15 18:23   <DIR>   d--------   C:\Program Files\Lavalys
2007-12-15 18:05 . 2007-12-15 18:05   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\DivX
2007-12-15 17:44 . 2007-12-15 17:44   <DIR>   d--------   C:\Program Files\Hamachi
2007-12-15 17:44 . 2007-12-23 00:20   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\Hamachi
2007-12-15 17:44 . 2007-12-15 17:44   25,280   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-15 17:35 . 2007-12-15 17:35   <DIR>   d--------   C:\Program Files\Codec Pack - All In 1
2007-12-15 17:35 . 2007-12-15 17:34   737,280   --a------   C:\WINDOWS\iun6002.exe
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\Codec
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\AVIcodec
2007-12-15 17:21 . 2006-10-26 19:56   32,592   --a------   C:\WINDOWS\system32\msonpmon.dll
2007-12-15 17:19 . 2007-12-15 17:19   <DIR>   d--------   C:\Program Files\Microsoft Works
2007-12-15 17:18 . 2007-12-15 17:18   <DIR>   d--------   C:\Program Files\Microsoft.NET
2007-12-15 17:16 . 2007-12-15 17:16   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 17:14 . 2007-12-15 17:19   <DIR>   d--------   C:\WINDOWS\SHELLNEW
2007-12-15 17:12 . 2007-12-15 17:12   <DIR>   dr-h-----   C:\MSOCache
2007-12-15 17:12 . 2007-12-15 20:04   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-12-15 17:10 . 2007-12-15 17:10   <DIR>   d--------   C:\Program Files\DAEMON Tools
2007-12-15 14:30 . 2007-12-15 14:30   685,816   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 14:20 . 2007-12-15 14:47   <DIR>   d--------   C:\Program Files\Valve
2007-12-15 14:04 . 2007-12-15 14:04   <DIR>   d--------   C:\Program Files\MSXML 6.0
2007-12-15 13:44 . 2007-07-30 19:19   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
2007-12-15 13:44 . 2007-07-30 19:18   30,072   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2007-12-15 13:04 . 2007-12-15 13:04   143   --a------   C:\WINDOWS\system32\mcrh.tmp
2007-12-15 11:29 . 2007-12-15 17:40   116   --a------   C:\WINDOWS\NeroDigital.ini
2007-12-15 10:41 . 2001-06-24 17:32   172,032   --a------   C:\WINDOWS\JAPI2.DLL
2007-12-15 10:41 . 2002-05-28 09:52   106,496   --a------   C:\WINDOWS\JAPI.DLL
2007-12-15 10:41 . 2004-12-03 12:19   102,400   --a------   C:\WINDOWS\MMVEM.EXE
2007-12-15 10:41 . 1999-10-24 10:25   20,992   --a------   C:\WINDOWS\MMVCB.AX
2007-12-15 10:40 . 2007-12-15 10:41   <DIR>   d--------   C:\Program Files\VP-EYE
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a------   C:\WINDOWS\system32\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a--c---   C:\WINDOWS\system32\dllcache\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a------   C:\WINDOWS\system32\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a--c---   C:\WINDOWS\system32\dllcache\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a--c---   C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a------   C:\WINDOWS\system32\ksxbar.ax
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a--c---   C:\WINDOWS\system32\dllcache\ksxbar.ax
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\EffectResources
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\CatRoot
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\Program Files\Vimicro
2007-12-15 10:36 . 2006-03-22 13:54   391,743   --a------   C:\WINDOWS\system32\drivers\usbVM305.sys
2007-12-15 10:36 . 2005-11-08 11:37   155,722   --a------   C:\WINDOWS\system32\VM305Prp.Ax
2007-12-15 10:36 . 2005-08-08 16:36   114,688   --a------   C:\WINDOWS\VM305Cap.exe
2007-12-15 10:36 . 1999-07-26 10:47   109,840   --a------   C:\WINDOWS\VidCap32.exe
2007-12-15 10:36 . 2005-08-05 18:36   81,920   --a------   C:\WINDOWS\system32\VM305STI.dll
2007-12-15 10:36 . 2005-08-05 15:15   61,440   --a------   C:\WINDOWS\VM305_STI.EXE
2007-12-15 10:36 . 2005-05-02 16:45   53,248   --a------   C:\WINDOWS\Sti305.exe
2007-12-15 10:36 . 2002-10-16 09:29   49,152   --a------   C:\WINDOWS\amcap.exe
2007-12-15 10:35 . 2007-12-15 10:35   <DIR>   d--------   C:\Program Files\Common Files\Nero
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Ahead
2007-12-15 10:34 . 2004-07-26 17:16   1,568,768   ---------   C:\WINDOWS\system32\ImagX7.dll
2007-12-15 10:34 . 2004-07-26 17:16   476,320   ---------   C:\WINDOWS\system32\ImagXpr7.dll
2007-12-15 10:34 . 2004-07-26 17:16   471,040   ---------   C:\WINDOWS\system32\ImagXRA7.dll
2007-12-15 10:34 . 2004-07-26 17:16   262,144   ---------   C:\WINDOWS\system32\ImagXR7.dll
2007-12-15 10:34 . 2001-07-09 11:50   155,648   --a------   C:\WINDOWS\system32\NeroCheck.exe
2007-12-15 10:34 . 2000-06-26 11:45   106,496   --a------   C:\WINDOWS\system32\TwnLib20.dll
2007-12-15 10:27 . 2007-12-15 10:27   483,466   --a------   C:\Orginalny windows xp.rar
2007-12-15 10:20 . 2007-12-16 11:20   952,503   ---hs----   C:\WINDOWS\system32\vmfwnsbn.ini
2007-12-15 10:12 . 2006-12-14 14:04   2,364   --a------   C:\License.reg
2007-12-15 09:55 . 2007-12-15 09:55   <DIR>   d--------   C:\WINDOWS\ServicePackFiles

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 19:44   ---------   d-----w   C:\Program Files\neostrada tp
2007-12-16 13:32   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-15 09:36   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-14 16:17   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-14 16:17   ---------   d-----w   C:\Documents and Settings\Tomek\Dane aplikacji\Gadu-Gadu
2007-12-14 16:12   33   ----a-w   C:\WINDOWS\system32\drivers\adidsl.cfg
2007-12-14 16:12   ---------   d-----w   C:\Program Files\SAGEM
2007-12-14 16:12   ---------   d-----w   C:\Program Files\Java
2007-12-14 15:36   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-14 15:35   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 14:56   93,264   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55   94,544   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-12-04 00:33   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2007-11-29 21:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 21:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
2007-11-29 21:28   196,608   ----a-w   C:\WINDOWS\system32\dtu100.dll
2007-11-18 19:56   244,224   ----a-w   C:\WINDOWS\system32\dxr.dll
2007-11-18 18:57   141,824   ----a-w   C:\WINDOWS\system32\mkx.dll
2007-11-18 18:57   108,032   ----a-w   C:\WINDOWS\system32\avi.dll
2007-11-18 18:56   163,840   ----a-w   C:\WINDOWS\system32\ts.dll
2007-11-18 18:56   159,744   ----a-w   C:\WINDOWS\system32\mmfinfo.dll
2007-11-18 18:56   141,312   ----a-w   C:\WINDOWS\system32\mp4.dll
2007-11-18 18:56   120,832   ----a-w   C:\WINDOWS\system32\ogm.dll
2007-11-18 18:55   23,552   ----a-w   C:\WINDOWS\system32\mkunicode.dll
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:44   1,291,264   ----a-w   C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28   222,720   ----a-w   C:\WINDOWS\system32\wmasf.dll
.

(((((((((((((((((((((((((((((   snapshot@2007-12-22_14.21.59.14   )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-23 19:44:03   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4a4.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-25 16:27]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 C:\WINDOWS\SOUNDMAN.EXE]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2004-06-11 04:15]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-10-14 03:17 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 15:15]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\
XP.lnk - C:\License.reg [2007-12-15 10:12:21]

R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
R3 ZSMC0305;A4 TECH PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [2006-03-22 13:54]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c64d573-aa60-11dc-9b69-806d6172696f}]
\Shell\AutoRun\command - F:\Setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 20:50:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-23 20:51:17
C:\ComboFix2.txt ... 2007-12-23 20:41
C:\ComboFix3.txt ... 2007-12-22 14:22
.
2007-12-15 19:04:44   --- E O F --- 


[wojtas]

zainstaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

Otworz notatnik i wklej w nim to:

File::
C:\pos2CEB.tmp
C:\pos2AF5.tmp
C:\pos28F9.tmp
C:\pos270A.tmp
C:\pos251B.tmp
C:\pos2325.tmp
C:\pos2134.tmp
C:\pos1F3E.tmp
C:\pos1D44.tmp
C:\pos1B54.tmp
C:\pos194A.tmp
C:\pos176D.tmp
C:\pos15DA.tmp
C:\pos1572.tmp
C:\pos1387.tmp
C:\pos1185.tmp
C:\posFF9.tmp
C:\posF99.tmp
C:\posDAB.tmp
C:\posBB8.tmp
C:\posAE9.tmp
C:\pos907.tmp
C:\pos3DC.tmp
C:\posF5.tmp
C:\pos717.tmp
C:\WINDOWS\system32\mcrh.tmp

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[Tomson]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 22:31:01, on 2007-12-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: XP.lnk = C:\License.reg
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=www.actina.pl
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197677793234
O17 - HKLM\System\CCS\Services\Tcpip\..\{D44CF0DD-3072-4C4D-95B1-1D21BAF6760E}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe



Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Tomek 2007-12-23 22:24:35.5 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.1.1045.18.178 [GMT 1:00]
Running from: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-23 to 2007-12-23  )))))))))))))))))))))))))))))))
.

2007-12-23 22:13 . 2007-12-23 22:13   <DIR>   d--------   C:\Program Files\Sunbelt Software
2007-12-22 11:44 . 2007-12-23 22:23   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-22 11:44 . 2007-12-14 16:33   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-22 11:44 . 2007-12-22 12:07   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-22 11:42 . 2007-12-22 11:42   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-22 00:11 . 2007-12-22 00:11   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-21 23:36 . 2007-12-22 11:42   <DIR>   d--------   C:\VundoFix Backups
2007-12-21 23:31 . 2007-12-22 11:03   1,802   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-21 17:28 . 2007-12-21 17:28   14,033   --a------   C:\pos2CE9.tmp
2007-12-21 16:39 . 2007-12-21 16:39   14,033   --a------   C:\pos2AF2.tmp
2007-12-21 16:26 . 2007-12-21 16:26   14,033   --a------   C:\pos28F4.tmp
2007-12-21 15:21 . 2007-12-21 15:22   14,033   --a------   C:\pos2707.tmp
2007-12-21 13:58 . 2007-12-21 13:58   14,033   --a------   C:\pos2514.tmp
2007-12-21 13:36 . 2007-12-21 13:36   14,033   --a------   C:\pos231B.tmp
2007-12-21 12:28 . 2007-12-21 12:28   14,033   --a------   C:\pos2129.tmp
2007-12-21 10:37 . 2007-12-21 10:37   14,033   --a------   C:\pos1F36.tmp
2007-12-21 00:48 . 2007-12-21 00:48   14,033   --a------   C:\pos1D3D.tmp
2007-12-21 00:18 . 2007-12-21 00:18   14,033   --a------   C:\pos1B52.tmp
2007-12-21 00:14 . 2007-12-21 00:14   14,033   --a------   C:\pos1948.tmp
2007-12-20 22:43 . 2007-12-20 22:43   14,033   --a------   C:\pos176C.tmp
2007-12-20 22:42 . 2007-12-20 22:42   14,033   --a------   C:\pos15D8.tmp
2007-12-20 22:20 . 2007-12-20 22:20   14,033   --a------   C:\pos1570.tmp
2007-12-20 20:41 . 2007-12-20 20:42   14,033   --a------   C:\pos137F.tmp
2007-12-20 19:19 . 2007-12-20 19:19   14,033   --a------   C:\pos117E.tmp
2007-12-20 19:18 . 2007-12-20 19:18   14,033   --a------   C:\posFED.tmp
2007-12-20 18:52 . 2007-12-20 18:52   14,033   --a------   C:\posF8F.tmp
2007-12-20 18:05 . 2007-12-20 18:05   14,033   --a------   C:\posD90.tmp
2007-12-20 17:25 . 2007-12-20 17:25   14,033   --a------   C:\posBA5.tmp
2007-12-20 17:01 . 2007-12-20 17:01   14,033   --a------   C:\posADE.tmp
2007-12-20 15:56 . 2007-12-20 15:56   14,033   --a------   C:\pos906.tmp
2007-12-20 14:32 . 2007-12-20 14:32   14,033   --a------   C:\pos3D8.tmp
2007-12-20 13:17 . 2007-12-20 13:17   14,033   --a------   C:\posE7.tmp
2007-12-20 12:50 . 2007-12-20 12:50   14,033   --a------   C:\pos70D.tmp
2007-12-18 01:43 . 2007-12-18 01:43   <DIR>   d--------   C:\Documents and Settings\Tomek\.jpi_cache
2007-12-16 13:35 . 2007-12-16 13:37   <DIR>   d--------   C:\WINDOWS\SxsCaPendDel
2007-12-15 20:30 . 2007-12-15 20:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-12-15 18:23 . 2007-12-15 18:23   <DIR>   d--------   C:\Program Files\Lavalys
2007-12-15 18:05 . 2007-12-15 18:05   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\DivX
2007-12-15 17:44 . 2007-12-15 17:44   <DIR>   d--------   C:\Program Files\Hamachi
2007-12-15 17:44 . 2007-12-23 00:20   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\Hamachi
2007-12-15 17:44 . 2007-12-15 17:44   25,280   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-15 17:35 . 2007-12-15 17:35   <DIR>   d--------   C:\Program Files\Codec Pack - All In 1
2007-12-15 17:35 . 2007-12-15 17:34   737,280   --a------   C:\WINDOWS\iun6002.exe
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\Codec
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\AVIcodec
2007-12-15 17:21 . 2006-10-26 19:56   32,592   --a------   C:\WINDOWS\system32\msonpmon.dll
2007-12-15 17:19 . 2007-12-15 17:19   <DIR>   d--------   C:\Program Files\Microsoft Works
2007-12-15 17:18 . 2007-12-15 17:18   <DIR>   d--------   C:\Program Files\Microsoft.NET
2007-12-15 17:16 . 2007-12-15 17:16   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 17:14 . 2007-12-15 17:19   <DIR>   d--------   C:\WINDOWS\SHELLNEW
2007-12-15 17:12 . 2007-12-15 17:12   <DIR>   dr-h-----   C:\MSOCache
2007-12-15 17:12 . 2007-12-15 20:04   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-12-15 17:10 . 2007-12-15 17:10   <DIR>   d--------   C:\Program Files\DAEMON Tools
2007-12-15 14:30 . 2007-12-15 14:30   685,816   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 14:20 . 2007-12-15 14:47   <DIR>   d--------   C:\Program Files\Valve
2007-12-15 14:04 . 2007-12-15 14:04   <DIR>   d--------   C:\Program Files\MSXML 6.0
2007-12-15 13:44 . 2007-07-30 19:19   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
2007-12-15 13:44 . 2007-07-30 19:18   30,072   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2007-12-15 11:29 . 2007-12-15 17:40   116   --a------   C:\WINDOWS\NeroDigital.ini
2007-12-15 10:41 . 2001-06-24 17:32   172,032   --a------   C:\WINDOWS\JAPI2.DLL
2007-12-15 10:41 . 2002-05-28 09:52   106,496   --a------   C:\WINDOWS\JAPI.DLL
2007-12-15 10:41 . 2004-12-03 12:19   102,400   --a------   C:\WINDOWS\MMVEM.EXE
2007-12-15 10:41 . 1999-10-24 10:25   20,992   --a------   C:\WINDOWS\MMVCB.AX
2007-12-15 10:40 . 2007-12-15 10:41   <DIR>   d--------   C:\Program Files\VP-EYE
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a------   C:\WINDOWS\system32\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a--c---   C:\WINDOWS\system32\dllcache\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a------   C:\WINDOWS\system32\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a--c---   C:\WINDOWS\system32\dllcache\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a--c---   C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a------   C:\WINDOWS\system32\ksxbar.ax
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a--c---   C:\WINDOWS\system32\dllcache\ksxbar.ax
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\EffectResources
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\CatRoot
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\Program Files\Vimicro
2007-12-15 10:36 . 2006-03-22 13:54   391,743   --a------   C:\WINDOWS\system32\drivers\usbVM305.sys
2007-12-15 10:36 . 2005-11-08 11:37   155,722   --a------   C:\WINDOWS\system32\VM305Prp.Ax
2007-12-15 10:36 . 2005-08-08 16:36   114,688   --a------   C:\WINDOWS\VM305Cap.exe
2007-12-15 10:36 . 1999-07-26 10:47   109,840   --a------   C:\WINDOWS\VidCap32.exe
2007-12-15 10:36 . 2005-08-05 18:36   81,920   --a------   C:\WINDOWS\system32\VM305STI.dll
2007-12-15 10:36 . 2005-08-05 15:15   61,440   --a------   C:\WINDOWS\VM305_STI.EXE
2007-12-15 10:36 . 2005-05-02 16:45   53,248   --a------   C:\WINDOWS\Sti305.exe
2007-12-15 10:36 . 2002-10-16 09:29   49,152   --a------   C:\WINDOWS\amcap.exe
2007-12-15 10:35 . 2007-12-15 10:35   <DIR>   d--------   C:\Program Files\Common Files\Nero
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Ahead
2007-12-15 10:34 . 2004-07-26 17:16   1,568,768   ---------   C:\WINDOWS\system32\ImagX7.dll
2007-12-15 10:34 . 2004-07-26 17:16   476,320   ---------   C:\WINDOWS\system32\ImagXpr7.dll
2007-12-15 10:34 . 2004-07-26 17:16   471,040   ---------   C:\WINDOWS\system32\ImagXRA7.dll
2007-12-15 10:34 . 2004-07-26 17:16   262,144   ---------   C:\WINDOWS\system32\ImagXR7.dll
2007-12-15 10:34 . 2001-07-09 11:50   155,648   --a------   C:\WINDOWS\system32\NeroCheck.exe
2007-12-15 10:34 . 2000-06-26 11:45   106,496   --a------   C:\WINDOWS\system32\TwnLib20.dll
2007-12-15 10:27 . 2007-12-15 10:27   483,466   --a------   C:\Orginalny windows xp.rar
2007-12-15 10:20 . 2007-12-16 11:20   952,503   ---hs----   C:\WINDOWS\system32\vmfwnsbn.ini
2007-12-15 10:12 . 2006-12-14 14:04   2,364   --a------   C:\License.reg
2007-12-15 09:55 . 2007-12-15 09:55   <DIR>   d--------   C:\WINDOWS\ServicePackFiles

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 21:15   ---------   d-----w   C:\Program Files\neostrada tp
2007-12-16 13:32   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-15 09:36   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-14 16:17   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-14 16:17   ---------   d-----w   C:\Documents and Settings\Tomek\Dane aplikacji\Gadu-Gadu
2007-12-14 16:12   33   ----a-w   C:\WINDOWS\system32\drivers\adidsl.cfg
2007-12-14 16:12   ---------   d-----w   C:\Program Files\SAGEM
2007-12-14 16:12   ---------   d-----w   C:\Program Files\Java
2007-12-14 15:36   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-14 15:35   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 14:56   93,264   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55   94,544   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-12-04 00:33   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2007-11-29 21:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 21:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
2007-11-29 21:28   196,608   ----a-w   C:\WINDOWS\system32\dtu100.dll
2007-11-18 19:56   244,224   ----a-w   C:\WINDOWS\system32\dxr.dll
2007-11-18 18:57   141,824   ----a-w   C:\WINDOWS\system32\mkx.dll
2007-11-18 18:57   108,032   ----a-w   C:\WINDOWS\system32\avi.dll
2007-11-18 18:56   163,840   ----a-w   C:\WINDOWS\system32\ts.dll
2007-11-18 18:56   159,744   ----a-w   C:\WINDOWS\system32\mmfinfo.dll
2007-11-18 18:56   141,312   ----a-w   C:\WINDOWS\system32\mp4.dll
2007-11-18 18:56   120,832   ----a-w   C:\WINDOWS\system32\ogm.dll
2007-11-18 18:55   23,552   ----a-w   C:\WINDOWS\system32\mkunicode.dll
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:44   1,291,264   ----a-w   C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28   222,720   ----a-w   C:\WINDOWS\system32\wmasf.dll
.

(((((((((((((((((((((((((((((   snapshot@2007-12-22_14.21.59.14   )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-15 17:13:34   274,432   ----a-w   C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2005-12-15 17:01:52   81,920   ----a-w   C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-23 21:15:30   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4f8.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-25 16:27]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 C:\WINDOWS\SOUNDMAN.EXE]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2004-06-11 04:15]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-10-14 03:17 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 15:15]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\
XP.lnk - C:\License.reg [2007-12-15 10:12:21]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
R3 ZSMC0305;A4 TECH PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [2006-03-22 13:54]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c64d573-aa60-11dc-9b69-806d6172696f}]
\Shell\AutoRun\command - F:\Setup.exe

*Newly Created Service* - FWDRV
*Newly Created Service* - KHIPS
*Newly Created Service* - KPF4
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 22:28:10
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  BigDog305 = C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-23 22:29:41
C:\ComboFix2.txt ... 2007-12-23 22:23
C:\ComboFix3.txt ... 2007-12-23 20:51
.
2007-12-15 19:04:44   --- E O F --- 


[wojtas]

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\pos2CEB.tmp
C:\pos2AF5.tmp
C:\pos28F9.tmp
C:\pos270A.tmp
C:\pos251B.tmp
C:\pos2325.tmp
C:\pos2134.tmp
C:\pos1F3E.tmp
C:\pos1D44.tmp
C:\pos1B54.tmp
C:\pos194A.tmp
C:\pos176D.tmp
C:\pos15DA.tmp
C:\pos1572.tmp
C:\pos1387.tmp
C:\pos1185.tmp
C:\posFF9.tmp
C:\posF99.tmp
C:\posDAB.tmp
C:\posBB8.tmp
C:\posAE9.tmp
C:\pos907.tmp
C:\pos3DC.tmp
C:\posF5.tmp
C:\pos717.tmp
C:\WINDOWS\system32\vmfwnsbn.ini

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Log po pracy programu zobaczymy w lokalizacji - C:\_OTMoveIt\MovedFiles
Po całej operacji należy zresetować komputer.

potem nowy log z hijacka i combofixa

[Tomson]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:40:57, on 2007-12-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Ares\Ares.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: XP.lnk = C:\License.reg
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=www.actina.pl
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197677793234
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe



Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Tomek 2007-12-24 15:21:31.6 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.1.1045.18.142 [GMT 1:00]
Running from: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-24 to 2007-12-24  )))))))))))))))))))))))))))))))
.

2007-12-23 22:13 . 2007-12-23 22:13   <DIR>   d--------   C:\Program Files\Sunbelt Software
2007-12-22 11:44 . 2007-12-23 22:29   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-22 11:44 . 2007-12-14 16:33   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-22 11:44 . 2007-12-14 17:24   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-22 11:44 . 2007-12-22 12:07   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-22 11:42 . 2007-12-22 11:42   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-22 00:11 . 2007-12-22 00:11   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-21 23:36 . 2007-12-22 11:42   <DIR>   d--------   C:\VundoFix Backups
2007-12-21 23:31 . 2007-12-22 11:03   1,802   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-18 01:43 . 2007-12-18 01:43   <DIR>   d--------   C:\Documents and Settings\Tomek\.jpi_cache
2007-12-16 13:35 . 2007-12-16 13:37   <DIR>   d--------   C:\WINDOWS\SxsCaPendDel
2007-12-15 20:30 . 2007-12-15 20:30   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-12-15 18:23 . 2007-12-15 18:23   <DIR>   d--------   C:\Program Files\Lavalys
2007-12-15 18:05 . 2007-12-15 18:05   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\DivX
2007-12-15 17:44 . 2007-12-15 17:44   <DIR>   d--------   C:\Program Files\Hamachi
2007-12-15 17:44 . 2007-12-23 00:20   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\Hamachi
2007-12-15 17:44 . 2007-12-15 17:44   25,280   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-15 17:35 . 2007-12-15 17:35   <DIR>   d--------   C:\Program Files\Codec Pack - All In 1
2007-12-15 17:35 . 2007-12-15 17:34   737,280   --a------   C:\WINDOWS\iun6002.exe
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\Codec
2007-12-15 17:34 . 2007-12-15 17:34   <DIR>   d--------   C:\Program Files\AVIcodec
2007-12-15 17:21 . 2006-10-26 19:56   32,592   --a------   C:\WINDOWS\system32\msonpmon.dll
2007-12-15 17:19 . 2007-12-15 17:19   <DIR>   d--------   C:\Program Files\Microsoft Works
2007-12-15 17:18 . 2007-12-15 17:18   <DIR>   d--------   C:\Program Files\Microsoft.NET
2007-12-15 17:16 . 2007-12-15 17:16   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 8
2007-12-15 17:14 . 2007-12-15 17:19   <DIR>   d--------   C:\WINDOWS\SHELLNEW
2007-12-15 17:12 . 2007-12-15 17:12   <DIR>   dr-h-----   C:\MSOCache
2007-12-15 17:12 . 2007-12-15 20:04   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-12-15 17:10 . 2007-12-15 17:10   <DIR>   d--------   C:\Program Files\DAEMON Tools
2007-12-15 14:30 . 2007-12-15 14:30   685,816   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 14:20 . 2007-12-15 14:47   <DIR>   d--------   C:\Program Files\Valve
2007-12-15 14:04 . 2007-12-15 14:04   <DIR>   d--------   C:\Program Files\MSXML 6.0
2007-12-15 13:44 . 2007-07-30 19:19   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
2007-12-15 13:44 . 2007-07-30 19:18   30,072   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2007-12-15 11:29 . 2007-12-15 17:40   116   --a------   C:\WINDOWS\NeroDigital.ini
2007-12-15 10:41 . 2001-06-24 17:32   172,032   --a------   C:\WINDOWS\JAPI2.DLL
2007-12-15 10:41 . 2002-05-28 09:52   106,496   --a------   C:\WINDOWS\JAPI.DLL
2007-12-15 10:41 . 2004-12-03 12:19   102,400   --a------   C:\WINDOWS\MMVEM.EXE
2007-12-15 10:41 . 1999-10-24 10:25   20,992   --a------   C:\WINDOWS\MMVCB.AX
2007-12-15 10:40 . 2007-12-15 10:41   <DIR>   d--------   C:\Program Files\VP-EYE
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a------   C:\WINDOWS\system32\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   91,136   --a--c---   C:\WINDOWS\system32\dllcache\kswdmcap.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a------   C:\WINDOWS\system32\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   61,952   --a--c---   C:\WINDOWS\system32\dllcache\kstvtune.ax
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   54,784   --a--c---   C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a------   C:\WINDOWS\system32\ksxbar.ax
2007-12-15 10:38 . 2004-08-04 00:44   43,008   --a--c---   C:\WINDOWS\system32\dllcache\ksxbar.ax
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\EffectResources
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\WINDOWS\CatRoot
2007-12-15 10:36 . 2007-12-15 10:36   <DIR>   d--------   C:\Program Files\Vimicro
2007-12-15 10:36 . 2006-03-22 13:54   391,743   --a------   C:\WINDOWS\system32\drivers\usbVM305.sys
2007-12-15 10:36 . 2005-11-08 11:37   155,722   --a------   C:\WINDOWS\system32\VM305Prp.Ax
2007-12-15 10:36 . 2005-08-08 16:36   114,688   --a------   C:\WINDOWS\VM305Cap.exe
2007-12-15 10:36 . 1999-07-26 10:47   109,840   --a------   C:\WINDOWS\VidCap32.exe
2007-12-15 10:36 . 2005-08-05 18:36   81,920   --a------   C:\WINDOWS\system32\VM305STI.dll
2007-12-15 10:36 . 2005-08-05 15:15   61,440   --a------   C:\WINDOWS\VM305_STI.EXE
2007-12-15 10:36 . 2005-05-02 16:45   53,248   --a------   C:\WINDOWS\Sti305.exe
2007-12-15 10:36 . 2002-10-16 09:29   49,152   --a------   C:\WINDOWS\amcap.exe
2007-12-15 10:35 . 2007-12-15 10:35   <DIR>   d--------   C:\Program Files\Common Files\Nero
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-12-15 10:34 . 2007-12-15 10:34   <DIR>   d--------   C:\Program Files\Ahead
2007-12-15 10:34 . 2004-07-26 17:16   1,568,768   ---------   C:\WINDOWS\system32\ImagX7.dll
2007-12-15 10:34 . 2004-07-26 17:16   476,320   ---------   C:\WINDOWS\system32\ImagXpr7.dll
2007-12-15 10:34 . 2004-07-26 17:16   471,040   ---------   C:\WINDOWS\system32\ImagXRA7.dll
2007-12-15 10:34 . 2004-07-26 17:16   262,144   ---------   C:\WINDOWS\system32\ImagXR7.dll
2007-12-15 10:34 . 2001-07-09 11:50   155,648   --a------   C:\WINDOWS\system32\NeroCheck.exe
2007-12-15 10:34 . 2000-06-26 11:45   106,496   --a------   C:\WINDOWS\system32\TwnLib20.dll
2007-12-15 10:27 . 2007-12-15 10:27   483,466   --a------   C:\Orginalny windows xp.rar
2007-12-15 10:12 . 2006-12-14 14:04   2,364   --a------   C:\License.reg
2007-12-15 09:55 . 2007-12-15 09:55   <DIR>   d--------   C:\WINDOWS\ServicePackFiles
2007-12-15 09:55 . 2004-07-17 11:40   19,528   --a------   C:\WINDOWS\[u]0[/u]00001_.tmp
2007-12-15 09:54 . 2007-12-15 09:54   <DIR>   d--------   C:\WINDOWS\EHome
2007-12-15 09:09 . 2007-12-15 09:09   1,158   --a------   C:\WINDOWS\mozver.dat
2007-12-15 01:53 . 2007-12-15 17:19   <DIR>   d--------   C:\Program Files\MSBuild
2007-12-15 01:50 . 2007-12-15 01:50   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2007-12-15 01:49 . 2007-12-15 01:49   <DIR>   d--------   C:\Program Files\Reference Assemblies
2007-12-15 01:49 . 2007-12-15 01:49   <DIR>   d--------   C:\f80cc1077cef24b7e0
2007-12-15 01:49 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2007-12-15 01:48 . 2007-12-15 01:48   <DIR>   d--------   C:\Program Files\Windows Media Connect 2
2007-12-15 01:47 . 2007-12-15 01:47   <DIR>   d--------   C:\WINDOWS\system32\LogFiles
2007-12-15 01:47 . 2007-12-15 01:47   <DIR>   d--------   C:\WINDOWS\system32\drivers\UMDF
2007-12-15 01:43 . 2007-12-15 14:47   <DIR>   d--------   C:\Program Files\Winamp
2007-12-15 01:43 . 2007-12-15 01:48   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\Winamp
2007-12-15 01:41 . 2007-12-15 01:42   <DIR>   d--------   C:\WINDOWS\system32\URTTemp
2007-12-15 01:31 . 2007-12-15 01:31   0   --a------   C:\WINDOWS\nsreg.dat
2007-12-15 01:03 . 2007-12-15 01:03   <DIR>   d--------   C:\Program Files\Alwil Software
2007-12-15 01:02 . 2007-12-15 01:02   169   --a------   C:\WINDOWS\RtlRack.ini
2007-12-15 01:00 . 2007-12-15 01:54   <DIR>   d--------   C:\WINDOWS\system32\pl-pl
2007-12-15 00:51 . 2007-12-15 01:06   <DIR>   d--------   C:\WINDOWS\NV3900284.TMP
2007-12-14 22:54 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-14 22:54 . 2004-08-03 23:08   31,616   --a--c---   C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-12-14 22:54 . 2004-08-03 23:08   26,496   --a--c---   C:\WINDOWS\system32\dllcache\usbstor.sys
2007-12-14 22:41 . 2007-12-16 14:34   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2007-12-14 22:28 . 2007-12-18 01:23   <DIR>   d--------   C:\Documents and Settings\Tomek\Dane aplikacji\skypePM
2007-12-14 22:28 . 2007-12-14 22:28   32   --a------   C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-14 22:27 . 2007-12-14 22:27   <DIR>   d--------   C:\Program Files\Skype

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 12:52   ---------   d-----w   C:\Program Files\neostrada tp
2007-12-16 13:32   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-15 09:36   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-14 16:17   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-14 16:17   ---------   d-----w   C:\Documents and Settings\Tomek\Dane aplikacji\Gadu-Gadu
2007-12-14 16:12   33   ----a-w   C:\WINDOWS\system32\drivers\adidsl.cfg
2007-12-14 16:12   ---------   d-----w   C:\Program Files\SAGEM
2007-12-14 16:12   ---------   d-----w   C:\Program Files\Java
2007-12-14 15:36   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-14 15:35   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 14:56   93,264   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55   94,544   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-12-04 00:33   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2007-11-29 21:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 21:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
2007-11-29 21:28   196,608   ----a-w   C:\WINDOWS\system32\dtu100.dll
2007-11-18 19:56   244,224   ----a-w   C:\WINDOWS\system32\dxr.dll
2007-11-18 18:57   141,824   ----a-w   C:\WINDOWS\system32\mkx.dll
2007-11-18 18:57   108,032   ----a-w   C:\WINDOWS\system32\avi.dll
2007-11-18 18:56   163,840   ----a-w   C:\WINDOWS\system32\ts.dll
2007-11-18 18:56   159,744   ----a-w   C:\WINDOWS\system32\mmfinfo.dll
2007-11-18 18:56   141,312   ----a-w   C:\WINDOWS\system32\mp4.dll
2007-11-18 18:56   120,832   ----a-w   C:\WINDOWS\system32\ogm.dll
2007-11-18 18:55   23,552   ----a-w   C:\WINDOWS\system32\mkunicode.dll
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:44   1,291,264   ----a-w   C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28   222,720   ----a-w   C:\WINDOWS\system32\wmasf.dll
.

(((((((((((((((((((((((((((((   snapshot@2007-12-22_14.21.59.14   )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-15 17:13:34   274,432   ----a-w   C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2005-12-15 17:01:52   81,920   ----a-w   C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-24 12:50:17   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4cc.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-25 16:27]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:11]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 C:\WINDOWS\SOUNDMAN.EXE]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2004-06-11 04:15]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-10-14 03:17 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 15:15]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\
XP.lnk - C:\License.reg [2007-12-15 10:12:21]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
R3 ZSMC0305;A4 TECH PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [2006-03-22 13:54]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c64d573-aa60-11dc-9b69-806d6172696f}]
\Shell\AutoRun\command - F:\Setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-24 15:29:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  BigDog305 = C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-24 15:33:17
C:\ComboFix2.txt ... 2007-12-23 22:29
C:\ComboFix3.txt ... 2007-12-23 22:23
.
2007-12-15 19:04:44   --- E O F --- 


[wojtas]

C:\WINDOWS\000001_.tmp
C:\f80cc1077cef24b7e0

skasuj te pogrubione do kosza i bedzie ok

Autor postu otrzymał pochwałę