prosze o sprawdzenie loga

[KamilK]

Witam...wkradł mi sie jakiś trojan do systemu Nod go wykrył i wrzucił do kwarantanny...ale po ponownym uruchomieniu systemu Nod mi sie nie odpala a jak chce go odpalić ręcznie to uruchomia mi sie tylko okienko dosowe...wklejam loga....prosze o pomoc.

Logfile of HijackThis v1.99.1
Scan saved at 21:06:02, on 2008-01-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\imapi.exe
H:\z pulpitu\z moje dokumenty\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=C:\WINDOWS\system32\sstqn.exe
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NodLogin] C:\Program Files\ESET\ESET Smart Security\nodlogin.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[Dzi@dek]

Zastosuj się do tego tematu
http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

Usuń wpis w hijackthis:

F3 - REG:win.ini: load=C:\WINDOWS\system32\sstqn.exe

Pobierz combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

otwórz notatnik i wklej:

File::
C:\WINDOWS\system32\sstqn.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

Autor postu otrzymał pochwałę

[KamilK]

zrobiłem jak mówiłeś....w trybie awaryjnym hijack nie wykrył tego co mi podałeś ale reszte zrobiłem...kilka programów mie sie nie dpałało ale wyrzuciłem i zainstalowałem na nowo.....wklejam teraz kontrolne logi

Logfile of HijackThis v1.99.1
Scan saved at 20:14:26, on 2008-01-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\Opera.exe
H:\z pulpitu\z moje dokumenty\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NodLogin] C:\Program Files\ESET\ESET Smart Security\nodlogin.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

ComboFix 08-01-11.3 - User 2008-01-12 20:17:28.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.709 [GMT 1:00]
Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 )))))))))))))))))))))))))))))))
.

2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\system32\oobe
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\srchasst
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-01-12 19:16 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-12 14:46 . 2008-01-12 19:14 171,520 --a------ C:\WINDOWS\system32\msconfig .exe
2008-01-12 14:36 . 2008-01-12 19:34 <DIR> d--h----- C:\Documents and Settings\MasterAdmin\Ustawienia lokalne
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Ulubione
2008-01-12 14:36 . 2007-10-24 17:56 <DIR> d--h----- C:\Documents and Settings\MasterAdmin\Szablony
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Pulpit
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Moje dokumenty
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> dr------- C:\Documents and Settings\MasterAdmin\Menu Start
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> dr-h----- C:\Documents and Settings\MasterAdmin\Dane aplikacji
2007-12-31 09:33 . 2007-12-31 09:36 <DIR> d-------- C:\Program Files\Oil Tycoon
2007-12-30 15:40 . 2007-12-30 15:50 32 --a------ C:\WINDOWS\CD-Start.INI
2007-12-30 15:38 . 2007-12-30 15:38 <DIR> d-------- C:\Program Files\Techland
2007-12-25 21:11 . 2007-12-25 21:12 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\SecondLife
2007-12-22 17:34 . 2007-12-22 17:34 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2007-12-18 22:01 . 2007-12-18 22:01 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-15 19:31 . 2007-12-15 19:31 <DIR> d-------- C:\Program Files\City Interactive
2007-12-14 21:20 . 2007-12-14 21:20 <DIR> d-------- C:\FastDow - Pobrane
2007-12-14 20:59 . 2008-01-09 17:21 <DIR> d-------- C:\FastDow-Pob
2007-12-14 20:59 . 2008-01-07 20:06 <DIR> d-------- C:\FastDow

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 13:44 507,392 ----a-w C:\WINDOWS\system32\msconfig.exe
2008-01-08 21:32 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Skype
2007-12-31 08:36 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2007-12-30 14:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 13:19 --------- d-----w C:\Program Files\MoorHunt
2007-12-10 20:07 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-10 19:20 --------- d-----w C:\Program Files\Winamp
2007-12-10 16:21 --------- d-----w C:\Program Files\IrfanView
2007-11-30 19:58 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Nero
2007-11-30 19:57 --------- d-----w C:\Program Files\Common Files\Nero
2007-11-30 19:55 --------- d-----w C:\Program Files\Nero
2007-11-30 19:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-11-30 16:01 18,008 ----a-w C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-11-27 16:08 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\ESET
2007-11-27 16:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2007-11-23 20:52 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-11-23 20:52 50,696 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-11-23 20:52 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-11-23 20:50 33,800 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-11-23 20:50 27,656 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-16 17:50 --------- d-----w C:\Program Files\Electronic Arts
2007-11-16 17:42 --------- d-----w C:\Program Files\Eidos Interactive
2007-11-14 21:36 --------- d-----w C:\Program Files\Fox
2007-11-07 16:47 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-10-31 17:32 19,804,456 ----a-w C:\Program Files\Onet-SkypeSetup.exe
2007-10-23 13:20 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-22 07:51 972,072 ----a-w C:\WINDOWS\UNRecode.exe
.

Kod: Zaznacz wszystko

<pre>
----a-w         1,410,304 2008-01-12 18:14:04  C:\RECYCLER\S-1-5-21-1715567821-1644491937-839522115-1001\Dc1\ESET Smart Security\egui .exe
----a-w           298,584 2008-01-12 13:28:32  C:\RECYCLER\S-1-5-21-1715567821-1644491937-839522115-1001\Dc1\ESET Smart Security\nodlogin .exe
----a-w           171,520 2008-01-12 18:14:07  C:\WINDOWS\system32\msconfig .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-15 17:42 4112384]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-15 17:42 81920]
"nwiz"="nwiz.exe" [2004-07-15 17:42 843776 C:\WINDOWS\system32\nwiz.exe]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-11-23 21:51 1410304]
"NodLogin"="C:\Program Files\ESET\ESET Smart Security\nodlogin.exe" [2007-12-30 16:00 298584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-05-10 15:39 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"DisableStatusMessages"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-10-23 14:18 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
--a------ 2004-06-09 14:37 40960 C:\WINDOWS\VM_STI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-09-20 08:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-09-13 13:37 22983464 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spol]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ WebClient LmHosts RemoteRegistry upnphost SSDPSRV

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-12 20:19:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-12 20:19:50
ComboFix-quarantined-files.txt 2008-01-12 19:19:41
ComboFix2.txt 2008-01-12 18:34:52
ComboFix3.txt 2008-01-12 18:29:28

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\msconfig .exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[KamilK]

zrobiłem co kazaliście....kontrolne logi

Logfile of HijackThis v1.99.1
Scan saved at 19:46:48, on 2008-01-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\Opera.exe
H:\z pulpitu\z moje dokumenty\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NodLogin] C:\Program Files\ESET\ESET Smart Security\nodlogin.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

ComboFix 08-01-11.3 - User 2008-01-14 19:50:30.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.690 [GMT 1:00]
Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-14 to 2008-01-14 )))))))))))))))))))))))))))))))
.

2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\system32\oobe
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\WINDOWS\srchasst
2008-01-12 19:23 . 2008-01-12 19:23 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-01-12 19:16 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-12 14:36 . 2008-01-13 20:35 <DIR> d--h----- C:\Documents and Settings\MasterAdmin\Ustawienia lokalne
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Ulubione
2008-01-12 14:36 . 2007-10-24 17:56 <DIR> d--h----- C:\Documents and Settings\MasterAdmin\Szablony
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Pulpit
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> d-------- C:\Documents and Settings\MasterAdmin\Moje dokumenty
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> dr------- C:\Documents and Settings\MasterAdmin\Menu Start
2008-01-12 14:36 . 2007-10-24 19:50 <DIR> dr-h----- C:\Documents and Settings\MasterAdmin\Dane aplikacji
2007-12-31 09:33 . 2007-12-31 09:36 <DIR> d-------- C:\Program Files\Oil Tycoon
2007-12-30 15:40 . 2007-12-30 15:50 32 --a------ C:\WINDOWS\CD-Start.INI
2007-12-30 15:38 . 2007-12-30 15:38 <DIR> d-------- C:\Program Files\Techland
2007-12-25 21:11 . 2007-12-25 21:12 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\SecondLife
2007-12-22 17:34 . 2007-12-22 17:34 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2007-12-18 22:01 . 2007-12-18 22:01 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-15 19:31 . 2007-12-15 19:31 <DIR> d-------- C:\Program Files\City Interactive
2007-12-14 21:20 . 2007-12-14 21:20 <DIR> d-------- C:\FastDow - Pobrane
2007-12-14 20:59 . 2008-01-09 17:21 <DIR> d-------- C:\FastDow-Pob
2007-12-14 20:59 . 2008-01-07 20:06 <DIR> d-------- C:\FastDow

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 19:47 --------- d-----w C:\Program Files\Driver Cleaner
2008-01-12 13:44 507,392 ----a-w C:\WINDOWS\system32\msconfig.exe
2008-01-08 21:32 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Skype
2007-12-31 08:36 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2007-12-30 14:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 13:19 --------- d-----w C:\Program Files\MoorHunt
2007-12-10 20:07 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-10 19:20 --------- d-----w C:\Program Files\Winamp
2007-12-10 16:21 --------- d-----w C:\Program Files\IrfanView
2007-11-30 19:58 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Nero
2007-11-30 19:57 --------- d-----w C:\Program Files\Common Files\Nero
2007-11-30 19:55 --------- d-----w C:\Program Files\Nero
2007-11-30 19:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-11-30 16:01 18,008 ----a-w C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-11-27 16:08 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\ESET
2007-11-27 16:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2007-11-23 20:52 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-11-23 20:52 50,696 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-11-23 20:52 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-11-23 20:50 33,800 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-11-23 20:50 27,656 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-16 17:50 --------- d-----w C:\Program Files\Electronic Arts
2007-11-16 17:42 --------- d-----w C:\Program Files\Eidos Interactive
2007-11-14 21:36 --------- d-----w C:\Program Files\Fox
2007-11-07 16:47 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-10-31 17:32 19,804,456 ----a-w C:\Program Files\Onet-SkypeSetup.exe
2007-10-23 13:20 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-22 07:51 972,072 ----a-w C:\WINDOWS\UNRecode.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-12_20.19.24,92 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-12 18:17:26 212,992 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-13 19:33:32 212,992 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-12 18:17:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-13 19:33:32 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-12 18:17:27 3,334,144 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-13 19:33:32 3,334,144 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-12 18:17:27 167,936 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-13 19:33:32 167,936 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-12 18:17:27 212,992 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-13 19:33:32 212,992 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-12 18:17:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-13 19:33:32 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-14 18:36:04 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_1b4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-15 17:42 4112384]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-07-15 17:42 81920]
"nwiz"="nwiz.exe" [2004-07-15 17:42 843776 C:\WINDOWS\system32\nwiz.exe]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-11-23 21:51 1410304]
"NodLogin"="C:\Program Files\ESET\ESET Smart Security\nodlogin.exe" [2007-12-30 16:00 298584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-05-10 15:39 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"DisableStatusMessages"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-10-23 14:18 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
--a------ 2004-06-09 14:37 40960 C:\WINDOWS\VM_STI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-09-20 08:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-09-13 13:37 22983464 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spol]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ WebClient LmHosts RemoteRegistry upnphost SSDPSRV

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-14 19:52:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-14 19:53:14
ComboFix-quarantined-files.txt 2008-01-14 18:53:04
ComboFix2.txt 2008-01-13 19:35:21
ComboFix3.txt 2008-01-13 19:31:50
ComboFix4.txt 2008-01-13 19:27:43
ComboFix5.txt 2008-01-12 19:19:51

[wojtas]

czysto

Autor postu otrzymał pochwałę

[KamilK]

dziękuje bardzo za pomoc....pozdrawiam

[ Dodano: Dzisiaj o 19:20 ]
a jeszcze jedno....ni moge zamknąć tych portów
:

[Dzi@dek]

klikasz po razie w pierwszy i ostatni i restart kompa.

[KamilK]

wiem że trzeba kliknąc...ale NetBios i Messenger cały czas są na żółto...pozdrawiam