proszę o sprawdzenie loga

[17rafal]

Od jakiegoś czasu, co kilka minut otwiera mi się sama przegladarka IE, na początku nic z tym nie robiłem, bo miałem nadzieje, że jakoś samo sie to wyłączy, ale tak sie nie stało. Mój log:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 22:53:31, on 2007-07-20
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\icq32.exe
C:\nvswc32.exe
C:\Program Files\lsass.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\System32\icq6.exe
D:\sass.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\kaspscays.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Rafal\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.123hots.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKLM\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\Run: [Internet Security Service] msq23.exe
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\Run: [Rundll] c:\Program Files\lsass.exe
O4 - HKLM\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [net32] C:\WINDOWS\svhost.exe
O4 - HKLM\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKLM\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKLM\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\RunServices: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\RunServices: [Internet Security Service] msq23.exe
O4 - HKLM\..\RunServices: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Rundll] c:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\RunServices: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\RunServices: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\RunServices: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\RunServices: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\RunServices: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKCU\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKCU\..\Run: [Internet Security Service] msq23.exe
O4 - HKCU\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Rundll] c:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKCU\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKCU\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKCU\..\Run: [Winamp Media] C:\WINDOWS\System32\qmedia.exe
O4 - HKCU\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKCU\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKCU\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKCU\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKCU\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKCU\..\RunServices: [systemscroot] systembin.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E cellSpacing=5 cellPadding=3 width=400} -
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Klient DHCP DhcpNetDDEdsdm (DhcpNetDDEdsdm) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Routing i dostęp zdalny RemoteAccessCryptSvc (RemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg


zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


potem nowy log z combofixa oraz hijacka

[17rafal]

log z hijackthis

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 23:51, on 2007-07-20
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\icq32.exe
C:\nvswc32.exe
C:\Program Files\lsass.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\System32\icq6.exe
D:\sass.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\kaspscays.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Rafal\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nightc
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKLM\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\Run: [Internet Security Service] msq23.exe
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [net32] C:\WINDOWS\svhost.exe
O4 - HKLM\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKLM\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKLM\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\RunServices: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\RunServices: [Internet Security Service] msq23.exe
O4 - HKLM\..\RunServices: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Rundll] c:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\RunServices: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\RunServices: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\RunServices: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\RunServices: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\RunServices: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKCU\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKCU\..\Run: [Internet Security Service] msq23.exe
O4 - HKCU\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Rundll] c:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKCU\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKCU\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKCU\..\Run: [Winamp Media] C:\WINDOWS\System32\qmedia.exe
O4 - HKCU\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKCU\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKCU\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKCU\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKCU\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKCU\..\RunServices: [systemscroot] systembin.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E cellSpacing=5 cellPadding=3 width=400} -
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Klient DHCP DhcpNetDDEdsdm (DhcpNetDDEdsdm) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Routing i dostep zdalny RemoteAccessCryptSvc (RemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: Lokalizator us3ugi zdalnego wywo3ania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe



z combofixa nie moglem zrobic

Przypomnial mi sie jeszcze jeden problem, a mianowicie jak uruchamiam komputer i pokazuje sie pulpit, to pokazuje sie na chwile okno

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

DhcpNetDDEdsdm
RemoteAccessCryptSvc
RPC

Files to delete:

C:\WINDOWS\System32\msq23.exe
C:\WINDOWS\System32\icq32.exe
C:\nvswc32.exe
C:\Program Files\lsass.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\System32\icq6.exe
D:\sass.exe
C:\WINDOWS\System32\kaspscays.exe
C:\WINDOWS\System32\45424062ldt.exe
d:\windows\sass.exe
c:\windows\sass.exe
C:\WINDOWS\System32\systembin.exe
d:\Program Files\sass.exe

Folders to delete:

C:\Program Files\Dealio

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nightc
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll
O4 - HKLM\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKLM\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\Run: [Internet Security Service] msq23.exe
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [net32] C:\WINDOWS\svhost.exe
O4 - HKLM\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKLM\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKLM\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKLM\..\RunServices: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKLM\..\RunServices: [Internet Security Service] msq23.exe
O4 - HKLM\..\RunServices: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Rundll] c:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
O4 - HKLM\..\RunServices: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKLM\..\RunServices: [NvCp1Do] D:\sass.exe
O4 - HKLM\..\RunServices: [NvCp1De] c:\windows\sass.exe
O4 - HKLM\..\RunServices: [NvCp1Da] d:\windows\sass.exe
O4 - HKLM\..\RunServices: [Rund] c:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKLM\..\RunServices: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
O4 - HKCU\..\Run: [NvCp1Daemon] C:\nvswc32.exe
O4 - HKCU\..\Run: [Internet Security Service] msq23.exe
O4 - HKCU\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Rundll] c:\Program Files\lsass.exe
O4 - HKCU\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
O4 - HKCU\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
O4 - HKCU\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
O4 - HKCU\..\Run: [Winamp Media] C:\WINDOWS\System32\qmedia.exe
O4 - HKCU\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKCU\..\Run: [NvCp1Do] D:\sass.exe
O4 - HKCU\..\Run: [NvCp1De] c:\windows\sass.exe
O4 - HKCU\..\Run: [NvCp1Da] d:\windows\sass.exe
O4 - HKCU\..\Run: [Rund] c:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
O4 - HKCU\..\Run: [Msnsgry.exe] d:\sass.exe
O4 - HKCU\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
O4 - HKCU\..\RunServices: [systemscroot] systembin.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll
O16 - DPF: {E cellSpacing=5 cellPadding=3 width=400} -

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z dss

http://www.techsupportforum.com/sectools/Deckard/dss.exe

[17rafal]

raport avenger

Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\fljvnnbs

*******************

Script file located at: \??\C:\WINDOWS\wmsltjkc.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver DhcpNetDDEdsdm unloaded successfully.
Driver RemoteAccessCryptSvc unloaded successfully.


Registry key \Registry\Machine\System\CurrentControlSet\Services\RPC not found!
Unload of driver RPC failed!

Could not process line:
RPC
Status: 0xc0000034



File C:\WINDOWS\System32\msq23.exe not found!
Deletion of file C:\WINDOWS\System32\msq23.exe failed!

Could not process line:
C:\WINDOWS\System32\msq23.exe
Status: 0xc0000034

File C:\WINDOWS\System32\icq32.exe deleted successfully.
File C:\nvswc32.exe deleted successfully.
File C:\Program Files\lsass.exe deleted successfully.
File C:\WINDOWS\svhoster.exe deleted successfully.
File C:\WINDOWS\System32\mdm.exe deleted successfully.
File C:\WINDOWS\svhost.exe deleted successfully.
File C:\WINDOWS\System32\icq6.exe deleted successfully.
File C:\WINDOWS\System32\kaspscays.exe deleted successfully.
File C:\WINDOWS\System32\45424062ldt.exe deleted successfully.
File c:\windows\sass.exe deleted successfully.


File C:\WINDOWS\System32\systembin.exe not found!
Deletion of file C:\WINDOWS\System32\systembin.exe failed!

Could not process line:
C:\WINDOWS\System32\systembin.exe
Status: 0xc0000034

Folder C:\Program Files\Dealio deleted successfully.
File D:\sass.exe deleted successfully.


Could not open file d:\windows\sass.exe for deletion
Deletion of file d:\windows\sass.exe failed!
Status: 0xc000003a



Could not open file d:\Program Files\sass.exe for deletion
Deletion of file d:\Program Files\sass.exe failed!
Status: 0xc000003a


Completed script processing.

*******************

Finished!  Terminate.

log z dss

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-21 at 20:32:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2007-07-21 18:32:48 UTC - RP219 - Deckard's System Scanner Restore Point
1: 2007-07-20 04:28:29 UTC - RP218 - Punkt kontrolny systemu


Backed up registry hives.

Performed disk cleanup.


-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 20:33, on 2007-07-21
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Wapster\AQQ\AQQ.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe
O23 - Service: Lokalizator us3ugi zdalnego wywo3ania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe


-- HijackThis Fixed Entries (C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\backups\) -------

backup-20070721-202006-336 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.siyber.com/
backup-20070721-202802-111 O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
backup-20070721-202802-113 O4 - HKLM\..\RunServices: [Msnsgrst.exe] d:\Program Files\sass.exe
backup-20070721-202802-148 O4 - HKLM\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
backup-20070721-202802-184 O4 - HKLM\..\RunServices: [Rundll] c:\Program Files\lsass.exe
backup-20070721-202802-203 O4 - HKLM\..\RunServices: [NvCp1Da] d:\windows\sass.exe
backup-20070721-202802-252 O4 - HKCU\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
backup-20070721-202802-257 O4 - HKLM\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
backup-20070721-202802-294 O4 - HKLM\..\RunServices: [Msnsgry.exe] d:\sass.exe
backup-20070721-202802-316 O4 - HKLM\..\Run: [NvCp1Do] C:\Program Files\sass.exe
backup-20070721-202802-326 O4 - HKLM\..\RunServices: [Internet Security Service] msq23.exe
backup-20070721-202802-380 O4 - HKLM\..\Run: [NvCp1Da] d:\windows\sass.exe
backup-20070721-202802-383 O4 - HKLM\..\RunServices: [NvCp1Daemon] C:\nvswc32.exe
backup-20070721-202802-384 O4 - HKCU\..\Run: [NvCp1Daemon] C:\nvswc32.exe
backup-20070721-202802-389 O4 - HKLM\..\RunServices: [NvCp1Do] C:\Program Files\sass.exe
backup-20070721-202802-398 O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll (file missing)
backup-20070721-202802-450 O4 - HKLM\..\RunServices: [NvCp1De] c:\windows\sass.exe
backup-20070721-202802-459 O4 - HKLM\..\Run: [Rund] c:\Program Files\sass.exe
backup-20070721-202802-484 O4 - HKCU\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
backup-20070721-202802-528 O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
backup-20070721-202802-613 O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll (file missing)
backup-20070721-202802-616 O4 - HKLM\..\RunServices: [Rund] c:\Program Files\sass.exe
backup-20070721-202802-646 O4 - HKLM\..\Run: [NvCp1Daemon] C:\nvswc32.exe
backup-20070721-202802-651 O4 - HKLM\..\Run: [NvCp1De] c:\windows\sass.exe
backup-20070721-202802-657 O4 - HKLM\..\RunServices: [Msnsgr.exe] d:\Program Files\lsass.exe
backup-20070721-202802-673 O4 - HKLM\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
backup-20070721-202802-687 O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
backup-20070721-202802-696 O4 - HKLM\..\RunServices: [NvCp1Daeme] d:\windows\lsass.exe
backup-20070721-202802-729 O4 - HKLM\..\Run: [Msnsgry.exe] d:\sass.exe
backup-20070721-202802-734 O4 - HKLM\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
backup-20070721-202802-764 O4 - HKLM\..\RunServices: [NvCp1Daemo] C:\Program Files\lsass.exe
backup-20070721-202802-770 O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\45424062ldt.exe
backup-20070721-202802-774 O4 - HKLM\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe
backup-20070721-202802-780 O4 - HKLM\..\Run: [NvCp1Daemo] C:\Program Files\lsass.exe
backup-20070721-202802-823 O4 - HKLM\..\Run: [icq client] C:\WINDOWS\System32\icq32.exe
backup-20070721-202802-913 O4 - HKLM\..\Run: [Internet Security Service] msq23.exe
backup-20070721-202802-929 O4 - HKLM\..\Run: [net32] C:\WINDOWS\svhost.exe
backup-20070721-202802-950 O4 - HKCU\..\Run: [Internet Security Service] msq23.exe
backup-20070721-202802-957 O4 - HKLM\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
backup-20070721-202803-114 O4 - HKCU\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
backup-20070721-202803-205 O16 - DPF: {E cellSpacing=5 cellPadding=3 width=400} -
backup-20070721-202803-206 O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
backup-20070721-202803-239 O4 - HKCU\..\Run: [Office SQL Monitor] C:\WINDOWS\System32\mdm.exe
backup-20070721-202803-266 O4 - HKCU\..\Run: [NvCp1Da] d:\windows\sass.exe
backup-20070721-202803-276 O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll (file missing)
backup-20070721-202803-287 O4 - HKCU\..\Run: [NvCp1Do] C:\Program Files\sass.exe
backup-20070721-202803-298 O4 - HKCU\..\Run: [NvCp1De] c:\windows\sass.exe
backup-20070721-202803-348 O4 - HKCU\..\Run: [NvCp1Daeme] d:\windows\lsass.exe
backup-20070721-202803-362 O4 - HKCU\..\Run: [Rund] c:\Program Files\sass.exe
backup-20070721-202803-505 O4 - HKCU\..\Run: [Winamp Media] C:\WINDOWS\System32\qmedia.exe
backup-20070721-202803-591 O4 - HKCU\..\Run: [Rundll] c:\Program Files\lsass.exe
backup-20070721-202803-661 O4 - HKCU\..\Run: [Msnsgry.exe] d:\sass.exe
backup-20070721-202803-896 O4 - HKCU\..\RunServices: [systemscroot] systembin.exe
backup-20070721-202803-911 O4 - HKCU\..\Run: [Network Socialiy] C:\WINDOWS\System32\kaspscays.exe
backup-20070721-202803-939 O4 - HKCU\..\Run: [Msnsgrst.exe] d:\Program Files\sass.exe
backup-20070721-202803-978 O4 - HKCU\..\Run: [Msnsgr.exe] d:\Program Files\lsass.exe

-- File Associations -----------------------------------------------------------

[COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR]


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>
R0 sfsync04 (StarForce Protection Synchronization Driver (version 4.x)) - c:\windows\system32\drivers\sfsync04.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>

S3 AvFlt (Antivirus Filter Driver) - c:\windows\system32\drivers\av5flt.sys (file missing)
S3 gAGP440p - c:\docume~1\rafal\ustawi~1\temp\gagp440p.sys (file missing)
S3 mssysroot - c:\documents and settings\rafal\mssysroot.sys (file missing)
S3 ss_bus (Samsung Mobile USB Device 1.0 driver (WDM)) - c:\windows\system32\drivers\ss_bus.sys <Not Verified; MCCI; Samsung Mobile USB Device 1.0>
S3 ss_mdfl (SAMSUNG Mobile USB Modem 1.0 Filter) - c:\windows\system32\drivers\ss_mdfl.sys <Not Verified; MCCI; SAMSUNG Mobile USB Modem 1.0 Filter>
S3 ss_mdm (SAMSUNG Mobile USB Modem 1.0 Drivers) - c:\windows\system32\drivers\ss_mdm.sys <Not Verified; MCCI; SAMSUNG Mobile USB Modem 1.0>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 FirebirdGuardianDefaultInstance (Firebird Guardian - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbguard.exe -s <Not Verified; The Firebird Project; Firebird SQL Server>
R3 FirebirdServerDefaultInstance (Firebird Server - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s <Not Verified; The Firebird Project; Firebird SQL Server>

S2 PAVSRVseclogon (Panda anti-virus service PAVSRVseclogon) - c:\windows\system32\1025x.exe srv
S2 RpcLocatorRemoteAccessCryptSvc (Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc) - c:\windows\system32\45424062ldt.exe srv (file missing)
S2 WmdmPmSNSSDPSRV (Portable Media Serial Number Service WmdmPmSNSSDPSRV) - c:\windows\system32\11107962ldj.exe srv <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe


-- Files created between 2007-06-21 and 2007-07-21 -----------------------------

2007-07-21 20:09:58    163840 ---hs---- C:\WINDOWS\sass.exe
2007-07-21 16:37:33     11776 --ahs---- C:\WINDOWS\System32\acledith.dll
2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:55:10       102 --a------ C:\WINDOWS\System32\clear.reg
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     34592 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  11547680 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-12 14:02:04    163840 ---hs---- C:\ntldx.exe
2007-07-12 14:02:01    163840 ---hs---- C:\Program Files\sass.exe
2007-07-04 14:09:28    159744 ---hs---- C:\hots.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>
2007-06-24 00:06:29    163840 ---hs---- C:\gsearch.exe
2007-06-21 17:34:30      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-06-21 16:06:37     59636 -r-hs---- C:\WINDOWS\System32\acleditr.exe
2007-06-21 12:35:57    262148 ---hs---- C:\scmdsk.exe


-- Find3M Report ---------------------------------------------------------------

2007-07-21 20:30:54         0 d-------- C:\Program Files\AutoConnect
2007-07-21 20:10:02         0 --a------ C:\WINDOWS\lsass.exe
2007-07-21 16:37:33       741 --ahs---- C:\WINDOWS\System32\3625576358.dat
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-17 00:53:23       212 --a------ C:\WINDOWS\_system.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-18 09:53:30    160772 ---hs---- C:\mtldr.exe
2007-06-17 12:36:03    118784 ---hs---- C:\lsass.exe
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar
2007-05-23 17:20:41     30980 -r-hs---- C:\WINDOWS\System32\1025x.exe
2007-05-22 22:33:24    143360 ---hs---- C:\ns.exe
2007-05-20 19:52:04     31552 -r-hs---- C:\WINDOWS\System32\11107962ldj.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"LXSUPMON"="C:\\WINDOWS\\System32\\LXSUPMON.EXE RUN"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVPDWIN"="\"C:\\Program Files\\Panda Software\\Panda Demo\\pandasft.exe\""
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"systemscroot"="systembin.exe"
"UpdateWin"="C:\\WINDOWS\\System32\\45424062ldt.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"UpdateWin"="C:\\WINDOWS\\System32\\45424062ldt.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-21 at 20:40:09 ---------



Jak narazie przegladarka, ani to okienko sie nie otworzyły

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\WINDOWS\sass.exe
gmer -del file C:\WINDOWS\System32\clear.reg
gmer -del file C:\WINDOWS\System32\acledith.dll
gmer -del file C:\ntldx.exe
gmer -del file C:\Program Files\sass.exe
gmer -del file C:\hots.exe
gmer -del file C:\gsearch.exe
gmer -del file C:\WINDOWS\System32\acleditr.exe
gmer -del file C:\scmdsk.exe
gmer -del file C:\WINDOWS\System32\3625576358.dat
gmer -del file C:\WINDOWS\_system.dat
gmer -del file C:\WINDOWS\System32\1025x.exe
gmer -del file C:\ns.exe
gmer -del file C:\WINDOWS\System32\11107962ldj.exe
gmer –reboot

I kliknij z prawej strony na Uruchom.

Otwierasz Gmera i przechodzisz do zakładki CMD zaznaczając tam REGEDIT. Do okna wklejasz

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"systemscroot"=-
"UpdateWin"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"UpdateWin"=-

Klik na Uruchom.

potem nowy log

[17rafal]

NIe wiem czy cos dało robienie tym gemarem, bo jak kasowalo to wyskakiwaly błedy.

log z dss, dac jeszcze jakis?

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-22 at 01:07:50
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 01:07, on 2007-07-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\svhoster.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe
O23 - Service: Lokalizator us3ugi zdalnego wywo3ania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)


-- Files created between 2007-06-22 and 2007-07-22 -----------------------------

2007-07-21 21:41:09    192000 --ahs---- C:\WINDOWS\svhoster.exe
2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48160 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  11834400 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-12 14:02:01    163840 ---hs---- C:\Program Files\sass.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-22 01:05:34         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 22:41:29       786 --a------ C:\WINDOWS\System32\3625576358.dat
2007-07-21 20:10:02         0 --a------ C:\WINDOWS\lsass.exe
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-18 09:53:30    160772 ---hs---- C:\mtldr.exe
2007-06-17 12:36:03    118784 ---hs---- C:\lsass.exe
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar
2007-05-23 17:20:41     30980 --a------ C:\WINDOWS\System32\1025x.exe


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"LXSUPMON"="C:\\WINDOWS\\System32\\LXSUPMON.EXE RUN"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVPDWIN"="\"C:\\Program Files\\Panda Software\\Panda Demo\\pandasft.exe\""
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"
"net64"="C:\\WINDOWS\\svhoster.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-22 at 01:08:20 ---------



[wojtas]

wklej do notatnika:

CD C:\
ATTRIB -R -S -H lsass.exe
ATTRIB -R -S -H mtldr.exe
DEL lsass.exe
DEL mtldr.exe
CD C:\Windows
ATTRIB -R -S -H svhoster.exe
DEL svhoster.exe
CD C:\WINDOWS\System32
ATTRIB -R -S -H 3625576358.dat
ATTRIB -R -S -H 1025x.exe
DEL 3625576358.dat
DEL 1025x.exe
CD C:\Program Files
ATTRIB -R -S -H sass.exe
DEL sass.exe

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na "Wszystkie pliki" >>> Zapisz jako FIX.BAT uruchom powstaly plik w trybie awaryjnym . jesli sie nie usunie to:

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\svhoster.exe
C:\WINDOWS\System32\3625576358.dat
C:\Program Files\sass.exe
C:\lsass.exe
C:\mtldr.exe
C:\WINDOWS\System32\1025x.exe

skasuj w hijacku te wpisy

O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O23 - Service: Lokalizator us3ugi zdalnego wywo3ania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)

[17rafal]

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-22 at 12:16:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 12:17, on 2007-07-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator us3ugi zdalnego wywo3ania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)


-- Files created between 2007-06-22 and 2007-07-22 -----------------------------

2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48160 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  11834400 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-22 12:14:30         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 20:10:02         0 --a------ C:\WINDOWS\lsass.exe
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"LXSUPMON"="C:\\WINDOWS\\System32\\LXSUPMON.EXE RUN"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVPDWIN"="\"C:\\Program Files\\Panda Software\\Panda Demo\\pandasft.exe\""
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-22 at 12:18:45 ---------



[wojtas]

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\lsass.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)


potem:

start>uruchom>cmd>wpisz

sc stop PAVSRVseclogon

enter

sc delete PAVSRVseclogon

enter

sc stop WmdmPmSNSSDPSRV

enter

sc delete WmdmPmSNSSDPSRV

enter

sc stop RPC

enter

sc delete RPC

enter

potem nowy log z dssa i moze jak Ci sie udaz z combofixa

[17rafal]

jak wpisywalem cdm to wyskakiwalo cos takiego


log z dss

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-22 at 18:11:10
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 18:11:14, on 2007-07-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)


-- Files created between 2007-06-22 and 2007-07-22 -----------------------------

2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48160 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  11975968 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-22 18:09:13         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-22 at 18:11:32 ---------


log z combofixa (jak go zrobilem to strasznie mi kompa zmulilo)

Kod: Zaznacz wszystko

"Rafal" - 2007-07-22 17:30:16 - ComboFix 07-07-14.6 - Dodatek Service Pack. 1  NTFS 


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\KAMILA~1\DANEAP~1\SystemDoctor 2006 Free
C:\DOCUME~1\KAMILA~1\DANEAP~1\SystemDoctor 2006 Free\Logs\update.log
C:\DOCUME~1\KAMILA~1\DANEAP~1\Ultimate Defender
C:\DOCUME~1\KAMILA~1\DANEAP~1\Ultimate Defender\logs\1151424040.log
C:\DOCUME~1\Rafal\MOJEDO~1.\fnts~1
C:\DOCUME~1\Rafal\MOJEDO~1\plug&play.lnk
C:\Program Files\Common Files\ppatch~1
C:\Program Files\Common Files\y1123ou.exe
C:\Program Files\Ultimate Defender
C:\WINDOWS\system32\setup.exe.tmp


(((((((((((((((((((((((((   Files Created from 2007-06-22 to 2007-07-22  )))))))))))))))))))))))))))))))


2007-07-21 20:32   <DIR>   d--------   C:\Deckard
2007-07-21 16:32   <DIR>   d--------   C:\WINDOWS\CSC
2007-07-20 23:49   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-20 21:09   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-20 21:09   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-20 21:09   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-20 20:54   39,184   --a------   C:\WINDOWS\system32\Ntrights.exe
2007-07-20 20:54   175,616   --a------   C:\WINDOWS\system32\strings.exe
2007-07-20 20:54   16,384   --a------   C:\WINDOWS\system32\restart.exe
2007-07-20 20:54   126,976   --a------   C:\WINDOWS\system32\zip.exe
2007-07-20 20:54   11,254   --a------   C:\WINDOWS\system32\locate.com
2007-07-20 20:49   <DIR>   d--------   C:\WINDOWS\pss
2007-07-20 17:20   0   --a------   C:\WINDOWS\nsreg.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klin.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klick.dat
2007-07-20 01:05   48,160   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-20 01:05   11,931,168   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-20 01:05   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Kaspersky Lab
2007-07-20 01:02   <DIR>   d--------   C:\!KillBox
2007-07-20 00:48   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-07-20 00:48   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-07-20 00:48   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-07-02 20:19   356,437   --a------   C:\WINDOWS\system32\GDS32.DLL


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 11:17:31   --------   d-----w   C:\Program Files\AutoConnect
2007-07-22 11:16:31   6,224   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-22 11:16:31   166,904   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-21 22:03:41   737,280   ----a-w   C:\WINDOWS\iun6002.exe
2007-07-21 14:35:26   3,678   ----a-w   C:\WINDOWS\system32\tmp.reg
2007-07-21 14:35:11   --------   d-----w   C:\Program Files\Neostrada TP
2007-07-20 21:55:12   67,078   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-07-20 21:55:12   435,978   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-07-20 04:08:43   1,614   --sha-w   C:\WINDOWS\system32\index.dat
2007-07-05 14:23:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\OpenOffice.org2
2007-06-14 20:57:11   --------   d-----w   C:\Program Files\Opera
2007-06-09 19:59:56   --------   d-----w   C:\Program Files\Snake
2007-06-09 19:55:20   487,424   ------w   C:\WINDOWS\Setup1.exe
2007-06-09 19:55:18   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-06-07 11:26:13   --------   d-----w   C:\Program Files\Ganymede
2007-06-05 13:18:17   --------   d-----w   C:\Program Files\Common Files\Panda Software
2007-06-04 15:49:42   80   ----a-w   C:\WINDOWS\system32\drivers\netfltConfig.dat
2007-06-03 12:11:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\MegauploadToolbar


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08   62080   --a------   C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
2007-02-08 07:04   158272   --a------   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
2006-10-31 08:55   1803720   --a------   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43   501400   --a------   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"Resume copy"="copyfstq.exe" [2006-09-27 17:01 C:\WINDOWS\copyfstq.exe]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [2006-03-10 09:07]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-14 16:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14]
"Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-04-25 17:27]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
NvCp1Daemon   C:\nvswc32.exe
NvCp1Daemo   C:\Program Files\lsass.exe
NvCp1Daeme   d:\windows\lsass.exe
Rundll   c:\Program Files\lsass.exe
Msnsgr.exe   d:\Program Files\lsass.exe
UpdateWin   C:\WINDOWS\System32\45424062ldt.exe
NvCp1Do   C:\Program Files\sass.exe
NvCp1De   c:\windows\sass.exe
NvCp1Da   d:\windows\sass.exe
Rund   c:\Program Files\sass.exe
Msnsgrst.exe   d:\Program Files\sass.exe
Msnsgry.exe   d:\sass.exe


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 17:34:12
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Name of App = C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w????????????????????Rafa??a?B???????L???????D??????w???w????j??w???w????????0?????C?0??????? ??? ?B?????????????????????061005025147859?5?1?4?7?8?5?9???????????????????0???????????????????????D?????G

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-22 17:34:58
C:\ComboFix-quarantined-files.txt ... 2007-07-22 17:34

   --- E O F ---

[wojtas]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1Daemon]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1Daemo]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1Daeme]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Rundll]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Msnsgr.exe]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\UpdateWin]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1Do]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1De]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\NvCp1Da]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Rund]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Msnsgrst.exe]

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Msnsgry.exe]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[17rafal]

Jak to zrobiłem to ktorego loga dac?

[wojtas]

dss i combo

[17rafal]

dss

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-22 at 20:45:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 20:45:11, on 2007-07-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)


-- Files created between 2007-06-22 and 2007-07-22 -----------------------------

2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48160 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  12110368 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-22 18:09:13         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-22 at 20:45:32 ---------



combofix

Kod: Zaznacz wszystko

"Rafal" - 2007-07-22 20:46:31 - ComboFix 07-07-14.6 - Dodatek Service Pack. 1  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-06-22 to 2007-07-22  )))))))))))))))))))))))))))))))


2007-07-21 20:32   <DIR>   d--------   C:\Deckard
2007-07-21 16:32   <DIR>   d--------   C:\WINDOWS\CSC
2007-07-20 23:49   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-20 21:09   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-20 21:09   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-20 21:09   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-20 20:54   39,184   --a------   C:\WINDOWS\system32\Ntrights.exe
2007-07-20 20:54   175,616   --a------   C:\WINDOWS\system32\strings.exe
2007-07-20 20:54   16,384   --a------   C:\WINDOWS\system32\restart.exe
2007-07-20 20:54   126,976   --a------   C:\WINDOWS\system32\zip.exe
2007-07-20 20:54   11,254   --a------   C:\WINDOWS\system32\locate.com
2007-07-20 20:49   <DIR>   d--------   C:\WINDOWS\pss
2007-07-20 17:20   0   --a------   C:\WINDOWS\nsreg.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klin.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klick.dat
2007-07-20 01:05   48,160   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-20 01:05   12,131,872   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-20 01:05   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Kaspersky Lab
2007-07-20 01:02   <DIR>   d--------   C:\!KillBox
2007-07-20 00:48   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-07-20 00:48   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-07-20 00:48   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-07-02 20:19   356,437   --a------   C:\WINDOWS\system32\GDS32.DLL


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 16:09:13   --------   d-----w   C:\Program Files\AutoConnect
2007-07-22 11:16:31   6,224   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-22 11:16:31   166,904   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-21 22:03:41   737,280   ----a-w   C:\WINDOWS\iun6002.exe
2007-07-21 14:35:26   3,678   ----a-w   C:\WINDOWS\system32\tmp.reg
2007-07-21 14:35:11   --------   d-----w   C:\Program Files\Neostrada TP
2007-07-20 21:55:12   67,078   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-07-20 21:55:12   435,978   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-07-20 04:08:43   1,614   --sha-w   C:\WINDOWS\system32\index.dat
2007-07-05 14:23:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\OpenOffice.org2
2007-06-14 20:57:11   --------   d-----w   C:\Program Files\Opera
2007-06-09 19:59:56   --------   d-----w   C:\Program Files\Snake
2007-06-09 19:55:20   487,424   ------w   C:\WINDOWS\Setup1.exe
2007-06-09 19:55:18   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-06-07 11:26:13   --------   d-----w   C:\Program Files\Ganymede
2007-06-05 13:18:17   --------   d-----w   C:\Program Files\Common Files\Panda Software
2007-06-04 15:49:42   80   ----a-w   C:\WINDOWS\system32\drivers\netfltConfig.dat
2007-06-03 12:11:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\MegauploadToolbar


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08   62080   --a------   C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
2007-02-08 07:04   158272   --a------   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
2006-10-31 08:55   1803720   --a------   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43   501400   --a------   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"Resume copy"="copyfstq.exe" [2006-09-27 17:01 C:\WINDOWS\copyfstq.exe]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [2006-03-10 09:07]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-14 16:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14]
"Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-04-25 17:27]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
NvCp1Daemon   C:\nvswc32.exe
NvCp1Daemo   C:\Program Files\lsass.exe
NvCp1Daeme   d:\windows\lsass.exe
Rundll   c:\Program Files\lsass.exe
Msnsgr.exe   d:\Program Files\lsass.exe
UpdateWin   C:\WINDOWS\System32\45424062ldt.exe
NvCp1Do   C:\Program Files\sass.exe
NvCp1De   c:\windows\sass.exe
NvCp1Da   d:\windows\sass.exe
Rund   c:\Program Files\sass.exe
Msnsgrst.exe   d:\Program Files\sass.exe
Msnsgry.exe   d:\sass.exe


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 20:49:19
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Name of App = C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w????????????????????Rafa??a?B???????L???????D??????w???w????j??w???w??????????????C????????? ??? ?B?????????????????????061005025147859?5?1?4?7?8?5?9???????????????????0???????????????????????D?????G

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-22 20:50:03
C:\ComboFix-quarantined-files.txt ... 2007-07-22 20:50
C:\ComboFix2.txt ... 2007-07-22 17:55
C:\ComboFix3.txt ... 2007-07-22 17:34

   --- E O F ---


[ Dodano: Dzisiaj o 21:00 ]
dss

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-22 at 20:45:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 20:45:11, on 2007-07-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)


-- Files created between 2007-06-22 and 2007-07-22 -----------------------------

2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48160 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  12110368 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-22 18:09:13         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-22 at 20:45:32 ---------



combofix

Kod: Zaznacz wszystko

"Rafal" - 2007-07-22 20:46:31 - ComboFix 07-07-14.6 - Dodatek Service Pack. 1  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-06-22 to 2007-07-22  )))))))))))))))))))))))))))))))


2007-07-21 20:32   <DIR>   d--------   C:\Deckard
2007-07-21 16:32   <DIR>   d--------   C:\WINDOWS\CSC
2007-07-20 23:49   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-20 21:09   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-20 21:09   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-20 21:09   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-20 20:54   39,184   --a------   C:\WINDOWS\system32\Ntrights.exe
2007-07-20 20:54   175,616   --a------   C:\WINDOWS\system32\strings.exe
2007-07-20 20:54   16,384   --a------   C:\WINDOWS\system32\restart.exe
2007-07-20 20:54   126,976   --a------   C:\WINDOWS\system32\zip.exe
2007-07-20 20:54   11,254   --a------   C:\WINDOWS\system32\locate.com
2007-07-20 20:49   <DIR>   d--------   C:\WINDOWS\pss
2007-07-20 17:20   0   --a------   C:\WINDOWS\nsreg.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klin.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klick.dat
2007-07-20 01:05   48,160   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-20 01:05   12,131,872   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-20 01:05   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Kaspersky Lab
2007-07-20 01:02   <DIR>   d--------   C:\!KillBox
2007-07-20 00:48   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-07-20 00:48   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-07-20 00:48   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-07-02 20:19   356,437   --a------   C:\WINDOWS\system32\GDS32.DLL


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 16:09:13   --------   d-----w   C:\Program Files\AutoConnect
2007-07-22 11:16:31   6,224   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-22 11:16:31   166,904   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-21 22:03:41   737,280   ----a-w   C:\WINDOWS\iun6002.exe
2007-07-21 14:35:26   3,678   ----a-w   C:\WINDOWS\system32\tmp.reg
2007-07-21 14:35:11   --------   d-----w   C:\Program Files\Neostrada TP
2007-07-20 21:55:12   67,078   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-07-20 21:55:12   435,978   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-07-20 04:08:43   1,614   --sha-w   C:\WINDOWS\system32\index.dat
2007-07-05 14:23:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\OpenOffice.org2
2007-06-14 20:57:11   --------   d-----w   C:\Program Files\Opera
2007-06-09 19:59:56   --------   d-----w   C:\Program Files\Snake
2007-06-09 19:55:20   487,424   ------w   C:\WINDOWS\Setup1.exe
2007-06-09 19:55:18   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-06-07 11:26:13   --------   d-----w   C:\Program Files\Ganymede
2007-06-05 13:18:17   --------   d-----w   C:\Program Files\Common Files\Panda Software
2007-06-04 15:49:42   80   ----a-w   C:\WINDOWS\system32\drivers\netfltConfig.dat
2007-06-03 12:11:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\MegauploadToolbar


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08   62080   --a------   C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
2007-02-08 07:04   158272   --a------   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
2006-10-31 08:55   1803720   --a------   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43   501400   --a------   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"Resume copy"="copyfstq.exe" [2006-09-27 17:01 C:\WINDOWS\copyfstq.exe]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [2006-03-10 09:07]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-14 16:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14]
"Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-04-25 17:27]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
NvCp1Daemon   C:\nvswc32.exe
NvCp1Daemo   C:\Program Files\lsass.exe
NvCp1Daeme   d:\windows\lsass.exe
Rundll   c:\Program Files\lsass.exe
Msnsgr.exe   d:\Program Files\lsass.exe
UpdateWin   C:\WINDOWS\System32\45424062ldt.exe
NvCp1Do   C:\Program Files\sass.exe
NvCp1De   c:\windows\sass.exe
NvCp1Da   d:\windows\sass.exe
Rund   c:\Program Files\sass.exe
Msnsgrst.exe   d:\Program Files\sass.exe
Msnsgry.exe   d:\sass.exe


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 20:49:19
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Name of App = C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w????????????????????Rafa??a?B???????L???????D??????w???w????j??w???w??????????????C????????? ??? ?B?????????????????????061005025147859?5?1?4?7?8?5?9???????????????????0???????????????????????D?????G

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-22 20:50:03
C:\ComboFix-quarantined-files.txt ... 2007-07-22 20:50
C:\ComboFix2.txt ... 2007-07-22 17:55
C:\ComboFix3.txt ... 2007-07-22 17:34

   --- E O F ---


[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

WmdmPmSNSSDPSRV
RpcLocatorRemoteAccessCryptSvc
PAVSRVseclogon

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)

start>uruchom>regedit>przejdz do klucza:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

i skasuj wymienione nizej

NvCp1Daemon
NvCp1Daemo
NvCp1Daeme
Rundll
Msnsgr.exe
UpdateWin
NvCp1Do
NvCp1De
NvCp1Da
Rund
Msnsgrst.exe
Msnsgry.exe

potem nowe logi

[17rafal]

log z dss

Kod: Zaznacz wszystko

Deckard's System Scanner v20070711.54
Run by Rafal on 2007-07-23 at 00:03:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Rafal.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 00:03, on 2007-07-23
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rafal\Pulpit\dss.exe
C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe


-- Files created between 2007-06-23 and 2007-07-23 -----------------------------

2007-07-22 23:24:22         0 d-------- C:\avenger
2007-07-22 23:15:05         0 --------- C:\WINDOWS\System32\drivers\nmt
2007-07-21 16:32:14         0 d-------- C:\WINDOWS\CSC
2007-07-20 20:54:51    126976 --a------ C:\WINDOWS\System32\zip.exe
2007-07-20 20:54:51    175616 --a------ C:\WINDOWS\System32\strings.exe
2007-07-20 20:54:51     16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart>
2007-07-20 20:54:51     39184 --a------ C:\WINDOWS\System32\Ntrights.exe
2007-07-20 20:54:51     11254 --a------ C:\WINDOWS\System32\locate.com
2007-07-20 20:49:22         0 d-------- C:\WINDOWS\pss
2007-07-20 17:20:32         0 --a------ C:\WINDOWS\nsreg.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-07-20 01:05:53     82258 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-07-20 01:05:44     48416 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-07-20 01:05:44  12148000 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-07-20 01:02:34         0 d-------- C:\!KillBox
2007-07-20 00:48:41    288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-20 00:48:41     53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-20 00:48:41     51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-07-02 20:19:41    356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server>


-- Find3M Report ---------------------------------------------------------------

2007-07-23 00:00:20         0 d-------- C:\Program Files\AutoConnect
2007-07-22 00:03:41    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-07-21 16:35:26      3678 --a------ C:\WINDOWS\System32\tmp.reg
2007-07-21 16:35:11         0 d-------- C:\Program Files\Neostrada TP
2007-07-20 23:55:12    435978 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-20 23:55:12     67078 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-20 17:20:30         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla
2007-07-20 06:08:43      1614 --ahs---- C:\WINDOWS\System32\index.dat
2007-07-05 16:23:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2
2007-06-14 22:57:11         0 d-------- C:\Program Files\Opera
2007-06-09 21:59:56         0 d-------- C:\Program Files\Snake
2007-06-09 21:55:20    487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-06-09 21:55:18     73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-06-07 13:26:13         0 d-------- C:\Program Files\Ganymede
2007-06-05 15:18:17         0 d-------- C:\Program Files\Common Files\Panda Software
2007-06-03 14:11:39         0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"Resume copy"="copyfstq.exe /startup"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- End of Deckard's System Scanner: finished at 2007-07-23 at 00:03:31 ---------



nie bylo tych wpisow

Kod: Zaznacz wszystko

23 - Service: Panda anti-virus service PAVSRVseclogon (PAVSRVseclogon) - Unknown owner - C:\WINDOWS\System32\1025x.exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorRemoteAccessCryptSvc (RpcLocatorRemoteAccessCryptSvc) - Unknown owner - C:\WINDOWS\System32\45424062ldt.exe (file missing)
O23 - Service: Portable Media Serial Number Service WmdmPmSNSSDPSRV (WmdmPmSNSSDPSRV) - Unknown owner - C:\WINDOWS\System32\11107962ldj.exe (file missing)

loga z combofixa dodam za chwile

[ Dodano: Dzisiaj o 1:46 ]
nie moge zrobic loga z combofixa, sprobuje popoludniu

[wojtas]

tu jest ok ale combofix by sie przydal

[17rafal]

udalo sie , dlaczego mi komp zamula jak zrobie tego loga??

Kod: Zaznacz wszystko

"Rafal" - 2007-07-23 20:06:55 - ComboFix 07-07-14.6 - Dodatek Service Pack. 1  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-06-23 to 2007-07-23  )))))))))))))))))))))))))))))))


2007-07-22 23:15   60,416   --a------   C:\WINDOWS\system32\drivers\nmt^cepo.sys
2007-07-21 20:32   <DIR>   d--------   C:\Deckard
2007-07-21 16:32   <DIR>   d--------   C:\WINDOWS\CSC
2007-07-20 23:49   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-20 21:09   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-20 21:09   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-20 21:09   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-20 21:09   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-20 21:09   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-20 20:54   39,184   --a------   C:\WINDOWS\system32\Ntrights.exe
2007-07-20 20:54   175,616   --a------   C:\WINDOWS\system32\strings.exe
2007-07-20 20:54   16,384   --a------   C:\WINDOWS\system32\restart.exe
2007-07-20 20:54   126,976   --a------   C:\WINDOWS\system32\zip.exe
2007-07-20 20:54   11,254   --a------   C:\WINDOWS\system32\locate.com
2007-07-20 20:49   <DIR>   d--------   C:\WINDOWS\pss
2007-07-20 17:20   0   --a------   C:\WINDOWS\nsreg.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klin.dat
2007-07-20 01:05   82,258   --a------   C:\WINDOWS\system32\drivers\klick.dat
2007-07-20 01:05   50,464   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-20 01:05   12,423,968   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-20 01:05   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Kaspersky Lab
2007-07-20 01:02   <DIR>   d--------   C:\!KillBox
2007-07-20 00:48   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-07-20 00:48   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-07-20 00:48   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-07-02 20:19   356,437   --a------   C:\WINDOWS\system32\GDS32.DLL


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-23 16:54:19   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\OpenOffice.org2
2007-07-23 13:18:38   --------   d-----w   C:\Program Files\AutoConnect
2007-07-22 23:56:26   6,584   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-22 23:56:26   171,224   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-21 22:03:41   737,280   ----a-w   C:\WINDOWS\iun6002.exe
2007-07-21 14:35:26   3,678   ----a-w   C:\WINDOWS\system32\tmp.reg
2007-07-21 14:35:11   --------   d-----w   C:\Program Files\Neostrada TP
2007-07-20 21:55:12   67,078   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-07-20 21:55:12   435,978   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-07-20 04:08:43   1,614   --sha-w   C:\WINDOWS\system32\index.dat
2007-06-14 20:57:11   --------   d-----w   C:\Program Files\Opera
2007-06-09 19:59:56   --------   d-----w   C:\Program Files\Snake
2007-06-09 19:55:20   487,424   ------w   C:\WINDOWS\Setup1.exe
2007-06-09 19:55:18   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-06-07 11:26:13   --------   d-----w   C:\Program Files\Ganymede
2007-06-05 13:18:17   --------   d-----w   C:\Program Files\Common Files\Panda Software
2007-06-04 15:49:42   80   ----a-w   C:\WINDOWS\system32\drivers\netfltConfig.dat
2007-06-03 12:11:39   --------   d-----w   C:\DOCUME~1\Rafal\DANEAP~1\MegauploadToolbar


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08   62080   --a------   C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
2007-02-08 07:04   158272   --a------   E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
2006-10-31 08:55   1803720   --a------   C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43   501400   --a------   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27]
"Resume copy"="copyfstq.exe" [2006-09-27 17:01 C:\WINDOWS\copyfstq.exe]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [2006-03-10 09:07]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-14 16:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14]
"Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-04-25 17:27]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll


**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-23 20:09:53
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Name of App = C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w????????????????????Rafa??a?B???????L???????D??????w???w????j??w???w??????????????C????????? ??? ?B?????????????????????061005025147859?5?1?4?7?8?5?9???????????????????0???????????????????????D?????G

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-23 20:11:02
C:\ComboFix-quarantined-files.txt ... 2007-07-23 20:10
C:\ComboFix2.txt ... 2007-07-22 20:50
C:\ComboFix3.txt ... 2007-07-22 17:55

   --- E O F ---


[wojtas]

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\drivers\nmt^cepo.sys

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)