proszę o sprawdzenie loga

[t0d]

ciągłe zwiechy komputera - zero info w podglądzie zdarzeń, więc może jakieś ustrojstwo?
HijackThis 2.0.2 :

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:15, on 2007-12-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\BMExtreme\BMExtreme.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\VNC\WinVNC4.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZyDummyZD11B-BG.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\mmc.exe
D:\gpm\--==programy\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BMExtreme.lnk = C:\Program Files\BMExtreme\BMExtreme.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.mapa.lodz.pl/VIEWERS/mgaxctrl.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{298A9B86-80CD-4CB4-9700-6F234BD022DD}: NameServer = 217.113.224.35,217.113.224.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winmxw32 - C:\WINDOWS\SYSTEM32\winmxw32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DirectX Service (DirectFapv) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\VNC\WinVNC4.exe
O23 - Service: ZyDAS1211BBG - Unknown owner - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe

--
End of file - 7858 bytes


Silent Runners:

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 55, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"DiskeeperSystray" = ""C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"" ["Executive Software International, Inc."]
"zBrowser Launcher" = "C:\Program Files\Logitech\iTouch\iTouch.exe" ["Logitech Inc.                    "]
"EM_EXEC" = "C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" ["Logitech Inc.                    "]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"00PCTFW" = ""C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s" ["PC Tools"]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"C-Media Mixer" = "Mixer.exe /startup" ["C-Media Electronic Inc. (www.cmedia.com.tw)"]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch"
  -> {HKLM...CLSID} = "FGCatchUrl"
                   \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
{F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "FlashGet GetFlash Class"
                   \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}" = "Eudora's Shell Extension"
  -> {HKLM...CLSID} = "Eudora's Shell Extension"
                   \InProcServer32\(Default) = "D:\gpm\Eudora\EuShlExt.dll" ["Qualcomm Inc."]
"{0561EC90-CE54-4f0c-9C55-E226110A740C}" = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\mmfinfo.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{a45cfb7d-6e23-40b5-94fa-290314f01dc5}" = "Better File Rename"
  -> {HKLM...CLSID} = "Better File Rename"
                   \InProcServer32\(Default) = "C:\Program Files\Better File Rename\BfrExt.dll" ["Informatique sur Mesure"]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
  -> {HKLM...CLSID} = "Microsoft Office Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {HKLM...CLSID} = "AlcoholShellEx"
                   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{D3796116-94D3-4009-96D7-51578411CC7D}" = "Outpost Shell Extension"
  -> {HKLM...CLSID} = "oshdlr.ShellHandler"
                   \InProcServer32\(Default) = "C:\PROGRA~1\OUTPOS~1.0\oshdlr.dll" [file not found]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}" = "Eudora's Shell Extension"
  -> {HKLM...CLSID} = "Eudora's Shell Extension"
                   \InProcServer32\(Default) = "D:\gpm\Eudora\EuShlExt.dll" ["Qualcomm Inc."]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> winmxw32\DLLName = "winmxw32.dll" [null data]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{0561EC90-CE54-4f0c-9C55-E226110A740C}\(Default) = "Haali Column Provider"
  -> {HKLM...CLSID} = "Haali Column Provider"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\mmfinfo.dll" [null data]
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Pod mikroskopem.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Pod mikroskopem.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS]


Startup items in "Frustrat" & "All Users" startup folders:
----------------------------------------------------------

C:\Documents and Settings\Frustrat\Menu Start\Programy\Autostart
"BMExtreme" -> shortcut to: "C:\Program Files\BMExtreme\BMExtreme.exe" ["Luigi Pino"]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart
"ZDWLan Utility" -> shortcut to: "C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe" [empty string]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 57
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet"
  -> {HKLM...CLSID} = "FlashGet"
                   \InProcServer32\(Default) = "C:\Program Files\FlashGet\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "FlashGet"
"Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Adobe LM Service, Adobe LM Service, ""C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"" ["Adobe Systems"]
ASP.NET State Service, aspnet_state, "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe" [MS]
InstallDriver Table Manager, IDriverT, ""C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"" ["Macrovision Corporation"]
Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
PC Tools Firewall Plus, PCToolsFirewallPlus, "C:\Program Files\PC Tools Firewall Plus\FWService.exe" ["PC Tools"]
Process Monitor, LVPrcSrv, "c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe" ["Logitech Inc."]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"]
Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]}
VNC Server Version 4, WinVNC4, ""C:\Program Files\VNC\WinVNC4.exe" -service" ["RealVNC Ltd."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
ZyDAS1211BBG, ZyDAS1211BBG, ""C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe"" [null data]


Keyboard Driver Filters:
------------------------

HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = <<!>> "Lkbdflt2" ["Logitech, Inc."]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
PDFCreator\Driver = "pdfcmnnt.dll" [null data]


---------- (launch time: 2007-12-15 22:32:33)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 210 seconds.
---------- (total run time: 256 seconds)


help

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[t0d]

SDFix:

Kod: Zaznacz wszystko


SDFix: Version 1.118

Run by Administrator on 2007-12-16 at 10:36

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix\SDFix

Safe Mode:
Checking Services:

Name:
DirectFapv

Path:
C:\WINDOWS\system32\directx.exe

DirectFapv - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing SharedAccess Service

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\GWFSPI~1.DLL - Deleted
C:\WINDOWS\SYSTEM32\WINMXW32.DLL - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-16 10:46:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:3eb51ca3
"s2"=dword:93be3246

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20]
"RefCount"=dword:00000005
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\repair\\explorer.exe"="C:\\WINDOWS\\repair\\explorer.exe:*:Enabled:Explorer"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\WINDOWS\\repair\\explorer.exe"="C:\\WINDOWS\\repair\\explorer.exe:*:Enabled:Explorer"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri  2 Feb 2007     5,242,880 A..H. --- "C:\Documents and Settings\Admin.ELEMDOM1\NTUSER.DAT.bak_jv16pt"
Fri  2 Feb 2007       262,144 A..H. --- "C:\Documents and Settings\LocalService.ZARZ¤DZANIE NT\NTUSER.DAT.bak_jv16pt"
Fri  2 Feb 2007       262,144 A..H. --- "C:\Documents and Settings\NetworkService.ZARZ¤DZANIE NT\NTUSER.DAT.bak_jv16pt"
Wed  2 Nov 2005       486,400 A.SH. --- "C:\Program Files\Cell Phone Manager\MobCfg.dll"
Thu  3 Nov 2005       508,416 A.SH. --- "C:\Program Files\Cell Phone Manager\MobSvr.exe"
Sat 28 Jul 2007     5,388,088 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Sun 30 Jul 2006         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 22 Aug 2006           401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv15.bak"
Fri 16 Nov 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Sun 30 Jul 2006         4,348 A..H. --- "C:\Documents and Settings\Admin.ELEMDOM1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak"
Tue 22 Aug 2006           401 A..H. --- "C:\Documents and Settings\Admin.ELEMDOM1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak"
Sun  2 Apr 2006           312 A.SH. --- "C:\Documents and Settings\Admin.ELEMDOM1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak"
Thu 15 Nov 2007           857 ...HR --- "C:\Documents and Settings\Frustrat\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"
Sun 30 Jul 2006         4,348 A..H. --- "C:\Documents and Settings\Frustrat\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak"
Tue 22 Aug 2006           401 A..H. --- "C:\Documents and Settings\Frustrat\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak"
Sun  2 Apr 2006           312 A.SH. --- "C:\Documents and Settings\Frustrat\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak"
Thu  1 Feb 2007       262,144 A..H. --- "C:\Documents and Settings\Admin.ELEMDOM1\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.bak_jv16pt"
Tue 12 Dec 2006       262,144 A..H. --- "C:\Documents and Settings\LocalService.ZARZ¤DZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.bak_jv16pt"
Tue 12 Dec 2006       262,144 A..H. --- "C:\Documents and Settings\NetworkService.ZARZ¤DZANIE NT\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.bak_jv16pt"
Wed 14 Aug 2002        65,088 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\3COM 3c556 Packet\3C556.COM"
Wed 14 Aug 2002        12,732 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\3COM 3c509 Packet\3C5X9PD.COM"
Wed 14 Aug 2002        26,424 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\3COM 3c59x Packet\3C59XPD.COM"
Wed 14 Aug 2002        28,062 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1207F Packet\EN5251PD.COM"
Wed 14 Aug 2002        10,710 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1207C Packet\PCIPD.COM"
Wed 14 Aug 2002        10,083 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1207D Packet\ACCPKT.COM"
Wed 14 Aug 2002        10,257 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1207TX Packet\PCIPD.COM"
Wed 14 Aug 2002        29,499 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1203 Packet\PCIPD.COM"
Wed 14 Aug 2002        12,660 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1204 Packet\VLNWPD.COM"
Wed 14 Aug 2002        11,031 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1207 Packet\PCIPD.COM"
Wed 14 Aug 2002        17,952 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1200 Packet\EC32PD.COM"
Wed 14 Aug 2002         9,424 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1208 Packet\1208PD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1650 Packet\NWPD.COM"
Wed 14 Aug 2002        13,673 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1640 Packet\NWPD.COM"
Wed 14 Aug 2002        14,438 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1658 Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN166X Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1651 Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1652 Packet\NWPD.COM"
Wed 14 Aug 2002         7,243 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1653 Packet\NE2PD.COM"
Wed 14 Aug 2002        24,767 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN2216 Packet\PCMPD.COM"
Wed 14 Aug 2002         7,463 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1625 Packet\NEPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1656 Packet\NWPD.COM"
Wed 14 Aug 2002        10,286 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN2228 Packet\PCMPD.COM"
Wed 14 Aug 2002        25,460 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN2218 Packet\PCMPD.COM"
Wed 14 Aug 2002        28,866 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN2320 Packet\EN5251PD.COM"
Wed 14 Aug 2002        14,438 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\ACCTON EN1657 Packet\NWPD.COM"
Wed 14 Aug 2002         8,544 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\CATC USB Ethernet\Elndis.sys"
Wed 14 Aug 2002        33,149 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\CATC USB Ethernet\Usbd.sys"
Wed 14 Aug 2002        47,826 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPI1394.SYS"
Wed 14 Aug 2002        35,340 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPI2DOS.SYS"
Wed 14 Aug 2002        14,378 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPI4DOS.SYS"
Wed 14 Aug 2002        37,984 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPI8DOS.SYS"
Wed 14 Aug 2002        44,828 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPI8U2.SYS"
Wed 14 Aug 2002        29,628 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPICD.SYS"
Wed 14 Aug 2002        49,750 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPIEHCI.SYS"
Wed 14 Aug 2002        49,242 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPIOHCI.SYS"
Wed 14 Aug 2002        50,606 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\ASPIUHCI.SYS"
Wed 14 Aug 2002       161,792 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\BOOTSRV.SYS"
Wed 14 Aug 2002       174,080 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\bootsrv16.sys"
Wed 14 Aug 2002        21,971 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\BTCDROM.SYS"
Wed 14 Aug 2002        30,955 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\BTDOSM.SYS"
Wed 14 Aug 2002       202,517 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\CMDS.EXE"
Wed 14 Aug 2002       374,038 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\CMDS16.EXE"
Wed 14 Aug 2002        22,158 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\COUNTRY.SYS"
Wed 14 Aug 2002         1,608 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\DEVICE.COM"
Wed 14 Aug 2002        15,345 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\DISPLAY.SYS"
Wed 14 Aug 2002         7,840 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\DLSHELP.SYS"
Wed 14 Aug 2002        56,821 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\E.EXE"
Wed 14 Aug 2002        64,425 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\FLASHPT.SYS"
Wed 14 Aug 2002        32,396 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\GUEST.EXE"
Wed 14 Aug 2002        14,160 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\HIMEM.SYS"
Wed 14 Aug 2002        10,898 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\KEYB.COM"
Wed 14 Aug 2002        53,556 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\KEYBOARD.SYS"
Wed 14 Aug 2002        15,777 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\MODE.COM"
Wed 14 Aug 2002        37,681 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\MOUSE.COM"
Wed 14 Aug 2002       354,304 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\msbootsrv16.sys"
Wed 14 Aug 2002        21,180 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\MSCDEX.EXE"
Wed 14 Aug 2002       354,263 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\Net.exe"
Wed 14 Aug 2002         8,513 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\NETBIND.COM"
Wed 14 Aug 2002        41,302 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\OAKCDROM.SYS"
Wed 14 Aug 2002       129,240 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\OHCI.EXE"
Wed 14 Aug 2002        28,439 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\Paralink.com"
Wed 14 Aug 2002        13,770 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\PROTMAN.EXE"
Wed 14 Aug 2002       130,980 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\UHCI.EXE"
Wed 14 Aug 2002        11,854 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DEC EtherWorks ISA (DE305) Packet\DE305.COM"
Wed 14 Aug 2002        52,715 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DEC EtherWORKS DE450 Packet\DE450.COM"
Wed 14 Aug 2002        62,391 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DEC EtherWORKS DE500 Packet\DE500.COM"
Wed 14 Aug 2002        11,491 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DMF560-TX Packet\Lmpd.com"
Wed 14 Aug 2002        17,791 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DT620 Packet\Dt620pd.com"
Wed 14 Aug 2002        17,043 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\DLink DE400 Packet\De400pd.com"
Wed 14 Aug 2002        11,786 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\IBM Crystal LAN Packet\Epktisa.com"
Wed 14 Aug 2002        18,300 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Kingston EtheRx KNE110TX Packet\Ktc110p.com"
Wed 14 Aug 2002        48,224 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD 10-100AL Packet\L100al.com"
Wed 14 Aug 2002        13,360 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD-CDF Packet\Ldcdt.com"
Wed 14 Aug 2002         9,190 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Laneed LD-PCI2TL Packet\Ldpcil.com"
Wed 14 Aug 2002        12,567 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Melco LPC2-T\Lpchkat2.com"
Wed 14 Aug 2002        44,640 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\FETPKT.COM"
Wed 14 Aug 2002        56,896 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\Rtspkt.com"
Wed 14 Aug 2002        44,640 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Planex FNW9x00T - ENW8300T Packet\fetpkt.com"
Wed 14 Aug 2002         9,692 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\PXE Packet Driver\Undipd.com"
Wed 14 Aug 2002         9,537 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\SN 2000p Packet\PNPPD.COM"
Wed 14 Aug 2002        32,484 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\WaveLAN Packet\Wvlan42.com"
Wed 14 Aug 2002        52,225 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe"
Wed 14 Aug 2002        48,491 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe"
Wed 14 Aug 2002        50,405 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom RE10 - RE100 Packet\Ce3pd.com"
Wed 14 Aug 2002        33,860 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe"
Wed 14 Aug 2002        50,175 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe"
Wed 14 Aug 2002        50,795 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe"
Wed 14 Aug 2002        48,223 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom CBE10-100BTX Packet\Cbepd.com"
Wed 14 Aug 2002        48,641 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe"
Wed 14 Aug 2002        49,015 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\Xircom Ethernet II PS Packet\Xpspd.com"
Wed 14 Aug 2002        53,786 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\pcdos\command.com"
Wed 14 Aug 2002        44,240 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\pcdos\IBMBIO.COM"
Wed 14 Aug 2002        42,550 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Ghost\Template\common\pcdos\IBMDOS.COM"

Finished!


Combofix:

Kod: Zaznacz wszystko

ComboFix 07-12-16.3 - Administrator 2007-12-16 12:32:51.4 - NTFSx86 MINIMAL
Running from: D:\gpm\--==programy\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\ksiazka tel\lodzkie2007\images\html\wg\kancelaria_adwokacka_2280585_pliki\_desktop.ini
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm






(((((((((((((((((((((((((   Files Created from 2007-11-16 to 2007-12-16  )))))))))))))))))))))))))))))))
.

2007-12-16 10:36 . 2007-12-16 10:36   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-15 21:35 . 2007-12-15 21:35   43,520   --a------   C:\WINDOWS\system32\CmdLineExt03.dll
2007-12-15 21:12 . 2005-09-09 16:26   176,128   --a------   C:\WINDOWS\system32\nvudisp.exe
2007-12-15 21:12 . 2007-12-16 10:56   29,204   --a------   C:\WINDOWS\system32\nvapps.xml
2007-12-15 21:12 . 2005-09-09 16:26   14,757   --a------   C:\WINDOWS\system32\nvdisp.nvu
2007-12-15 21:11 . 2007-12-15 21:11   <DIR>   d--------   C:\NVIDIA
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-15 20:59 . 2006-12-12 21:28   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-15 20:59 . 2007-12-15 21:01   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-02 15:26 . 2007-12-02 15:26   <DIR>   d---s----   C:\Documents and Settings\Frustrat\UserData
2007-11-20 15:27 . 2007-11-20 15:27   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-11-16 17:45 . 2007-11-16 17:46   <DIR>   d--hs----   C:\Documents and Settings\All Users.WINDOWS\DRM

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-16 09:56   0   ----a-w   C:\WINDOWS\system32\drivers\lvuvc.hs
2007-12-15 20:04   ---------   d-----w   C:\Program Files\Driver Cleaner
2007-12-15 13:26   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-12-10 16:28   ---------   d-----w   C:\Program Files\PITY2006NG
2007-11-23 10:05   ---------   d-----w   C:\Program Files\Opera
2007-11-22 19:21   ---------   d-----w   C:\Program Files\FlashGet
2007-11-16 16:46   ---------   d---a-w   C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2007-11-15 11:39   98,304   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-11-14 09:19   ---------   d-----w   C:\Program Files\DVDFab Decrypter 3
2007-11-13 11:53   21,840   ----atw   C:\WINDOWS\system32\SIntfNT.dll
2007-11-13 11:53   17,212   ----atw   C:\WINDOWS\system32\SIntf32.dll
2007-11-13 11:53   12,067   ----atw   C:\WINDOWS\system32\SIntf16.dll
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 13:08   ---------   d--h--r   C:\Documents and Settings\Frustrat\Dane aplikacji\SecuROM
2007-11-08 11:58   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-11-08 11:58   249,856   ------w   C:\WINDOWS\Setup1.exe
2007-11-02 13:03   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-31 10:01   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\foobar2000
2007-10-29 22:44   1,291,264   ----a-w   C:\WINDOWS\system32\quartz.dll
2007-10-29 07:19   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Ahead
2007-10-20 05:01   227,328   ----a-w   C:\WINDOWS\system32\wmasf.dll
2007-10-18 07:30   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-10-17 13:36   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Gadu-Gadu
2007-10-17 12:14   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Mp3tag
2007-10-16 17:46   ---------   d-----w   C:\Program Files\UltraVNC
2007-10-16 09:23   ---------   d-----w   C:\Program Files\C-Media
2007-06-27 04:07   10,828,364   ----a-w   C:\WINDOWS\Internet Logs\zlclient_2nd_2007_06_26_11_29_34.dmp.zip
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2004-12-21 23:29]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-07-22 02:10]
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-07-09 09:50]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 15:22 C:\WINDOWS\soundman.exe]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-09-19 14:27]
"C-Media Mixer"="Mixer.exe" [2002-07-12 15:33 C:\WINDOWS\mixer.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-09-09 16:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= D:\gpm\Eudora\EuShlExt.dll [2005-11-14 15:15 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmxw32]
winmxw32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin.ELEMDOM1^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Admin.ELEMDOM1\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Hardware Doctor.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Hardware Doctor.lnk
backup=C:\WINDOWS\pss\Hardware Doctor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51   39792   --a------   C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boingo Wireless Software]
         C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe -Minimized
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2007-02-27 15:55   937984   --a------   C:\Program Files\FileZilla Server\FileZilla Server Interface.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
         C:\WINDOWS\system32\dumprep 0 -k
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-02-08 01:12   488984   --a------   C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
         C:\Program Files\Logitech\QuickCam10\QuickCam10.exe /hide
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 16:40   155648   --a------   C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
         nwiz.exe /install
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-11-09 15:07   49263   --a------   C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)
"ERSvc"=3 (0x3)
"srservice"=3 (0x3)
"RemoteRegistry"=3 (0x3)
"helpsvc"=3 (0x3)
"LmHosts"=3 (0x3)
"Diskeeper"=3 (0x3)
"CiSvc"=3 (0x3)
"Boingo WMonitor"=3 (0x3)
"Boingo Wireless Engine"=3 (0x3)

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-16 12:35:35
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-16 12:36:16
.
2007-12-15 13:39:21   --- E O F --- 


hijack

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43, on 2007-12-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\VNC\WinVNC4.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZyDummyZD11B-BG.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\BMExtreme\BMExtreme.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\gpm\--==programy\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BMExtreme.lnk = C:\Program Files\BMExtreme\BMExtreme.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.mapa.lodz.pl/VIEWERS/mgaxctrl.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{298A9B86-80CD-4CB4-9700-6F234BD022DD}: NameServer = 217.113.224.35,217.113.224.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winmxw32 - winmxw32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\VNC\WinVNC4.exe
O23 - Service: ZyDAS1211BBG - Unknown owner - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe

--
End of file - 7735 bytes


dodam że nadal się zawiesza

[wojtas]

skasuj:

O20 - Winlogon Notify: winmxw32 - winmxw32.dll (file missing)

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\drivers\lvuvc.hs

Driver::
lvuvc

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[t0d]

skasuj:

O20 - Winlogon Notify: winmxw32 - winmxw32.dll (file missing)

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\drivers\lvuvc.hs

Driver::
lvuvc

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

HijackThis:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:02:56, on 2007-12-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\BMExtreme\BMExtreme.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\VNC\WinVNC4.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZyDummyZD11B-BG.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
D:\gpm\--==programy\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BMExtreme.lnk = C:\Program Files\BMExtreme\BMExtreme.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.mapa.lodz.pl/VIEWERS/mgaxctrl.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{298A9B86-80CD-4CB4-9700-6F234BD022DD}: NameServer = 217.113.224.35,217.113.224.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\VNC\WinVNC4.exe
O23 - Service: ZyDAS1211BBG - Unknown owner - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe

--
End of file - 7423 bytes


Combofix:

Kod: Zaznacz wszystko

ComboFix 07-12-16.3 - Frustrat 2007-12-17 15:33:46.9 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.677 [GMT 1:00]
Running from: C:\naprawa\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-17 to 2007-12-17  )))))))))))))))))))))))))))))))
.

2007-12-16 18:25 . 2007-12-16 19:43   <DIR>   d--------   C:\naprawa
2007-12-16 10:36 . 2007-12-16 10:36   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-15 21:35 . 2007-12-15 21:35   43,520   --a------   C:\WINDOWS\system32\CmdLineExt03.dll
2007-12-15 21:12 . 2005-09-09 16:26   176,128   --a------   C:\WINDOWS\system32\nvudisp.exe
2007-12-15 21:12 . 2007-12-17 09:38   29,204   --a------   C:\WINDOWS\system32\nvapps.xml
2007-12-15 21:12 . 2005-09-09 16:26   14,757   --a------   C:\WINDOWS\system32\nvdisp.nvu
2007-12-15 21:11 . 2007-12-15 21:11   <DIR>   d--------   C:\NVIDIA
2007-12-15 20:59 . 2007-12-16 19:55   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2007-12-15 20:59 . 2006-12-12 21:28   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2007-12-15 20:59 . 2007-12-15 21:01   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2007-12-15 20:59 . 2006-12-12 22:20   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-02 15:26 . 2007-12-02 15:26   <DIR>   d---s----   C:\Documents and Settings\Frustrat\UserData
2007-11-20 15:27 . 2007-11-20 15:27   <DIR>   d--------   C:\Program Files\SkanerOnline

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-16 17:19   0   ----a-w   C:\WINDOWS\system32\drivers\lvuvc.hs
2007-12-15 20:04   ---------   d-----w   C:\Program Files\Driver Cleaner
2007-12-15 13:26   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-12-10 16:28   ---------   d-----w   C:\Program Files\PITY2006NG
2007-11-23 10:05   ---------   d-----w   C:\Program Files\Opera
2007-11-22 19:21   ---------   d-----w   C:\Program Files\FlashGet
2007-11-16 16:46   ---------   d---a-w   C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2007-11-15 11:39   98,304   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-11-14 09:19   ---------   d-----w   C:\Program Files\DVDFab Decrypter 3
2007-11-13 11:53   21,840   ----atw   C:\WINDOWS\system32\SIntfNT.dll
2007-11-13 11:53   17,212   ----atw   C:\WINDOWS\system32\SIntf32.dll
2007-11-13 11:53   12,067   ----atw   C:\WINDOWS\system32\SIntf16.dll
2007-11-13 10:25   20,480   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 13:08   ---------   d--h--r   C:\Documents and Settings\Frustrat\Dane aplikacji\SecuROM
2007-11-08 11:58   73,216   ----a-w   C:\WINDOWS\ST6UNST.EXE
2007-11-08 11:58   249,856   ------w   C:\WINDOWS\Setup1.exe
2007-11-02 13:03   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-31 10:01   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\foobar2000
2007-10-29 22:44   1,291,264   ----a-w   C:\WINDOWS\system32\quartz.dll
2007-10-29 07:19   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Ahead
2007-10-20 05:01   227,328   ----a-w   C:\WINDOWS\system32\wmasf.dll
2007-10-18 07:30   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-10-17 13:36   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Gadu-Gadu
2007-10-17 12:14   ---------   d-----w   C:\Documents and Settings\Frustrat\Dane aplikacji\Mp3tag
2007-06-27 04:07   10,828,364   ----a-w   C:\WINDOWS\Internet Logs\zlclient_2nd_2007_06_26_11_29_34.dmp.zip
.

(((((((((((((((((((((((((((((   snapshot@2007-12-16_11.04.06.25   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-12 20:37:46   16,384   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-12-16 19:06:00   16,384   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2006-12-12 20:37:46   32,768   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2007-12-16 19:06:00   32,768   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2006-12-12 20:37:46   32,768   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-16 19:06:00   32,768   -c--a-w   C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2004-12-21 23:29]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-07-22 02:10]
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-07-09 09:50]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 15:22 C:\WINDOWS\soundman.exe]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-09-19 14:27]
"C-Media Mixer"="Mixer.exe" [2002-07-12 15:33 C:\WINDOWS\mixer.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2005-09-09 16:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2007-08-30 08:05:02]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= D:\gpm\Eudora\EuShlExt.dll [2005-11-14 15:15 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin.ELEMDOM1^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Admin.ELEMDOM1\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Hardware Doctor.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Hardware Doctor.lnk
backup=C:\WINDOWS\pss\Hardware Doctor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51   39792   --a------   C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boingo Wireless Software]
         C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe -Minimized
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2007-02-27 15:55   937984   --a------   C:\Program Files\FileZilla Server\FileZilla Server Interface.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
         C:\WINDOWS\system32\dumprep 0 -k
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-02-08 01:12   488984   --a------   C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
         C:\Program Files\Logitech\QuickCam10\QuickCam10.exe /hide
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 16:40   155648   --a------   C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
         nwiz.exe /install
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-11-09 15:07   49263   --a------   C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPS"=3 (0x3)
"ERSvc"=3 (0x3)
"srservice"=3 (0x3)
"RemoteRegistry"=3 (0x3)
"helpsvc"=3 (0x3)
"LmHosts"=3 (0x3)
"Diskeeper"=3 (0x3)
"CiSvc"=3 (0x3)
"Boingo WMonitor"=3 (0x3)
"Boingo Wireless Engine"=3 (0x3)

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys
R1 pctfw2;pctfw2;\??\C:\WINDOWS\system32\drivers\pctfw2.sys
R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys
R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys
R1 vcdrom;Virtual CD-ROM Device Driver;\??\C:\WINDOWS\system32\drivers\VCdRom.sys
R2 ZyDAS1211BBG;ZyDAS1211BBG;"C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe"
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys
S3 cyg_ser;CP2101 USB to UART Bridge Controller Drivers;C:\WINDOWS\system32\DRIVERS\cyg_ser.sys
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt
S3 FreshIO;FreshIO;\??\C:\Program Files\bezpieczenstwo\FreshDiagnose\FreshIO.sys
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\NSNDIS5.SYS
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.0 Final Release\RivaTuner32.sys
S3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-17 23:00:39
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-17 23:01:20
.
2007-12-15 13:39:21   --- E O F --- 


[wojtas]

juz czysto jest

[t0d]

czyli sprzęt dzięki za pomoc