proszę o sprawdzenie loga

[Fagi]

Logfile of HijackThis v1.99.1
Scan saved at 18:14:07, on 2008-02-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\user\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,c:\program files\g data internetsecurity\avkkid\avkcks.exe
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AvkWebIE.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\Video Add-on\isfmdl.dll (file missing)
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-ABCD-7DD20B8622FF} - C:\Program Files\Helper\1201809946.dll (file missing)
O3 - Toolbar: IE Custom Tools - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - C:\Program Files\Video Add-on\ictmdl.dll (file missing)
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AvkWebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - Global Startup: G DATA Firewall Tray.lnk = C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS1\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS2\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: Strażnik AVK (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

logi musza byc w tagach quote lub code oraz musi byc podana przyczyna wklejania logów . masz jakis problem z kompem?

[Fagi]

Logfile of HijackThis v1.99.1
Scan saved at 18:14:07, on 2008-02-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\user\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,c:\program files\g data internetsecurity\avkkid\avkcks.exe
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AvkWebIE.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\Video Add-on\isfmdl.dll (file missing)
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-ABCD-7DD20B8622FF} - C:\Program Files\Helper\1201809946.dll (file missing)
O3 - Toolbar: IE Custom Tools - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - C:\Program Files\Video Add-on\ictmdl.dll (file missing)
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AvkWebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - Global Startup: G DATA Firewall Tray.lnk = C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS1\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS2\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: Strażnik AVK (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[ Dodano: Dzisiaj o 19:46 ]
Niestety na kompie pojawił się spyware, więc aktywowane są wszelkie z nim związane problemy Także na pasku zadań pojawiła się dziwna ikonka z antyspyware...

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Fagi]

ComboFix 08-02.05.1 - user 2008-02-05 21:14:53.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.634 [GMT 1:00]
Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))))))))
.

2008-02-05 21:05 . 2008-02-05 21:05 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-05 21:02 . 2008-02-05 21:11 <DIR> d-------- C:\SDFix
2008-02-05 21:00 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-05 21:00 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-05 21:00 . 2008-02-04 12:47 83,456 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-05 21:00 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-05 21:00 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 21:00 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-05 21:00 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-05 20:06 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-05 19:47 . 2008-02-05 19:47 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Media Player Classic
2008-02-05 19:45 . 2008-02-05 19:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-02-05 17:57 . 2008-02-05 17:57 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-03 15:18 . 2008-02-03 15:18 47,312 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Program Files\G DATA InternetSecurity
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Program Files\Common Files\G DATA
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\G DATA
2008-02-02 19:59 . 2008-02-04 10:16 <DIR> d-------- C:\Program Files\SkanerOnline
2008-01-31 23:04 . 2008-02-03 17:31 <DIR> d-------- C:\Program Files\MalwareCore 7.3
2008-01-31 21:35 . 2008-01-31 21:35 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\OczyszczaczKomputerza
2008-01-31 21:28 . 2008-02-03 17:25 <DIR> d-------- C:\Program Files\Common Files\OczyszczaczKomputerza
2008-01-31 21:28 . 2008-01-31 21:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OczyszczaczKomputerza
2008-01-31 21:06 . 2008-01-31 23:12 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-30 13:58 . 2008-01-30 13:58 <DIR> d-------- C:\Program Files\MarBit
2008-01-27 16:24 . 2008-02-05 17:54 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-01-27 16:24 . 2008-01-27 16:24 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-27 16:19 . 2008-02-05 21:12 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Program Files\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-26 11:59 . 2008-01-31 14:50 <DIR> d-------- C:\Program Files\eMule
2008-01-26 11:56 . 2008-01-26 11:56 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-01-26 11:48 . 2008-01-26 11:49 <DIR> d-------- C:\Program Files\Winamp
2008-01-26 11:48 . 2008-01-26 13:32 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-01-25 22:25 . 2008-01-25 22:25 <DIR> d-------- C:\WINDOWS\Sun
2008-01-25 22:24 . 2008-02-05 20:06 <DIR> d-------- C:\Program Files\Java
2008-01-25 22:23 . 2008-01-25 22:23 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-23 15:33 . 2008-01-23 15:33 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu
2008-01-23 14:03 . 2008-02-02 12:31 <DIR> d-------- C:\Documents and Settings\user\Gadu-Gadu
2008-01-23 14:02 . 2008-01-23 14:03 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-01-23 10:08 . 2008-01-23 10:08 <DIR> d--hs---- C:\Documents and Settings\user\UserData
2008-01-21 11:43 . 2008-02-03 14:26 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d--h----- C:\Documents and Settings\Gość\Ustawienia lokalne
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d--h----- C:\Documents and Settings\Gość\Ustawienia lokalne
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Ulubione
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Ulubione
2008-01-14 12:25 . 2007-12-07 00:04 <DIR> d--h----- C:\Documents and Settings\Gość\Szablony
2008-01-14 12:25 . 2007-12-07 00:04 <DIR> d--h----- C:\Documents and Settings\Gość\Szablony
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d-------- C:\Documents and Settings\Gość\Pulpit
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d-------- C:\Documents and Settings\Gość\Pulpit
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Moje dokumenty
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Moje dokumenty
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> dr------- C:\Documents and Settings\Gość\Menu Start
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> dr------- C:\Documents and Settings\Gość\Menu Start
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> d-------- C:\Documents and Settings\Gość\Dane aplikacji\PC Suite
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr-h----- C:\Documents and Settings\Gość\Dane aplikacji
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr-h----- C:\Documents and Settings\Gość\Dane aplikacji

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 19:24 13,312 --s-a-w C:\WINDOWS\system32\ofcpi.dll
2008-01-26 12:42 --------- d-----w C:\Program Files\MatematykaDlaDzieci
2008-01-24 20:05 --------- d-----w C:\Program Files\GameTop.com
2008-01-21 10:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2008-01-18 20:19 607,744 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-01-16 15:36 --------- d-----w C:\Program Files\Tajemnicza Wyspa
2008-01-14 11:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-01-11 15:54 --------- d-----w C:\Program Files\Kangurek KAO
2008-01-03 18:14 --------- d-----w C:\Program Files\Acclaim Entertainment
2008-01-02 20:39 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\URSE Games
2008-01-02 19:46 --------- d-----w C:\Program Files\Play
2008-01-02 19:45 --------- d-----w C:\Program Files\SPIDI
2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-12-24 08:33 --------- d-----w C:\Program Files\Fox
2007-12-17 09:40 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Nokia
2007-12-17 09:24 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Datalayer
2007-12-17 09:05 --------- d-----w C:\Program Files\DIFX
2007-12-17 09:05 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\PC Suite
2007-12-17 09:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2007-12-14 16:55 --------- d-----w C:\Program Files\CyberLink
2007-12-13 18:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-12 17:13 --------- d-----w C:\Program Files\Midas
2007-12-12 17:04 --------- d-----w C:\Program Files\directx
2007-12-09 18:41 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2007-12-06 23:19 --------- d-----w C:\Program Files\Realtek
2007-12-06 23:19 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\InstallShield
2007-12-06 23:16 --------- d-----w C:\Program Files\Intel
2007-12-06 23:08 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-06 23:07 --------- d-----w C:\Program Files\Usługi online
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
C:\Program Files\Video Add-on\isfmdl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8113B5DE-F7EB-4154-A311-497FB80D8BD0}
{0124123D-61B4-456F-AF86-78C53A0790C5}

[HKEY_CLASSES_ROOT\clsid\{8113b5de-f7eb-4154-a311-497fb80d8bd0}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"= C:\Program Files\Video Add-on\ictmdl.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{8113b5de-f7eb-4154-a311-497fb80d8bd0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:23 21686568]
"AntiSpywareShield"="C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"PowerDVD"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" [2000-10-26 16:57 307200]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 23:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"= C:\WINDOWS\system32\ofcpi.dll [2008-01-31 20:24 13312]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\startuj.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 21:15:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\system32\ofcpi.dll
.
Completion time: 2008-02-05 21:16:01
.
2008-01-28 20:09:34 --- E O F ---

SDFix: Version 1.136

Run by user on 2008-02-05 at 21:06

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\Program Files\Video Add-on\ot.ico - Deleted
C:\Program Files\Video Add-on\Thumbs.db - Deleted
C:\Program Files\Video Add-on\ts.ico - Deleted



Folder C:\Program Files\Helper - Removed
Folder C:\Program Files\Sotfone - Removed
Folder C:\Program Files\Video Add-on - Removed


Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 21:09:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,72,00,00,00,01,00,00,00,01,00,00,00,66,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*:Enabled:Kreator transferu plik˘w i ustawieä"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 2 Mar 2006 25,088 A..H. --- "C:\WINDOWS\system32\userinit.exe"

Finished!

Logfile of HijackThis v1.99.1
Scan saved at 21:16:24, on 2008-02-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
E:\programiki\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\Video Add-on\isfmdl.dll (file missing)
O3 - Toolbar: IE Custom Tools - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - C:\Program Files\Video Add-on\ictmdl.dll (file missing)
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS1\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS2\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

zainstaluj jakiegos antywirusa

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\ofcpi.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)


skasuj te wpisy w hijacku:

O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\Video Add-on\isfmdl.dll (file missing)
O3 - Toolbar: IE Custom Tools - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - C:\Program Files\Video Add-on\ictmdl.dll (file missing)
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.freeietool.com/redirect.php (file missing)

Potem nowy log z hijacka oraz combofixa

[Fagi]

ComboFix 08-02.05.1 - user 2008-02-05 21:41:57.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.660 [GMT 1:00]
Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))))))))
.

2008-02-05 21:14 . 2006-03-02 13:00 395,776 --a------ C:\kmd.exe
2008-02-05 21:05 . 2008-02-05 21:05 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-05 21:02 . 2008-02-05 21:11 <DIR> d-------- C:\SDFix
2008-02-05 21:00 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-05 21:00 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-05 21:00 . 2008-02-04 12:47 83,456 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-05 21:00 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-05 21:00 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 21:00 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-05 21:00 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-05 20:06 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-05 19:47 . 2008-02-05 19:47 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Media Player Classic
2008-02-05 19:45 . 2008-02-05 19:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-02-05 17:57 . 2008-02-05 17:57 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-03 15:18 . 2008-02-03 15:18 47,312 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Program Files\G DATA InternetSecurity
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Program Files\Common Files\G DATA
2008-02-03 14:29 . 2008-02-05 20:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\G DATA
2008-02-02 19:59 . 2008-02-04 10:16 <DIR> d-------- C:\Program Files\SkanerOnline
2008-01-31 23:04 . 2008-02-03 17:31 <DIR> d-------- C:\Program Files\MalwareCore 7.3
2008-01-31 21:35 . 2008-01-31 21:35 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\OczyszczaczKomputerza
2008-01-31 21:28 . 2008-02-03 17:25 <DIR> d-------- C:\Program Files\Common Files\OczyszczaczKomputerza
2008-01-31 21:28 . 2008-01-31 21:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OczyszczaczKomputerza
2008-01-31 21:06 . 2008-01-31 23:12 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-30 13:58 . 2008-01-30 13:58 <DIR> d-------- C:\Program Files\MarBit
2008-01-27 16:24 . 2008-02-05 17:54 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-01-27 16:24 . 2008-01-27 16:24 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-27 16:19 . 2008-02-05 21:37 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Program Files\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-27 16:16 . 2008-01-27 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-26 11:59 . 2008-01-31 14:50 <DIR> d-------- C:\Program Files\eMule
2008-01-26 11:56 . 2008-01-26 11:56 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-01-26 11:48 . 2008-01-26 11:49 <DIR> d-------- C:\Program Files\Winamp
2008-01-26 11:48 . 2008-01-26 13:32 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-01-25 22:25 . 2008-01-25 22:25 <DIR> d-------- C:\WINDOWS\Sun
2008-01-25 22:24 . 2008-02-05 20:06 <DIR> d-------- C:\Program Files\Java
2008-01-25 22:23 . 2008-01-25 22:23 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-23 15:33 . 2008-01-23 15:33 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu
2008-01-23 14:03 . 2008-02-05 21:27 <DIR> d-------- C:\Documents and Settings\user\Gadu-Gadu
2008-01-23 14:02 . 2008-01-23 14:03 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-01-23 10:08 . 2008-01-23 10:08 <DIR> d--hs---- C:\Documents and Settings\user\UserData
2008-01-21 11:43 . 2008-02-03 14:26 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-14 12:25 . 2008-02-05 21:16 <DIR> d--h----- C:\Documents and Settings\Gość\Ustawienia lokalne
2008-01-14 12:25 . 2008-02-05 21:16 <DIR> d--h----- C:\Documents and Settings\Gość\Ustawienia lokalne
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Ulubione
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Ulubione
2008-01-14 12:25 . 2007-12-07 00:04 <DIR> d--h----- C:\Documents and Settings\Gość\Szablony
2008-01-14 12:25 . 2007-12-07 00:04 <DIR> d--h----- C:\Documents and Settings\Gość\Szablony
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d-------- C:\Documents and Settings\Gość\Pulpit
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> d-------- C:\Documents and Settings\Gość\Pulpit
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Moje dokumenty
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr------- C:\Documents and Settings\Gość\Moje dokumenty
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> dr------- C:\Documents and Settings\Gość\Menu Start
2008-01-14 12:25 . 2007-12-07 00:59 <DIR> dr------- C:\Documents and Settings\Gość\Menu Start
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> d-------- C:\Documents and Settings\Gość\Dane aplikacji\PC Suite
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr-h----- C:\Documents and Settings\Gość\Dane aplikacji
2008-01-14 12:25 . 2008-01-14 12:25 <DIR> dr-h----- C:\Documents and Settings\Gość\Dane aplikacji

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 12:42 --------- d-----w C:\Program Files\MatematykaDlaDzieci
2008-01-24 20:05 --------- d-----w C:\Program Files\GameTop.com
2008-01-21 10:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2008-01-18 20:19 607,744 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-01-16 15:36 --------- d-----w C:\Program Files\Tajemnicza Wyspa
2008-01-14 11:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-01-11 15:54 --------- d-----w C:\Program Files\Kangurek KAO
2008-01-03 18:14 --------- d-----w C:\Program Files\Acclaim Entertainment
2008-01-02 20:39 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\URSE Games
2008-01-02 19:46 --------- d-----w C:\Program Files\Play
2008-01-02 19:45 --------- d-----w C:\Program Files\SPIDI
2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-12-24 08:33 --------- d-----w C:\Program Files\Fox
2007-12-17 09:40 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Nokia
2007-12-17 09:24 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Datalayer
2007-12-17 09:05 --------- d-----w C:\Program Files\DIFX
2007-12-17 09:05 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\PC Suite
2007-12-17 09:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2007-12-14 16:55 --------- d-----w C:\Program Files\CyberLink
2007-12-13 18:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-12 17:13 --------- d-----w C:\Program Files\Midas
2007-12-12 17:04 --------- d-----w C:\Program Files\directx
2007-12-09 18:41 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2007-12-06 23:19 --------- d-----w C:\Program Files\Realtek
2007-12-06 23:19 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\InstallShield
2007-12-06 23:16 --------- d-----w C:\Program Files\Intel
2007-12-06 23:08 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-06 23:07 --------- d-----w C:\Program Files\Usługi online
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"= C:\Program Files\Video Add-on\ictmdl.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{8113b5de-f7eb-4154-a311-497fb80d8bd0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:23 21686568]
"AntiSpywareShield"="C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"PowerDVD"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" [2000-10-26 16:57 307200]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 23:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"= C:\WINDOWS\system32\ofcpi.dll [ ]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\startuj.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 21:42:53
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-05 21:43:20
ComboFix2.txt 2008-02-05 20:16:02
.
2008-01-28 20:09:34 --- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 21:44:50, on 2008-02-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
E:\programiki\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS1\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O17 - HKLM\System\CS2\Services\Tcpip\..\{1102A313-952C-493F-A907-718F5C32FD43}: NameServer = 193.151.52.34,193.151.52.38
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Powiedz że clear!!

[wojtas]

znasz to :

C:\kmd.exe

jesli nie skasuj

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"=-

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....