strasznie mulący komputer

[Okocza]

Witam panowie, siedzę u dziewczyny i mówi że strasznie jej komputer muli i że zawiesza, no to ja szybko pobrałem Hijackthis'a przeskanowałem komputer i takie oto rzeczy są:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:18:32, on 2008-02-21
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Users\komputer\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\komputer\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pl.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe



wiem że są 2 antywirusy, jeśli czegoś jeszcze trzeba będzie dorzucic to mówicie, aha, jak naciskam alt + c to otwiera sie catalyst center...

[Dzi@dek]

Odinstalować jednego antywira i daj log z Combofix

[Okocza]

Kod: Zaznacz wszystko

ComboFix 08-02-21 - komputer 2008-02-21 16:01:22.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1250.1.1045.18.173 [GMT 1:00]
Running from: C:\Users\komputer\Desktop\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2008-01-21 to 2008-02-21  )))))))))))))))))))))))))))))))
.

2008-02-21 15:44 . 2008-02-21 15:44   <DIR>   d--------   C:\Program Files\Common Files\Adobe Systems Shared
2008-02-18 15:45 . 2008-02-19 17:57   <DIR>   d--------   C:\Users\komputer\AppData\Roaming\Cool Record Edit Pro
2008-02-18 15:37 . 2008-02-21 15:22   <DIR>   d--------   C:\Users\komputer\AppData\Roaming\foobar2000
2008-02-18 15:37 . 2008-02-18 15:37   <DIR>   d--------   C:\Program Files\foobar2000
2008-02-18 15:28 . 2008-02-18 15:28   <DIR>   d--------   C:\Program Files\Free Sound Recorder
2008-02-18 15:10 . 2008-02-18 15:10   <DIR>   d--------   C:\Program Files\Burn4Free Toolbar
2008-02-18 15:10 . 2008-02-18 15:10   <DIR>   d--------   C:\Program Files\Burn4Free
2008-02-18 15:10 . 2008-02-18 15:10   232,046   --a------   C:\Windows\Burn4Free_Toolbar_Uninstaller_3849.exe
2008-02-16 15:28 . 2008-02-16 15:28   <DIR>   d--------   C:\Windows\Downloaded Installations
2008-02-16 12:10 . 2008-01-10 06:50   1,244,672   --a------   C:\Windows\System32\mcmde.dll
2008-02-14 03:15 . 2008-02-14 03:15   194,560   --a------   C:\Windows\System32\WebClnt.dll
2008-02-14 03:15 . 2008-02-14 03:15   110,080   --a------   C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 03:09 . 2008-02-14 03:09   3,504,696   --a------   C:\Windows\System32\ntkrnlpa.exe
2008-02-14 03:09 . 2008-02-14 03:09   3,470,392   --a------   C:\Windows\System32\ntoskrnl.exe
2008-02-14 03:09 . 2008-02-14 03:09   154,624   --a------   C:\Windows\System32\drivers\nwifi.sys
2008-02-14 03:09 . 2008-02-14 03:09   109,624   --a------   C:\Windows\System32\drivers\ataport.sys
2008-02-14 03:09 . 2008-02-14 03:09   45,112   --a------   C:\Windows\System32\drivers\pciidex.sys
2008-02-14 03:09 . 2008-02-14 03:09   21,560   --a------   C:\Windows\System32\drivers\atapi.sys
2008-02-14 03:09 . 2008-02-14 03:09   15,928   --a------   C:\Windows\System32\drivers\pciide.sys
2008-02-14 03:08 . 2008-02-14 03:08   4,247,552   --a------   C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 03:08 . 2008-02-14 03:08   1,686,528   --a------   C:\Windows\System32\gameux.dll
2008-02-14 03:08 . 2008-02-14 03:08   803,328   --a------   C:\Windows\System32\drivers\tcpip.sys
2008-02-14 03:08 . 2008-02-14 03:08   216,632   --a------   C:\Windows\System32\drivers\netio.sys
2008-02-14 03:08 . 2008-02-14 03:08   167,424   --a------   C:\Windows\System32\tcpipcfg.dll
2008-02-14 03:08 . 2008-02-14 03:08   24,064   --a------   C:\Windows\System32\netcfg.exe
2008-02-14 03:08 . 2008-02-14 03:08   22,016   --a------   C:\Windows\System32\netiougc.exe
2008-02-12 18:21 . 2008-02-12 18:21   <DIR>   d--------   C:\Users\komputer\AppData\Roaming\Sony
2008-02-12 18:20 . 2008-02-12 18:20   <DIR>   d--------   C:\Users\All Users\Sony
2008-02-12 18:20 . 2008-02-12 18:20   <DIR>   d--------   C:\ProgramData\Sony
2008-02-12 18:19 . 2008-02-12 18:19   <DIR>   d--------   C:\Program Files\Vstplugins
2008-02-12 18:17 . 2008-02-12 18:17   <DIR>   d--------   C:\Program Files\Sony
2008-02-12 18:15 . 2008-02-12 18:15   <DIR>   d--------   C:\Program Files\Sony Setup
2008-01-26 15:54 . 2008-01-26 15:54   <DIR>   d--------   C:\Users\komputer\AppData\Roaming\PeerNetworking

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 14:46   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-02-20 21:23   ---------   d-----w   C:\Users\komputer\AppData\Roaming\Skype
2008-02-20 16:15   ---------   d-----w   C:\Users\komputer\AppData\Roaming\skypePM
2008-02-19 21:44   ---------   d-----w   C:\Users\komputer\AppData\Roaming\SlimBrowser
2008-02-14 23:04   ---------   d-----w   C:\ProgramData\CyberLink
2008-02-14 02:08   537,600   ----a-w   C:\Windows\AppPatch\AcLayers.dll
2008-02-14 02:08   449,536   ----a-w   C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 02:08   2,144,256   ----a-w   C:\Windows\AppPatch\AcGenral.dll
2008-02-14 02:08   173,056   ----a-w   C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 02:04   824,832   ----a-w   C:\Windows\System32\wininet.dll
2008-02-14 02:04   56,320   ----a-w   C:\Windows\System32\iesetup.dll
2008-02-14 02:04   52,736   ----a-w   C:\Windows\AppPatch\iebrshim.dll
2008-02-14 02:04   26,624   ----a-w   C:\Windows\System32\ieUnatt.exe
2008-02-10 16:11   370   ----a-w   C:\Users\komputer\AppData\Roaming\wklnhst.dat
2008-01-28 20:19   ---------   d-----w   C:\ProgramData\Yahoo! Companion
2008-01-26 16:37   ---------   d-----w   C:\ProgramData\Microsoft Help
2008-01-15 18:17   ---------   d-----w   C:\Program Files\Alwil Software
2008-01-15 15:52   ---------   d-----w   C:\Program Files\ESET
2008-01-09 18:59   ---------   d-----w   C:\Program Files\Windows Mail
2008-01-09 18:50   211,000   ----a-w   C:\Windows\system32\drivers\volsnap.sys
2008-01-09 18:50   11,776   ----a-w   C:\Windows\System32\sbunattend.exe
2008-01-09 18:50   1,060,920   ----a-w   C:\Windows\system32\drivers\ntfs.sys
2008-01-09 18:50   ---------   d-----w   C:\Program Files\Windows Sidebar
2008-01-05 16:52   ---------   d-----w   C:\ProgramData\eMule
2008-01-05 16:52   ---------   d-----w   C:\Program Files\eMule
2007-12-29 01:42   32   ----a-w   C:\Users\All Users\ezsid.dat
2007-12-29 01:42   32   ----a-w   C:\ProgramData\ezsid.dat
2007-12-29 01:40   ---------   d-----w   C:\ProgramData\Skype
2007-12-29 01:40   ---------   d-----w   C:\Program Files\Skype
2007-12-29 01:40   ---------   d-----w   C:\Program Files\Common Files\Skype
2007-12-12 03:04   1,327,104   ----a-w   C:\Windows\System32\quartz.dll
2007-12-12 03:03   9,728   ----a-w   C:\Windows\System32\LAPRXY.DLL
2007-12-12 03:03   223,232   ----a-w   C:\Windows\System32\WMASF.DLL
2007-12-03 02:08   174   --sha-w   C:\Program Files\desktop.ini
2007-12-02 15:58   8,192   ----a-w   C:\Windows\System32\riched32.dll
2007-12-02 15:57   87,040   ----a-w   C:\Windows\System32\msoert2.dll
2007-12-02 15:57   704,000   ----a-w   C:\Windows\System32\PhotoScreensaver.scr
2007-12-02 15:57   39,424   ----a-w   C:\Windows\System32\ACCTRES.dll
2007-12-02 15:57   24,064   ----a-w   C:\Windows\System32\wtsapi32.dll
2007-12-02 15:57   205,824   ----a-w   C:\Windows\System32\msoeacct.dll
2007-12-02 15:57   2,027,008   ----a-w   C:\Windows\System32\win32k.sys
2007-12-02 15:56   67,584   ----a-w   C:\Windows\System32\wlanhlp.dll
2007-12-02 15:56   542,720   ----a-w   C:\Windows\System32\sysmain.dll
2007-12-02 15:56   502,784   ----a-w   C:\Windows\System32\wlansvc.dll
2007-12-02 15:56   49,664   ----a-w   C:\Windows\System32\csrsrv.dll
2007-12-02 15:56   47,104   ----a-w   C:\Windows\System32\wlanapi.dll
2007-12-02 15:56   376,320   ----a-w   C:\Windows\System32\winsrv.dll
2007-12-02 15:56   297,984   ----a-w   C:\Windows\System32\wlansec.dll
2007-12-02 15:56   290,816   ----a-w   C:\Windows\System32\wlanmsm.dll
2007-12-02 15:56   2,923,520   ----a-w   C:\Windows\explorer.exe
2007-12-02 15:53   374,456   ----a-w   C:\Windows\System32\mcupdate_GenuineIntel.dll
2007-12-02 15:52   86,016   ----a-w   C:\Windows\System32\icfupgd.dll
2007-12-02 15:52   8,147,968   ----a-w   C:\Windows\System32\wmploc.DLL
2007-12-02 15:52   7,680   ----a-w   C:\Windows\System32\spwmp.dll
2007-12-02 15:52   61,952   ----a-w   C:\Windows\System32\cmifw.dll
2007-12-02 15:52   4,096   ----a-w   C:\Windows\System32\dxmasf.dll
2007-12-02 15:52   396,800   ----a-w   C:\Windows\System32\MPSSVC.dll
2007-12-02 15:52   392,192   ----a-w   C:\Windows\System32\FirewallAPI.dll
2007-12-02 15:52   356,864   ----a-w   C:\Windows\System32\MediaMetadataHandler.dll
2007-12-02 15:52   178,688   ----a-w   C:\Windows\System32\iphlpsvc.dll
2007-12-02 15:52   16,896   ----a-w   C:\Windows\System32\wfapigp.dll
2007-12-02 15:51   1,191,936   ----a-w   C:\Windows\System32\msxml3.dll
2007-12-02 15:48   84,480   ----a-w   C:\Windows\System32\INETRES.dll
2007-12-02 15:48   737,792   ----a-w   C:\Windows\System32\inetcomm.dll
2007-12-02 15:48   57,856   ----a-w   C:\Windows\System32\SLUINotify.dll
2007-12-02 15:48   566,784   ----a-w   C:\Windows\System32\SLCommDlg.dll
2007-12-02 15:48   39,936   ----a-w   C:\Windows\System32\slcinst.dll
2007-12-02 15:48   351,232   ----a-w   C:\Windows\System32\SLUI.exe
2007-12-02 15:48   33,280   ----a-w   C:\Windows\System32\slwmi.dll
2007-12-02 15:48   268,288   ----a-w   C:\Windows\System32\mcbuilder.exe
2007-12-02 15:48   223,232   ----a-w   C:\Windows\System32\SLC.dll
2007-12-02 15:48   2,605,568   ----a-w   C:\Windows\System32\SLsvc.exe
2007-12-02 15:48   186,368   ----a-w   C:\Windows\System32\SLLUA.exe
2007-12-02 15:48   1,335,296   ----a-w   C:\Windows\System32\msxml6.dll
2007-12-02 15:47   788,992   ----a-w   C:\Windows\System32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
2008-02-18 15:10   806912   --a------   C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}

[HKEY_CLASSES_ROOT\clsid\{4f11acbb-393f-4c86-a214-ff3d0d155cc3}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"= C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll [2008-02-18 15:10 806912]

[HKEY_CLASSES_ROOT\clsid\{4f11acbb-393f-4c86-a214-ff3d0d155cc3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 19:50 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:34 2159104 C:\Windows\System32\oobefldr.dll]
"Acer Tour Reminder"="" []
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-02 16:55 1006264]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 12:00 174872]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 10:10 4468736 C:\Windows\RtHDVCpl.exe]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-05-09 09:36 1286144]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-12 16:42 457728]
"Acer Tour"="" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 05:44 107112]
"IS CfgWiz"="C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2006-11-21 05:43 46728]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 05:42 22696]
"PLFSet"="C:\Windows\PLFSet.dll" [2007-03-09 18:51 45056]
"SetPanel"="C:\Acer\APanel\APanel.cmd" [ ]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-04-04 08:02 678672]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-03 11:16 206952]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-11-07 13:57 159744]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 17:39 151552]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-23 21:51 1410304]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 17:39 151552]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-06-02 21:46:26 535336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\Windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^komputer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk]
path=C:\Users\komputer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk
backup=C:\Windows\pss\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2007-03-09 11:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-07 15:11 21803304 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-12-03 15:58 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-12 16:43]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-12 16:43]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-12 16:43]
R1 DritekPortIO;Dritek General Port I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 14:27]
R1 epfwtdir;epfwtdir;C:\Windows\system32\DRIVERS\epfwtdir.sys [2007-11-23 21:52]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 16:51]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-12 16:43]
R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-04-17 18:36]
R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-05-10 13:05]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 18:12]
R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 11:57]
R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-05-16 21:15]
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 09:44]
R3 athrusb;Atheros Wireless LAN USB device driver;C:\Windows\system32\DRIVERS\athrusb.sys [2006-12-22 20:05]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-04 15:19]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 09:26]
R3 NETw4v32;Sterownik karty Intel(R) Wireless WiFi Link dla systemu Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-24 23:14]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC);C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-02-07 18:35]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 08:03]
S3 btwaudio;Urz1dzenie dYwiekowe Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 20:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 07:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 07:20]
S3 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 05:42]
S3 NETw3v32;Sterownik karty Intel(R) PRO/Wireless 3945BG dla 32-bitowej wersji systemu Windows Vista;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 08:30]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs   REG_MULTI_SZ      BthServ

*Newly Created Service* - COMHOST
.


jeden antywirus odinstalowany, oto log z combofix'a

[wojtas]

czysto