trojany, brak możliwości uruchamiania programow inne

[heymen]

Wiec tak, pojawily sie na komputerze trojany, wirusy itp ktore unieruchamiaja system, brak dostepu do menedzera zadan, brak paska zadan wraz z menu strat, brak mozliwosci polaczenia sie z internetem, reczne usuwanie plikow ( m.in findfast, autorun ) nic nie daje, takze proba czyszczenia rejestru, prosba o pomoc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:23:24, on 2008-05-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Documents and Settings\Monika\ie_updates3r.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\shell.exe
F:\Anty\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer.exe
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O4 - HKUS\S-1-5-21-725345543-343818398-839522115-1003\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-725345543-343818398-839522115-1003 Startup: findfast.exe (User '?')
O4 - Startup: findfast.exe
O4 - Global Startup: autorun.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205868208156
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {961480A1-6231-445F-AF8F-5F52B081391A} (Image Uploader) - http://sub.cyfrafotki.pl/e-photoshop/cyfrafotki_pl/uploader/PoewarePhotoSender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9E065E4A-BD9D-4547-8F90-985DC62A5591} (PlayerPT Control) - http://157.158.16.81/PlayerPT.cab
O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2 Control) - http://157.158.16.80/NetCamPlayerWeb11gv2.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp07.photoprintit.de/microsite/11471/defaults/activex/IPSUploader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt32.dll
O21 - SSODL: eEaxdlmq - {4C3ACB64-E690-61CE-AE69-A0086FB36884} - C:\WINDOWS\system32\gcbsz.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\Monika\ie_updates3r.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)
O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

--
End of file - 5961 bytes

ComboFix 08-05-11.1 - Monika 2008-05-12 19:24:57.1 - NTFSx86
Running from: F:\Anty\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\autorun.exe
C:\Documents and Settings\LocalService\Dane aplikacji\ultra
C:\Documents and Settings\LocalService\Dane aplikacji\ultra\ultra.inf
C:\Documents and Settings\LocalService\Dane aplikacji\ultra\uninstall.bat
C:\Documents and Settings\LocalService\ftpdll.dll
C:\Documents and Settings\Monika\Dane aplikacji\install.dat
C:\Documents and Settings\Monika\ftpdll.dll
C:\Documents and Settings\Monika\Menu Start\Programy\Autostart\findfast.exe
C:\Program Files\SystemDefender
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\dllgh8jkd1q1.exe
C:\WINDOWS\system32\dllgh8jkd1q2.exe
C:\WINDOWS\system32\dllgh8jkd1q5.exe
C:\WINDOWS\system32\dllgh8jkd1q8.exe
C:\WINDOWS\system32\drivers\CVLR79.sys
C:\WINDOWS\system32\drivers\Gnu41.sys
C:\WINDOWS\system32\drivers\grande48.sys
C:\WINDOWS\system32\drivers\Mtb75.sys
C:\WINDOWS\system32\ftpdll.dll
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\svchost.t__
C:\WINDOWS\system32\WinData.cab
C:\WINDOWS\system32\WinNt32.dll
C:\WINDOWS\xpupdate.exe
C:\WINDOWS\system32\WinData.cab . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CVLR79
-------\Legacy_ICF
-------\Service_Cvlr79
-------\Service_CVLR79
-------\Service_Gnu41
-------\Service_ICF
-------\Service_Mtb75
-------\Service_tcpsr


((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-12 19:27 . 2008-05-12 19:27 0 --a------ C:\WINDOWS\system32\WinData.cab
2008-05-11 16:53 . 2008-05-11 16:53 29 --a------ C:\WINDOWS\system32\idpqfura.tmp
2008-05-11 16:06 . 2008-05-11 16:06 14,976 --a------ C:\WINDOWS\system32\drivers\Aho20.sys
2008-05-11 16:02 . 2008-05-11 16:06 2 --a------ C:\1278921571
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-05-11 16:01 . 2008-05-11 16:01 39,424 --a------ C:\WINDOWS\system32\gdcl602.exe
2008-05-11 16:01 . 2008-05-11 16:52 1 --a------ C:\WINDOWS\system32\lsfxjd.tmp
2008-05-11 16:00 . 2008-05-11 16:00 3,117 --a------ C:\Documents and Settings\Monika\ie_updates3r.exe
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44 159744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eEaxdlmq"= {4C3ACB64-E690-61CE-AE69-A0086FB36884} - C:\WINDOWS\system32\gcbsz.dll [2004-08-04 00:44 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3baa09ae-82dc-11dc-bf09-001b2404d18a}]
\Shell\Auto\command - H:\Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d8e08d3-b790-11dc-801c-001b2404d18a}]
\Shell\Auto\command - F:\Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d38599aa-e454-11dc-80f7-001b2404d18a}]
\Shell\AutoRun\command - F:\rthrw.com
\Shell\explore\Command - F:\rthrw.com
\Shell\open\Command - F:\rthrw.com

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 19:28:40
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\C:\WINDOWS\TEMP\8.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Documents and Settings\Monika\ie_updates3r.exe
C:\WINDOWS\system32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2008-05-12 19:30:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-12 17:30:53

Pre-Run: 875,626,496 bajtów wolnych
Post-Run: 2,382,659,584 bajt˘w wolnych

210

[Okocza]

fix w hijacku

O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt32.dll
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)
O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

przeskanuj na www.virustotal.com

Kod: Zaznacz wszystko

C:\WINDOWS\system32\gcbsz.dll
C:\WINDOWS\system32\lsfxjd.tmp
C:\WINDOWS\system32\gdcl602.exe

potem:

otwierasz notatnik i wklejasz w nim to:

Kod: Zaznacz wszystko

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3baa09ae-82dc-11dc-bf09-001b2404d18a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d8e08d3-b790-11dc-801c-001b2404d18a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d38599aa-e454-11dc-80f7-001b2404d18a}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[heymen]

wiec tak w hijacku nie bylo wpisow, wiec nie moglem ich usunac :

O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)

w www.virustotal.com nie moglem sprawdzic poniewaz nie chce sie polaczyc z internetem

3 rzecz stworzylem plik ze skryptem, jednak nie bylo mozliwosci przecigniecia, wiec "otworz za pomoca" ComboFix wiec to chyba to samo
i wygenerowalo nast log

ComboFix 08-05-11.1 - Monika 2008-05-12 20:08:50.2 - NTFSx86 MINIMAL
Running from: F:\Anty\ComboFix.exe
Command switches used :: F:\Anty\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\WinData.cab
C:\WINDOWS\system32\WinData.cab . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-12 20:11 . 2008-05-12 20:11 0 --a------ C:\WINDOWS\system32\WinData.cab
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-11 16:53 . 2008-05-11 16:53 29 --a------ C:\WINDOWS\system32\idpqfura.tmp
2008-05-11 16:06 . 2008-05-11 16:06 14,976 --a------ C:\WINDOWS\system32\drivers\Aho20.sys
2008-05-11 16:02 . 2008-05-11 16:06 2 --a------ C:\1278921571
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-05-11 16:01 . 2008-05-11 16:01 39,424 --a------ C:\WINDOWS\system32\gdcl602.exe
2008-05-11 16:01 . 2008-05-11 16:52 1 --a------ C:\WINDOWS\system32\lsfxjd.tmp
2008-05-11 16:00 . 2008-05-11 16:00 3,117 --a------ C:\Documents and Settings\Monika\ie_updates3r.exe
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-12_19.30.46.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-12 17:27:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 18:11:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44 159744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eEaxdlmq"= {4C3ACB64-E690-61CE-AE69-A0086FB36884} - C:\WINDOWS\system32\gcbsz.dll [2004-08-04 00:44 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 20:12:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\C:\WINDOWS\TEMP\8.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Documents and Settings\Monika\ie_updates3r.exe
C:\WINDOWS\system32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2008-05-12 20:14:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-12 18:14:45
ComboFix2.txt 2008-05-12 17:30:56

Pre-Run: 2,386,157,568 bajtów wolnych
Post-Run: 2,376,933,376 bajt˘w wolnych

172

[Okocza]

wiec tak w hijacku nie bylo wpisow, wiec nie moglem ich usunac :

Cytat:
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)

tworzysz jeszcze raz loga z hijacka i poszukaj ich tam - muszą być.


w takim razie przeskanuj tu: http://virscan.org/

[heymen]

wiec tak, zeskanowalem jeszcze raz no i ich nie ma

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:30:26, on 2008-05-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Documents and Settings\Monika\ie_updates3r.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
F:\Anty\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205868208156
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {961480A1-6231-445F-AF8F-5F52B081391A} (Image Uploader) - http://sub.cyfrafotki.pl/e-photoshop/cyfrafotki_pl/uploader/PoewarePhotoSender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9E065E4A-BD9D-4547-8F90-985DC62A5591} (PlayerPT Control) - http://157.158.16.81/PlayerPT.cab
O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2 Control) - http://157.158.16.80/NetCamPlayerWeb11gv2.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp07.photoprintit.de/microsite/11471/defaults/activex/IPSUploader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: eEaxdlmq - {4C3ACB64-E690-61CE-AE69-A0086FB36884} - C:\WINDOWS\system32\gcbsz.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\Monika\ie_updates3r.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)

--
End of file - 5025 bytes

tzn nie chodizlo mi ze strona nie dzila tylko ogolnie internet, poniewaz to jest laptop na wifi, nie pokazuje zadnych polaczen sieciowych.
nie da sie plikow kopiowac, chcialem sprobowac skopiowac te pliki na pendrive i na stacjonarnym sprawdzic ale nei da sie

[Okocza]

O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)

to jeszcze wyczyść


Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]combofixa[/url

[heymen]

a wiec tak
to za kazdym razem sie pojawia mimo ze fixuje to pochwili znow jest

O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)

SDFix: Version 1.182
Run by Monika on 2008-05-12 at 21:02

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
Google Online Services
yzbgqap
{DEF85C80-216A-43ab-AF70-1665EDBE2780}
AHO20

Path :
C:\Documents and Settings\Monika\ie_updates3r.exe -A
\??\C:\WINDOWS\system32\yzbgqap.sys
\??\C:\WINDOWS\TEMP\8.tmp
System32\Drivers\Aho20.sys

Google Online Services - Deleted
yzbgqap - Deleted
{DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted
AHO20 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Service AHO20 - Deleted

Checking Files :

Trojan Files Found:

C:\127892~1 - Deleted
C:\Documents and Settings\Monika\ie_updates3r.exe - Deleted
C:\WINDOWS\system32\WinData.cab - Deleted
C:\WINDOWS\system32\drivers\AHO20.sys - Deleted

Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use Gmer or Dr.Web CureIt

Could Not Remove C:\WINDOWS\Temp\bca4e2da.$$$
Could Not Remove C:\WINDOWS\Temp\fa56d7ec.$$$



Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 21:09:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :

AHO20



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\WINDOWS\\shell.exe"="C:\\WINDOWS\\shell.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\printer.exe"="C:\\WINDOWS\\system32\\printer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\spoolvs.exe"="C:\\WINDOWS\\system32\\spoolvs.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Monika\\Menu Start\\Programy\\Autostart\\findfast.exe"="C:\\Documents and Settings\\Monika\\Menu Start\\Programy\\Autostart\\findfast.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\autorun.exe"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\autorun.exe:*:Enabled:@xpsp2res.dll,-22019"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

Remaining Files :

C:\WINDOWS\Temp\bca4e2da.$$$ Found
C:\WINDOWS\Temp\fa56d7ec.$$$ Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 16 Jan 2008 19,456 ...H. --- "C:\Documents and Settings\Monika\Dane aplikacji\Microsoft\Word\~WRL3654.tmp"

Finished!

ComboFix 08-05-11.1 - Monika 2008-05-12 21:12:32.3 - NTFSx86
Running from: F:\Anty\new\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 20:53 . 2008-05-12 21:10 <DIR> d-------- C:\SDFix
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-11 16:53 . 2008-05-11 16:53 29 --a------ C:\WINDOWS\system32\idpqfura.tmp
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-05-11 16:01 . 2008-05-11 16:01 39,424 --a------ C:\WINDOWS\system32\gdcl602.exe
2008-05-11 16:01 . 2008-05-11 16:52 1 --a------ C:\WINDOWS\system32\lsfxjd.tmp
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 f1ec0952a942c776399c4a548b658822 C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-12_19.30.46.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-12 17:27:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 19:07:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-05-12 18:59:12 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:59:13 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-05-12 18:58:56 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:58:56 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eEaxdlmq"= {4C3ACB64-E690-61CE-AE69-A0086FB36884} - C:\WINDOWS\system32\gcbsz.dll [2004-08-04 00:44 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 21:13:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-12 21:13:50
ComboFix-quarantined-files.txt 2008-05-12 19:13:45
ComboFix2.txt 2008-05-12 18:14:48
ComboFix3.txt 2008-05-12 17:30:56

Pre-Run: 2,323,795,968 bajtów wolnych
Post-Run: 2,315,051,008 bajtów wolnych

161

[wojtas]

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exei dajesz go na forum
3. dajesz loga z combofixa

[heymen]

1. wiec dr web usunal pare rzeczy, nie mam loga skad bo restart byl razem z nim
2. mbr

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
malicious code @ sector 0x950e4c1 size 0x1ca !
copy of MBR has been found in sector 62 !

3. combofix

ComboFix 08-05-11.1 - Monika 2008-05-12 22:06:38.5 - NTFSx86
Running from: F:\Anty\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-12 22:01 . 2008-05-12 21:52 10,367,552 --a------ C:\cureit.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-11 16:53 . 2008-05-11 16:53 29 --a------ C:\WINDOWS\system32\idpqfura.tmp
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-05-11 16:01 . 2008-05-11 16:01 39,424 --a------ C:\WINDOWS\system32\gdcl602.exe
2008-05-11 16:01 . 2008-05-11 16:52 1 --a------ C:\WINDOWS\system32\lsfxjd.tmp
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-12_19.30.46.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-12 17:27:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 19:54:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-05-12 18:59:12 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:59:13 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-05-12 18:58:56 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:58:56 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-05-12 16:22:38 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-12 19:33:58 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-05-12 16:22:38 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-05-12 19:33:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-05-12 16:22:38 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-12 19:33:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

*Newly Created Service* - MBR
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 22:07:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-12 22:08:00
ComboFix-quarantined-files.txt 2008-05-12 20:07:54
ComboFix2.txt 2008-05-12 19:13:51
ComboFix3.txt 2008-05-12 18:14:48
ComboFix4.txt 2008-05-12 17:30:56

Pre-Run: 2,301,218,816 bajtów wolnych
Post-Run: 2,305,253,376 bajtów wolnych

169

[wojtas]

Przenieś program mbr.exe bezpośrednio na C:\
nastepnie przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER

potem wklej do notatnika:

File::
C:\WINDOWS\system32\idpqfura.tmp
C:\WINDOWS\system32\gdcl602.exe
C:\WINDOWS\system32\lsfxjd.tmp

Folder::
C:\WINDOWS\Temp

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[heymen]

niestety dzialanie programem mbr nie powiodlo sie, byc moze dlatego ze nie da sie wylaczyc opcji przywracania systemu


nowy log

ComboFix 08-05-11.1 - Monika 2008-05-12 22:41:46.6 - NTFSx86
Running from: F:\Anty\ComboFix.exe
Command switches used :: F:\Anty\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\gdcl602.exe
C:\WINDOWS\system32\idpqfura.tmp
C:\WINDOWS\system32\lsfxjd.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\gdcl602.exe
C:\WINDOWS\system32\idpqfura.tmp
C:\WINDOWS\system32\lsfxjd.tmp
C:\WINDOWS\Temp

.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-12 22:01 . 2008-05-12 21:52 10,367,552 --a------ C:\cureit.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-12_19.30.46.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-12 17:27:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 20:38:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-05-12 18:59:12 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:59:13 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-12 03:06:38 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-05-12 18:58:56 5,496,832 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-05-12 18:58:56 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-05-12 16:22:38 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-12 19:33:58 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-05-12 16:22:38 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-05-12 19:33:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-05-12 16:22:38 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-12 19:33:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 22:42:46
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


folder error: C:\WINDOWS\TEMP\

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-12 22:44:20
ComboFix-quarantined-files.txt 2008-05-12 20:44:17
ComboFix2.txt 2008-05-12 20:08:00
ComboFix3.txt 2008-05-12 19:13:51
ComboFix4.txt 2008-05-12 18:14:48
ComboFix5.txt 2008-05-12 17:30:56

Pre-Run: 2,307,334,144 bajtów wolnych
Post-Run: 2,298,703,872 bajtów wolnych

180

[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahn41.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Aho20.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fms06.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt31.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gnt53.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Krx41.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lsa07.sys]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\autoload]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[heymen]

niestety dalej

mbr dalej to samo

[ Dodano: Dzisiaj o 9:16 ]
przy probie wylaczenia przywracania systemu, pojawia sie blad:

"przywracanie systemu napotkalo blad podczas proby wlaczenia/wylaczenia jednego lub wiecej dyskow. uruchom ponownie komputer i sprobuj ponownie"

[wojtas]

Zastosuj jeszcze raz SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]combofixa[/url

[heymen]

dodatkowo po kazdorazowym uruchomieniu combofixa zawiesza sie komputer z widoczna jedynie tapeta pulpitu i nic poza tym

SDFix: Version 1.182
Run by Monika on 2008-05-13 at 15:54

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 16:05:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\WINDOWS\\shell.exe"="C:\\WINDOWS\\shell.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\printer.exe"="C:\\WINDOWS\\system32\\printer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\spoolvs.exe"="C:\\WINDOWS\\system32\\spoolvs.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Monika\\Menu Start\\Programy\\Autostart\\findfast.exe"="C:\\Documents and Settings\\Monika\\Menu Start\\Programy\\Autostart\\findfast.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\autorun.exe"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\autorun.exe:*:Enabled:@xpsp2res.dll,-22019"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 16 Jan 2008 19,456 ...H. --- "C:\Documents and Settings\Monika\Dane aplikacji\Microsoft\Word\~WRL3654.tmp"

Finished!

ComboFix 08-05-12.1 - Monika 2008-05-13 16:07:48.8 - NTFSx86
Running from: C:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 )))))))))))))))))))))))))))))))
.

2008-05-13 13:06 . 2008-05-13 12:50 1,914,914 --a------ C:\ComboFix.exe
2008-05-13 12:53 . 2008-05-13 16:06 <DIR> d-------- C:\SDFix
2008-05-13 12:25 . 2008-05-13 12:25 <DIR> d-------- C:\Deckard
2008-05-13 11:13 . 2008-05-12 19:19 401,720 --a------ C:\HiJackThis.exe
2008-05-12 22:01 . 2008-05-12 21:52 10,367,552 --a------ C:\cureit.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-13 16:08 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-12 19:53 . 2007-10-24 14:26 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-12 19:53 . 2008-05-13 15:48 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-13_13.08.05,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-13 11:02:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-13 14:03:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-13 10:54:05 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-13 13:51:04 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2008-05-13 10:54:05 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-13 13:51:04 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\Documents and Settings\Monika\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 16:08:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-13 16:09:09
ComboFix-quarantined-files.txt 2008-05-13 14:09:03
ComboFix2.txt 2008-05-13 11:08:15

Pre-Run: 2,270,093,312 bajtów wolnych
Post-Run: 2,261,393,408 bajtów wolnych

147

[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\WINDOWS\\shell.exe"=-
"C:\\WINDOWS\\system32\\spoolvs.exe"=-
"C:\\WINDOWS\\system32\\printer.exe"=-
"C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\autorun.exe"=-
"C:\\Documents and Settings\\Monika\\Menu Start\\Programy\\Autostart\\findfast.exe"=-
"%windir%\\system32\\winav.exe"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[heymen]

system dalej dlugo sie laduje, no i objawy podobne jak na poczatku z zastrzeniem, ze mam dostep do menedzera zadan, no i jak pisalem wczesniej nie moge wylaczyc przywracania systemu

[Okocza]

jeszcze raz combofix bym prosił

[heymen]

oczywsice system sie zawiesil po operacji ale log ponizej

ComboFix 08-05-12.1 - Monika 2008-05-13 17:27:26.9 - NTFSx86
Running from: C:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 )))))))))))))))))))))))))))))))
.

2008-05-13 13:06 . 2008-05-13 12:50 1,914,914 --a------ C:\ComboFix.exe
2008-05-13 12:53 . 2008-05-13 16:06 <DIR> d-------- C:\SDFix
2008-05-13 12:25 . 2008-05-13 12:25 <DIR> d-------- C:\Deckard
2008-05-13 11:13 . 2008-05-12 19:19 401,720 --a------ C:\HiJackThis.exe
2008-05-12 22:01 . 2008-05-12 21:52 10,367,552 --a------ C:\cureit.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-13 17:28 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-12 19:53 . 2007-10-24 14:26 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-12 19:53 . 2008-05-13 15:48 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-13_13.08.05,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-13 11:02:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-13 15:08:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-13 10:54:05 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-13 13:51:04 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2008-05-13 10:54:05 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-13 13:51:04 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 17:28:27
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-13 17:30:00
ComboFix-quarantined-files.txt 2008-05-13 15:29:55
ComboFix2.txt 2008-05-13 14:09:10
ComboFix3.txt 2008-05-13 11:08:15

Pre-Run: 2,269,925,376 bajtów wolnych
Post-Run: 2,261,336,064 bajtów wolnych

147

[Okocza]

C:\cureit.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum