trojany, brak możliwości uruchamiania programow inne

[heymen]

ComboFix 08-05-12.1 - Monika 2008-05-13 17:50:09.11 - NTFSx86
Running from: F:\Anty\ComboFix.exe
Command switches used :: C:\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 )))))))))))))))))))))))))))))))
.

2008-05-13 13:06 . 2008-05-13 12:50 1,914,914 --a------ C:\ComboFix.exe
2008-05-13 12:53 . 2008-05-13 16:06 <DIR> d-------- C:\SDFix
2008-05-13 12:25 . 2008-05-13 12:25 <DIR> d-------- C:\Deckard
2008-05-13 11:13 . 2008-05-12 19:19 401,720 --a------ C:\HiJackThis.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-13 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-12 19:53 . 2007-10-24 14:26 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-12 19:53 . 2008-05-13 15:48 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:53 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2008-05-11 16:53 17408 748cb4eea045f5ca9269e8446da67449 C:\WINDOWS\system32\svchost.exe

2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll
2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll
2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\dllcache\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

2004-08-04 00:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe

2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe

2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe
2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-13_13.08.05,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-13 11:02:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-13 15:31:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-13 10:54:05 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-13 13:51:04 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2008-05-13 10:54:05 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-13 13:51:04 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 17:50:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-13 17:51:20
ComboFix-quarantined-files.txt 2008-05-13 15:51:14
ComboFix2.txt 2008-05-13 15:30:00
ComboFix3.txt 2008-05-13 14:09:10
ComboFix4.txt 2008-05-13 11:08:15

Pre-Run: 2,269,564,928 bajtów wolnych
Post-Run: 2,261,061,632 bajtów wolnych

147

[ Dodano: Dzisiaj o 18:53 ]
czyli co ?? pozostaje format ?

[wojtas]

wejdz do konsoli odzyskiwania

W linii komend wpisz polecenie:

expand X:\i386\svchost.ex_ Y:\Windows\system32\

X- litera napędu z płytką
Y- nazwa partycji gdzie masz zainstalowany system

[heymen]

ooo zadziałało wielkie dzieki
czy teraz profilaktycznie sprawdzic czyms jeszcze ?

[Okocza]

możesz przeskanować antyvirusem lub CF

[heymen]

ComboFix 08-05-12.1 - Monika 2008-05-13 20:34:06.12 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.723 [GMT 2:00]
Running from: C:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 )))))))))))))))))))))))))))))))
.

2008-05-13 22:18 . 2004-08-04 02:44 14,336 --a------ C:\WINDOWS\system32\svchost.exe
2008-05-13 20:33 . 2008-05-13 20:33 <DIR> d-------- C:\backups
2008-05-13 13:06 . 2008-05-13 12:50 1,914,914 --a------ C:\ComboFix.exe
2008-05-13 12:53 . 2008-05-13 16:06 <DIR> d-------- C:\SDFix
2008-05-13 11:13 . 2008-05-12 19:19 401,720 --a------ C:\HiJackThis.exe
2008-05-12 21:59 . 2008-05-12 21:37 66,048 --a------ C:\mbr.exe
2008-05-12 21:52 . 2008-05-12 21:52 <DIR> d-------- C:\Documents and Settings\Monika\DoctorWeb
2008-05-12 20:58 . 2008-05-12 20:58 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-12 19:53 . 2008-05-13 20:34 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-12 19:53 . 2007-10-24 14:26 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-12 19:53 . 2007-10-24 22:19 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-12 19:53 . 2008-05-12 19:53 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-12 19:53 . 2008-05-13 15:48 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-05-11 16:01 . 2008-05-11 16:01 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione
2008-04-30 07:18 . 2008-04-30 07:18 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-30 07:18 . 2008-04-30 07:18 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-24 20:54 . 2008-04-24 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:30 --------- d-----w C:\Program Files\ArcaMicroScan
2008-05-11 14:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-05-11 03:35 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\AVG7
2008-05-09 14:57 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\uTorrent
2008-05-07 05:23 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\WinShell
2008-04-30 18:25 --------- d-----w C:\Program Files\Atheros
2008-04-04 10:27 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-22 18:02 --------- d-----w C:\Program Files\Opera
2008-03-20 07:07 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\gtk-2.0
2008-03-18 19:52 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-18 19:48 --------- d-----w C:\Program Files\Ghostgum
2008-03-17 18:24 --------- d-----w C:\Program Files\Gofin
2008-03-15 20:01 --------- d-----w C:\Program Files\Network Stumbler
2007-11-27 22:04 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

------- Sigcheck -------

2004-08-04 00:44 506368 0eef6de395790568ed5f47e66168b81d C:\WINDOWS\system32\winlogon.exe

2004-08-04 00:44 1036288 5ad59fae5e90453b99946ae2ce890843 C:\WINDOWS\explorer.exe

2004-08-04 00:44 110592 4247b219b0b653726a725007b0f8da90 C:\WINDOWS\system32\services.exe

2004-08-04 00:44 14848 ce33c287fad97398dd24e133323d5c6f C:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-13_13.08.05,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-13 11:02:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-13 18:19:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-13 10:54:05 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-13 13:51:04 5,533,696 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2008-05-13 10:54:05 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-13 13:51:04 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-07 20:48 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 11:42 7331840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosWireless]
C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
--a------ 2007-11-16 16:50 91432 C:\Program Files\Cyberlink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-02-03 10:43 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 09:36 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-12-15 11:42 7331840 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 07:05 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 18:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-07 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-09-30 16:09 737370 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-11-02 21:42]
S0 Ahn41;Ahn41;C:\WINDOWS\system32\Drivers\Ahn41.sys []
S0 Fms06;Fms06;C:\WINDOWS\system32\Drivers\Fms06.sys []
S0 Fmt31;Fmt31;C:\WINDOWS\system32\Drivers\Fmt31.sys []
S0 Gnt53;Gnt53;C:\WINDOWS\system32\Drivers\Gnt53.sys []
S0 Krx41;Krx41;C:\WINDOWS\system32\Drivers\Krx41.sys []
S0 Lsa07;Lsa07;C:\WINDOWS\system32\Drivers\Lsa07.sys []
S3 athr;Atheros Extensible Wireless LAN device driver;C:\WINDOWS\system32\DRIVERS\athr.sys [2006-11-10 08:38]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 20:35:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-05-13 20:36:31
ComboFix-quarantined-files.txt 2008-05-13 18:36:29
ComboFix2.txt 2008-05-13 15:30:00
ComboFix3.txt 2008-05-13 14:09:10
ComboFix4.txt 2008-05-13 11:08:15

Pre-Run: 2,278,756,352 bajtów wolnych
Post-Run: 2,270,916,608 bajtów wolnych

142

[wojtas]

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

[heymen]

ok, wykonane wszystko
wielkie dzieki chlopaki !!