Virus alert

[Fabmax]

Witam!

Chciałabym prosić o pomoc.

Na pulpicie pojawiły się trzy ikony
Privacy protector
error cleaner
spyware & malware protection.

Oprócz tego nie mam wszystkich programow w menu start, po ponownym uruchomieniu systemu rejestr nie jest zmieniony (nadal zablokowany menadzer zadan i ekran), brak twardych dyskow w "moj komputer", Wolniej mi dziala komputer.

HIJACKTHIS

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40: VIRUS ALERT!, on 2008-10-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Spyware Doctor\pctsAuxs.exe
D:\Program Files\Spyware Doctor\pctsSvc.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
D:\Program Files\Spyware Doctor\pctsTray.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
D:\WINDOWS\System32\alg.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Spyware Doctor\pctsGui.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: olnmraew - {25F4E094-86FF-44FD-B832-8AADF8C63528} - D:\WINDOWS\olnmraew.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [VirtualCloneDrive] "D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [582b776d] rundll32.exe "D:\WINDOWS\system32\kikefsnj.dll",b
O4 - HKLM\..\Run: [ISTray] "D:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [AdobeUpdater] D:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: FIFA 09 Registration.lnk = D:\Program Files\EA Sports\FIFA 09\Support\EAregister.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D4A0C4B-63A4-455D-90A7-D6DB16B0C288}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{9D4A0C4B-63A4-455D-90A7-D6DB16B0C288}: NameServer = 194.204.159.1 217.98.63.164
O21 - SSODL: qmafxprs - {98C71743-D52E-425C-A24D-0690930565E9} - D:\WINDOWS\qmafxprs.dll
O21 - SSODL: lfstbwvd - {67E49366-3E8B-4682-897D-D8F95BCD956A} - D:\WINDOWS\lfstbwvd.dll
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 7429 bytes


[Okocza]

Kod: Zaznacz wszystko

O3 - Toolbar: olnmraew - {25F4E094-86FF-44FD-B832-8AADF8C63528} - D:\WINDOWS\olnmraew.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k
O4 - HKLM\..\Run: [582b776d] rundll32.exe "D:\WINDOWS\system32\kikefsnj.dll",b
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O21 - SSODL: qmafxprs - {98C71743-D52E-425C-A24D-0690930565E9} - D:\WINDOWS\qmafxprs.dll
O21 - SSODL: lfstbwvd - {67E49366-3E8B-4682-897D-D8F95BCD956A} - D:\WINDOWS\lfstbwvd.dll


to na fix w hj - wstaw log z combofixa

[djarta]

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user'

Tych nie trzeba Fixować.


=======================
K.

[Okocza]

Tych nie trzeba Fixować.

nie trzeba ale można.

Sry za OT

[Fabmax]

Jak to mam zrobic??

[Okocza]

hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

poczytaj

[Fabmax]

ZROBILEM TO co mialem zrobic.. teraz reset tak? i powinno juz go nie byc:)?

[Okocza]

tak, nie powinno tego być. daj log z combofixa

[Fabmax]

Combo Fix mi sie nie wlacza;/

[Okocza]

Combo Fix mi sie nie wlacza;/

to uruchom w awaryjnym (f8 podczas włączania komputera)

[Fabmax]

Kod: Zaznacz wszystko

ComboFix 08-10-11.04 - MasterAdmin 2008-10-12 20:57:29.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.733 [GMT 2:00]
Uruchomiony z: D:\Documents and Settings\User\Pulpit\ComboFix.exe

[COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
D:\WINDOWS\esgp.exe
D:\WINDOWS\lfstbwvd.dll
D:\WINDOWS\olnmraew.dll
D:\WINDOWS\qmafxprs.dll
D:\WINDOWS\system32\efcAQhhH.dll
D:\WINDOWS\system32\HhhQAcfe.ini
D:\WINDOWS\system32\HhhQAcfe.ini2
D:\WINDOWS\system32\jnsfekik.ini
D:\WINDOWS\system32\kikefsnj.dll
D:\WINDOWS\system32\knatmdmi.dll
D:\WINDOWS\system32\lklwix.dll
D:\WINDOWS\system32\mlJAqnKc.dll
D:\WINDOWS\vortsgbqgnf.dll

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-09-12 do 2008-10-12  )))))))))))))))))))))))))))))))
.

2008-10-12 21:03 . 2008-10-12 21:03   <DIR>   d--------   D:\WINDOWS\system32\xircom
2008-10-12 21:03 . 2008-10-12 21:03   <DIR>   d--------   D:\WINDOWS\system32\oobe
2008-10-12 21:03 . 2008-10-12 21:03   <DIR>   d--------   D:\WINDOWS\srchasst
2008-10-12 21:03 . 2008-10-12 21:03   <DIR>   d--------   D:\WINDOWS\msagent
2008-10-12 21:03 . 2008-10-12 21:03   <DIR>   d--------   D:\Program Files\microsoft frontpage
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   d--h-----   D:\Documents and Settings\MasterAdmin\Ustawienia lokalne
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   d--------   D:\Documents and Settings\MasterAdmin\Ulubione
2008-10-12 20:54 . 2008-09-25 20:00   <DIR>   d--h-----   D:\Documents and Settings\MasterAdmin\Szablony
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   d--------   D:\Documents and Settings\MasterAdmin\Pulpit
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   d--------   D:\Documents and Settings\MasterAdmin\Moje dokumenty
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   dr-------   D:\Documents and Settings\MasterAdmin\Menu Start
2008-10-12 20:54 . 2008-09-25 21:57   <DIR>   dr-h-----   D:\Documents and Settings\MasterAdmin\Dane aplikacji
2008-10-12 20:54 . 2008-09-25 20:04   <DIR>   d--------   D:\Documents and Settings\MasterAdmin\7zS54D.tmp
2008-10-12 20:54 . 2008-09-25 20:03   <DIR>   d--------   D:\Documents and Settings\MasterAdmin\7zS54A.tmp
2008-10-12 20:54 . 2008-10-12 20:55   <DIR>   d--------   D:\Documents and Settings\MasterAdmin
2008-10-12 12:43 . 2008-10-12 12:43   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-10-12 12:40 . 2008-10-12 12:40   <DIR>   d--------   D:\Program Files\Trend Micro
2008-10-12 12:30 . 2008-10-12 12:30   <DIR>   d--------   D:\Program Files\Yahoo!
2008-10-12 12:29 . 2008-10-12 12:30   <DIR>   d--------   D:\Program Files\CCleaner
2008-10-12 11:12 . 2008-10-12 18:05   <DIR>   d--------   D:\Program Files\Spyware Doctor
2008-10-12 11:12 . 2008-10-12 11:12   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\PC Tools
2008-10-12 11:12 . 2008-08-25 11:36   81,288   --a------   D:\WINDOWS\system32\drivers\iksyssec.sys
2008-10-12 11:12 . 2008-08-25 11:36   66,952   --a------   D:\WINDOWS\system32\drivers\iksysflt.sys
2008-10-12 11:12 . 2008-08-25 11:36   40,840   --a------   D:\WINDOWS\system32\drivers\ikfilesec.sys
2008-10-12 11:12 . 2008-06-02 15:19   29,576   --a------   D:\WINDOWS\system32\drivers\kcom.sys
2008-10-12 10:34 . 2008-10-12 10:34   <DIR>   d--------   D:\Program Files\Kaspersky Lab
2008-10-12 10:34 . 2008-10-12 21:03   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-10-12 10:34 . 2008-10-12 20:53   2,645,024   --ahs----   D:\WINDOWS\system32\drivers\fidbox.dat
2008-10-12 10:34 . 2008-10-12 20:53   188,448   --ahs----   D:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-12 10:34 . 2008-10-12 10:34   96,976   --a------   D:\WINDOWS\system32\drivers\klin.dat
2008-10-12 10:34 . 2008-10-12 10:34   87,855   --a------   D:\WINDOWS\system32\drivers\klick.dat
2008-10-12 10:34 . 2008-10-12 20:53   22,792   --ahs----   D:\WINDOWS\system32\drivers\fidbox.idx
2008-10-12 10:34 . 2008-10-12 20:53   2,772   --ahs----   D:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-12 10:32 . 2008-10-12 10:32   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-10-12 10:26 . 2008-10-12 10:26   <DIR>   d--------   D:\Program Files\Lavasoft
2008-10-12 10:26 . 2008-10-12 10:26   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Lavasoft
2008-10-12 10:14 . 2008-10-12 21:03   <DIR>   d-a------   D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-10-12 10:04 . 2008-10-12 07:38   94,208   --a------   D:\WINDOWS\qkeftmxn.exe
2008-10-12 10:03 . 2008-10-12 10:04   <DIR>   d--------   D:\Extracted
2008-10-12 02:01 . 2008-10-12 02:10   <DIR>   d--------   D:\Program Files\BitComet
2008-10-11 11:51 . 2008-10-11 11:51   <DIR>   d--------   D:\Program Files\Steinberg
2008-10-10 17:53 . 2008-10-10 17:53   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Media Player Classic
2008-10-10 17:52 . 2008-10-10 17:52   <DIR>   d--------   D:\Program Files\Real Alternative
2008-10-09 14:24 . 2008-10-09 14:24   7,332   --ah-----   D:\WINDOWS\system32\mlfcache.dat
2008-10-03 20:44 . 2008-10-12 10:04   <DIR>   d--------   D:\Program Files\Common Files\Adobe
2008-10-03 14:07 . 2008-10-03 14:07   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Leadertech
2008-10-03 13:55 . 2008-10-03 13:55   <DIR>   d--------   D:\Program Files\EA Sports
2008-10-03 13:52 . 2008-10-03 13:52   <DIR>   d--------   D:\Program Files\Elaborate Bytes
2008-10-03 13:43 . 2008-10-03 13:43   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\DAEMON Tools
2008-10-03 13:43 . 2008-10-03 13:43   717,296   --a------   D:\WINDOWS\system32\drivers\sptd.sys
2008-10-02 21:58 . 2008-10-02 21:58   <DIR>   d--------   D:\Program Files\Ventrilo
2008-10-02 21:58 . 2008-10-02 21:59   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Ventrilo
2008-10-02 21:57 . 2008-10-02 21:58   <DIR>   d--------   D:\Program Files\Common Files\Wise Installation Wizard
2008-10-02 14:35 . 2008-10-02 14:35   <DIR>   d--------   D:\Documents and Settings\User\KONAMI
2008-10-02 14:10 . 2001-08-17 22:02   9,600   --a------   D:\WINDOWS\system32\drivers\hidusb.sys
2008-10-02 05:54 . 2008-10-02 05:54   <DIR>   d--------   D:\Program Files\KONAMI
2008-10-02 00:36 . 2008-10-02 00:36   754   --a------   D:\WINDOWS\WORDPAD.INI
2008-09-30 22:09 . 2008-09-30 22:09   <DIR>   d--------   D:\Program Files\ArtsAcoustic Reverb
2008-09-30 22:09 . 2008-09-30 22:09   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\ArtsAcoustic
2008-09-30 09:13 . 2008-09-30 09:13   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Nero
2008-09-30 08:49 . 2008-09-30 08:49   4,767   --a------   D:\WINDOWS\Irremote.ini
2008-09-30 08:47 . 2008-09-30 08:47   <DIR>   d--------   D:\Program Files\Windows Sidebar
2008-09-30 08:39 . 2008-09-30 08:48   <DIR>   d--------   D:\Program Files\Nero
2008-09-30 08:39 . 2008-09-30 08:59   <DIR>   d--------   D:\Program Files\Common Files\Nero
2008-09-30 08:39 . 2008-09-30 08:44   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-09-28 14:33 . 2008-09-28 14:33   <DIR>   d--------   D:\ST_NG_SetupWizard
2008-09-27 17:40 . 2008-09-27 17:40   107,888   --a------   D:\WINDOWS\system32\CmdLineExt.dll
2008-09-27 16:40 . 2008-09-27 16:40   <DIR>   d--------   D:\WINDOWS\Logs
2008-09-27 10:19 . 2008-09-27 10:19   <DIR>   d--------   D:\Program Files\ASIO4ALL v2
2008-09-27 10:18 . 2008-10-11 16:53   <DIR>   d--------   D:\Program Files\VstPlugins
2008-09-27 10:18 . 2008-09-27 10:18   <DIR>   d--------   D:\Program Files\Outsim
2008-09-27 10:18 . 2008-09-27 15:21   <DIR>   d--------   D:\FL STUDIO
2008-09-27 10:18 . 2002-07-08 00:14   1,294,336   --a------   D:\WINDOWS\system32\vorbis.acm
2008-09-27 10:18 . 2006-06-20 10:56   225,280   --a------   D:\WINDOWS\system32\rewire.dll
2008-09-27 10:17 . 2008-09-27 10:19   <DIR>   d--------   D:\Program Files\Image-Line
2008-09-26 23:51 . 2008-09-26 23:51   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\Sports Interactive
2008-09-25 23:05 . 2008-09-25 23:05   <DIR>   d--------   D:\Documents and Settings\User\Dane aplikacji\BitSpirit
2008-09-25 22:49 . 2008-03-05 15:56   3,786,760   --a------   D:\WINDOWS\system32\D3DX9_37.dll
2008-09-25 22:49 . 2007-07-19 18:14   3,727,720   --a------   D:\WINDOWS\system32\d3dx9_35.dll
2008-09-25 22:49 . 2007-05-16 16:45   3,497,832   --a------   D:\WINDOWS\system32\d3dx9_34.dll
2008-09-25 22:49 . 2007-03-12 16:42   3,495,784   --a------   D:\WINDOWS\system32\d3dx9_33.dll
2008-09-25 22:49 . 2007-04-04 18:53   81,768   --a------   D:\WINDOWS\system32\xinput1_3.dll

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-05 10:24   ---------   d-----w   D:\Documents and Settings\User\Dane aplikacji\teamspeak2
2008-09-25 18:42   ---------   d-----w   D:\Documents and Settings\User\Dane aplikacji\Soldat
2008-09-25 18:25   ---------   d-----w   D:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu
2008-09-25 18:20   ---------   d--h--w   D:\Program Files\InstallShield Installation Information
2008-09-25 18:20   ---------   d-----w   D:\Program Files\Thomson
2008-09-25 18:20   ---------   d-----w   D:\Program Files\Common Files\InstallShield
2008-09-25 18:18   ---------   d-----w   D:\Program Files\Neostrada TP
2008-09-25 18:15   ---------   d-----w   D:\Program Files\Realtek
2008-09-25 18:15   ---------   d-----w   D:\Documents and Settings\User\Dane aplikacji\InstallShield
2008-09-25 18:12   ---------   d-----w   D:\Program Files\Intel
2008-09-25 18:03   ---------   d-----w   D:\Program Files\Theorica Divx ;-) Codecs
2008-09-25 18:00   ---------   d-----w   D:\Program Files\Windows Media Connect 2
2008-07-31 08:41   68,616   ----a-w   D:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 08:41   238,088   ----a-w   D:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 08:40   509,448   ----a-w   D:\WINDOWS\system32\XAudio2_2.dll
2008-07-29 18:21   218,376   ----a-w   D:\WINDOWS\system32\klogon.dll
2008-07-14 16:52   80,840   ----a-w   D:\WINDOWS\system32\ElbyVCD.dll
2008-07-12 06:18   467,984   ----a-w   D:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 06:18   3,851,784   ----a-w   D:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 06:18   1,493,528   ----a-w   D:\WINDOWS\system32\D3DCompiler_39.dll
.

------- Sigcheck -------

2007-05-10 21:55  1423872  a50dfe31981a01423d327fdd05bdf452   D:\WINDOWS\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 217544]
"AdobeUpdater"="D:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-10-03 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-04-20 8429568]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-04-20 81920]
"SpeedTouch USB Diagnostics"="D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"VirtualCloneDrive"="D:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-30 52168]
"ISTray"="D:\Program Files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"AVP"="D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
"nwiz"="nwiz.exe" [2007-04-20 D:\WINDOWS\system32\nwiz.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 D:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 D:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-05-10 D:\WINDOWS\system32\advpack.dll]

D:\Documents and Settings\User\Menu Start\Programy\Autostart\
FIFA 09 Registration.lnk - D:\Program Files\EA Sports\FIFA 09\Support\EAregister.exe [2008-08-13 4369408]

D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"DisableStatusMessages"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= D:\WINDOWS\system32\i263_32.drv
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
"VIDC.HFYU"= huffyuv.dll
"vidc.ffds"= D:\Program Files\Theorica Divx ;-) Codecs\ffdshow.ax
"vidc.i263"= D:\WINDOWS\system32\i263_32.drv
"msacm.imc"= D:\WINDOWS\system32\imc32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Soldat\\Soldat.exe"=
"C:\\Downloads\\[PC] Pro Evolution Soccer 2008 [ENG] [dopeman]\\PES08\\Pro Evolution Soccer 2008\\PES2008.exe"=
"C:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"C:\\Downloads\\Call of Duty 4 Modern Warfare Full-Rip Skullptura\\Call.of.Duty.4.Modern.Warfare.Full-Rip.Skullptura\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3874:TCP"= 3874:TCP:vent
"18991:TCP"= 18991:TCP:BitComet 18991 TCP
"18991:UDP"= 18991:UDP:BitComet 18991 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;D:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;D:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 usbstor;Sterownik magazynu masowego USB;D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

*Newly Created Service* - HELPSVC
.
- - - - USUNIĘTO PUSTE WPISY - - - -

BHO-{02E46301-D5C5-45B3-AF3A-1B5C9E633AB2} - D:\WINDOWS\vortsgbqgnf.dll
BHO-{C40820AC-3550-4656-9521-C779CB186935} - D:\WINDOWS\system32\efcAQhhH.dll
BHO-{DDF7DD8E-A920-471D-B97B-BA22109CC9D7} - D:\WINDOWS\system32\yaywwXoM.dll
BHO-{ef84618b-b9e0-49e7-96f6-90aea8a759b1} - D:\WINDOWS\system32\lklwix.dll
Toolbar-{25F4E094-86FF-44FD-B832-8AADF8C63528} - D:\WINDOWS\olnmraew.dll
ShellExecuteHooks-{DDF7DD8E-A920-471D-B97B-BA22109CC9D7} - D:\WINDOWS\system32\yaywwXoM.dll
SSODL-lfstbwvd-{FA43BE77-36A2-4DD7-8089-0E3E180CD31D} - D:\WINDOWS\lfstbwvd.dll
Notify-yaywwXoM - yaywwXoM.dll


.
------- Skan uzupełniający -------
.
FireFox -: Profile - D:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\68mchl50.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-12 21:03:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...


**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Spyware Doctor\pctsAuxs.exe
D:\Program Files\Spyware Doctor\pctsSvc.exe
D:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Czas ukończenia: 2008-10-12 21:07:25 - komputer został uruchomiony ponownie [User]
ComboFix-quarantined-files.txt  2008-10-12 19:07:05

Przed: 11 873 763 328 bajtów wolnych
Po: 13,720,825,856 bajtów wolnych

252


Dodano Dzisiaj, 21:14:
Przez chwile nie było Virus alert...no ale znowu zawitał

[Okocza]

otwórz notatnik i wklej:

Kod: Zaznacz wszystko

File::
D:\WINDOWS\qkeftmxn.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum