Win32/patched.bg wirus (log)

[przemeksz]

NOD32 online wykrył mi:
C:\WINDOWS\system32\drivers\tcpip.sys Win32/Patched.BG wirus nie mozna wyleczyc
Poproszę o pomoc

LOGI OTL

Kod: Zaznacz wszystko

OTL Extras logfile created on: 2009-08-04 17:39:42 - Run 1
OTL by OldTimer - Version 3.0.10.4     Folder = D:\
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,48 Mb Total Physical Memory | 269,33 Mb Available Physical Memory | 52,66% Memory free
1,22 Gb Paging File | 0,91 Gb Available in Paging File | 74,30% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 3,91 Gb Total Space | 0,76 Gb Free Space | 19,37% Space Free | Partition Type: NTFS
Drive D: | 24,59 Gb Total Space | 6,60 Gb Free Space | 26,84% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NIP
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Winamp Remote\bin\Orb.exe" = C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- File not found
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" = C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- File not found
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- File not found


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{392FD77C-CEB1-45FA-8949-443E87529070}" = Świadectwa Optivum
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1038-7B44-CEA000000001}" = Adobe Reader 6.0.2 CE
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner (remove only)
"ESET Online Scanner" = ESET Online Scanner v3
"HijackThis" = HijackThis 2.0.2
"IrfanView" = IrfanView (remove only)
"Nowe Gadu-Gadu" = Nowe Gadu-Gadu
"RealAlt_is1" = Real Alternative 1.9.0 Lite
"RealPlayer 6.0" = RealPlayer
"SubEdit-Player_is1" = SubEdit-Player
"Windows Media Format Runtime" = Windows Media Format Runtime

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2009-05-26 09:27:39 | Computer Name = NIP | Source = MsiInstaller | ID = 11601
Description = Product: Apple Software Update -- Disk full: Out of disk space --
Volume: 'C:'; required space: -1 484 KB; available space: 0 KB.  Free some disk
space and retry.

Error - 2009-05-26 09:27:40 | Computer Name = NIP | Source = MsiInstaller | ID = 11601
Description = Product: Apple Software Update -- Disk full: Out of disk space --
Volume: 'C:'; required space: -1 484 KB; available space: 0 KB.  Free some disk
space and retry.

Error - 2009-05-30 02:52:26 | Computer Name = NIP | Source = crypt32 | ID = 131080
Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej
listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,
wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu. 

Error - 2009-05-30 02:53:47 | Computer Name = NIP | Source = crypt32 | ID = 131080
Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej
listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,
wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu. 

Error - 2009-05-30 03:00:33 | Computer Name = NIP | Source = crypt32 | ID = 131080
Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej
listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,
wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu. 

Error - 2009-05-30 03:00:40 | Computer Name = NIP | Source = crypt32 | ID = 131080
Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej
listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,
wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu. 

[ System Events ]
Error - 2009-08-03 07:38:07 | Computer Name = NIP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%2

Error - 2009-08-03 07:41:58 | Computer Name = NIP | Source = Service Control Manager | ID = 7023
Description = Usługa Przeglądarka komputera zakończyła działanie; wystąpił następujący
błąd:   %%1460

Error - 2009-08-03 14:23:43 | Computer Name = NIP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%2

Error - 2009-08-03 14:27:35 | Computer Name = NIP | Source = Service Control Manager | ID = 7023
Description = Usługa Przeglądarka komputera zakończyła działanie; wystąpił następujący
błąd:   %%1460

Error - 2009-08-04 07:23:57 | Computer Name = NIP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%2

Error - 2009-08-04 07:27:41 | Computer Name = NIP | Source = Service Control Manager | ID = 7023
Description = Usługa Przeglądarka komputera zakończyła działanie; wystąpił następujący
błąd:   %%1460

Error - 2009-08-04 10:05:44 | Computer Name = NIP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%2

Error - 2009-08-04 10:09:35 | Computer Name = NIP | Source = Service Control Manager | ID = 7023
Description = Usługa Przeglądarka komputera zakończyła działanie; wystąpił następujący
błąd:   %%1460

Error - 2009-08-04 11:13:23 | Computer Name = NIP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%2

Error - 2009-08-04 11:17:11 | Computer Name = NIP | Source = Service Control Manager | ID = 7023
Description = Usługa Przeglądarka komputera zakończyła działanie; wystąpił następujący
błąd:   %%1460


< End of report >


Kod: Zaznacz wszystko

OTL logfile created on: 2009-08-04 17:39:42 - Run 1
OTL by OldTimer - Version 3.0.10.4     Folder = D:\
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,48 Mb Total Physical Memory | 269,33 Mb Available Physical Memory | 52,66% Memory free
1,22 Gb Paging File | 0,91 Gb Available in Paging File | 74,30% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 3,91 Gb Total Space | 0,76 Gb Free Space | 19,37% Space Free | Partition Type: NTFS
Drive D: | 24,59 Gb Total Space | 6,60 Gb Free Space | 26,84% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NIP
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2009-06-10 23:11:42 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2007-10-20 14:11:02 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009-03-02 12:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009-07-27 17:42:10 | 10,719,848 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe
PRC - [2009-06-10 23:11:42 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe
PRC - [2009-07-27 16:39:44 | 00,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
PRC - [2004-06-10 13:29:52 | 12,047,560 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
PRC - [2004-08-04 00:44:22 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\internet explorer\iexplore.exe
PRC - [2009-08-04 17:37:02 | 00,514,048 | ---- | M] (OldTimer Tools) -- D:\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-06-10 23:11:42 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running])
SRV - [2009-06-10 23:11:42 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running])
SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2002-02-14 12:48:06 | 00,299,008 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\System32\LEXBCES.EXE -- (LexBceS [Disabled | Stopped])
SRV - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM [Auto | Running])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-02-13 11:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running])
DRV - [2009-04-29 21:49:35 | 00,055,640 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running])
DRV - [2009-04-29 21:49:35 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System | Running])
DRV - [2002-06-29 15:41:44 | 00,414,543 | R--- | M] (C-Media Inc) -- C:\WINDOWS\System32\drivers\cmuda.sys -- (cmuda [On_Demand | Running])
DRV - [2007-04-04 15:58:26 | 00,024,344 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Stopped])
DRV - [2004-08-04 00:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008-02-21 04:05:38 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2008-02-07 22:02:23 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running])
DRV - [2004-08-04 01:07:44 | 00,041,088 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp [Boot | Running])
DRV - [2004-08-04 00:31:36 | 00,032,768 | ---- | M] (SiS Corporation) -- C:\WINDOWS\System32\DRIVERS\sisnic.sys -- (SISNIC [On_Demand | Running])
DRV - [2009-05-26 16:39:47 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2009-06-10 23:11:42 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
IE - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\S-1-5-21-1708537768-1606980848-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\java\jre6\lib\deploy\jqs\ff


O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (no name) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No CLSID value found.
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.)
O4 - HKLM..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.)
O4 - Startup: C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ap ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 1
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKU\S-1-5-21-1708537768-1606980848-1343024091-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00000161-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/msaudio.cab (Reg Error: Key error.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://nadaje.com/img/winamp.gif
O24 - Desktop Components:1 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-12-23 13:19:41 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-08-04 17:37:18 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro
[2009-08-04 17:37:17 | 00,000,000 | ---D | C] -- C:\rsit
[2009-08-04 17:21:06 | 00,029,184 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Rozmowa z Markiem Wieczorkiem-maj2009.doc
[2009-08-04 17:20:24 | 00,025,600 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Rozmowa z Markiem Bąkowskim-czerwiec2009.doc
[2009-08-02 11:26:46 | 00,125,440 | ---- | C] () -- C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ap
[2009-08-02 11:26:33 | 00,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2009-08-02 11:26:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
[2009-08-02 10:18:12 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009-07-31 17:03:23 | 00,021,504 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\FRANKÓW.doc
[2009-07-14 15:31:07 | 00,117,760 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\formularz.doc
[2009-07-14 15:30:56 | 00,041,472 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\wniosek.doc
[2008-10-02 20:29:51 | 00,000,109 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008-05-17 13:54:06 | 00,000,057 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008-02-21 04:05:44 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008-02-21 04:04:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008-02-21 04:04:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008-02-21 04:03:24 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008-02-07 22:33:08 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008-01-25 16:33:14 | 00,000,036 | ---- | C] () -- C:\WINDOWS\vsp-poker.ini
[2007-12-27 12:10:35 | 00,001,199 | ---- | C] () -- C:\WINDOWS\bestplayer.ini
[2007-05-31 17:49:46 | 00,000,000 | ---- | C] () -- C:\WINDOWS\UMXADDIN.INI
[2007-05-31 17:49:46 | 00,000,000 | ---- | C] () -- C:\WINDOWS\pexplore.ini
[2007-01-29 09:47:28 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007-01-27 17:42:08 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxaxlcnp.dll
[2006-12-26 19:01:48 | 00,002,611 | ---- | C] () -- C:\WINDOWS\VPlayer.INI
[2006-12-23 14:32:10 | 00,000,192 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2006-12-23 14:16:01 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006-12-23 13:44:57 | 00,000,034 | ---- | C] () -- C:\WINDOWS\if40le.ini
[2006-12-23 13:44:55 | 00,000,016 | ---- | C] () -- C:\WINDOWS\SCNDRVU.INI
[2006-12-23 13:34:28 | 00,000,046 | ---- | C] () -- C:\WINDOWS\adiras.ini
[2005-10-21 00:58:52 | 00,090,112 | ---- | C] () -- C:\WINDOWS\System32\vspxvfw.dll
[2005-09-01 16:20:46 | 00,524,288 | ---- | C] () -- C:\WINDOWS\System32\vspxcore.dll
[2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2001-07-22 00:16:20 | 00,000,614 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009-08-04 17:11:45 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-08-02 11:26:48 | 00,125,440 | ---- | M] () -- C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ap
[2009-07-31 17:03:23 | 00,021,504 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\FRANKÓW.doc
[2009-07-20 09:33:45 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-07-14 15:31:07 | 00,117,760 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\formularz.doc
[2009-07-14 15:30:57 | 00,041,472 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\wniosek.doc

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 165 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:DFC5A2B2
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:1AAB2E68
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:364682BC
< End of report >


LOG HijackThis

Kod: Zaznacz wszystko

[Logfile of random's system information tool 1.06 (written by random/random)
Run by Admin at 2009-08-04 17:37:17
Microsoft Windows XP Professional Dodatek Service Pack 2
System drive C: has 776 MB (19%) free of 4 GB
Total RAM: 511 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:37:27, on 2009-08-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Nowe Gadu-Gadu\gg.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\internet explorer\iexplore.exe
D:\RSIT.exe
C:\Program Files\trend micro\Admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - (no file)
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ap
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O24 - Desktop Component 0: (no name) - http://nadaje.com/img/winamp.gif

--
End of file - 3765 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Konserwacja jednym kliknięciem.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}]
IEPluginBHO Class - C:\Documents and Settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-05-26 42088]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"Anti Trojan Elite"=C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"=C:\Program Files\Nowe Gadu-Gadu\gg.exe [2009-07-27 10719848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
C:\WINDOWS\system32\LXSUPMON.EXE [2002-01-28 885760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3
"MDM"=2
"LexBceS"=2

C:\Documents and Settings\Admin\Menu Start\Programy\Autostart
ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vyd71.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Vyd71.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"RunStartupScriptSync"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"RunStartupScriptSync"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=91000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.ini - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1
.txt - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2009-08-04 17:37:18 ----D---- C:\Program Files\trend micro
2009-08-04 17:37:17 ----D---- C:\rsit
2009-08-02 11:26:33 ----D---- C:\Program Files\Trojan Remover
2009-08-02 11:26:33 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software
2009-08-02 10:18:12 ----D---- C:\Program Files\ESET

======List of files/folders modified in the last 1 months======

2009-08-04 17:37:18 ----RD---- C:\Program Files
2009-08-04 17:13:12 ----D---- C:\WINDOWS\TEMP
2009-08-04 17:12:58 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-04 17:12:53 ----D---- C:\WINDOWS
2009-08-04 13:42:32 ----D---- C:\WINDOWS\system32
2009-08-03 13:38:44 ----D---- C:\Program Files\Nowe Gadu-Gadu
2009-08-02 12:18:11 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-08-02 10:32:21 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-30 13:18:26 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM
2009-07-23 09:25:16 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2009-07-23 09:25:14 ----D---- C:\WINDOWS\system32\drivers

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-04 41472]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-29 96104]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-10 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-04-29 55640]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2002-06-29 414543]
R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-18 9600]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
R3 SISNIC;Sterownik karty PCI Fast Ethernet SiS; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-04 32768]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys []
S3 adiusbaw;USB ADSL WAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbaw.sys []
S3 ATE_PROCMON;ATE_PROCMON; \??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344]
S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-06-10 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-06-10 185089]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2002-02-14 299008]

-----------------EOF-----------------


[kanel]

Witam
mam chyba identyczny problem przydała by się pomoc bo nawet format nie pomaga poniżej znajdują się logi!

OTL: http://wklej.org/id/130759/ , http://wklej.org/id/130764/
Combofix : http://wklej.org/id/130762/
HijackThis http://wklej.org/id/130765/

[Okocza]

kanel, załóż swój temat

Dodano 05.08.2009 11:25:59:
przemeksz, daj log z combofixa

[przemeksz]

LOG Z COMBO

Kod: Zaznacz wszystko

ComboFix 09-08-04.03 - Admin 2009-08-05 19:46.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.511.322 [GMT 2:00]
Uruchomiony z: D:\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00CD-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00F1-0D24-347CA8A3377C}
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Dane aplikacji\wiaserva.log
c:\program files\Common Files\Real\WeatherBug\MiniBugTransporter.dll
c:\windows\Installer\51105.msi

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-07-05 do 2009-08-05  )))))))))))))))))))))))))))))))
.

2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   c:\program files\trend micro
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   C:\rsit
2009-08-02 09:26 . 2009-08-04 11:42   --------   d-----w-   c:\program files\Trojan Remover
2009-08-02 09:26 . 2009-08-02 09:26   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2009-08-02 08:18 . 2009-08-02 08:18   --------   d-----w-   c:\program files\ESET

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-05 17:31 . 2009-04-29 13:50   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:38 . 2009-03-04 12:50   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-07-30 11:18 . 2009-07-02 10:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-07-23 07:25 . 2007-11-22 10:38   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-02 10:16 . 2009-07-02 10:16   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\OpenFM
2009-06-17 11:01 . 2009-06-17 11:01   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Apple Computer
2009-06-10 09:01 . 2008-05-23 10:33   --------   d-----w-   c:\program files\Win RaR
2009-06-08 09:52 . 2009-06-08 08:27   --------   d-----w-   c:\program files\Common Files\PC Tools
2009-06-08 08:55 . 2009-06-08 08:55   --------   d-----w-   c:\program files\MSSOAP
2009-06-08 08:50 . 2009-06-08 08:50   164   ----a-w-   c:\windows\install.dat
2009-05-26 16:01 . 2009-05-26 16:01   42088   ----a-w-   c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-26 14:39 . 2008-02-07 20:33   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2007-10-15 12:56 . 2007-06-14 08:44   1917   --sha-w-   c:\windows\system32\2497927680.dat
.

------- Sigcheck -------

[-] 2004-08-03 21:14   359040   1745B00FC1141404B28F4B94F69A8871   c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-07-27 10719848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\Admin\Menu Start\Programy\Autostart\
ap [2009-8-2 125440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vyd71.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MDM"=2 (0x2)
"LexBceS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-29 108289]
S0 Vyd71;Vyd71;c:\windows\system32\Drivers\Vyd71.sys --> c:\windows\system32\Drivers\Vyd71.sys [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
.
Zawartość folderu 'Zaplanowane zadania'
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-Anti Trojan Elite - c:\program files\Anti Trojan Elite\TJEnder.exe


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-05 19:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
Czas ukończenia: 2009-08-05 19:52
ComboFix-quarantined-files.txt  2009-08-05 17:51

Przed: 718 790 656 bajtów wolnych
Po: 758 767 616 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

109


[Okocza]

Kod: Zaznacz wszystko

Files::

c:\windows\system32\2497927680.dat
c:\windows\system32\drivers\tcpip.sys

wklej to w notatnik i zapisz jako cfscript.txt i przeciągnij na combofix.exe daj log jaki się wygeneruje

[przemeksz]

Kod: Zaznacz wszystko

ComboFix 09-08-04.03 - Admin 2009-08-06 10:11.2.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.511.263 [GMT 2:00]
Uruchomiony z: D:\ComboFix.exe
Użyto następujących komend :: D:\cfscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00CD-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00F1-0D24-347CA8A3377C}
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-07-06 do 2009-08-06  )))))))))))))))))))))))))))))))
.

2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   c:\program files\trend micro
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   C:\rsit
2009-08-02 09:26 . 2009-08-04 11:42   --------   d-----w-   c:\program files\Trojan Remover
2009-08-02 09:26 . 2009-08-02 09:26   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2009-08-02 08:18 . 2009-08-02 08:18   --------   d-----w-   c:\program files\ESET

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 07:56 . 2001-10-26 16:15   49492   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-06 07:56 . 2001-10-26 16:15   355486   ----a-w-   c:\windows\system32\perfh015.dat
2009-08-05 17:31 . 2009-04-29 13:50   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:38 . 2009-03-04 12:50   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-07-30 11:18 . 2009-07-02 10:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-07-23 07:25 . 2007-11-22 10:38   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-02 10:16 . 2009-07-02 10:16   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\OpenFM
2009-06-17 11:01 . 2009-06-17 11:01   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Apple Computer
2009-06-10 09:01 . 2008-05-23 10:33   --------   d-----w-   c:\program files\Win RaR
2009-06-08 09:52 . 2009-06-08 08:27   --------   d-----w-   c:\program files\Common Files\PC Tools
2009-06-08 08:55 . 2009-06-08 08:55   --------   d-----w-   c:\program files\MSSOAP
2009-06-08 08:50 . 2009-06-08 08:50   164   ----a-w-   c:\windows\install.dat
2009-05-26 16:01 . 2009-05-26 16:01   42088   ----a-w-   c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-26 14:39 . 2008-02-07 20:33   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2007-10-15 12:56 . 2007-06-14 08:44   1917   --sha-w-   c:\windows\system32\2497927680.dat
.

------- Sigcheck -------

[-] 2004-08-03 21:14   359040   1745B00FC1141404B28F4B94F69A8871   c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((   SnapShot@2009-08-05_17.49.40   )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-08-17 21:30 . 2009-08-06 07:56   39992              c:\windows\system32\perfc009.dat
+ 2001-08-17 21:30 . 2009-08-06 07:56   311604              c:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-07-27 10719848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\Admin\Menu Start\Programy\Autostart\
ap [2009-8-2 125440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vyd71.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MDM"=2 (0x2)
"LexBceS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-29 108289]
S0 Vyd71;Vyd71;c:\windows\system32\Drivers\Vyd71.sys --> c:\windows\system32\Drivers\Vyd71.sys [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-06 10:14
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
Czas ukończenia: 2009-08-06 10:17
ComboFix-quarantined-files.txt  2009-08-06 08:17
ComboFix2.txt  2009-08-05 17:52

Przed: 766 009 344 bajtów wolnych
Po: 764 788 736 bajtów wolnych

98


Dodano 10.08.2009 19:04:23:
Zrobilem wszystko jak powyzej, dalem loga, ale nie ma odpowiedzi, a ja znowu zrobilem skan NOD32 online i ponownie wykryto ten sam wirus. O co chodzi?

[Okocza]

przemeksz, pliki:

c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\perfc009.dat
c:\windows\system32\perfh009.dat

usuń za pomocą programu unlocker lub pocket killbox

wróć z logiem z combofixa

[przemeksz]

Usunąłem wskazane pliki , a teraz logo:

Kod: Zaznacz wszystko

ComboFix 09-08-10.04 - Admin 2009-08-11 11:29.3.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.511.258 [GMT 2:00]
Uruchomiony z: D:\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00CD-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00F1-0D24-347CA8A3377C}
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-07-11 do 2009-08-11  )))))))))))))))))))))))))))))))
.

2009-08-11 09:15 . 2009-08-11 09:25   --------   d-----w-   C:\!KillBox
2009-08-11 09:14 . 2009-08-11 09:14   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Desktopicon
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   c:\program files\trend micro
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   C:\rsit
2009-08-02 09:26 . 2009-08-04 11:42   --------   d-----w-   c:\program files\Trojan Remover
2009-08-02 09:26 . 2009-08-02 09:26   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2009-08-02 08:18 . 2009-08-02 08:18   --------   d-----w-   c:\program files\ESET

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 07:56 . 2001-10-26 16:15   49492   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-06 07:56 . 2001-10-26 16:15   355486   ----a-w-   c:\windows\system32\perfh015.dat
2009-08-05 17:31 . 2009-04-29 13:50   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:38 . 2009-03-04 12:50   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-07-30 11:18 . 2009-07-02 10:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-07-23 07:25 . 2007-11-22 10:38   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-02 10:16 . 2009-07-02 10:16   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\OpenFM
2009-06-17 11:01 . 2009-06-17 11:01   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Apple Computer
2009-06-08 08:50 . 2009-06-08 08:50   164   ----a-w-   c:\windows\install.dat
2009-05-26 16:01 . 2009-05-26 16:01   42088   ----a-w-   c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-26 14:39 . 2008-02-07 20:33   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2007-10-15 12:56 . 2007-06-14 08:44   1917   --sha-w-   c:\windows\system32\2497927680.dat
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-07-27 10719848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\Admin\Menu Start\Programy\Autostart\
ap [2009-8-2 125440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vyd71.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MDM"=2 (0x2)
"LexBceS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-29 108289]
S0 Vyd71;Vyd71;c:\windows\system32\Drivers\Vyd71.sys --> c:\windows\system32\Drivers\Vyd71.sys [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 11:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
Czas ukończenia: 2009-08-11 11:35
ComboFix-quarantined-files.txt  2009-08-11 09:35
ComboFix2.txt  2009-08-06 08:17
ComboFix3.txt  2009-08-05 17:52

Przed: 703 086 592 bajtów wolnych
Po: 714 792 960 bajtów wolnych

94


Dodano 11.08.2009 11:37:06:
Po usunięciu tych plików i restarcie komputera nie mam dostępu do internetu - co się mogło stać? (piszę z połączenia z netem z drugiego kompa), pomocy

Dodano 11.08.2009 12:27:51:
Daje aktualnego loga z combofixa, przywracanie systemu nic nie dało:

Kod: Zaznacz wszystko

ComboFix 09-08-10.04 - Admin 2009-08-11 13:14.3.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.511.199 [GMT 2:00]
Uruchomiony z: D:\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00CD-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00F1-0D24-347CA8A3377C}
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-07-11 do 2009-08-11  )))))))))))))))))))))))))))))))
.

2009-08-11 11:08 . 2009-08-11 11:08   --------   d-----w-   c:\windows\system32\wbem\Repository
2009-08-11 09:15 . 2009-08-11 09:25   --------   d-----w-   C:\!KillBox
2009-08-11 09:14 . 2009-08-11 09:14   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Desktopicon
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   c:\program files\trend micro
2009-08-04 15:37 . 2009-08-04 15:37   --------   d-----w-   C:\rsit
2009-08-02 09:26 . 2009-08-04 11:42   --------   d-----w-   c:\program files\Trojan Remover
2009-08-02 09:26 . 2009-08-02 09:26   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2009-08-02 08:18 . 2009-08-02 08:18   --------   d-----w-   c:\program files\ESET

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 07:56 . 2001-10-26 16:15   49492   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-06 07:56 . 2001-10-26 16:15   355486   ----a-w-   c:\windows\system32\perfh015.dat
2009-08-05 17:31 . 2009-04-29 13:50   55656   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-08-03 11:38 . 2009-03-04 12:50   --------   d-----w-   c:\program files\Nowe Gadu-Gadu
2009-07-30 11:18 . 2009-07-02 10:17   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-07-23 07:25 . 2007-11-22 10:38   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-02 10:16 . 2009-07-02 10:16   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\OpenFM
2009-06-17 11:01 . 2009-06-17 11:01   --------   d-----w-   c:\documents and settings\Admin\Dane aplikacji\Apple Computer
2009-06-08 08:50 . 2009-06-08 08:50   164   ----a-w-   c:\windows\install.dat
2009-05-26 16:01 . 2009-05-26 16:01   42088   ----a-w-   c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-26 14:39 . 2008-02-07 20:33   717296   ----a-w-   c:\windows\system32\drivers\sptd.sys
2007-10-15 12:56 . 2007-06-14 08:44   1917   --sha-w-   c:\windows\system32\2497927680.dat
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-07-27 10719848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vyd71.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MDM"=2 (0x2)
"LexBceS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-29 108289]
S0 Vyd71;Vyd71;c:\windows\system32\Drivers\Vyd71.sys --> c:\windows\system32\Drivers\Vyd71.sys [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 13:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
Czas ukończenia: 2009-08-11 13:20
ComboFix-quarantined-files.txt  2009-08-11 11:19
ComboFix2.txt  2009-08-11 09:35
ComboFix3.txt  2009-08-06 08:17
ComboFix4.txt  2009-08-05 17:52

Przed: 664 391 680 bajtów wolnych
Po: 657 154 048 bajtów wolnych

92


[wojtas]

musisz ten plik z plyty windowsa wrzucic do tej lokalizacji:

c:\windows\system32\drivers\tcpip.sys

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

Autor postu otrzymał pochwałę

[przemeksz]

Tylko, że nie mam płyty widnowsa Xp, bo ktoś mi go instalował i to dawno, z 3 lata temu. Jak inaczej to obejść? Możesz mi ten plik podesłać albo coś?
A jeśli chodzi o skanowanie Kasperskim, to nie mogę zrobić, bo nie mam Internetu przez skasowanie tamtych plików

[Okocza]

http://www.sendspace.pl/file/818e040e5e333d31d8a4de8

Plik tcpip.sys wolny od wirusa

Autor postu otrzymał pochwałę

[przemeksz]

Wielkie dzięki, pliczek zadziałał i już mam net.