win32-=

[baryła]

Miałwm wirusa Win32/adware.virtumonde aplikacja i zrobiłem scan comfix i usuną ale czy wszystko to nie wiem,poproszę o przejżenie logów z comfix i hijack.A ewentualnie co mam dalej robić. Pozdrawiam.

ComboFix 08-05-01.1 - Wojciech 2008-05-02 6:46:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.120 [GMT 2:00]
Running from: C:\Documents and Settings\Wojciech\Pulpit\TORRENTY\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\efcYpMFu.dll
C:\WINDOWS\system32\geBrsSkk.dll
C:\WINDOWS\system32\hgGywTmJ.dll
C:\WINDOWS\system32\uFMpYcfe.ini
C:\WINDOWS\system32\uFMpYcfe.ini2
C:\WINDOWS\system32\winitn.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 )))))))))))))))))))))))))))))))
.

2008-05-02 06:46 . 2008-05-02 06:46 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-01 20:47 . 2008-05-01 20:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback
2008-05-01 19:39 . 2008-05-01 19:39 <DIR> d--hs---- C:\!KillBox
2008-05-01 16:45 . 2007-05-25 14:48 3,154 --a------ C:\WINDOWS\system32\3DTitanicScreensaver.html
2008-05-01 15:46 . 2008-05-01 15:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Uniblue
2008-05-01 15:45 . 2008-05-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WinZip
2008-05-01 15:18 . 2008-05-01 15:18 <DIR> d-------- C:\WINDOWS\system32\3Planesoft
2008-05-01 13:43 . 2008-05-01 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 13:41 . 2008-05-01 13:41 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-01 13:39 . 2006-12-29 20:02 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-05-01 13:39 . 2006-12-29 20:21 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
2008-05-01 13:37 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002712_.tmp
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\IDM
2008-05-01 11:44 . 2008-05-01 16:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\DMCache
2008-05-01 08:18 . 2007-09-21 11:09 90,112 --a------ C:\WINDOWS\WateryDesktop_vista.dll
2008-05-01 08:18 . 2007-09-21 11:09 69,632 --a------ C:\WINDOWS\WateryDesktop_xp.dll
2008-04-30 18:16 . 2008-04-30 18:16 86 --a------ C:\WINDOWS\ProductKeyExplorer.INI
2008-04-30 10:11 . 2008-04-30 14:46 <DIR> d-------- C:\Program Files\Galleon 3D Screensaver
2008-04-30 10:07 . 2008-04-30 10:08 <DIR> d-------- C:\Program Files\Nautilus 3D Screensaver
2008-04-30 09:10 . 2004-03-09 15:29 167,936 --a------ C:\WINDOWS\Living 3D Butterflies Full.scr
2008-04-29 16:21 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Azureus
2008-04-29 13:53 . 2005-06-16 17:11 716,800 --a------ C:\WINDOWS\Living 3D Dinosaurs Full.scr
2008-04-29 12:17 . 2008-04-30 08:43 <DIR> d-------- C:\Program Files\Freeze.com
2008-04-29 07:22 . 2008-04-30 09:10 <DIR> d-------- C:\Program Files\ScreenSaver.com
2008-04-29 07:22 . 2004-04-08 07:51 939,368 --a------ C:\WINDOWS\flash.ocx
2008-04-29 07:22 . 2005-04-12 17:43 659,456 --a------ C:\WINDOWS\3D Lake Cabin Full.scr
2008-04-29 07:00 . 2008-04-29 07:00 63 --a------ C:\WINDOWS\wininit.ini
2008-04-29 06:51 . 2008-04-29 06:51 <DIR> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-28 19:33 . 2008-04-28 19:33 <DIR> d-------- C:\WINDOWS\system32\EWS
2008-04-27 17:54 . 2008-04-30 15:49 <DIR> d-------- C:\Program Files\Ad Muncher
2008-04-27 17:54 . 2008-04-27 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ad Muncher
2008-04-27 14:18 . 2008-05-01 14:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-27 11:54 . 2008-04-28 19:17 <DIR> d-------- C:\Program Files\Atlantis3D
2008-04-26 17:48 . 2008-04-26 17:48 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\WinCare2008
2008-04-23 17:40 . 2008-04-23 17:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-21 14:41 . 2008-01-07 14:29 352 ---h----- C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 14:38 . 2008-04-21 14:38 <DIR> d-------- C:\Program Files\ESET
2008-04-20 13:48 . 2008-04-20 13:48 8,704 ---hs---- C:\WINDOWS\Thumbs.db
2008-04-19 15:27 . 2008-04-19 15:27 <DIR> d-------- C:\WINDOWS\Cache
2008-04-16 08:19 . 2008-04-16 08:20 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-04-15 14:56 . 2008-04-15 14:56 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-15 14:53 . 2008-04-15 14:53 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-15 14:51 . 2008-04-15 14:51 <DIR> dr-h----- C:\MSOCache
2008-04-13 15:35 . 2008-05-01 19:45 <DIR> d-------- C:\Program Files\Winamp
2008-04-13 15:35 . 2008-04-14 17:34 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Winamp
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\Wojciech\ntuser.dat_TU_34122.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_81161.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_26301.LOG
2008-04-12 20:58 . 2008-04-12 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-04-12 20:58 . 2008-04-12 20:58 307,968 --------- C:\WINDOWS\system32\TuneUpDefragService.exe
2008-04-12 20:58 . 2008-02-27 13:15 28,416 --------- C:\WINDOWS\system32\uxtuneup.dll
2008-04-12 20:57 . 2008-04-20 08:08 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-04-12 20:57 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-12 17:46 . 2008-04-12 17:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\TuneUp Software
2008-04-12 08:58 . 2008-04-12 08:58 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-12 08:55 . 2008-04-12 08:59 79,609 --------- C:\WINDOWS\hpfins05.dat
2008-04-12 08:55 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-04-12 07:39 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-10 17:51 . 2008-04-11 06:54 78,762 --------- C:\WINDOWS\hpfins05.dat.temp
2008-04-10 17:51 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat.temp
2008-04-10 17:28 . 2008-04-10 17:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Image Zone Express
2008-04-10 08:20 . 2008-04-16 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-09 09:17 . 2008-04-12 08:12 1,374 --------- C:\WINDOWS\imsins.BAK
2008-04-07 17:36 . 2008-04-13 07:01 6,680,576 --------- C:\Documents and Settings\Wojciech\ntuser.dat_BAK_34122
2008-04-02 15:54 . 2008-04-02 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 04:19 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-01 17:45 --------- d-----w C:\Program Files\English Translator 3
2008-05-01 04:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-27 05:18 --------- d-----w C:\Program Files\Xvid
2008-04-12 06:58 --------- d-----w C:\Program Files\HP
2008-04-12 05:40 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Lavasoft
2008-04-07 12:24 484,352 --sh--w C:\Program Files\Common Files\mscom.dll
2008-04-07 12:24 20,480 --sh--w C:\Program Files\Common Files\smsse.exe
2008-04-03 14:28 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Skype
2008-04-03 14:14 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\skypePM
2008-03-31 16:01 --------- d-----w C:\Program Files\MSECache
2008-03-31 15:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-03-31 07:26 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-31 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\MegauploadToolbar
2008-03-29 08:20 259,072 --sh--w C:\Program Files\Common Files\mscome.exe
2008-03-28 06:56 --------- d-----w C:\Program Files\Weather Clock
2008-03-27 15:05 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\DAEMON Tools
2008-03-26 07:21 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Talkback
2008-03-24 07:27 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-24 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\URSoft
2008-03-22 19:39 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Weather Clock
2008-03-19 16:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-19 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-17 14:26 --------- d-----w C:\Program Files\Bonjour
2008-03-15 14:58 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-03-15 05:40 --------- d-----w C:\Program Files\TGTSoft
2008-03-14 16:00 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 15:59 --------- d-----w C:\Program Files\MSBuild
2008-03-14 11:24 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 11:23 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 06:28 --------- d-----w C:\Program Files\Real
2008-03-14 05:18 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Thinstall
2008-03-13 16:44 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-13 16:42 --------- d-----w C:\Program Files\Nero
2008-03-13 15:29 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-13 14:55 --------- d-----w C:\Program Files\CyberLink
2008-03-13 14:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-13 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-13 09:27 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Nero
2008-03-12 16:46 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\CyberLink
2008-03-12 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-12 16:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-09 16:08 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Media Player Classic
2008-03-08 15:23 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Apple Computer
2008-03-08 15:19 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-08 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-07 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-03 15:03 716,272 ------w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 14:45 --------- d-----w C:\Program Files\Audio Record Expert
2008-02-20 07:32 32 ------w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherClock"="C:\Program Files\Weather Clock\WeatherClock.exe" [2008-03-28 08:57 732639]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
"Ad Muncher"="C:\Program Files\Ad Muncher\AdMunch.exe" [2007-11-03 06:48 779776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--------- 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CryptLoad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--------- 2006-10-26 20:48 434528 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--------- 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--------- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--------- 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--------- 2007-09-20 10:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2003-10-31 20:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-r------- 2008-02-06 19:24 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--------- 2006-05-24 20:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--------- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-03-14 13:23 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
--------- 2008-02-29 14:24 196864 C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-r------- 2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-r------- 2005-03-11 11:33 147456 C:\WINDOWS\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zRain]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"8369:TCP"= 8369:TCP:BitComet 8369 TCP
"8369:UDP"= 8369:UDP:BitComet 8369 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundMaskRequest"= 1 (0x1)

R0 AFPAnsi;Alfa File Protector Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2007-03-11 22:39]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 15:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-12 20:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F62g62BC-4266-43f0-B6ED-9D76C4202C7E}]
C:\Program Files\Common Files\mscome.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-05-02 04:51:59 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-02 04:51:59 C:\WINDOWS\Tasks\1-Klik Konserwacja.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-02 06:52:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-05-02 6:55:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-02 04:55:28

Pre-Run: 39,385,919,488 bajtów wolnych
Post-Run: 39,386,435,584 bajt˘w wolnych

252 --- E O F --- 2008-04-24 05:25:51


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:06:52, on 2008-05-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Ad Muncher\AdMunch.exe
C:\Program Files\Weather Clock\WeatherClock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
D:\PROGRAMY ANTYWIRUSOWE\HIJACK\HiJackThis-narzędzie dom wykonywania loga\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Ad Muncher] "C:\Program Files\Ad Muncher\AdMunch.exe" /bt
O4 - HKCU\..\Run: [WeatherClock] C:\Program Files\Weather Clock\WeatherClock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Block frame with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame
O8 - Extra context menu item: Block image with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image
O8 - Extra context menu item: Block link with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link
O8 - Extra context menu item: Don't filter page with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Report page to the Ad Muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4D21BDFC-A621-4DE6-87DA-7C952D0ADF7E} (P00RecImageCtrl Class) - http://www.zaglebie-lubin.pl/www/inc/klub/nowy_stadion/kamera/push04.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7081 bytes

[Okocza]

otwórz notatnik wklej w nim:

Kod: Zaznacz wszystko

Files::

C:\Program Files\ScreenSaver.com
C:\Program Files\Freeze.com


Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[baryła]

Oto logi po ponownym scanie

ComboFix 08-05-01.1 - Wojciech 2008-05-02 15:13:23.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.148 [GMT 2:00]
Running from: D:\PROGRAMY ANTYWIRUSOWE\ComboFix.exe
Command switches used :: D:\PROGRAMY ANTYWIRUSOWE\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 )))))))))))))))))))))))))))))))
.

2008-05-02 07:57 . 2008-05-02 07:57 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2008-05-02 07:56 . 2008-05-02 08:02 <DIR> d-------- C:\Program Files\BitComet
2008-05-02 06:46 . 2008-05-02 15:13 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-01 20:47 . 2008-05-01 20:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback
2008-05-01 19:39 . 2008-05-01 19:39 <DIR> d--hs---- C:\!KillBox
2008-05-01 16:45 . 2007-05-25 14:48 3,154 --a------ C:\WINDOWS\system32\3DTitanicScreensaver.html
2008-05-01 15:46 . 2008-05-01 15:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Uniblue
2008-05-01 15:45 . 2008-05-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WinZip
2008-05-01 15:18 . 2008-05-01 15:18 <DIR> d-------- C:\WINDOWS\system32\3Planesoft
2008-05-01 13:43 . 2008-05-01 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 13:41 . 2008-05-01 13:41 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-01 13:39 . 2006-12-29 20:02 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-05-01 13:39 . 2006-12-29 20:21 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
2008-05-01 13:37 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002712_.tmp
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\IDM
2008-05-01 11:44 . 2008-05-01 16:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\DMCache
2008-05-01 08:18 . 2007-09-21 11:09 90,112 --a------ C:\WINDOWS\WateryDesktop_vista.dll
2008-05-01 08:18 . 2007-09-21 11:09 69,632 --a------ C:\WINDOWS\WateryDesktop_xp.dll
2008-04-30 18:16 . 2008-04-30 18:16 86 --a------ C:\WINDOWS\ProductKeyExplorer.INI
2008-04-30 10:11 . 2008-04-30 14:46 <DIR> d-------- C:\Program Files\Galleon 3D Screensaver
2008-04-30 10:07 . 2008-04-30 10:08 <DIR> d-------- C:\Program Files\Nautilus 3D Screensaver
2008-04-30 09:10 . 2004-03-09 15:29 167,936 --a------ C:\WINDOWS\Living 3D Butterflies Full.scr
2008-04-29 16:21 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Azureus
2008-04-29 13:53 . 2005-06-16 17:11 716,800 --a------ C:\WINDOWS\Living 3D Dinosaurs Full.scr
2008-04-29 12:17 . 2008-04-30 08:43 <DIR> d-------- C:\Program Files\Freeze.com
2008-04-29 07:22 . 2008-04-30 09:10 <DIR> d-------- C:\Program Files\ScreenSaver.com
2008-04-29 07:22 . 2004-04-08 07:51 939,368 --a------ C:\WINDOWS\flash.ocx
2008-04-29 07:22 . 2005-04-12 17:43 659,456 --a------ C:\WINDOWS\3D Lake Cabin Full.scr
2008-04-29 07:00 . 2008-04-29 07:00 63 --a------ C:\WINDOWS\wininit.ini
2008-04-29 06:51 . 2008-04-29 06:51 <DIR> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-28 19:33 . 2008-04-28 19:33 <DIR> d-------- C:\WINDOWS\system32\EWS
2008-04-27 17:54 . 2008-04-30 15:49 <DIR> d-------- C:\Program Files\Ad Muncher
2008-04-27 17:54 . 2008-04-27 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ad Muncher
2008-04-27 14:18 . 2008-05-01 14:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-27 11:54 . 2008-04-28 19:17 <DIR> d-------- C:\Program Files\Atlantis3D
2008-04-26 17:48 . 2008-04-26 17:48 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\WinCare2008
2008-04-23 17:40 . 2008-04-23 17:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-21 14:41 . 2008-01-07 14:29 352 ---h----- C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 14:38 . 2008-04-21 14:38 <DIR> d-------- C:\Program Files\ESET
2008-04-20 13:48 . 2008-04-20 13:48 8,704 ---hs---- C:\WINDOWS\Thumbs.db
2008-04-19 15:27 . 2008-04-19 15:27 <DIR> d-------- C:\WINDOWS\Cache
2008-04-16 08:19 . 2008-04-16 08:20 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-04-15 14:56 . 2008-04-15 14:56 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-15 14:53 . 2008-04-15 14:53 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-15 14:51 . 2008-04-15 14:51 <DIR> dr-h----- C:\MSOCache
2008-04-13 15:35 . 2008-05-01 19:45 <DIR> d-------- C:\Program Files\Winamp
2008-04-13 15:35 . 2008-04-14 17:34 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Winamp
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\Wojciech\ntuser.dat_TU_34122.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_81161.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_26301.LOG
2008-04-12 20:58 . 2008-04-12 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-04-12 20:58 . 2008-04-12 20:58 307,968 --------- C:\WINDOWS\system32\TuneUpDefragService.exe
2008-04-12 20:58 . 2008-02-27 13:15 28,416 --------- C:\WINDOWS\system32\uxtuneup.dll
2008-04-12 20:57 . 2008-04-20 08:08 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-04-12 20:57 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-12 17:46 . 2008-04-12 17:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\TuneUp Software
2008-04-12 08:58 . 2008-04-12 08:58 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-12 08:55 . 2008-04-12 08:59 79,609 --------- C:\WINDOWS\hpfins05.dat
2008-04-12 08:55 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-04-12 07:39 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-10 17:51 . 2008-04-11 06:54 78,762 --------- C:\WINDOWS\hpfins05.dat.temp
2008-04-10 17:51 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat.temp
2008-04-10 17:28 . 2008-04-10 17:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Image Zone Express
2008-04-10 08:20 . 2008-04-16 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-09 09:17 . 2008-04-12 08:12 1,374 --------- C:\WINDOWS\imsins.BAK
2008-04-07 17:36 . 2008-04-13 07:01 6,680,576 --------- C:\Documents and Settings\Wojciech\ntuser.dat_BAK_34122
2008-04-02 15:54 . 2008-04-02 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 05:27 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-01 17:45 --------- d-----w C:\Program Files\English Translator 3
2008-05-01 04:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-27 05:18 --------- d-----w C:\Program Files\Xvid
2008-04-14 21:16 1,804 ------w C:\WINDOWS\system32\dcache.bin
2008-04-12 06:58 --------- d-----w C:\Program Files\HP
2008-04-12 05:40 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Lavasoft
2008-04-07 12:24 484,352 --sh--w C:\Program Files\Common Files\mscom.dll
2008-04-07 12:24 20,480 --sh--w C:\Program Files\Common Files\smsse.exe
2008-04-03 14:28 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Skype
2008-04-03 14:14 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\skypePM
2008-03-31 16:01 --------- d-----w C:\Program Files\MSECache
2008-03-31 15:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-03-31 07:26 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-31 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\MegauploadToolbar
2008-03-29 08:20 259,072 --sh--w C:\Program Files\Common Files\mscome.exe
2008-03-28 06:56 --------- d-----w C:\Program Files\Weather Clock
2008-03-27 15:05 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\DAEMON Tools
2008-03-26 07:21 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Talkback
2008-03-24 07:27 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-24 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\URSoft
2008-03-22 19:39 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Weather Clock
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 16:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-19 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-17 14:26 --------- d-----w C:\Program Files\Bonjour
2008-03-15 14:58 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-03-15 05:40 --------- d-----w C:\Program Files\TGTSoft
2008-03-14 16:00 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 15:59 --------- d-----w C:\Program Files\MSBuild
2008-03-14 11:24 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 11:23 499,712 ------w C:\WINDOWS\system32\msvcp71.dll
2008-03-14 11:23 348,160 ------w C:\WINDOWS\system32\msvcr71.dll
2008-03-14 11:23 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 06:28 --------- d-----w C:\Program Files\Real
2008-03-14 05:18 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Thinstall
2008-03-13 16:44 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-13 16:42 --------- d-----w C:\Program Files\Nero
2008-03-13 15:29 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-13 14:55 --------- d-----w C:\Program Files\CyberLink
2008-03-13 14:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-13 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-13 09:27 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Nero
2008-03-12 16:46 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\CyberLink
2008-03-12 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-12 16:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-09 16:44 90,112 ------w C:\WINDOWS\system32\agsaami.dll
2008-03-09 16:44 610,304 ------w C:\WINDOWS\system32\agsaamg.dll
2008-03-09 16:44 372,736 ------w C:\WINDOWS\system32\agsaamc.dll
2008-03-09 16:44 2,535,424 ------w C:\WINDOWS\system32\agsaamj.dll
2008-03-09 16:08 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Media Player Classic
2008-03-08 15:23 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Apple Computer
2008-03-08 15:19 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-08 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-07 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-03 15:03 716,272 ------w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 14:45 --------- d-----w C:\Program Files\Audio Record Expert
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-28 12:26 1,414,440 ------w C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-02-23 16:23 202,248 ------w C:\WINDOWS\system32\oodtrrs.dll
2008-02-23 14:16 2,320,256 ------w C:\WINDOWS\system32\kernel1.exe
2008-02-20 07:32 32 ------w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr(4).dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dnsapi(4).dll
2008-02-19 21:04 591,872 ------w C:\WINDOWS\system32\context.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherClock"="C:\Program Files\Weather Clock\WeatherClock.exe" [2008-03-28 08:57 732639]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
"Ad Muncher"="C:\Program Files\Ad Muncher\AdMunch.exe" [2007-11-03 06:48 779776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--------- 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2008-03-25 08:38 2196280 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CryptLoad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--------- 2006-10-26 20:48 434528 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--------- 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--------- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--------- 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--------- 2007-09-20 10:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2003-10-31 20:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-r------- 2008-02-06 19:24 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--------- 2006-05-24 20:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--------- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-03-14 13:23 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
--------- 2008-02-29 14:24 196864 C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-r------- 2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-r------- 2005-03-11 11:33 147456 C:\WINDOWS\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zRain]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"8369:TCP"= 8369:TCP:BitComet 8369 TCP
"8369:UDP"= 8369:UDP:BitComet 8369 UDP
"20492:TCP"= 20492:TCP:BitComet 20492 TCP
"20492:UDP"= 20492:UDP:BitComet 20492 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundMaskRequest"= 1 (0x1)

R0 AFPAnsi;Alfa File Protector Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2007-03-11 22:39]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 15:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-12 20:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F62g62BC-4266-43f0-B6ED-9D76C4202C7E}]
C:\Program Files\Common Files\mscome.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-05-02 13:04:10 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-02 13:04:05 C:\WINDOWS\Tasks\1-Klik Konserwacja.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-02 15:15:28
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Ad Muncher\AM28140.dll
.
Completion time: 2008-05-02 15:17:28
ComboFix-quarantined-files.txt 2008-05-02 13:17:20
ComboFix2.txt 2008-05-02 04:55:36

Pre-Run: 39,322,783,744 bajtów wolnych
Post-Run: 39,313,018,880 bajtów wolnych

262 --- E O F --- 2008-04-24 05:25:51




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:18:30, on 2008-05-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Ad Muncher\AdMunch.exe
C:\Program Files\Weather Clock\WeatherClock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
D:\PROGRAMY ANTYWIRUSOWE\HIJACK\HiJackThis-narzędzie dom wykonywania loga\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Ad Muncher] "C:\Program Files\Ad Muncher\AdMunch.exe" /bt
O4 - HKCU\..\Run: [WeatherClock] C:\Program Files\Weather Clock\WeatherClock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Block frame with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame
O8 - Extra context menu item: Block image with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image
O8 - Extra context menu item: Block link with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link
O8 - Extra context menu item: Don't filter page with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Report page to the Ad Muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BD7A6CB-1CBD-49C2-A967-0E6A8F609FDE}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7184 bytes

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\002712_.tmp
C:\Program Files\Common Files\mscom.dll
C:\Program Files\Common Files\mscome.exe
C:\Program Files\Common Files\smsse.exe

Folder::
C:\Program Files\Freeze.com
C:\Program Files\ScreenSaver.com

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F62g62BC-4266-43f0-B6ED-9D76C4202C7E}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[baryła]

Log z ostatniego scanowania

ComboFix 08-05-01.1 - Wojciech 2008-05-02 16:37:08.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.205 [GMT 2:00]
Running from: D:\PROGRAMY ANTYWIRUSOWE\ComboFix.exe
Command switches used :: D:\PROGRAMY ANTYWIRUSOWE\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Freeze.com
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\dinosaurs.ico
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\freeze.ico
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\freeze.url
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\INSTALL.LOG
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\license.txt
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\ptest.exe
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\remove.exe
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\resources
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\settings.dat
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\settings.xml
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\Test Living 3D Dinosaurs Full.lnk
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\undata.exe
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\undata.ini
C:\Program Files\Freeze.com\Living 3D Dinosaurs Full\UNINSTAL.EXE
C:\Program Files\ScreenSaver.com
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\cabin.ico
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\freeze.ico
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\freeze.url
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\INSTALL.LOG
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\license.txt
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\ptest.exe
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\remove.exe
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\resources
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\settings.dat
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\settings.xml
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\Test 3D Lake Cabin Full.lnk
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\undata.exe
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\undata.ini
C:\Program Files\ScreenSaver.com\3D Lake Cabin Full\UNINSTAL.EXE

.
((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 )))))))))))))))))))))))))))))))
.

2008-05-02 15:52 . 2008-05-02 15:54 <DIR> d-------- C:\Program Files\Watermill 3D Screensaver
2008-05-02 07:57 . 2008-05-02 07:57 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2008-05-02 07:56 . 2008-05-02 08:02 <DIR> d-------- C:\Program Files\BitComet
2008-05-02 06:46 . 2008-05-02 16:36 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-01 20:47 . 2008-05-01 20:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback
2008-05-01 19:39 . 2008-05-01 19:39 <DIR> d--hs---- C:\!KillBox
2008-05-01 16:45 . 2007-05-25 14:48 3,154 --a------ C:\WINDOWS\system32\3DTitanicScreensaver.html
2008-05-01 15:46 . 2008-05-01 15:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Uniblue
2008-05-01 15:45 . 2008-05-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WinZip
2008-05-01 15:18 . 2008-05-01 15:18 <DIR> d-------- C:\WINDOWS\system32\3Planesoft
2008-05-01 13:43 . 2008-05-01 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 13:41 . 2008-05-01 13:41 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-01 13:39 . 2006-12-29 20:02 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-05-01 13:39 . 2006-12-29 20:21 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
2008-05-01 13:37 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002712_.tmp
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\IDM
2008-05-01 11:44 . 2008-05-01 16:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\DMCache
2008-05-01 08:18 . 2007-09-21 11:09 90,112 --a------ C:\WINDOWS\WateryDesktop_vista.dll
2008-05-01 08:18 . 2007-09-21 11:09 69,632 --a------ C:\WINDOWS\WateryDesktop_xp.dll
2008-04-30 18:16 . 2008-04-30 18:16 86 --a------ C:\WINDOWS\ProductKeyExplorer.INI
2008-04-30 10:11 . 2008-04-30 14:46 <DIR> d-------- C:\Program Files\Galleon 3D Screensaver
2008-04-30 10:07 . 2008-04-30 10:08 <DIR> d-------- C:\Program Files\Nautilus 3D Screensaver
2008-04-30 09:10 . 2004-03-09 15:29 167,936 --a------ C:\WINDOWS\Living 3D Butterflies Full.scr
2008-04-29 16:21 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Azureus
2008-04-29 13:53 . 2005-06-16 17:11 716,800 --a------ C:\WINDOWS\Living 3D Dinosaurs Full.scr
2008-04-29 07:22 . 2004-04-08 07:51 939,368 --a------ C:\WINDOWS\flash.ocx
2008-04-29 07:22 . 2005-04-12 17:43 659,456 --a------ C:\WINDOWS\3D Lake Cabin Full.scr
2008-04-29 07:00 . 2008-04-29 07:00 63 --a------ C:\WINDOWS\wininit.ini
2008-04-29 06:51 . 2008-04-29 06:51 <DIR> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-28 19:33 . 2008-04-28 19:33 <DIR> d-------- C:\WINDOWS\system32\EWS
2008-04-27 17:54 . 2008-04-30 15:49 <DIR> d-------- C:\Program Files\Ad Muncher
2008-04-27 17:54 . 2008-04-27 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ad Muncher
2008-04-27 14:18 . 2008-05-01 14:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-27 11:54 . 2008-04-28 19:17 <DIR> d-------- C:\Program Files\Atlantis3D
2008-04-26 17:48 . 2008-04-26 17:48 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\WinCare2008
2008-04-23 17:40 . 2008-04-23 17:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-21 14:41 . 2008-01-07 14:29 352 ---h----- C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 14:38 . 2008-04-21 14:38 <DIR> d-------- C:\Program Files\ESET
2008-04-20 13:48 . 2008-04-20 13:48 8,704 ---hs---- C:\WINDOWS\Thumbs.db
2008-04-19 15:27 . 2008-04-19 15:27 <DIR> d-------- C:\WINDOWS\Cache
2008-04-16 08:19 . 2008-04-16 08:20 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-04-15 14:56 . 2008-04-15 14:56 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-15 14:53 . 2008-04-15 14:53 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-15 14:51 . 2008-04-15 14:51 <DIR> dr-h----- C:\MSOCache
2008-04-13 15:35 . 2008-05-01 19:45 <DIR> d-------- C:\Program Files\Winamp
2008-04-13 15:35 . 2008-04-14 17:34 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Winamp
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\Wojciech\ntuser.dat_TU_34122.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_81161.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_26301.LOG
2008-04-12 20:58 . 2008-04-12 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-04-12 20:58 . 2008-04-12 20:58 307,968 --------- C:\WINDOWS\system32\TuneUpDefragService.exe
2008-04-12 20:58 . 2008-02-27 13:15 28,416 --------- C:\WINDOWS\system32\uxtuneup.dll
2008-04-12 20:57 . 2008-04-20 08:08 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-04-12 20:57 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-12 17:46 . 2008-04-12 17:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\TuneUp Software
2008-04-12 08:58 . 2008-04-12 08:58 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-12 08:55 . 2008-04-12 08:59 79,609 --------- C:\WINDOWS\hpfins05.dat
2008-04-12 08:55 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-04-12 07:39 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-10 17:51 . 2008-04-11 06:54 78,762 --------- C:\WINDOWS\hpfins05.dat.temp
2008-04-10 17:51 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat.temp
2008-04-10 17:28 . 2008-04-10 17:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Image Zone Express
2008-04-10 08:20 . 2008-04-16 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-09 09:17 . 2008-04-12 08:12 1,374 --------- C:\WINDOWS\imsins.BAK
2008-04-07 17:36 . 2008-04-13 07:01 6,680,576 --------- C:\Documents and Settings\Wojciech\ntuser.dat_BAK_34122
2008-04-02 15:54 . 2008-04-02 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 05:27 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-01 17:45 --------- d-----w C:\Program Files\English Translator 3
2008-05-01 04:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-27 05:18 --------- d-----w C:\Program Files\Xvid
2008-04-14 21:16 1,804 ------w C:\WINDOWS\system32\dcache.bin
2008-04-12 06:58 --------- d-----w C:\Program Files\HP
2008-04-12 05:40 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Lavasoft
2008-04-07 12:24 484,352 --sh--w C:\Program Files\Common Files\mscom.dll
2008-04-07 12:24 20,480 --sh--w C:\Program Files\Common Files\smsse.exe
2008-04-03 14:28 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Skype
2008-04-03 14:14 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\skypePM
2008-03-31 16:01 --------- d-----w C:\Program Files\MSECache
2008-03-31 15:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-03-31 07:26 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-31 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\MegauploadToolbar
2008-03-29 08:20 259,072 --sh--w C:\Program Files\Common Files\mscome.exe
2008-03-28 06:56 --------- d-----w C:\Program Files\Weather Clock
2008-03-27 15:05 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\DAEMON Tools
2008-03-26 07:21 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Talkback
2008-03-24 07:27 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-24 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\URSoft
2008-03-22 19:39 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Weather Clock
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 16:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-19 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-17 14:26 --------- d-----w C:\Program Files\Bonjour
2008-03-15 14:58 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-03-15 05:40 --------- d-----w C:\Program Files\TGTSoft
2008-03-14 16:00 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 15:59 --------- d-----w C:\Program Files\MSBuild
2008-03-14 11:24 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 11:23 499,712 ------w C:\WINDOWS\system32\msvcp71.dll
2008-03-14 11:23 348,160 ------w C:\WINDOWS\system32\msvcr71.dll
2008-03-14 11:23 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 06:28 --------- d-----w C:\Program Files\Real
2008-03-14 05:18 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Thinstall
2008-03-13 16:44 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-13 16:42 --------- d-----w C:\Program Files\Nero
2008-03-13 15:29 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-13 14:55 --------- d-----w C:\Program Files\CyberLink
2008-03-13 14:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-13 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-13 09:27 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Nero
2008-03-12 16:46 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\CyberLink
2008-03-12 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-12 16:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-09 16:44 90,112 ------w C:\WINDOWS\system32\agsaami.dll
2008-03-09 16:44 610,304 ------w C:\WINDOWS\system32\agsaamg.dll
2008-03-09 16:44 372,736 ------w C:\WINDOWS\system32\agsaamc.dll
2008-03-09 16:44 2,535,424 ------w C:\WINDOWS\system32\agsaamj.dll
2008-03-09 16:08 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Media Player Classic
2008-03-08 15:23 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Apple Computer
2008-03-08 15:19 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-08 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-07 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-03 15:03 716,272 ------w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 14:45 --------- d-----w C:\Program Files\Audio Record Expert
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-28 12:26 1,414,440 ------w C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-02-23 16:23 202,248 ------w C:\WINDOWS\system32\oodtrrs.dll
2008-02-23 14:16 2,320,256 ------w C:\WINDOWS\system32\kernel1.exe
2008-02-20 07:32 32 ------w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr(4).dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dnsapi(4).dll
2008-02-19 21:04 591,872 ------w C:\WINDOWS\system32\context.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherClock"="C:\Program Files\Weather Clock\WeatherClock.exe" [2008-03-28 08:57 732639]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
"Ad Muncher"="C:\Program Files\Ad Muncher\AdMunch.exe" [2007-11-03 06:48 779776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--------- 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2008-03-25 08:38 2196280 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CryptLoad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--------- 2006-10-26 20:48 434528 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--------- 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--------- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--------- 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--------- 2007-09-20 10:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2003-10-31 20:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-r------- 2008-02-06 19:24 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--------- 2006-05-24 20:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--------- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-03-14 13:23 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
--------- 2008-02-29 14:24 196864 C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-r------- 2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-r------- 2005-03-11 11:33 147456 C:\WINDOWS\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zRain]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"8369:TCP"= 8369:TCP:BitComet 8369 TCP
"8369:UDP"= 8369:UDP:BitComet 8369 UDP
"20492:TCP"= 20492:TCP:BitComet 20492 TCP
"20492:UDP"= 20492:UDP:BitComet 20492 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundMaskRequest"= 1 (0x1)

R0 AFPAnsi;Alfa File Protector Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2007-03-11 22:39]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 15:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-12 20:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-02 14:00:01 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-02 14:00:01 C:\WINDOWS\Tasks\1-Klik Konserwacja.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-02 16:38:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-02 16:40:19
ComboFix-quarantined-files.txt 2008-05-02 14:39:58

Pre-Run: 39,175,520,256 bajtów wolnych
Post-Run: 39,165,218,816 bajtów wolnych

285 --- E O F --- 2008-04-24 05:25:51

[wojtas]

te plik/i :

C:\Program Files\Common Files\mscom.dll
C:\WINDOWS\WateryDesktop_xp.dll

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

Jeśli nie będą widoczne, to najpierw usuń atrybuty ochronne:
>>Start>>Panel Sterowania>>Opcje Folderów>>Widok>>usuń zaznaczenie przy "Ukryj chronione pliki systemowe">
>zaznacz przy "Pokaż ukryte pliki">>Zastosuj>>OK.

[baryła]

Service load:
0% 100%
File: WateryDesktop_xp.dll
Status:
OK
MD5: 1333d6868078658d38b64d9be5036661
Packers detected:
-
Bit9 reports:
Scanner results
Scan taken on 02 May 2008 17:06:02 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

Water

Service load:
0% 100%
File: WateryDesktop_xp.dll
Status:
OK
MD5: 1333d6868078658d38b64d9be5036661
Packers detected:
-
Bit9 reports:
Scanner results
Scan taken on 02 May 2008 17:06:02 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

[ Dodano: Dzisiaj o 18:15 ]

Service load:
0% 100%
File: mscom.dll
Status:
INFECTED/MALWARE
MD5: 6bffcd7c13d1c20f46f330aeca146c1a
Packers detected:
-
Bit9 reports:
Scanner results
Scan taken on 02 May 2008 16:55:27 (GMT)
A-Squared
Found Backdoor.Win32.Delf.dpx
AntiVir
Found BDS/Delf.dpx
ArcaVir
Found Trojan.Delf.Dpx
Avast
Found Win32:Trojan-gen {Delphi}
AVG Antivirus
Found BackDoor.Generic9.VLL
BitDefender
Found nothing
ClamAV
Found Trojan.Agent-14151
CPsecure
Found BackDoor.W32.Delf.dpx
Dr.Web
Found BackDoor.Sabason
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found Backdoor.Win32.Delf.dpx
Fortinet
Found W32/Delf.DPX!tr.bdr
Ikarus
Found Backdoor.Win32.Delf.dpx
Kaspersky Anti-Virus
Found Backdoor.Win32.Delf.dpx
NOD32
Found nothing
Norman Virus Control
Found W32/Delf.BLSY
Panda Antivirus
Found Trj/Downloader.MDW
Sophos Antivirus
Found Mal/Generic-A
VirusBuster
Found nothing
VBA32
Found Backdoor.Win32.Delf.dpx

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\002712_.tmp
C:\Program Files\Common Files\mscom.dll
C:\Program Files\Common Files\mscome.exe
C:\Program Files\Common Files\smsse.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa . odczekaj az wygeneruje sie nowy log i go daj na forum

[baryła]

ComboFix 08-05-01.1 - Wojciech 2008-05-02 19:41:55.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.177 [GMT 2:00]
Running from: C:\Documents and Settings\Wojciech\Pulpit\SCANOWANIE\ComboFix.exe
Command switches used :: C:\Documents and Settings\Wojciech\Pulpit\SCANOWANIE\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 )))))))))))))))))))))))))))))))
.

2008-05-02 19:04 . 2008-05-02 19:04 <DIR> d-------- C:\Program Files\Nowy folder
2008-05-02 15:52 . 2008-05-02 15:54 <DIR> d-------- C:\Program Files\Watermill 3D Screensaver
2008-05-02 07:57 . 2008-05-02 07:57 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2008-05-02 07:56 . 2008-05-02 08:02 <DIR> d-------- C:\Program Files\BitComet
2008-05-02 06:46 . 2008-05-02 16:36 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-01 20:47 . 2008-05-01 20:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback
2008-05-01 19:39 . 2008-05-01 19:39 <DIR> d--hs---- C:\!KillBox
2008-05-01 16:45 . 2007-05-25 14:48 3,154 --a------ C:\WINDOWS\system32\3DTitanicScreensaver.html
2008-05-01 15:46 . 2008-05-01 15:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Uniblue
2008-05-01 15:45 . 2008-05-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WinZip
2008-05-01 15:18 . 2008-05-01 15:18 <DIR> d-------- C:\WINDOWS\system32\3Planesoft
2008-05-01 13:43 . 2008-05-01 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 13:41 . 2008-05-01 13:41 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-01 13:39 . 2006-12-29 20:02 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-05-01 13:39 . 2006-12-29 20:21 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
2008-05-01 13:37 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002712_.tmp
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\IDM
2008-05-01 11:44 . 2008-05-01 16:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\DMCache
2008-04-30 18:16 . 2008-04-30 18:16 86 --a------ C:\WINDOWS\ProductKeyExplorer.INI
2008-04-30 10:11 . 2008-04-30 14:46 <DIR> d-------- C:\Program Files\Galleon 3D Screensaver
2008-04-30 10:07 . 2008-04-30 10:08 <DIR> d-------- C:\Program Files\Nautilus 3D Screensaver
2008-04-30 09:10 . 2004-03-09 15:29 167,936 --a------ C:\WINDOWS\Living 3D Butterflies Full.scr
2008-04-29 16:21 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Azureus
2008-04-29 13:53 . 2005-06-16 17:11 716,800 --a------ C:\WINDOWS\Living 3D Dinosaurs Full.scr
2008-04-29 07:22 . 2004-04-08 07:51 939,368 --a------ C:\WINDOWS\flash.ocx
2008-04-29 07:22 . 2005-04-12 17:43 659,456 --a------ C:\WINDOWS\3D Lake Cabin Full.scr
2008-04-29 07:00 . 2008-04-29 07:00 63 --a------ C:\WINDOWS\wininit.ini
2008-04-29 06:51 . 2008-04-29 06:51 <DIR> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-28 19:33 . 2008-04-28 19:33 <DIR> d-------- C:\WINDOWS\system32\EWS
2008-04-27 17:54 . 2008-04-30 15:49 <DIR> d-------- C:\Program Files\Ad Muncher
2008-04-27 17:54 . 2008-04-27 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ad Muncher
2008-04-27 14:18 . 2008-05-01 14:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-27 11:54 . 2008-04-28 19:17 <DIR> d-------- C:\Program Files\Atlantis3D
2008-04-26 17:48 . 2008-04-26 17:48 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\WinCare2008
2008-04-23 17:40 . 2008-04-23 17:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-21 14:41 . 2008-01-07 14:29 352 ---h----- C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 14:38 . 2008-04-21 14:38 <DIR> d-------- C:\Program Files\ESET
2008-04-20 13:48 . 2008-04-20 13:48 8,704 ---hs---- C:\WINDOWS\Thumbs.db
2008-04-19 15:27 . 2008-04-19 15:27 <DIR> d-------- C:\WINDOWS\Cache
2008-04-16 08:19 . 2008-04-16 08:20 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-04-15 14:56 . 2008-04-15 14:56 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-15 14:53 . 2008-04-15 14:53 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-15 14:51 . 2008-04-15 14:51 <DIR> dr-h----- C:\MSOCache
2008-04-13 15:35 . 2008-05-01 19:45 <DIR> d-------- C:\Program Files\Winamp
2008-04-13 15:35 . 2008-04-14 17:34 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Winamp
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\Wojciech\ntuser.dat_TU_34122.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_81161.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_26301.LOG
2008-04-12 20:58 . 2008-04-12 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-04-12 20:58 . 2008-04-12 20:58 307,968 --------- C:\WINDOWS\system32\TuneUpDefragService.exe
2008-04-12 20:58 . 2008-02-27 13:15 28,416 --------- C:\WINDOWS\system32\uxtuneup.dll
2008-04-12 20:57 . 2008-04-20 08:08 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-04-12 20:57 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-12 17:46 . 2008-04-12 17:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\TuneUp Software
2008-04-12 08:58 . 2008-04-12 08:58 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-12 08:55 . 2008-04-12 08:59 79,609 --------- C:\WINDOWS\hpfins05.dat
2008-04-12 08:55 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-04-12 07:39 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-10 17:51 . 2008-04-11 06:54 78,762 --------- C:\WINDOWS\hpfins05.dat.temp
2008-04-10 17:51 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat.temp
2008-04-10 17:28 . 2008-04-10 17:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Image Zone Express
2008-04-10 08:20 . 2008-04-16 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-09 09:17 . 2008-04-12 08:12 1,374 --------- C:\WINDOWS\imsins.BAK
2008-04-07 17:36 . 2008-04-13 07:01 6,680,576 --------- C:\Documents and Settings\Wojciech\ntuser.dat_BAK_34122
2008-04-02 15:54 . 2008-04-02 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 05:27 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-01 17:45 --------- d-----w C:\Program Files\English Translator 3
2008-05-01 04:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-27 05:18 --------- d-----w C:\Program Files\Xvid
2008-04-14 21:16 1,804 ------w C:\WINDOWS\system32\dcache.bin
2008-04-12 06:58 --------- d-----w C:\Program Files\HP
2008-04-12 05:40 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Lavasoft
2008-04-07 12:24 484,352 --sha-w C:\Program Files\Common Files\mscom.dll
2008-04-07 12:24 20,480 --sh--w C:\Program Files\Common Files\smsse.exe
2008-04-03 14:28 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Skype
2008-04-03 14:14 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\skypePM
2008-03-31 16:01 --------- d-----w C:\Program Files\MSECache
2008-03-31 15:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-03-31 07:26 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-31 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\MegauploadToolbar
2008-03-29 08:20 259,072 --sh--w C:\Program Files\Common Files\mscome.exe
2008-03-28 06:56 --------- d-----w C:\Program Files\Weather Clock
2008-03-27 15:05 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\DAEMON Tools
2008-03-26 07:21 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Talkback
2008-03-24 07:27 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-24 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\URSoft
2008-03-22 19:39 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Weather Clock
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 16:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-19 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-17 14:26 --------- d-----w C:\Program Files\Bonjour
2008-03-15 14:58 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-03-15 05:40 --------- d-----w C:\Program Files\TGTSoft
2008-03-14 16:00 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 15:59 --------- d-----w C:\Program Files\MSBuild
2008-03-14 11:24 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 11:23 499,712 ------w C:\WINDOWS\system32\msvcp71.dll
2008-03-14 11:23 348,160 ------w C:\WINDOWS\system32\msvcr71.dll
2008-03-14 11:23 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 06:28 --------- d-----w C:\Program Files\Real
2008-03-14 05:18 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Thinstall
2008-03-13 16:44 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-13 16:42 --------- d-----w C:\Program Files\Nero
2008-03-13 15:29 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-13 14:55 --------- d-----w C:\Program Files\CyberLink
2008-03-13 14:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-13 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-13 09:27 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Nero
2008-03-12 16:46 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\CyberLink
2008-03-12 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-12 16:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-09 16:44 90,112 ------w C:\WINDOWS\system32\agsaami.dll
2008-03-09 16:44 610,304 ------w C:\WINDOWS\system32\agsaamg.dll
2008-03-09 16:44 372,736 ------w C:\WINDOWS\system32\agsaamc.dll
2008-03-09 16:44 2,535,424 ------w C:\WINDOWS\system32\agsaamj.dll
2008-03-09 16:08 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Media Player Classic
2008-03-08 15:23 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Apple Computer
2008-03-08 15:19 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-08 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-07 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-03 15:03 716,272 ------w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 14:45 --------- d-----w C:\Program Files\Audio Record Expert
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-28 12:26 1,414,440 ------w C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-02-23 16:23 202,248 ------w C:\WINDOWS\system32\oodtrrs.dll
2008-02-23 14:16 2,320,256 ------w C:\WINDOWS\system32\kernel1.exe
2008-02-20 07:32 32 ------w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr(4).dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dnsapi(4).dll
2008-02-19 21:04 591,872 ------w C:\WINDOWS\system32\context.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-02_16.39.45,53 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-02 13:50:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-02 16:45:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherClock"="C:\Program Files\Weather Clock\WeatherClock.exe" [2008-03-28 08:57 732639]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
"Ad Muncher"="C:\Program Files\Ad Muncher\AdMunch.exe" [2007-11-03 06:48 779776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--------- 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2008-03-25 08:38 2196280 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CryptLoad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--------- 2006-10-26 20:48 434528 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--------- 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--------- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--------- 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--------- 2007-09-20 10:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2003-10-31 20:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-r------- 2008-02-06 19:24 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--------- 2006-05-24 20:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--------- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-03-14 13:23 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
--------- 2008-02-29 14:24 196864 C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-r------- 2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-r------- 2005-03-11 11:33 147456 C:\WINDOWS\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zRain]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"8369:TCP"= 8369:TCP:BitComet 8369 TCP
"8369:UDP"= 8369:UDP:BitComet 8369 UDP
"20492:TCP"= 20492:TCP:BitComet 20492 TCP
"20492:UDP"= 20492:UDP:BitComet 20492 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundMaskRequest"= 1 (0x1)

R0 AFPAnsi;Alfa File Protector Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2007-03-11 22:39]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 15:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-12 20:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-02 17:00:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-02 17:00:00 C:\WINDOWS\Tasks\1-Klik Konserwacja.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-02 19:43:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-02 19:45:12
ComboFix-quarantined-files.txt 2008-05-02 17:44:51
ComboFix2.txt 2008-05-02 14:40:20

Pre-Run: 38,975,787,008 bajtów wolnych
Post-Run: 38,969,532,416 bajtów wolnych

257 --- E O F --- 2008-04-24 05:25:51

[wojtas]

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\WINDOWS\002712_.tmp
C:\Program Files\Common Files\mscom.dll
C:\Program Files\Common Files\mscome.exe
C:\Program Files\Common Files\smsse.exe

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Po całej operacji należy zresetować komputer

[baryła]

Tak też zrobiłem jak kazałeś.Czy to już wszystko.Czy jest ok.

[wojtas]

daj nowego loga z combofixa widze u Ciebie duzo jakis wygaszaczy czy sciagales to sam ? czy mam kasowac?

np:

C:\Program Files\Watermill 3D Screensaver
C:\WINDOWS\system32\3DTitanicScreensaver.html

[baryła]

Sam wgrywałem.Chcę pozostawić wygaszacze -
1.Ancient Castle
2.Loving 3D Butterfilles
3.Nautilus
4.Shark vision
5.Watermill 3d


ComboFix 08-05-01.1 - Wojciech 2008-05-03 6:49:05.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.130 [GMT 2:00]
Running from: C:\Documents and Settings\Wojciech\Pulpit\SCANOWANIE\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.

2008-05-02 20:00 . 2008-05-02 20:00 <DIR> d-------- C:\_OTMoveIt
2008-05-02 19:04 . 2008-05-02 19:04 <DIR> d-------- C:\Program Files\Nowy folder
2008-05-02 15:52 . 2008-05-02 15:54 <DIR> d-------- C:\Program Files\Watermill 3D Screensaver
2008-05-02 07:57 . 2008-05-02 07:57 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2008-05-02 07:56 . 2008-05-02 08:02 <DIR> d-------- C:\Program Files\BitComet
2008-05-02 06:46 . 2008-05-02 16:36 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-01 20:47 . 2008-05-01 20:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback
2008-05-01 19:39 . 2008-05-01 19:39 <DIR> d--hs---- C:\!KillBox
2008-05-01 16:45 . 2007-05-25 14:48 3,154 --a------ C:\WINDOWS\system32\3DTitanicScreensaver.html
2008-05-01 15:46 . 2008-05-01 15:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Uniblue
2008-05-01 15:45 . 2008-05-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WinZip
2008-05-01 15:18 . 2008-05-01 15:18 <DIR> d-------- C:\WINDOWS\system32\3Planesoft
2008-05-01 13:43 . 2008-05-01 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 13:41 . 2008-05-01 13:41 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-01 13:39 . 2006-12-29 20:02 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-05-01 13:39 . 2006-12-29 20:21 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-01 11:44 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\IDM
2008-05-01 11:44 . 2008-05-01 16:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\DMCache
2008-04-30 18:16 . 2008-04-30 18:16 86 --a------ C:\WINDOWS\ProductKeyExplorer.INI
2008-04-30 10:11 . 2008-04-30 14:46 <DIR> d-------- C:\Program Files\Galleon 3D Screensaver
2008-04-30 10:07 . 2008-04-30 10:08 <DIR> d-------- C:\Program Files\Nautilus 3D Screensaver
2008-04-30 09:10 . 2004-03-09 15:29 167,936 --a------ C:\WINDOWS\Living 3D Butterflies Full.scr
2008-04-29 16:21 . 2008-05-01 19:49 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Azureus
2008-04-29 07:22 . 2004-04-08 07:51 939,368 --a------ C:\WINDOWS\flash.ocx
2008-04-29 07:00 . 2008-04-29 07:00 63 --a------ C:\WINDOWS\wininit.ini
2008-04-29 06:51 . 2008-04-29 06:51 <DIR> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-28 19:33 . 2008-04-28 19:33 <DIR> d-------- C:\WINDOWS\system32\EWS
2008-04-27 17:54 . 2008-04-30 15:49 <DIR> d-------- C:\Program Files\Ad Muncher
2008-04-27 17:54 . 2008-04-27 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ad Muncher
2008-04-27 14:18 . 2008-05-01 14:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-27 11:54 . 2008-04-28 19:17 <DIR> d-------- C:\Program Files\Atlantis3D
2008-04-26 17:48 . 2008-04-26 17:48 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\WinCare2008
2008-04-23 17:40 . 2008-04-23 17:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-21 14:41 . 2008-01-07 14:29 352 ---h----- C:\WINDOWS\nod32fixtemdono.reg
2008-04-21 14:38 . 2008-04-21 14:38 <DIR> d-------- C:\Program Files\ESET
2008-04-20 13:48 . 2008-04-20 13:48 8,704 ---hs---- C:\WINDOWS\Thumbs.db
2008-04-19 15:27 . 2008-04-19 15:27 <DIR> d-------- C:\WINDOWS\Cache
2008-04-16 08:19 . 2008-04-16 08:20 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-04-15 14:56 . 2008-04-15 14:56 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-15 14:53 . 2008-04-15 14:53 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-15 14:51 . 2008-04-15 14:51 <DIR> dr-h----- C:\MSOCache
2008-04-13 15:35 . 2008-05-01 19:45 <DIR> d-------- C:\Program Files\Winamp
2008-04-13 15:35 . 2008-04-14 17:34 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Winamp
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\Wojciech\ntuser.dat_TU_34122.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_81161.LOG
2008-04-13 07:01 . 2008-04-13 07:01 0 ---h----- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_26301.LOG
2008-04-12 20:58 . 2008-04-12 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-04-12 20:58 . 2008-04-12 20:58 307,968 --------- C:\WINDOWS\system32\TuneUpDefragService.exe
2008-04-12 20:58 . 2008-02-27 13:15 28,416 --------- C:\WINDOWS\system32\uxtuneup.dll
2008-04-12 20:57 . 2008-04-20 08:08 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-04-12 20:57 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-12 17:46 . 2008-04-12 17:46 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\TuneUp Software
2008-04-12 08:58 . 2008-04-12 08:58 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-12 08:55 . 2008-04-12 08:59 79,609 --------- C:\WINDOWS\hpfins05.dat
2008-04-12 08:55 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-04-12 07:39 . 2008-04-17 17:07 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-10 17:51 . 2008-04-11 06:54 78,762 --------- C:\WINDOWS\hpfins05.dat.temp
2008-04-10 17:51 . 2005-05-24 05:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat.temp
2008-04-10 17:28 . 2008-04-10 17:28 <DIR> d-------- C:\Documents and Settings\Wojciech\Dane aplikacji\Image Zone Express
2008-04-10 08:20 . 2008-04-16 08:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-09 09:17 . 2008-04-12 08:12 1,374 --------- C:\WINDOWS\imsins.BAK
2008-04-07 17:36 . 2008-04-13 07:01 6,680,576 --------- C:\Documents and Settings\Wojciech\ntuser.dat_BAK_34122

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-03 04:44 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-01 17:45 --------- d-----w C:\Program Files\English Translator 3
2008-05-01 04:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-04-27 05:18 --------- d-----w C:\Program Files\Xvid
2008-04-14 21:16 1,804 ------w C:\WINDOWS\system32\dcache.bin
2008-04-12 06:58 --------- d-----w C:\Program Files\HP
2008-04-12 05:40 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Lavasoft
2008-04-03 14:28 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Skype
2008-04-03 14:14 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\skypePM
2008-04-02 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-03-31 16:01 --------- d-----w C:\Program Files\MSECache
2008-03-31 15:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-03-31 07:26 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-31 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\MegauploadToolbar
2008-03-28 06:56 --------- d-----w C:\Program Files\Weather Clock
2008-03-27 15:05 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\DAEMON Tools
2008-03-26 07:21 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Talkback
2008-03-24 07:27 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-24 07:26 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\URSoft
2008-03-22 19:39 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Weather Clock
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 16:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-19 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-17 14:26 --------- d-----w C:\Program Files\Bonjour
2008-03-15 14:58 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-03-15 05:40 --------- d-----w C:\Program Files\TGTSoft
2008-03-14 16:00 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 15:59 --------- d-----w C:\Program Files\MSBuild
2008-03-14 11:24 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 11:23 499,712 ------w C:\WINDOWS\system32\msvcp71.dll
2008-03-14 11:23 348,160 ------w C:\WINDOWS\system32\msvcr71.dll
2008-03-14 11:23 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 06:28 --------- d-----w C:\Program Files\Real
2008-03-14 05:18 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Thinstall
2008-03-13 16:44 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-13 16:42 --------- d-----w C:\Program Files\Nero
2008-03-13 15:29 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-13 14:55 --------- d-----w C:\Program Files\CyberLink
2008-03-13 14:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-13 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-03-13 09:27 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Nero
2008-03-12 16:46 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\CyberLink
2008-03-12 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-12 16:41 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-09 16:44 90,112 ------w C:\WINDOWS\system32\agsaami.dll
2008-03-09 16:44 610,304 ------w C:\WINDOWS\system32\agsaamg.dll
2008-03-09 16:44 372,736 ------w C:\WINDOWS\system32\agsaamc.dll
2008-03-09 16:44 2,535,424 ------w C:\WINDOWS\system32\agsaamj.dll
2008-03-09 16:08 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Media Player Classic
2008-03-08 15:23 --------- d-----w C:\Documents and Settings\Wojciech\Dane aplikacji\Apple Computer
2008-03-08 15:19 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-08 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-03-07 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-03 15:03 716,272 ------w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 14:45 --------- d-----w C:\Program Files\Audio Record Expert
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-28 12:26 1,414,440 ------w C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-02-23 16:23 202,248 ------w C:\WINDOWS\system32\oodtrrs.dll
2008-02-23 14:16 2,320,256 ------w C:\WINDOWS\system32\kernel1.exe
2008-02-20 07:32 32 ------w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr(4).dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dnsapi(4).dll
2008-02-19 21:04 591,872 ------w C:\WINDOWS\system32\context.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-02_16.39.45,53 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-02 13:50:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 04:38:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherClock"="C:\Program Files\Weather Clock\WeatherClock.exe" [2008-03-28 08:57 732639]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
"Ad Muncher"="C:\Program Files\Ad Muncher\AdMunch.exe" [2007-11-03 06:48 779776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--------- 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2008-03-25 08:38 2196280 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CryptLoad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--------- 2006-10-26 20:48 434528 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--------- 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--------- 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--------- 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--------- 2007-09-20 10:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NodLogin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2003-10-31 20:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-r------- 2008-02-06 19:24 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--------- 2006-05-24 20:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--------- 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-03-14 13:23 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TuneUp MemOptimizer]
--------- 2008-02-29 14:24 196864 C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-r------- 2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
-r------- 2005-03-11 11:33 147456 C:\WINDOWS\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zRain]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"8369:TCP"= 8369:TCP:BitComet 8369 TCP
"8369:UDP"= 8369:UDP:BitComet 8369 UDP
"20492:TCP"= 20492:TCP:BitComet 20492 TCP
"20492:UDP"= 20492:UDP:BitComet 20492 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundMaskRequest"= 1 (0x1)

R0 AFPAnsi;Alfa File Protector Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2007-03-11 22:39]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 15:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-12 20:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-03 04:38:39 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-03 04:38:33 C:\WINDOWS\Tasks\1-Klik Konserwacja.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 06:50:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-03 6:52:29
ComboFix-quarantined-files.txt 2008-05-03 04:52:17
ComboFix2.txt 2008-05-03 04:10:21
ComboFix3.txt 2008-05-02 17:45:13
ComboFix4.txt 2008-05-02 14:40:20

Pre-Run: 39,038,218,240 bajtów wolnych
Post-Run: 39,029,362,688 bajtów wolnych

252 --- E O F --- 2008-04-24 05:25:51

[wojtas]

C:\WINDOWS\system32\3DTitanicScreensaver.html
C:\Program Files\Galleon 3D Screensaver

skasuj ^^ pogrubione

te plik/i :

C:\WINDOWS\ProductKeyExplorer.INI

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raport

[baryła]

Powiedz mi czy dobrze robię w/w raporty,jeżeli nie to poproszę o podpowiedż jak mam to robić.

Service load:
0% 100%
File: ProductKeyExplorer.INI
Status:
OK
MD5: b2465660e65026f8694068a3cdc9f2b6
Packers detected:
-
Bit9 reports:
Scanner results
Scan taken on 03 May 2008 10:10:47 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing









Plik ProductKeyExplorer.INI otrzymany 2008.05.03 12:14:51 (CET)
Antywirus Wersja Ostatnia aktualizacja Wynik
AhnLab-V3 2008.5.3.0 2008.05.02 -
AntiVir 7.8.0.11 2008.05.02 -
Authentium 4.93.8 2008.05.02 -
Avast 4.8.1169.0 2008.05.03 -
AVG 7.5.0.516 2008.05.03 -
BitDefender 7.2 2008.05.03 -
CAT-QuickHeal 9.50 2008.05.02 -
ClamAV 0.92.1 2008.05.02 -
DrWeb 4.44.0.09170 2008.05.03 -
eSafe 7.0.15.0 2008.04.28 -
eTrust-Vet 31.3.5755 2008.05.03 -
Ewido 4.0 2008.05.02 -
F-Prot 4.4.2.54 2008.05.02 -
F-Secure 6.70.13260.0 2008.05.03 -
FileAdvisor 1 2008.05.03 -
Fortinet 3.14.0.0 2008.05.03 -
Ikarus T3.1.1.26.0 2008.05.03 -
Kaspersky 7.0.0.125 2008.05.03 -
McAfee 5287 2008.05.02 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3072 2008.05.03 -
Norman 5.80.02 2008.05.02 -
Panda 9.0.0.4 2008.05.03 -
Prevx1 V2 2008.05.03 -
Rising 20.42.22.00 2008.04.30 -
Sophos 4.29.0 2008.05.03 -
Sunbelt 3.0.1097.0 2008.05.03 -
TheHacker 6.2.92.299 2008.05.03 -
VBA32 3.12.6.5 2008.05.02 -
VirusBuster 4.3.26:9 2008.05.02 -
Webwasher-Gateway 6.6.2 2008.05.03 -
Dodatkowe informacje
File size: 86 bytes
MD5...: b2465660e65026f8694068a3cdc9f2b6
SHA1..: b959ad20922155c621e3dc02d8723697dd84b1b9
SHA256: a7bc5487efc7e38b55408daf4763fcc5b640f1be9456d4b8a29edda5ea5c1f8c
SHA512: 46d9011e72f36c526a26000dc6ad3a020af10ccb5d8b7892dbf1af18bdde9045<br>5aeaee6ebde21e6f55c6f899c4d16039ffb8ea957abdf03e702ccc3f83ab3a19
PEiD..: -
PEInfo: -

[wojtas]

tak to są raporty:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem i powinno byc ok

[baryła]

Wszystko zrobione tak jak pisałeś.Tylko z %userprofile% nie mogę usunąć pliku "ntuser.dat"Dostaję odpowiedż Używany przez inną osobę lub program i.t.d.Co mam dalej robić.

[Okocza]

nic już, jest czysto, teraz powinno być ok