windows security alert. zablokowany taskman.exe

[narg]

Problem
komunikat: "spyware alert" -- worm.win32.NetSky detected on your machine(...)
ctrl +alt + del: "menedżer zadań został wyłączony przez administratora"
ikonki: ErrorCleaner PrivacyProtector Spyware&Malware Protection
otwierajace sie strony www

uzywam firefox

Logfile of HijackThis v1.99.1
Scan saved at 15:06:04, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file)
O2 - BHO: BDEX System - {5085333B-FD15-4754-A571-852F7077C5F2} - C:\WINDOWS\dxpvqlmqng.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: The ensfolr - {A037112F-183D-4E98-8CEA-1A0D93BA9F48} - C:\WINDOWS\ensfolr.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O20 - AppInit_DLLs: CLKERN.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: bklgvsf - {1BC12C81-51AD-4097-94F5-0BD09E6A4428} - C:\WINDOWS\bklgvsf.dll
O21 - SSODL: ampkfst - {C82010D6-BA3E-4074-A2E5-675B6ABB9EEC} - C:\WINDOWS\ampkfst.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[Dzi@dek]

http://www.programosy.pl/program,combofix.html
daj log.

[narg]

ComboFix 08-01-04.1 - R 2008-01-07 15:58:11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.420 [GMT 1:00]
Running from: C:\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\ampkfst.dll
C:\WINDOWS\bklgvsf.dll
C:\WINDOWS\dat.txt
C:\WINDOWS\ensfolr.dll
C:\WINDOWS\foxflpd.exe
C:\WINDOWS\system32\uninstall.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-07 15:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-06 23:56 . 2008-01-05 15:06 311,296 --a------ C:\WINDOWS\dxpvqlmqng.dll
2008-01-03 19:06 . 2008-01-06 21:32 2,022,270 --a------ C:\WINDOWS\Untitled.scr
2008-01-03 19:06 . 2008-01-06 21:32 45,056 --a------ C:\WINDOWS\NCUNINST.EXe
2008-01-03 19:06 . 2008-01-03 19:06 40,960 --a------ C:\WINDOWS\NCLAUNCH.EXe
2007-12-31 22:16 . 2008-01-02 22:45 10 --a------ C:\WINDOWS\popcinfo.dat
2007-12-31 03:09 . 2008-01-07 15:52 <DIR> d-------- C:\Program Files\FlashGet
2007-12-31 00:45 . 2008-01-07 15:51 <DIR> d-------- C:\Downloads
2007-12-30 00:03 . 2007-12-30 00:03 <DIR> d-------- C:\Program Files\FLVPlayer
2007-12-29 12:57 . 2007-12-31 04:04 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-27 15:32 . 2007-12-27 15:32 <DIR> d-------- C:\Program Files\Real Alternative
2007-12-25 14:19 . 2007-12-25 14:25 69,632 --a------ C:\WINDOWS\AutoUpdateWin31.dll
2007-12-24 05:26 . 2007-12-24 05:26 <DIR> d--h----- C:\WINDOWS\PIF
2007-12-23 18:50 . 2007-12-23 18:50 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-23 16:59 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-12-23 16:58 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-23 16:49 . 2007-12-23 16:58 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-23 16:49 . 2007-12-23 20:03 <DIR> d-------- C:\Program Files\Samsung
2007-12-23 16:49 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-23 15:46 . 2007-12-25 14:15 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-12 14:19 . 2007-12-12 14:19 <DIR> dr-h----- C:\Documents and Settings\R\Dane aplikacji\SecuROM
2007-12-12 14:19 . 2007-12-12 14:19 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-12 14:18 . 2007-12-12 14:18 <DIR> d-------- C:\Program Files\GameShadow
2007-12-12 13:23 . 2007-12-16 18:37 <DIR> d-------- C:\Program Files\Image-Line
2007-12-12 13:23 . 2002-07-07 23:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2007-12-12 13:23 . 2006-06-20 09:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2007-12-07 18:28 . 2007-12-07 18:32 <DIR> d-------- C:\Program Files\AV Vcs 6.0 DIAMOND

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 13:02 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-07 11:05 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\AVG7
2008-01-06 22:30 --------- d-----w C:\Program Files\eMule
2008-01-04 14:24 --------- d-----w C:\Program Files\Soulseek
2007-12-28 00:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\BearShare
2007-12-28 00:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
2007-12-24 02:31 --------- d-----w C:\Program Files\iPlus
2007-12-23 15:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 14:06 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys
2007-12-10 18:28 5,047,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-12-08 19:26 --------- d-----w C:\Program Files\IrfanView
2007-12-06 17:08 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-06 16:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-06 16:57 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2007-12-06 16:39 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Winamp
2007-12-06 16:33 --------- d-----w C:\Program Files\Winamp
2007-12-05 21:50 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Corel
2007-12-05 21:20 --------- d-----w C:\Program Files\Hide Folders XP 2
2007-12-05 21:12 129,048 ----a-w C:\Documents and Settings\R\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-05 17:23 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\DllCache\uxtheme.dll
2007-12-03 17:26 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Ahead
2007-12-03 17:21 --------- d-----w C:\Program Files\Ahead
2007-12-03 17:15 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-03 16:37 --------- d-----w C:\Program Files\radeonator
2007-12-01 13:41 --------- d-----w C:\Program Files\Dell
2007-11-30 17:24 --------- d-----w C:\Program Files\3Com
2007-11-20 01:50 --------- d-----w C:\Program Files\Browser Hijack Recover
2007-11-18 16:09 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\GameHouse
2007-11-18 16:00 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DivX
2007-11-18 15:33 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-11-18 15:28 --------- d-----w C:\Program Files\CDBurnerXP
2007-11-18 15:24 --------- d-----w C:\Program Files\PLANET
2007-11-18 15:24 --------- d-----w C:\Program Files\DivX
2007-11-18 14:49 603,082,752 --sha-w C:\pagefil2.sys
2007-11-18 13:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-18 13:13 --------- d-----w C:\Program Files\SubEdit-Player
2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\DllCache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 12:37 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-11 16:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\vlc
2007-11-11 16:43 --------- d-----w C:\Program Files\VideoLAN
2007-11-10 13:49 --------- d-----w C:\Program Files\aviry
2007-11-08 21:53 --------- d-----w C:\Program Files\Reference Assemblies
2007-11-08 21:52 --------- d-----w C:\Program Files\radio internauty
2007-11-08 21:22 --------- d-----w C:\Program Files\MarBit
2007-11-08 21:06 --------- d-----w C:\Program Files\Hasbro
2007-11-08 21:03 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-08 20:58 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DAEMON Tools Pro
2007-11-08 20:48 --------- d-----w C:\Program Files\DeskSpace
2007-11-08 20:45 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-08 19:57 --------- d-----w C:\Program Files\ivo
2007-11-08 19:47 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\OtakuSoftware
2007-10-30 10:19 3,079,680 ------w C:\WINDOWS\system32\DllCache\mshtml.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:44 1,291,264 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-10-25 16:57 8,483,328 ------w C:\WINDOWS\system32\DllCache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\DllCache\wmasf.dll
2007-10-19 11:26 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2007-10-19 11:26 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2007-10-19 11:26 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2007-10-15 20:16 196 ----a-w C:\Documents and Settings\R\adres.dat
2007-10-11 06:14 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll
2007-10-11 06:14 662,016 ------w C:\WINDOWS\system32\DllCache\wininet.dll
2007-10-11 06:14 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll
2007-10-11 06:14 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll
2007-10-11 06:14 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll
2007-10-11 06:14 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll
2007-10-11 06:14 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll
2007-10-11 06:14 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll
2007-10-11 06:14 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll
2007-10-11 06:14 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll
2007-10-11 06:14 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll
2007-10-11 06:14 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll
2007-10-11 06:14 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll
2007-10-11 06:14 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll
2007-10-11 06:14 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll
2007-10-11 06:14 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll
2007-10-11 06:14 1,023,488 ------w C:\WINDOWS\system32\DllCache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe
2007-10-09 23:45 400 ----a-w C:\Documents and Settings\R\score.dat
2007-09-08 23:04 56,296 ----a-w C:\Program Files\Glass2k.exe
2001-02-23 19:22 299,008 ----a-w C:\Program Files\bestplayer1.0.exe
2000-04-19 21:00 6,995 ----a-w C:\WINDOWS\inf\RAMDISK.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5085333B-FD15-4754-A571-852F7077C5F2}]
2008-01-05 15:06 311296 --a------ C:\WINDOWS\dxpvqlmqng.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TransTask"="-C:\Program Files\Tweak-XP Pro\transtask.exe" [ ]
"TransparentIcons"="-C:\Program Files\Tweak-XP Pro\tranicon.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 21:29 21504]
"Dexpot 1.3"="-C:\Program Files\Dexpot\Dexpot.exe" [ ]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
"hfxp"="C:\Program Files\Hide Folders XP 2\hfxp.exe" [2006-11-15 13:19 823296]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2008-01-03 19:06 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [2002-01-16 23:49 163840]
"ATIModeChange"="-Ati2mdxx.exe" []
"ATIPTA"="-C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"iPlusManager"="-C:\Program Files\iPlus\iPlusChecker.exe" [ ]
"BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 15:21 270336]
"LogonStudio"="-C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 16:10 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-08-27 03:01 1450096]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-06-29 12:44 1990704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-28 09:15 219136]

C:\Documents and Settings\R\Menu Start\Programy\Autostart\
UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2005-07-20 10:23:45]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 10:10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bklgvsf"= {1BC12C81-51AD-4097-94F5-0BD09E6A4428} - C:\WINDOWS\bklgvsf.dll [ ]
"ampkfst"= {C82010D6-BA3E-4074-A2E5-675B6ABB9EEC} - C:\WINDOWS\ampkfst.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=CLKERN.DLL

R0 HFXP2;HFXP2;C:\WINDOWS\system32\DRIVERS\HFXP2.SYS [2006-08-01 19:20]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2002-01-16 23:49]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-05-04 08:27]
R2 r6probe;R6 Probe;C:\WINDOWS\system32\Drivers\r6probe.sys [2002-09-08 13:24]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-11-06 18:57]
R3 GTEDGWModem;Option NV GTEDGWModem;C:\WINDOWS\system32\DRIVERS\GTEDG.sys [2006-10-09 16:05]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;C:\WINDOWS\system32\DRIVERS\GTEDGNet.sys [2006-10-09 16:05]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2002-01-16 23:49]
R3 OptionWWSC;GT EDGE SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GTEDGSC.sys [2006-10-09 16:05]
S0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdisk.sys []
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\BlueScrn\BioNT_bs.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcf66032-56ea-11dc-901f-000874489776}]
\Shell\AutoRun\command - F:\Setup.exe
\Shell\dxsetup\command - F:\directx\dxsetup.exe
\Shell\setup\command - F:\setup.exe

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 15:59:47
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 16:00:37
ComboFix-quarantined-files.txt 2008-01-07 15:00:12

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\dxpvqlmqng.dll
C:\WINDOWS\AutoUpdateWin31.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5085333B-FD15-4754-A571-852F7077C5F2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bklgvsf"=-
"ampkfst"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

zastosuj:

smitfraudfix z opcji 2


Potem nowy log z hijacka oraz combofixa

[narg]

Logfile of HijackThis v1.99.1
Scan saved at 17:49:00, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\MMKeybd.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O20 - AppInit_DLLs: CLKERN.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

ComboFix 08-01-04.1 - R 2008-01-07 17:51:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.362 [GMT 1:00]
Running from: C:\Downloads\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-07 17:45 . 2008-01-07 17:45 2,512 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-07 17:44 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-07 17:44 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-07 17:44 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-07 17:44 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-07 17:44 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-07 17:44 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-07 15:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-06 23:56 . 2008-01-05 15:06 311,296 --a------ C:\WINDOWS\dxpvqlmqng.dll
2008-01-03 19:06 . 2008-01-06 21:32 2,022,270 --a------ C:\WINDOWS\Untitled.scr
2008-01-03 19:06 . 2008-01-06 21:32 45,056 --a------ C:\WINDOWS\NCUNINST.EXe
2008-01-03 19:06 . 2008-01-03 19:06 40,960 --a------ C:\WINDOWS\NCLAUNCH.EXe
2007-12-31 22:16 . 2008-01-02 22:45 10 --a------ C:\WINDOWS\popcinfo.dat
2007-12-31 03:09 . 2008-01-07 17:52 <DIR> d-------- C:\Program Files\FlashGet
2007-12-31 00:45 . 2008-01-07 17:24 <DIR> d-------- C:\Downloads
2007-12-30 00:03 . 2007-12-30 00:03 <DIR> d-------- C:\Program Files\FLVPlayer
2007-12-29 12:57 . 2007-12-31 04:04 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-27 15:32 . 2007-12-27 15:32 <DIR> d-------- C:\Program Files\Real Alternative
2007-12-25 14:19 . 2007-12-25 14:25 69,632 --a------ C:\WINDOWS\AutoUpdateWin31.dll
2007-12-24 05:26 . 2007-12-24 05:26 <DIR> d--h----- C:\WINDOWS\PIF
2007-12-23 18:50 . 2007-12-23 18:50 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-23 16:59 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-12-23 16:58 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-23 16:49 . 2007-12-23 16:58 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-23 16:49 . 2007-12-23 20:03 <DIR> d-------- C:\Program Files\Samsung
2007-12-23 16:49 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-23 15:46 . 2007-12-25 14:15 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-12 14:19 . 2007-12-12 14:19 <DIR> dr-h----- C:\Documents and Settings\R\Dane aplikacji\SecuROM
2007-12-12 14:19 . 2007-12-12 14:19 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-12 14:18 . 2007-12-12 14:18 <DIR> d-------- C:\Program Files\GameShadow
2007-12-12 13:23 . 2007-12-16 18:37 <DIR> d-------- C:\Program Files\Image-Line
2007-12-12 13:23 . 2002-07-07 23:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2007-12-12 13:23 . 2006-06-20 09:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2007-12-07 18:28 . 2007-12-07 18:32 <DIR> d-------- C:\Program Files\AV Vcs 6.0 DIAMOND

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 15:11 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-07 11:05 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\AVG7
2008-01-06 22:30 --------- d-----w C:\Program Files\eMule
2008-01-04 14:24 --------- d-----w C:\Program Files\Soulseek
2007-12-28 00:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\BearShare
2007-12-28 00:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
2007-12-24 02:31 --------- d-----w C:\Program Files\iPlus
2007-12-23 15:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 14:06 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys
2007-12-10 18:28 5,047,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-12-08 19:26 --------- d-----w C:\Program Files\IrfanView
2007-12-06 17:08 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-06 16:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-06 16:57 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2007-12-06 16:39 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Winamp
2007-12-06 16:33 --------- d-----w C:\Program Files\Winamp
2007-12-05 21:50 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Corel
2007-12-05 21:20 --------- d-----w C:\Program Files\Hide Folders XP 2
2007-12-05 21:12 129,048 ----a-w C:\Documents and Settings\R\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-05 17:23 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\DllCache\uxtheme.dll
2007-12-03 17:26 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Ahead
2007-12-03 17:21 --------- d-----w C:\Program Files\Ahead
2007-12-03 17:15 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-03 16:37 --------- d-----w C:\Program Files\radeonator
2007-12-01 13:41 --------- d-----w C:\Program Files\Dell
2007-11-30 17:24 --------- d-----w C:\Program Files\3Com
2007-11-20 01:50 --------- d-----w C:\Program Files\Browser Hijack Recover
2007-11-18 16:09 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\GameHouse
2007-11-18 16:00 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DivX
2007-11-18 15:33 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-11-18 15:28 --------- d-----w C:\Program Files\CDBurnerXP
2007-11-18 15:24 --------- d-----w C:\Program Files\PLANET
2007-11-18 15:24 --------- d-----w C:\Program Files\DivX
2007-11-18 14:49 603,082,752 --sha-w C:\pagefil2.sys
2007-11-18 13:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-18 13:13 --------- d-----w C:\Program Files\SubEdit-Player
2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\DllCache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 12:37 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-11 16:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\vlc
2007-11-11 16:43 --------- d-----w C:\Program Files\VideoLAN
2007-11-10 13:49 --------- d-----w C:\Program Files\aviry
2007-11-08 21:53 --------- d-----w C:\Program Files\Reference Assemblies
2007-11-08 21:52 --------- d-----w C:\Program Files\radio internauty
2007-11-08 21:22 --------- d-----w C:\Program Files\MarBit
2007-11-08 21:06 --------- d-----w C:\Program Files\Hasbro
2007-11-08 21:03 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-08 20:58 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DAEMON Tools Pro
2007-11-08 20:48 --------- d-----w C:\Program Files\DeskSpace
2007-11-08 20:45 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-08 19:57 --------- d-----w C:\Program Files\ivo
2007-11-08 19:47 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\OtakuSoftware
2007-10-30 10:19 3,079,680 ------w C:\WINDOWS\system32\DllCache\mshtml.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:44 1,291,264 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-10-25 16:57 8,483,328 ------w C:\WINDOWS\system32\DllCache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\DllCache\wmasf.dll
2007-10-19 11:26 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2007-10-19 11:26 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2007-10-19 11:26 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2007-10-15 20:16 196 ----a-w C:\Documents and Settings\R\adres.dat
2007-10-11 06:14 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll
2007-10-11 06:14 662,016 ------w C:\WINDOWS\system32\DllCache\wininet.dll
2007-10-11 06:14 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll
2007-10-11 06:14 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll
2007-10-11 06:14 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll
2007-10-11 06:14 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll
2007-10-11 06:14 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll
2007-10-11 06:14 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll
2007-10-11 06:14 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll
2007-10-11 06:14 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll
2007-10-11 06:14 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll
2007-10-11 06:14 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll
2007-10-11 06:14 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll
2007-10-11 06:14 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll
2007-10-11 06:14 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll
2007-10-11 06:14 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll
2007-10-11 06:14 1,023,488 ------w C:\WINDOWS\system32\DllCache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe
2007-10-09 23:45 400 ----a-w C:\Documents and Settings\R\score.dat
2007-09-08 23:04 56,296 ----a-w C:\Program Files\Glass2k.exe
2001-02-23 19:22 299,008 ----a-w C:\Program Files\bestplayer1.0.exe
2000-04-19 21:00 6,995 ----a-w C:\WINDOWS\inf\RAMDISK.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TransTask"="-C:\Program Files\Tweak-XP Pro\transtask.exe" [ ]
"TransparentIcons"="-C:\Program Files\Tweak-XP Pro\tranicon.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 21:29 21504]
"Dexpot 1.3"="-C:\Program Files\Dexpot\Dexpot.exe" [ ]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
"hfxp"="C:\Program Files\Hide Folders XP 2\hfxp.exe" [2006-11-15 13:19 823296]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2008-01-03 19:06 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [2002-01-16 23:49 163840]
"ATIModeChange"="-Ati2mdxx.exe" []
"ATIPTA"="-C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"iPlusManager"="-C:\Program Files\iPlus\iPlusChecker.exe" [ ]
"BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 15:21 270336]
"LogonStudio"="-C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 16:10 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-08-27 03:01 1450096]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-06-29 12:44 1990704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-28 09:15 219136]

C:\Documents and Settings\R\Menu Start\Programy\Autostart\
UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2005-07-20 10:23:45]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 10:10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=CLKERN.DLL

R0 HFXP2;HFXP2;C:\WINDOWS\system32\DRIVERS\HFXP2.SYS [2006-08-01 19:20]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2002-01-16 23:49]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-05-04 08:27]
R2 r6probe;R6 Probe;C:\WINDOWS\system32\Drivers\r6probe.sys [2002-09-08 13:24]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-11-06 18:57]
R3 GTEDGWModem;Option NV GTEDGWModem;C:\WINDOWS\system32\DRIVERS\GTEDG.sys [2006-10-09 16:05]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;C:\WINDOWS\system32\DRIVERS\GTEDGNet.sys [2006-10-09 16:05]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2002-01-16 23:49]
R3 OptionWWSC;GT EDGE SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GTEDGSC.sys [2006-10-09 16:05]
S0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdisk.sys []
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\BlueScrn\BioNT_bs.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcf66032-56ea-11dc-901f-000874489776}]
\Shell\AutoRun\command - F:\Setup.exe
\Shell\dxsetup\command - F:\directx\dxsetup.exe
\Shell\setup\command - F:\setup.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 17:52:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 17:53:52
ComboFix-quarantined-files.txt 2008-01-07 16:53:28
ComboFix2.txt 2008-01-07 16:28:32
ComboFix3.txt 2008-01-07 15:00:38

[wojtas]

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\WINDOWS\dxpvqlmqng.dll
C:\WINDOWS\AutoUpdateWin31.dll

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Log po pracy programu zobaczymy w lokalizacji - C:\_OTMoveIt\MovedFiles
Po całej operacji należy zresetować komputer.

potem skasuj w hijacku te wpisy:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

nastepnie wszystkie pliki pogrubione :

C:\WINDOWS\MMKeybd.exe
C:\WINDOWS\Nhksrv.exe
O20 - AppInit_DLLs: CLKERN.DLL
C:\WINDOWS\Untitled.scr

przeskanuj na tych stronach:

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty z plikow + nowe logi jesli sie nie beda miescic to wrzuc je na www.wklej.org i podaj link do nich

[narg]

jeszcze nie skanowalem na tych stronach. nie bardzo wiem co trzeba tam zrobic, jakie pliki wyslac do skanowania

narazie logi

Logfile of HijackThis v1.99.1
Scan saved at 18:45:21, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O20 - AppInit_DLLs: CLKERN.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

ComboFix 08-01-04.1 - R 2008-01-07 18:52:14.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.384 [GMT 1:00]
Running from: C:\Downloads\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-07 17:45 . 2008-01-07 17:45 2,512 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-07 17:44 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-07 17:44 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-07 17:44 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-07 17:44 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-07 17:44 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-07 17:44 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-07 15:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 19:06 . 2008-01-06 21:32 45,056 --a------ C:\WINDOWS\NCUNINST.EXe
2008-01-03 19:06 . 2008-01-03 19:06 40,960 --a------ C:\WINDOWS\NCLAUNCH.EXe
2007-12-31 22:16 . 2008-01-02 22:45 10 --a------ C:\WINDOWS\popcinfo.dat
2007-12-31 03:09 . 2008-01-07 18:51 <DIR> d-------- C:\Program Files\FlashGet
2007-12-31 00:45 . 2008-01-07 18:25 <DIR> d-------- C:\Downloads
2007-12-30 00:03 . 2007-12-30 00:03 <DIR> d-------- C:\Program Files\FLVPlayer
2007-12-29 12:57 . 2007-12-31 04:04 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-27 15:32 . 2007-12-27 15:32 <DIR> d-------- C:\Program Files\Real Alternative
2007-12-24 05:26 . 2007-12-24 05:26 <DIR> d--h----- C:\WINDOWS\PIF
2007-12-23 18:50 . 2007-12-23 18:50 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-23 16:59 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-12-23 16:58 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-23 16:49 . 2007-12-23 16:58 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-23 16:49 . 2007-12-23 20:03 <DIR> d-------- C:\Program Files\Samsung
2007-12-23 16:49 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-23 15:46 . 2007-12-25 14:15 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-12 14:19 . 2007-12-12 14:19 <DIR> dr-h----- C:\Documents and Settings\R\Dane aplikacji\SecuROM
2007-12-12 14:19 . 2007-12-12 14:19 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-12 14:18 . 2007-12-12 14:18 <DIR> d-------- C:\Program Files\GameShadow
2007-12-12 13:23 . 2007-12-16 18:37 <DIR> d-------- C:\Program Files\Image-Line
2007-12-12 13:23 . 2002-07-07 23:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2007-12-12 13:23 . 2006-06-20 09:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2007-12-07 18:28 . 2007-12-07 18:32 <DIR> d-------- C:\Program Files\AV Vcs 6.0 DIAMOND

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 17:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-07 11:05 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\AVG7
2008-01-06 22:30 --------- d-----w C:\Program Files\eMule
2008-01-04 14:24 --------- d-----w C:\Program Files\Soulseek
2007-12-28 00:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\BearShare
2007-12-28 00:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
2007-12-24 02:31 --------- d-----w C:\Program Files\iPlus
2007-12-23 15:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 14:06 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys
2007-12-10 18:28 5,047,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-12-08 19:26 --------- d-----w C:\Program Files\IrfanView
2007-12-06 17:08 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-06 16:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-06 16:57 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2007-12-06 16:39 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Winamp
2007-12-06 16:33 --------- d-----w C:\Program Files\Winamp
2007-12-05 21:50 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Corel
2007-12-05 21:20 --------- d-----w C:\Program Files\Hide Folders XP 2
2007-12-05 21:12 129,048 ----a-w C:\Documents and Settings\R\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-05 17:23 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\DllCache\uxtheme.dll
2007-12-03 17:26 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Ahead
2007-12-03 17:21 --------- d-----w C:\Program Files\Ahead
2007-12-03 17:15 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-03 16:37 --------- d-----w C:\Program Files\radeonator
2007-12-01 13:41 --------- d-----w C:\Program Files\Dell
2007-11-30 17:24 --------- d-----w C:\Program Files\3Com
2007-11-20 01:50 --------- d-----w C:\Program Files\Browser Hijack Recover
2007-11-18 16:09 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\GameHouse
2007-11-18 16:00 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DivX
2007-11-18 15:33 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-11-18 15:28 --------- d-----w C:\Program Files\CDBurnerXP
2007-11-18 15:24 --------- d-----w C:\Program Files\PLANET
2007-11-18 15:24 --------- d-----w C:\Program Files\DivX
2007-11-18 14:49 603,082,752 --sha-w C:\pagefil2.sys
2007-11-18 13:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-18 13:13 --------- d-----w C:\Program Files\SubEdit-Player
2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\DllCache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 12:37 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-11 16:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\vlc
2007-11-11 16:43 --------- d-----w C:\Program Files\VideoLAN
2007-11-10 13:49 --------- d-----w C:\Program Files\aviry
2007-11-08 21:53 --------- d-----w C:\Program Files\Reference Assemblies
2007-11-08 21:52 --------- d-----w C:\Program Files\radio internauty
2007-11-08 21:22 --------- d-----w C:\Program Files\MarBit
2007-11-08 21:06 --------- d-----w C:\Program Files\Hasbro
2007-11-08 21:03 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-08 20:58 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DAEMON Tools Pro
2007-11-08 20:48 --------- d-----w C:\Program Files\DeskSpace
2007-11-08 20:45 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-08 19:57 --------- d-----w C:\Program Files\ivo
2007-11-08 19:47 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\OtakuSoftware
2007-10-30 10:19 3,079,680 ------w C:\WINDOWS\system32\DllCache\mshtml.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:44 1,291,264 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-10-25 16:57 8,483,328 ------w C:\WINDOWS\system32\DllCache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\DllCache\wmasf.dll
2007-10-19 11:26 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2007-10-19 11:26 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2007-10-19 11:26 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2007-10-15 20:16 196 ----a-w C:\Documents and Settings\R\adres.dat
2007-10-11 06:14 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll
2007-10-11 06:14 662,016 ------w C:\WINDOWS\system32\DllCache\wininet.dll
2007-10-11 06:14 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll
2007-10-11 06:14 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll
2007-10-11 06:14 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll
2007-10-11 06:14 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll
2007-10-11 06:14 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll
2007-10-11 06:14 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll
2007-10-11 06:14 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll
2007-10-11 06:14 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll
2007-10-11 06:14 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll
2007-10-11 06:14 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll
2007-10-11 06:14 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll
2007-10-11 06:14 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll
2007-10-11 06:14 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll
2007-10-11 06:14 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll
2007-10-11 06:14 1,023,488 ------w C:\WINDOWS\system32\DllCache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe
2007-10-09 23:45 400 ----a-w C:\Documents and Settings\R\score.dat
2007-09-08 23:04 56,296 ----a-w C:\Program Files\Glass2k.exe
2001-02-23 19:22 299,008 ----a-w C:\Program Files\bestplayer1.0.exe
2000-04-19 21:00 6,995 ----a-w C:\WINDOWS\inf\RAMDISK.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TransTask"="-C:\Program Files\Tweak-XP Pro\transtask.exe" [ ]
"TransparentIcons"="-C:\Program Files\Tweak-XP Pro\tranicon.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 21:29 21504]
"Dexpot 1.3"="-C:\Program Files\Dexpot\Dexpot.exe" [ ]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
"hfxp"="C:\Program Files\Hide Folders XP 2\hfxp.exe" [2006-11-15 13:19 823296]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2008-01-03 19:06 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [ ]
"ATIModeChange"="-Ati2mdxx.exe" []
"ATIPTA"="-C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"iPlusManager"="-C:\Program Files\iPlus\iPlusChecker.exe" [ ]
"BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 15:21 270336]
"LogonStudio"="-C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 16:10 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-08-27 03:01 1450096]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-06-29 12:44 1990704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-28 09:15 219136]

C:\Documents and Settings\R\Menu Start\Programy\Autostart\
UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2005-07-20 10:23:45]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 10:10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=CLKERN.DLL

R0 HFXP2;HFXP2;C:\WINDOWS\system32\DRIVERS\HFXP2.SYS [2006-08-01 19:20]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-05-04 08:27]
R2 r6probe;R6 Probe;C:\WINDOWS\system32\Drivers\r6probe.sys [2002-09-08 13:24]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-11-06 18:57]
R3 GTEDGWModem;Option NV GTEDGWModem;C:\WINDOWS\system32\DRIVERS\GTEDG.sys [2006-10-09 16:05]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;C:\WINDOWS\system32\DRIVERS\GTEDGNet.sys [2006-10-09 16:05]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2002-01-16 23:49]
R3 OptionWWSC;GT EDGE SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GTEDGSC.sys [2006-10-09 16:05]
S0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdisk.sys []
S2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe []
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\BlueScrn\BioNT_bs.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcf66032-56ea-11dc-901f-000874489776}]
\Shell\AutoRun\command - F:\Setup.exe
\Shell\dxsetup\command - F:\directx\dxsetup.exe
\Shell\setup\command - F:\setup.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 18:54:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 18:55:01
ComboFix-quarantined-files.txt 2008-01-07 17:54:38
ComboFix2.txt 2008-01-07 16:53:52
ComboFix3.txt 2008-01-07 16:28:32
ComboFix4.txt 2008-01-07 15:00:38

[wojtas]

wchodzisz na ta strone:

http://virusscan.jotti.org/

na gorze dajesz przegladaj znajdujesz pierwszy pogrubiony plik u siebie na kompie i dajesz submit i tak z kazdym plikiem na kazdej z tych stron i raport bedzie wygladal w ten sposob;

A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing

itd . kazdy plik sprawdz i daj raporty

[narg]

yyyy

napisales ktore pliki przeskanowac ... cholera.

C:\WINDOWS\MMKeybd.exe
C:\WINDOWS\Nhksrv.exe
O20 - AppInit_DLLs: CLKERN.DLL
C:\WINDOWS\Untitled.scr

tele ze ja jeprzez nieuwage
usunalem tym

OTMoveIt

[wojtas]

no nic to daj loga nowego z hijacka i combofixa

[narg]

ComboFix 08-01-04.1 - R 2008-01-07 19:34:40.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.348 [GMT 1:00]
Running from: C:\Downloads\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-07 17:45 . 2008-01-07 17:45 2,512 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-07 17:44 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-07 17:44 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-07 17:44 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-07 17:44 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-07 17:44 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-07 17:44 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-07 15:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 19:06 . 2008-01-06 21:32 45,056 --a------ C:\WINDOWS\NCUNINST.EXe
2008-01-03 19:06 . 2008-01-03 19:06 40,960 --a------ C:\WINDOWS\NCLAUNCH.EXe
2007-12-31 22:16 . 2008-01-02 22:45 10 --a------ C:\WINDOWS\popcinfo.dat
2007-12-31 03:09 . 2008-01-07 19:27 <DIR> d-------- C:\Program Files\FlashGet
2007-12-31 00:45 . 2008-01-07 18:25 <DIR> d-------- C:\Downloads
2007-12-30 00:03 . 2007-12-30 00:03 <DIR> d-------- C:\Program Files\FLVPlayer
2007-12-29 12:57 . 2007-12-31 04:04 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-27 15:32 . 2007-12-27 15:32 <DIR> d-------- C:\Program Files\Real Alternative
2007-12-24 05:26 . 2007-12-24 05:26 <DIR> d--h----- C:\WINDOWS\PIF
2007-12-23 18:50 . 2007-12-23 18:50 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-23 16:59 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-12-23 16:58 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-23 16:49 . 2007-12-23 16:58 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-23 16:49 . 2007-12-23 20:03 <DIR> d-------- C:\Program Files\Samsung
2007-12-23 16:49 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-23 15:46 . 2007-12-25 14:15 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-12 14:19 . 2007-12-12 14:19 <DIR> dr-h----- C:\Documents and Settings\R\Dane aplikacji\SecuROM
2007-12-12 14:19 . 2007-12-12 14:19 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-12 14:18 . 2007-12-12 14:18 <DIR> d-------- C:\Program Files\GameShadow
2007-12-12 13:23 . 2007-12-16 18:37 <DIR> d-------- C:\Program Files\Image-Line
2007-12-12 13:23 . 2002-07-07 23:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2007-12-12 13:23 . 2006-06-20 09:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2007-12-07 18:28 . 2007-12-07 18:32 <DIR> d-------- C:\Program Files\AV Vcs 6.0 DIAMOND

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 18:01 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-07 11:05 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\AVG7
2008-01-06 22:30 --------- d-----w C:\Program Files\eMule
2008-01-04 14:24 --------- d-----w C:\Program Files\Soulseek
2007-12-28 00:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\BearShare
2007-12-28 00:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
2007-12-24 02:31 --------- d-----w C:\Program Files\iPlus
2007-12-23 15:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 14:06 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys
2007-12-10 18:28 5,047,296 ----a-w C:\WINDOWS\system32\logonuiX.exe
2007-12-08 19:26 --------- d-----w C:\Program Files\IrfanView
2007-12-06 17:08 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-06 16:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-06 16:57 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2007-12-06 16:39 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Winamp
2007-12-06 16:33 --------- d-----w C:\Program Files\Winamp
2007-12-05 21:50 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Corel
2007-12-05 21:20 --------- d-----w C:\Program Files\Hide Folders XP 2
2007-12-05 21:12 129,048 ----a-w C:\Documents and Settings\R\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-05 17:23 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-05 16:18 219,648 ----a-w C:\WINDOWS\system32\DllCache\uxtheme.dll
2007-12-03 17:26 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\Ahead
2007-12-03 17:21 --------- d-----w C:\Program Files\Ahead
2007-12-03 17:15 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-03 16:37 --------- d-----w C:\Program Files\radeonator
2007-12-01 13:41 --------- d-----w C:\Program Files\Dell
2007-11-30 17:24 --------- d-----w C:\Program Files\3Com
2007-11-20 01:50 --------- d-----w C:\Program Files\Browser Hijack Recover
2007-11-18 16:09 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\GameHouse
2007-11-18 16:00 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DivX
2007-11-18 15:33 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-11-18 15:28 --------- d-----w C:\Program Files\CDBurnerXP
2007-11-18 15:24 --------- d-----w C:\Program Files\PLANET
2007-11-18 15:24 --------- d-----w C:\Program Files\DivX
2007-11-18 14:49 603,082,752 --sha-w C:\pagefil2.sys
2007-11-18 13:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-18 13:13 --------- d-----w C:\Program Files\SubEdit-Player
2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\DllCache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 12:37 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-11 16:52 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\vlc
2007-11-11 16:43 --------- d-----w C:\Program Files\VideoLAN
2007-11-10 13:49 --------- d-----w C:\Program Files\aviry
2007-11-08 21:53 --------- d-----w C:\Program Files\Reference Assemblies
2007-11-08 21:52 --------- d-----w C:\Program Files\radio internauty
2007-11-08 21:22 --------- d-----w C:\Program Files\MarBit
2007-11-08 21:06 --------- d-----w C:\Program Files\Hasbro
2007-11-08 21:03 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-08 20:58 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\DAEMON Tools Pro
2007-11-08 20:48 --------- d-----w C:\Program Files\DeskSpace
2007-11-08 20:45 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-08 19:57 --------- d-----w C:\Program Files\ivo
2007-11-08 19:47 --------- d-----w C:\Documents and Settings\R\Dane aplikacji\OtakuSoftware
2007-10-30 10:19 3,079,680 ------w C:\WINDOWS\system32\DllCache\mshtml.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:44 1,291,264 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-10-25 16:57 8,483,328 ------w C:\WINDOWS\system32\DllCache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\DllCache\wmasf.dll
2007-10-19 11:26 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2007-10-19 11:26 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2007-10-19 11:26 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2007-10-15 20:16 196 ----a-w C:\Documents and Settings\R\adres.dat
2007-10-11 06:14 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll
2007-10-11 06:14 662,016 ------w C:\WINDOWS\system32\DllCache\wininet.dll
2007-10-11 06:14 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll
2007-10-11 06:14 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll
2007-10-11 06:14 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll
2007-10-11 06:14 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll
2007-10-11 06:14 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll
2007-10-11 06:14 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll
2007-10-11 06:14 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll
2007-10-11 06:14 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll
2007-10-11 06:14 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll
2007-10-11 06:14 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll
2007-10-11 06:14 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll
2007-10-11 06:14 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll
2007-10-11 06:14 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll
2007-10-11 06:14 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll
2007-10-11 06:14 1,023,488 ------w C:\WINDOWS\system32\DllCache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe
2007-10-09 23:45 400 ----a-w C:\Documents and Settings\R\score.dat
2007-09-08 23:04 56,296 ----a-w C:\Program Files\Glass2k.exe
2001-02-23 19:22 299,008 ----a-w C:\Program Files\bestplayer1.0.exe
2000-04-19 21:00 6,995 ----a-w C:\WINDOWS\inf\RAMDISK.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TransTask"="-C:\Program Files\Tweak-XP Pro\transtask.exe" [ ]
"TransparentIcons"="-C:\Program Files\Tweak-XP Pro\tranicon.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-08-25 21:03 2119104]
"Dexpot 1.3"="-C:\Program Files\Dexpot\Dexpot.exe" [ ]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
"hfxp"="C:\Program Files\Hide Folders XP 2\hfxp.exe" [2006-11-15 13:19 823296]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2008-01-03 19:06 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\MMKeybd.exe" [ ]
"ATIModeChange"="-Ati2mdxx.exe" []
"ATIPTA"="-C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"iPlusManager"="-C:\Program Files\iPlus\iPlusChecker.exe" [ ]
"BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 15:21 270336]
"LogonStudio"="-C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 16:10 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-08-27 03:01 1450096]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-06-29 12:44 1990704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-28 09:15 219136]

C:\Documents and Settings\R\Menu Start\Programy\Autostart\
UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2005-07-20 10:23:45]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 10:10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=CLKERN.DLL

R0 HFXP2;HFXP2;C:\WINDOWS\system32\DRIVERS\HFXP2.SYS [2006-08-01 19:20]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-05-04 08:27]
R2 r6probe;R6 Probe;C:\WINDOWS\system32\Drivers\r6probe.sys [2002-09-08 13:24]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-11-06 18:57]
R3 GTEDGWModem;Option NV GTEDGWModem;C:\WINDOWS\system32\DRIVERS\GTEDG.sys [2006-10-09 16:05]
R3 GTEDGWWNIC;Option NV GTEDGWWNIC;C:\WINDOWS\system32\DRIVERS\GTEDGNet.sys [2006-10-09 16:05]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2002-01-16 23:49]
R3 OptionWWSC;GT EDGE SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GTEDGSC.sys [2006-10-09 16:05]
S0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdisk.sys []
S2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe []
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\BlueScrn\BioNT_bs.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcf66032-56ea-11dc-901f-000874489776}]
\Shell\AutoRun\command - F:\Setup.exe
\Shell\dxsetup\command - F:\directx\dxsetup.exe
\Shell\setup\command - F:\setup.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 19:36:36
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 19:37:41
ComboFix-quarantined-files.txt 2008-01-07 18:37:12
ComboFix2.txt 2008-01-07 17:55:02
ComboFix3.txt 2008-01-07 16:53:52
ComboFix4.txt 2008-01-07 16:28:32
ComboFix5.txt 2008-01-07 15:00:38

Logfile of HijackThis v1.99.1
Scan saved at 19:37:58, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O20 - AppInit_DLLs: CLKERN.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[wojtas]

skasuj:

O20 - AppInit_DLLs: CLKERN.DLL

i bedzie ok

[narg]

Logfile of HijackThis v1.99.1
Scan saved at 20:01:23, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
c:\program files\gadu-gadu\gg.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "c:\program files\gadu-gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

zresetuje sie i zobacze czy wszystko ok

[ Dodano: Dzisiaj o 20:18 ]
wyglada na to ze wszystko jest ok.

bardzo dziekuje za pomoc

nawet nie chce wiedziec skad wiedziales co trzeba zrobic : )

jaszcze tylko pytanie; co to w ogole bylo ?
i skad sie wzielo
i czy w tej sytuacji jest sens uzywac avg 7.5

a na deser...

Logfile of HijackThis v1.99.1
Scan saved at 20:13:12, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\program files\gadu-gadu\gg.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\program files\gadu-gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[wojtas]

skasuj jeszcze wpis:

i czy w tej sytuacji jest sens uzywac avg 7.5

oraz start>uruchom>cmd wpisz:

sc stop Nhksrv

enter

sc delete Nhksrv

enter

O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe

tak spokojnie uzywaj do tego zainstaluj jakiegos firewalla np:

http://www.programosy.pl/program,comodo-firewall.html

[narg]

Logfile of HijackThis v1.99.1
Scan saved at 21:41:26, on 2008-01-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\program files\gadu-gadu\gg.exe
C:\Program Files\Hide Folders XP 2\hfxp.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\iPlus\iPlusManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Documents and Settings\R\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [ATIModeChange] -Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] -C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iPlusManager] -C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [LogonStudio] -"C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [TransTask] -"C:\Program Files\Tweak-XP Pro\transtask.exe"
O4 - HKCU\..\Run: [TransparentIcons] -"C:\Program Files\Tweak-XP Pro\tranicon.exe" -ex
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\program files\gadu-gadu\StrongGG.exe" /tray
O4 - HKCU\..\Run: [Dexpot 1.3] -C:\Program Files\Dexpot\Dexpot.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [hfxp] C:\Program Files\Hide Folders XP 2\hfxp.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Startup: UniSpiker-2.6.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O17 - HKLM\System\CS4\Services\Tcpip\..\{07DA4DC0-F053-4699-A323-7396FBBD3BFD}: NameServer = 212.2.96.51 212.2.96.52
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[wojtas]

czysto

Autor postu otrzymał pochwałę

[narg]

Bardzo dziekuje !!!

w zyciu bym sam tego nie zrobil

dzieki raz jeszcze