włamanie ? ktos wysyła meila z mojego ip

[aversion]

witam mam taki problem przychodze sobie z pracy rano po nocce właczam kompa odpalam sobie neta i wyskaskuje ze server w mojej sieci zablokował mi neta na 30 min poniewaz wysyłane z mojego kompa są meile które zawieraja spam i wirusy i rzeczywiście wchodzę w cmd biore netstat i wyskakuje mi masa połączeń z jakimiś nieznanymi serverami poczty smtp i co chwila wyskakują jakieś nowe połaczenia !!! przeskanowałem czym się da mam pande 2007 razem z firewallem ale jakoś nic to nie daje !! przeskanowałem różnymi antytrojanami antyspamami i nic nadal połączenia istenieja niewiem moze ktos miał juz taki problem i moze mi pomóc bo ja niemam siły juz na to ((((((((((((((((((((((((((((((((((((((( może da się z tym coś zrobic czy pozostał tylko format !!??

z góry dzięki za szybką odopowiedz

Autor postu otrzymał pochwałę

[Precel]

1. zmien nazwe tematu bo poleci do kosza
2.daj loga z hj
opis jak to zrobic masz tutaj
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[aversion]

skanowałem hj i jest wszystko ok czy mozna jakos zablokowac te połaczenia smtp ? jestem teraz w pracy bo w domu jak włącze neta to po 30 sekundach server mnie blokuje tak jak napisałem i niemoge nic zrobic.
moze mozna zabkolowac jakoś to wszystko żeby na spokojnie to usunąć albo ktoś zna jakiś program który jest w stanie wykryc ewentualnego trojana czy wirusa który to powoduje bo moje nic nie znajdują xoftspay spaybot adware se trojan remover hj !!

[Precel]

lbo ktoś zna jakiś program który jest w stanie wykryc ewentualnego trojana

daj logi z
HijackThis
Silent Runners
chcemy ci pomoc a ty nie wspolpracujesz

[aversion]

ok logi zaraz beda

[ Dodano: Dzisiaj o 23:48 ]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 23:15:46, on 2006-10-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE
C:\WINDOWS\system32\winalert.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\temp\wincss323072.exe
C:\Program Files\D-Link AirPlus\AirPlus.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\WebProxy.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.wp.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [Windows Update Alert] "C:\WINDOWS\system32\winalert.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [TRTray] "C:\Program Files\Trojan Remover\trtray.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\temp\wincss323072.exe
O4 - HKCU\..\Run: [Winsvr] C:\WINDOWS\temp\wincss3216384.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{83887991-1C0E-4301-BDEE-85CFF6BBAE41}: NameServer = 213.199.225.14,82.160.1.1
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.e

log wygląda tak nareszcie mi się udało połączyć do netu ale ciągle pokazuje mi jakies dziwne połączenia narazie się trochę uspokoiło zreetowałem kompa i nie ma połączeń z smtp

log silent runners

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 48, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"]
"WinMedia" = "C:\WINDOWS\temp\wincss323072.exe" [null data]
"Winsvr" = "C:\WINDOWS\temp\wincss3216384.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"APVXDWIN" = ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s" ["Panda Software International"]
"SCANINICIO" = ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"" ["Panda Software International"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033 -noicon" ["DAEMON'S HOME"]
"Windows Update Alert" = ""C:\WINDOWS\system32\winalert.exe"" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "IeCatch2 Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"]
{E5A1691B-D188-4419-AD02-90002030B8EE}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "FlashFXP Helper for Internet Explorer"
                   \InProcServer32\(Default) = "C:\PROGRA~1\FlashFXP\IEFlash.dll" ["IniCom Networks, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{65756541-C65C-11CD-0000-4B656E696100}" = "Panda Antivirus"
  -> {HKLM...CLSID} = "Panda Antivirus"
                   \InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PAVOLE.DLL" ["Panda Software"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {HKLM...CLSID} = "AlcoholShellEx"
                   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"]
"{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}" = "Autodesk Drawing Preview"
  -> {HKLM...CLSID} = "ACTHUMBNAIL"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll" ["Autodesk"]
"{36A21736-36C2-4C11-8ACB-D4136F2B57BD}" = "Uchwyt nakładania ikony podpisu cyfrowego"
  -> {HKLM...CLSID} = "AcSignIcon"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\AcSignIcon.dll" ["Autodesk"]
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview"
  -> {HKLM...CLSID} = "ACDWFTHMBPRXY"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcDwfThmbPrxy16.dll" ["Autodesk"]
"{52B87208-9CCF-42C9-B88E-069281105805}" = "Trojan Remover Shell Extension"
  -> {HKLM...CLSID} = "Trojan Remover Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! avldr\DLLName = "avldr.dll" ["Panda Software"]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
  -> {HKLM...CLSID} = "Panda Antivirus"
                   \InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PAVOLE.DLL" ["Panda Software"]
Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}"
  -> {HKLM...CLSID} = "Trojan Remover Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
  -> {HKLM...CLSID} = "Panda Antivirus"
                   \InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PAVOLE.DLL" ["Panda Software"]
Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}"
  -> {HKLM...CLSID} = "Trojan Remover Shell Extension"
                   \InProcServer32\(Default) = "C:\PROGRA~1\TROJAN~1\Trshlex.dll" ["Simply Super Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Default executables:
--------------------

HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile"
INFECTION WARNING! HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINDOWS\system32\notepad.exe" "%1"" [MS]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\aversion\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "aversion" & "All Users" startup folders:
----------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"D-Link AirPlus" -> shortcut to: "C:\Program Files\D-Link AirPlus\AirPlus.exe" ["D-Link"]


Enabled Scheduled Tasks:
------------------------

"XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" [empty string]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavlsp.dll ["Panda Software International"], 01 - 03, 09
%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 10 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
  -> {HKLM...CLSID} = "FlashGet Bar"
                   \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}"
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_01"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
Netropa NHK Server, nhksrv, "C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe" [null data]
Panda anti-virus service, PAVSRV, ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe"" ["Panda Software International"]
Panda Antispam Engine, pmshellsrv, "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe" ["Panda Software International"]
Panda Function Service, PAVFNSVR, ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe"" ["Panda Software International"]
Panda IManager Service, PSIMSVC, ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe"" ["Panda Software"]
Panda Network Manager, PNMSRV, ""c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE"" ["Panda Software"]
Panda Process Protection Service, PavPrSrv, ""C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe"" ["Panda Software"]
Panda TPSrv, TPSrv, ""C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe"" ["Panda Software"]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]


Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = INFECTION WARNING! "msikbd2k" ["Netropa Corporation"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
HP Standard TCP/IP Port\Driver = "HpTcpMon.dll" ["Hewlett Packard"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
  use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 28 seconds, including 2 seconds for message boxes)


tutuaj macie jeszcze cos takiego
po wpisaniu netstat w cmd po chwili mnie blokuje na serverze

Kod: Zaznacz wszystko

Microsoft Windows XP [Wersja 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\aversion>netstat

Aktywne połączenia

  Protokół  Adres lokalny          Obcy adres        Stan
  TCP    0i37g10u14uk80o:1247   unused-217017045147.atman.pl:https  USTANOWIONO
  TCP    0i37g10u14uk80o:1248   208.66.194.234:2599    USTANOWIONO
  TCP    0i37g10u14uk80o:1249   208.66.194.234:smtp    CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1250   80.72.40.70:http       USTANOWIONO
  TCP    0i37g10u14uk80o:1267   mx4.ovh.net:smtp       CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1274   mx4.ovh.net:smtp       USTANOWIONO
  TCP    0i37g10u14uk80o:1275   mx4.ovh.net:smtp       USTANOWIONO
  TCP    0i37g10u14uk80o:1283   www.i-comm.de:smtp     CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1284   www.i-comm.de:smtp     CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1285   webmail.icomme.tm.fr:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1290   pa-wss.iconus.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1291   pa-wss.iconus.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1300   ns1.infomaid.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1301   ns1.infomaid.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1303   mail.iconirl.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1442   mx.kpn.com:smtp        CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1445   100.92.96-84.rev.gaoland.net:smtp  CZAS_OCZEKIWA
NIA
  TCP    0i37g10u14uk80o:1447   mail1.oofundailyecards.com:smtp  CZAS_OCZEKIWANI
A
  TCP    0i37g10u14uk80o:1595   mail2.ppg.com:smtp     CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1598   202.85.225.211:smtp    CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1599   202.85.225.211:smtp    CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1605   *.s5b2.psmtp.com:smtp  CZAS_OCZEKIWANIA
  TCP    0i37g10u14uk80o:1632   rev-85.232.233.9.gadu-gadu.pl:http  CZAS_OCZEKIW
ANIA
  TCP    0i37g10u14uk80o:1638   194.9.24.52:http       CZAS_OCZEKIWANIA

oczywiście tego jest więcej ale nie będę tyle aż tego wklejał i co wy na to ma ktos moze jakiś pomysl jak się tego pozbyć ??? czy wogule da się coś z tym zrobić !! dzieki z góry

[Aqui]

skanowałem hj i jest wszystko ok

Nie jest..
Usuwasz z wyłączonym przywracaniem systemu i w trybe awaryjnym
Oproznij ten folder oczywiscie w trybie awayjnym z wyłączonym pzywacaniem systemu
C:\WINDOWS\temp(oproznij a nie usun )

C:\WINDOWS\system32\winalert.exe
C:\WINDOWS\temp\wincss323072.exe
O4 - HKLM\..\Run: [Windows Update Alert] "C:\WINDOWS\system32\winalert.exe"
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\temp\wincss323072.exe
O4 - HKCU\..\Run: [Winsvr] C:\WINDOWS\temp\wincss3216384.exe

Wpisy fixujesz w hijacku,a pogrubione pliki/foldery usuwasz recznie z dysku-po zabiegach nowe logi plus silentrunners