Your computer is infected.....

[Natii]

Witam pisze pierwszy raz na forum i mam problem wczoraj wyskakiwał mi komunikat your computer is infected ... miałam avasta ale go odinstalowałam bo sobie nie poradził teraz mam ESET Smart Security który też sobie nie poradził z tym tylko wywala mi wirusa figaro.sys próbowałam wieloma programami antysyware i nie pomogło na końcu znalazłam programik launch po przeskanowaniu nim zniknął komunikat ale nie mam żadnej pewności czy wszystko jest ok a pewnie nie bo ikona od sieci bezprzewodowej cały pobiera adres internetowy a net chodzi. Przesyłam logi do sprawdzenia z OTL, DDS i RSIST
OTS

Kod: Zaznacz wszystko

OTL logfile created on: 2009-08-28 16:54:26 - Run 1
OTL by OldTimer - Version 3.0.10.7     Folder = C:\Documents and Settings\Kwaśnik\Pulpit
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1014,36 Mb Total Physical Memory | 519,22 Mb Available Physical Memory | 51,19% Memory free
2,38 Gb Paging File | 2,06 Gb Available in Paging File | 86,25% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 10,25 Gb Free Space | 52,50% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 7,90 Gb Free Space | 16,18% Space Free | Partition Type: NTFS
Drive E: | 43,42 Gb Total Space | 43,05 Gb Free Space | 99,15% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DOM-9D9890D4879
Current User Name: Kwaśnik
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2007-06-01 11:48:24 | 00,987,136 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2007-07-25 19:14:58 | 00,009,216 | ---- | M] (Agere Systems) -- C:\WINDOWS\System32\agrsmsvc.exe
PRC - [2008-07-01 09:02:28 | 00,468,224 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2007-06-01 12:00:20 | 00,647,168 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2004-09-29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\System32\HPZipm12.exe
PRC - [2007-06-01 11:41:30 | 00,327,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2005-01-28 14:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe
PRC - [2004-08-03 23:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008-02-22 05:25:21 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
PRC - [2007-07-26 16:30:32 | 16,377,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
PRC - [2008-07-01 09:01:04 | 01,447,168 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2007-11-14 12:54:24 | 02,131,392 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2004-08-04 01:55:54 | 01,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2007-02-13 16:20:50 | 01,205,840 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
PRC - [2009-08-04 19:21:16 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-08-28 16:53:25 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kwaśnik\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2007-07-25 19:14:58 | 00,009,216 | ---- | M] (Agere Systems) -- C:\WINDOWS\System32\agrsmsvc.exe -- (AgereModemAudio [Auto | Running])
SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008-07-01 09:08:00 | 00,019,200 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv [On_Demand | Stopped])
SRV - [2008-07-01 09:02:28 | 00,468,224 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn [Auto | Running])
SRV - [2007-06-01 12:00:20 | 00,647,168 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng [Auto | Running])
SRV - [2004-08-03 23:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2001-11-29 01:50:00 | 00,032,768 | ---- | M] (Borland Software Corporation) -- C:\Program Files\Borland\InterBase\bin\ibguard.exe -- (InterBaseGuardian [Auto | Stopped])
SRV - [2001-11-29 01:50:00 | 01,769,472 | ---- | M] (Borland Software Corporation) -- C:\Program Files\Borland\InterBase\bin\ibserver.exe -- (InterBaseServer [On_Demand | Stopped])
SRV - [2001-10-26 18:30:00 | 00,003,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\regedt32.exe -- (NOD32FiXTemDono [Auto | Stopped])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2004-09-29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\System32\HPZipm12.exe -- (Pml Driver HPZ12 [Auto | Running])
SRV - [2007-06-01 11:41:30 | 00,327,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc [Auto | Running])
SRV - [2007-06-01 11:48:24 | 00,987,136 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor [Auto | Running])
SRV - [2009-06-02 10:10:08 | 00,637,952 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2005-01-28 14:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2008-03-01 16:05:56 | 00,021,393 | ---- | M] (Cisco Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\AegisP.sys -- (AegisP [Auto | Running])
DRV - [2007-07-25 19:14:58 | 01,161,888 | ---- | M] (Agere Systems) -- C:\WINDOWS\System32\DRIVERS\AGRSM.sys -- (AgereSoftModem [On_Demand | Running])
DRV - [2004-12-20 08:31:52 | 00,005,120 | ---- | M] ((Standard Mouse Types)) -- C:\WINDOWS\System32\DRIVERS\Amfilter.sys -- (Amfilter [System | Running])
DRV - [2004-12-20 08:31:53 | 00,010,240 | ---- | M] ((Standard Mouse Types)) -- C:\WINDOWS\System32\DRIVERS\Amusbprt.sys -- (Amusbprt [On_Demand | Stopped])
DRV - [2004-12-20 08:31:53 | 00,007,424 | ---- | M] ((Standard Mouse Types)) -- C:\WINDOWS\System32\DRIVERS\Arfumftr.sys -- (Arfumftr [On_Demand | Stopped])
DRV - [2007-01-04 13:47:48 | 00,069,656 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\e4ldr.sys -- (E4LOADER [Auto | Stopped])
DRV - [2007-01-04 13:48:04 | 00,104,344 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\System32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Stopped])
DRV - [2008-07-01 08:56:22 | 00,039,944 | ---- | M] (ESET) -- C:\WINDOWS\System32\DRIVERS\eamon.sys -- (eamon [Auto | Running])
DRV - [2008-07-01 08:57:14 | 00,053,256 | ---- | M] (ESET) -- C:\WINDOWS\System32\DRIVERS\easdrv.sys -- (easdrv [System | Running])
DRV - [2008-07-01 09:04:34 | 00,071,688 | ---- | M] (ESET) -- C:\WINDOWS\System32\DRIVERS\epfw.sys -- (epfw [Auto | Running])
DRV - [2008-07-01 09:04:36 | 00,030,728 | ---- | M] (ESET) -- C:\WINDOWS\System32\DRIVERS\Epfwndis.sys -- (Epfwndis [On_Demand | Running])
DRV - [2008-07-01 09:04:38 | 00,054,280 | ---- | M] (ESET) -- C:\WINDOWS\System32\DRIVERS\epfwtdi.sys -- (epfwtdi [System | Running])
DRV - [2003-02-19 11:04:06 | 00,132,608 | ---- | M] () -- C:\WINDOWS\System32\drivers\Haspnt.sys -- (Haspnt [Auto | Running])
DRV - [2005-01-07 18:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2005-03-08 06:43:25 | 00,051,120 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped])
DRV - [2005-03-08 06:43:26 | 00,016,496 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped])
DRV - [2005-03-08 06:43:27 | 00,021,744 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped])
DRV - [2007-07-26 16:18:28 | 05,761,760 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\igxpmp32.sys -- (ialm [On_Demand | Running])
DRV - [2007-12-18 21:14:43 | 00,304,920 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor [Boot | Running])
DRV - [2005-09-01 12:03:04 | 00,005,888 | ---- | M] (Ahead Software AG) -- C:\WINDOWS\System32\Drivers\imagedrv.sys -- (imagedrv [Boot | Running])
DRV - [2005-09-01 12:03:04 | 00,127,488 | ---- | M] (Ahead Software AG) -- C:\WINDOWS\system32\DRIVERS\imagesrv.sys -- (imagesrv [Boot | Running])
DRV - [2007-07-26 16:30:34 | 04,429,312 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
DRV - [2007-06-21 05:43:26 | 02,208,512 | R--- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\NETw4x32.sys -- (NETw4x32 [On_Demand | Running])
DRV - [2009-02-09 08:37:46 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2009-02-09 08:37:46 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2008-08-26 10:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2007-07-26 16:29:32 | 00,090,880 | ---- | M] (Realtek Semiconductor Corporation                           ) -- C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys -- (RTLE8023xp [On_Demand | Running])
DRV - [2007-05-29 16:29:30 | 00,012,416 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\s24trans.sys -- (s24trans [Auto | Running])
DRV - [2004-07-17 10:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2002-11-25 12:01:40 | 00,076,288 | ---- | M] (Rainbow Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel [Auto | Stopped])
DRV - [2001-08-17 21:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
DRV - [2007-07-26 16:19:42 | 00,290,304 | ---- | M] (Texas Instruments) -- C:\WINDOWS\System32\drivers\tifm21.sys -- (tifm21 [On_Demand | Running])
DRV - [2006-06-22 17:27:12 | 00,011,264 | ---- | M] (TOSHIBA ) -- C:\WINDOWS\System32\drivers\TPwSav.sys -- (TPwSav [System | Running])
DRV - [2009-02-09 08:37:48 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2004-08-04 00:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2009-02-09 08:37:56 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60346
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.iesearch.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.pl/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.13
FF - prefs.js..keyword.URL: "http://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60346&qkw="

FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009-07-27 19:09:02 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-08-05 15:48:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-08-04 19:21:21 | 00,000,000 | ---D | M]

[2009-07-16 16:15:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\mozilla\Extensions
[2009-07-16 16:15:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-07-16 16:15:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\mozilla\Firefox\Profiles\eal4tkp3.default\extensions
[2009-07-16 16:15:19 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-08-04 19:21:21 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-08-04 19:21:15 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-08-04 19:21:15 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009-08-04 19:21:18 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009-07-23 17:34:40 | 00,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2009-08-25 09:32:38 | 00,001,340 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [braviax]  File not found
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [Regedit32] C:\WINDOWS\System32\regedit.exe File not found
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [braviax]  File not found
O4 - HKCU..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.)
O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceClassicControlPanel = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} http://91.196.9.102/activex/AMC.cab (AxisMediaControlEmb Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 () - file:///C:/DOCUME~1/KWANIK~1/USTAWI~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Components:1 () - file:///C:/DOCUME~1/KWANIK~1/USTAWI~1/Temp/msohtml1/01/clip_image002.gif
O24 - Desktop Components:2 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-03-01 15:48:02 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[3 C:\WINDOWS\*.tmp files]
[2009-08-28 16:53:00 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kwaśnik\Pulpit\OTL.exe
[2009-08-28 16:52:18 | 00,781,909 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\RSIT.exe
[2009-08-28 16:51:52 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kwaśnik\Pulpit\OTS.exe
[2009-08-28 16:42:53 | 00,042,571 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\hijackthis-silent-runners-regulamin-tego-dzialu-vt9452.html
[2009-08-28 16:42:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kwaśnik\Pulpit\hijackthis-silent-runners-regulamin-tego-dzialu-vt9452_pliki
[2009-08-27 21:07:06 | 15,809,832 | ---- | C] (Doctor Web, Ltd.) -- C:\Documents and Settings\Kwaśnik\Pulpit\launch.exe
[2009-08-27 20:21:28 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF6853.exe
[2009-08-27 20:19:28 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF6547.exe
[2009-08-27 19:38:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\ESET
[2009-08-27 19:19:39 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009-08-27 18:00:54 | 00,019,334 | ---- | C] () -- C:\WINDOWS\uhybez.bat
[2009-08-27 18:00:54 | 00,017,795 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\kamukaxe.lib
[2009-08-27 18:00:54 | 00,016,261 | ---- | C] () -- C:\WINDOWS\System32\heqi.dat
[2009-08-27 18:00:54 | 00,016,160 | ---- | C] () -- C:\WINDOWS\fibobabak.lib
[2009-08-27 18:00:54 | 00,015,500 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\nuzuz.bat
[2009-08-27 18:00:54 | 00,015,360 | ---- | C] () -- C:\WINDOWS\unutiba.dll
[2009-08-27 18:00:54 | 00,015,254 | ---- | C] () -- C:\Program Files\Common Files\anezinih.bat
[2009-08-27 18:00:54 | 00,015,095 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\imep.lib
[2009-08-27 18:00:54 | 00,014,921 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\ulumu.exe
[2009-08-27 18:00:54 | 00,014,622 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\aqimo.db
[2009-08-27 18:00:54 | 00,013,966 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\vajocyluw.bat
[2009-08-27 18:00:54 | 00,011,799 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\iraguwof.lib
[2009-08-27 18:00:54 | 00,011,415 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\gylahak.pif
[2009-08-27 18:00:06 | 00,001,758 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\ESET Smart Security.lnk
[2009-08-27 16:23:47 | 00,005,702 | -H-- | C] () -- C:\WINDOWS\nod32restoretemdono.reg
[2009-08-27 16:23:47 | 00,000,568 | -H-- | C] () -- C:\WINDOWS\nod32fixtemdono.reg
[2009-08-27 16:23:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\ESET
[2009-08-27 16:20:28 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009-08-27 16:20:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET
[2009-08-26 21:15:24 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF30249.exe
[2009-08-26 21:14:08 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2009-08-26 21:03:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp
[2009-08-26 20:58:29 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF26960.exe
[2009-08-26 20:29:17 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF21262.exe
[2009-08-26 20:27:48 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2009-08-26 20:27:45 | 00,262,400 | ---- | C] () -- C:\cmldr
[2009-08-26 20:27:45 | 00,000,000 | ---D | C] -- C:\cmdcons
[2009-08-26 20:25:35 | 00,229,376 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2009-08-26 20:25:35 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009-08-26 20:25:35 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009-08-26 20:25:35 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009-08-26 20:25:35 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009-08-26 20:25:35 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009-08-26 20:25:35 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009-08-26 20:25:35 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009-08-26 20:25:28 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF20439.exe
[2009-08-26 20:24:10 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF20263.exe
[2009-08-26 20:21:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009-08-26 20:21:58 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009-08-26 20:21:57 | 00,395,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CF19825.exe
[2009-08-26 20:15:06 | 00,000,000 | ---D | C] -- C:\Program Files\SpywareGuard
[2009-08-26 19:46:12 | 00,018,127 | ---- | C] () -- C:\Program Files\Common Files\nibafeholy.db
[2009-08-26 19:46:12 | 00,016,489 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\qywoh.sys
[2009-08-26 19:46:12 | 00,016,269 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\zytosose.bin
[2009-08-26 19:46:12 | 00,014,477 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\ifuvawitu.bin
[2009-08-26 19:46:12 | 00,014,263 | ---- | C] () -- C:\WINDOWS\xota.db
[2009-08-26 19:46:12 | 00,012,836 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\pepaso.dat
[2009-08-26 19:46:12 | 00,011,526 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\qeqacixy.lib
[2009-08-26 19:46:12 | 00,011,194 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\lofopu.sys
[2009-08-26 17:47:37 | 00,000,720 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\3614.pik
[2009-08-26 17:47:26 | 00,001,479 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\3367.pik
[2009-08-26 17:47:08 | 00,000,351 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\2683.pik
[2009-08-25 15:40:13 | 00,060,726 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\5034405236_22_0.pdf
[2009-08-25 15:39:37 | 00,100,747 | ---- | C] () -- C:\Documents and Settings\Kwaśnik\Pulpit\5033794107_22_0.pdf
[2009-07-19 18:24:13 | 00,000,043 | ---- | C] () -- C:\WINDOWS\msqview.ini
[2009-07-11 18:42:48 | 00,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini
[2009-07-11 18:42:48 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini
[2009-07-11 18:42:31 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll
[2009-07-11 18:42:31 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL
[2009-07-11 18:26:51 | 00,000,990 | ---- | C] () -- C:\WINDOWS\adiras.ini
[2009-07-11 18:26:19 | 00,028,672 | R--- | C] () -- C:\WINDOWS\System32\adinst32.dll
[2008-10-19 10:47:50 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2008-10-19 10:46:25 | 00,132,608 | ---- | C] () -- C:\WINDOWS\System32\drivers\Haspnt.sys
[2008-06-25 16:58:54 | 00,000,716 | ---- | C] () -- C:\WINDOWS\WinKalk.ini
[2008-06-25 16:50:25 | 00,000,127 | ---- | C] () -- C:\WINDOWS\coder.ini
[2008-06-17 16:06:16 | 00,000,073 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini
[2008-06-17 16:04:45 | 00,210,032 | ---- | C] () -- C:\WINDOWS\System32\DBCLIENT.DLL
[2008-05-05 13:55:02 | 00,004,592 | ---- | C] () -- C:\WINDOWS\ewikony.ini
[2008-05-05 13:19:58 | 00,000,667 | ---- | C] () -- C:\WINDOWS\dokument.ini
[2008-05-05 13:17:33 | 00,002,414 | ---- | C] () -- C:\WINDOWS\EwAccess.ini
[2008-04-30 17:48:38 | 00,005,432 | ---- | C] () -- C:\WINDOWS\baza.ini
[2008-04-30 17:45:48 | 00,019,485 | ---- | C] () -- C:\WINDOWS\ewmapa.ini
[2008-03-11 17:24:03 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008-03-06 18:44:18 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-03-01 19:53:31 | 00,002,269 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008-03-01 19:08:48 | 00,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2008-03-01 19:08:48 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2008-03-01 19:08:48 | 00,010,132 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2008-03-01 19:08:48 | 00,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2008-03-01 16:42:28 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\EBLib.DLL
[2008-03-01 16:32:19 | 00,910,464 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2008-03-01 16:32:19 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4833.dll
[2006-01-05 19:49:34 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\HWS_Ctrl.dll
[2006-01-05 18:36:22 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\EKECioCtl.dll
[2006-01-04 11:59:52 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\TCtrlIO.dll
[2004-12-20 08:31:53 | 00,184,320 | ---- | C] () -- C:\WINDOWS\System32\Amsample.dll
[2004-12-20 08:31:52 | 00,299,008 | ---- | C] () -- C:\WINDOWS\System32\Amoucplx.dll
[2004-12-20 08:31:52 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\Amoures.dll
[2004-12-20 08:31:52 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\Amhooker.dll
[2004-08-03 23:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004-07-17 10:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001-07-21 23:16:20 | 00,000,659 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-21 23:15:52 | 00,000,246 | ---- | C] () -- C:\WINDOWS\system.ini
[2001-07-06 16:30:02 | 00,003,234 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009-08-28 16:53:25 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kwaśnik\Pulpit\OTL.exe
[2009-08-28 16:52:23 | 00,781,909 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\RSIT.exe
[2009-08-28 16:52:16 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kwaśnik\Pulpit\OTS.exe
[2009-08-28 16:42:55 | 00,042,571 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\hijackthis-silent-runners-regulamin-tego-dzialu-vt9452.html
[2009-08-28 16:33:10 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-08-28 16:33:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-08-27 22:54:52 | 04,310,994 | -H-- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-08-27 21:43:42 | 00,002,269 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-08-27 21:07:07 | 15,809,832 | ---- | M] (Doctor Web, Ltd.) -- C:\Documents and Settings\Kwaśnik\Pulpit\launch.exe
[2009-08-27 20:36:37 | 00,000,659 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-08-27 20:36:37 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2009-08-27 20:36:37 | 00,000,246 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-08-27 20:20:49 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF6853.exe
[2009-08-27 20:19:15 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF6547.exe
[2009-08-27 18:00:54 | 00,019,334 | ---- | M] () -- C:\WINDOWS\uhybez.bat
[2009-08-27 18:00:54 | 00,017,795 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\kamukaxe.lib
[2009-08-27 18:00:54 | 00,016,261 | ---- | M] () -- C:\WINDOWS\System32\heqi.dat
[2009-08-27 18:00:54 | 00,016,160 | ---- | M] () -- C:\WINDOWS\fibobabak.lib
[2009-08-27 18:00:54 | 00,015,500 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\nuzuz.bat
[2009-08-27 18:00:54 | 00,015,360 | ---- | M] () -- C:\WINDOWS\unutiba.dll
[2009-08-27 18:00:54 | 00,015,254 | ---- | M] () -- C:\Program Files\Common Files\anezinih.bat
[2009-08-27 18:00:54 | 00,015,095 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\imep.lib
[2009-08-27 18:00:54 | 00,014,921 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\ulumu.exe
[2009-08-27 18:00:54 | 00,014,622 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\aqimo.db
[2009-08-27 18:00:54 | 00,013,966 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\vajocyluw.bat
[2009-08-27 18:00:54 | 00,011,799 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\iraguwof.lib
[2009-08-27 18:00:54 | 00,011,415 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\gylahak.pif
[2009-08-27 18:00:06 | 00,001,758 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\ESET Smart Security.lnk
[2009-08-27 16:15:35 | 00,002,707 | ---- | M] () -- C:\WINDOWS\System32\config.nt
[2009-08-26 21:15:04 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF30249.exe
[2009-08-26 20:58:17 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF26960.exe
[2009-08-26 20:29:12 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF21262.exe
[2009-08-26 20:25:00 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF20439.exe
[2009-08-26 20:24:06 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF20263.exe
[2009-08-26 20:21:52 | 00,395,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\CF19825.exe
[2009-08-26 19:46:12 | 00,018,127 | ---- | M] () -- C:\Program Files\Common Files\nibafeholy.db
[2009-08-26 19:46:12 | 00,016,489 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\qywoh.sys
[2009-08-26 19:46:12 | 00,016,269 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\zytosose.bin
[2009-08-26 19:46:12 | 00,014,477 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\ifuvawitu.bin
[2009-08-26 19:46:12 | 00,014,263 | ---- | M] () -- C:\WINDOWS\xota.db
[2009-08-26 19:46:12 | 00,012,836 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\pepaso.dat
[2009-08-26 19:46:12 | 00,011,526 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\qeqacixy.lib
[2009-08-26 19:46:12 | 00,011,194 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Dane aplikacji\lofopu.sys
[2009-08-26 18:11:21 | 00,019,485 | ---- | M] () -- C:\WINDOWS\ewmapa.ini
[2009-08-26 18:00:55 | 00,000,351 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\2683.pik
[2009-08-26 17:51:58 | 00,001,479 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\3367.pik
[2009-08-26 17:48:00 | 00,000,720 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\3614.pik
[2009-08-26 16:23:01 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-08-25 15:40:13 | 00,060,726 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\5034405236_22_0.pdf
[2009-08-25 15:39:38 | 00,100,747 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\5033794107_22_0.pdf
[2009-08-23 15:47:29 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009-08-23 03:09:13 | 00,229,376 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2009-08-17 21:16:10 | 00,002,539 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Pulpit\WORD.lnk
[2009-08-17 19:40:21 | 00,013,030 | ---- | M] () -- C:\PDOXUSRS.NET
[2009-08-17 19:40:21 | 00,000,716 | ---- | M] () -- C:\WINDOWS\WinKalk.ini
[2009-08-13 19:11:57 | 00,088,311 | -H-- | M] () -- C:\TREEINFO.WC
[2009-08-11 16:33:34 | 00,000,211 | ---- | M] () -- C:\Boot.bak
[2009-08-06 16:59:30 | 00,043,008 | ---- | M] () -- C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:E25BED53
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:A1454082
< End of report >


oraz

Kod: Zaznacz wszystko

OTL Extras logfile created on: 2009-08-28 16:54:26 - Run 1
OTL by OldTimer - Version 3.0.10.7     Folder = C:\Documents and Settings\Kwaśnik\Pulpit
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1014,36 Mb Total Physical Memory | 519,22 Mb Available Physical Memory | 51,19% Memory free
2,38 Gb Paging File | 2,06 Gb Available in Paging File | 86,25% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 10,25 Gb Free Space | 52,50% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 7,90 Gb Free Space | 16,18% Space Free | Partition Type: NTFS
Drive E: | 43,42 Gb Total Space | 43,05 Gb Free Space | 99,15% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DOM-9D9890D4879
Current User Name: Kwaśnik
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny -- (Gadu-Gadu S.A.)
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- ()
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\BearShare\BearShare.exe" = C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare -- File not found
"C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- (Ares Development Group)
"C:\WINDOWS\system32\winver.exe" = C:\WINDOWS\system32\winver.exe:*:Enabled:winver -- (Microsoft Corporation)
"C:\Program Files\Winamp Remote\bin\Orb.exe" = C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- File not found
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" = C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- File not found
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- File not found
"C:\Program Files\EMULE\emule.exe" = C:\Program Files\EMULE\emule.exe:*:Enabled:eMule -- File not found
"C:\Documents and Settings\Kwaśnik\Dane aplikacji\ENet\Apache\Apache.exe" = C:\Documents and Settings\Kwaśnik\Dane aplikacji\ENet\Apache\Apache.exe:*:Enabled:Apache -- File not found
"C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Temp\PG2008_04\python\pythonw.exe" = C:\Documents and Settings\Kwaśnik\Ustawienia lokalne\Temp\PG2008_04\python\pythonw.exe:*:Enabled:pythonw -- File not found
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{193DB24F-9A66-4896-8404-22D53EA89075}" = 1400_Help
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{266959FA-0AEE-41D0-A88E-F1EAC10A7C14}" = 1400
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5B622B7A-60FB-4630-B11D-F121D20BCCD6}" = MarketResearch
"{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B
"{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls Driver
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware
"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"{7C9B95B7-B598-4398-B30F-7F6827192E6C}" = ProductContext
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90A40415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3572B3A-C1C5-51E5-8BC5-841F49C0BBD6}" = Search Assistant Mysidesearch
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{BFBB5FAF-FF83-4E9E-9732-77A237DB81DC}" = ESET Smart Security
"{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan
"{C510CA36-98D6-4F07-8AFF-81E7399A075B}" = 1400Trb
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express
"504244733D18C8F63FF584AEB290E3904E791693" = Pakiet sterowników systemu Windows - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ambdtfqtizylhw" = RON Tool Cpmsky
"Ares" = Ares 2.1.1
"AXIS Media Control Embedded" = AXIS Media Control Embedded
"BDE" = BDE
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 6.0.0.766
"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Pakiet sterowników systemu Windows - Nokia Modem  (06/01/2009 4.1)
"Eset NOD32 v3.0.642 FiX1.2 by TemDono_is1" = NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up
"EWMAPA 6.5" = EWMAPA 6.5
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Pakiet sterowników systemu Windows - Nokia Modem  (06/01/2009 7.01.0.3)
"Gadu-Gadu" = Gadu-Gadu 7.7
"HASP Device Driver" = HASP Device Driver
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"HPExtendedCapabilities" = HP Extended Capabilities 5.3
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = Sprzęt instalacyjny TOSHIBA
"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = Program TOSHIBA Hotkey Utility
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InterBase" = InterBase 6.5
"IrfanView" = IrfanView (remove only)
"Kalkulator geodezyjny" = Kalkulator geodezyjny
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.0.13)" = Mozilla Firefox (3.0.13)
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"Nokia PC Suite" = Nokia PC Suite
"ProInst" = Intel(R) PROSet/Wireless Software
"Rainbow Sentinel Driver" = Sentinel System Driver
"SubEdit-Player_is1" = SubEdit-Player
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"Totalcmd" = Total Commander (Remove or Repair)
"vbcpp40" = VisiBroker for Cpp 4.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WheelMouse" = Mouse Driver 8.4
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinKalk" = WinKalk
"WinRAR archiver" = Archiwizator WinRAR
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2009-08-27 13:35:44 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 13:37:27 | Computer Name = DOM-9D9890D4879 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd svchost.exe, wersja 5.1.2600.2180, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00406472.

Error - 2009-08-27 13:40:10 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 13:40:58 | Computer Name = DOM-9D9890D4879 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd svchost.exe, wersja 5.1.2600.2180, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00406472.

Error - 2009-08-27 14:24:50 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 14:26:04 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 14:37:53 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 15:25:02 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-27 16:54:10 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

Error - 2009-08-28 10:33:15 | Computer Name = DOM-9D9890D4879 | Source = InterBase Guardian | ID = 212
Description =

[ System Events ]
Error - 2009-08-28 10:33:27 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842784
Description = Nie można odnaleźć zestawu zależnego Microsoft.VC80.MFCLOC; ostatni
błąd: Odnośny zestaw nie jest zainstalowany w tym systemie. 

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC80.MFCLOC.
Odpowiedni
komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842784
Description = Nie można odnaleźć zestawu zależnego Microsoft.VC80.MFCLOC; ostatni
błąd: Odnośny zestaw nie jest zainstalowany w tym systemie. 

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC80.MFCLOC.
Odpowiedni
komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842784
Description = Nie można odnaleźć zestawu zależnego Microsoft.VC80.MFCLOC; ostatni
błąd: Odnośny zestaw nie jest zainstalowany w tym systemie. 

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC80.MFCLOC.
Odpowiedni
komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie.  .

Error - 2009-08-28 10:33:28 | Computer Name = DOM-9D9890D4879 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie.  .


< End of report >


DDS
http://www.wklej.eu/index.php?id=fa89e33910
http://www.wklej.eu/index.php?id=4d861bb4f4
RSIST
http://www.wklej.eu/index.php?id=15fd170b0d
Z tego co czytałam to żeby nie używać combofixa chociaż wczoraj go pobrałam i nic zwiesił się komp
Bardzo proszę o pomoc .

[Okocza]

Natii, spróbuj jeszcze raz użyć combo - przy tej infekcji dobrze by było gdybyś dała radę Jeśli nie, to daj log z SDFixa a potem dopiero spróbuj combofixa użyć

sposób użycia SDFixa:

specjalne-narzedzia-czyszczace-vt96631.html

[Natii]

Spróbowałam jeszcze raz wczoraj użyć combofixa. Proszę o sprawdzenie

Kod: Zaznacz wszystko

ComboFix 09-08-27.A3 - Kwaśnik 2009-08-28 18:04.3.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.1014.615 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Kwaśnik\Pulpit\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Zapora osobista *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dane aplikacji\ulumu.exe
c:\documents and settings\Kwa˜nik\Ustawienia lokalne\Dane aplikacji\nuzuz.bat
c:\documents and settings\Kwa˜nik\Ustawienia lokalne\Dane aplikacji\vajocyluw.bat
c:\program files\Common Files\anezinih.bat
c:\windows\uhybez.bat
c:\windows\unutiba.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RUNTIME


(((((((((((((((((((((((((   Pliki utworzone od 2009-07-28 do 2009-08-28  )))))))))))))))))))))))))))))))
.

2009-08-28 14:59 . 2009-08-28 15:00   --------   d-----w-   c:\program files\trend micro
2009-08-28 14:59 . 2009-08-28 15:00   --------   d-----w-   C:\rsit
2009-08-28 14:56 . 2009-08-28 14:56   --------   d--h--w-   c:\windows\PIF
2009-08-27 20:33 . 2009-08-27 20:33   --------   d-----w-   c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2009-08-27 17:38 . 2009-08-27 17:38   --------   d-----w-   c:\windows\system32\wbem\Repository
2009-08-27 17:19 . 2009-08-27 17:19   --------   d-----w-   c:\windows\ERUNT
2009-08-27 16:00 . 2009-08-27 16:00   16261   ----a-w-   c:\windows\system32\heqi.dat
2009-08-27 14:23 . 2008-03-03 16:21   568   ---ha-w-   c:\windows\nod32fixtemdono.reg
2009-08-27 14:23 . 2008-03-03 12:25   5702   ---ha-w-   c:\windows\nod32restoretemdono.reg
2009-08-27 14:20 . 2009-08-27 14:20   --------   d-----w-   c:\program files\ESET
2009-08-27 14:20 . 2009-08-27 14:20   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\ESET
2009-08-26 18:15 . 2009-08-27 17:34   --------   d-----w-   c:\program files\SpywareGuard

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 17:42 . 2008-03-01 13:59   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-08-27 17:34 . 2009-07-26 11:32   --------   d-----w-   c:\program files\Ares
2009-08-26 17:46 . 2009-08-26 17:46   18127   ----a-w-   c:\program files\Common Files\nibafeholy.db
2009-08-26 17:46 . 2009-08-26 17:46   12836   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\pepaso.dat
2009-08-17 17:38 . 2008-04-27 11:32   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-27 17:09 . 2009-07-27 17:09   --------   d-----w-   c:\program files\Common Files\PCSuite
2009-07-27 17:08 . 2009-07-27 17:08   --------   d-----w-   c:\program files\Common Files\Nokia
2009-07-27 17:08 . 2009-07-27 17:07   --------   d-----w-   c:\program files\Nokia
2009-07-27 17:08 . 2008-03-06 18:09   --------   d-----w-   c:\program files\DIFX
2009-07-27 17:08 . 2009-07-27 17:08   --------   d-----w-   c:\program files\PC Connectivity Solution
2009-07-27 17:07 . 2009-07-27 17:07   95232   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-07-27 17:07 . 2009-07-27 17:07   8192   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-07-27 17:07 . 2009-07-27 17:07   61440   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-07-27 17:07 . 2009-07-27 17:07   10240   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-07-27 17:06 . 2008-03-06 17:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Installations
2009-07-27 17:06 . 2009-07-27 17:07   33984304   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe
2009-07-17 17:25 . 2008-10-18 16:42   --------   d-----w-   c:\program files\Borland
2009-07-11 17:07 . 2009-07-11 16:42   33   ----a-w-   c:\windows\system32\drivers\adidsl.cfg
2009-07-11 16:41 . 2009-07-11 16:41   --------   d-----w-   c:\program files\SAGEM
2009-06-30 18:02 . 2008-04-15 15:58   --------   d-----w-   c:\program files\EASYWORK
2009-06-30 16:39 . 2009-06-30 16:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\NOS
2009-06-30 16:36 . 2008-03-03 16:28   --------   d-----w-   c:\program files\Common Files\Adobe
2009-06-30 16:33 . 2009-06-30 16:33   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2009-06-30 16:31 . 2009-06-30 16:31   86016   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\NOS\Adobe_Downloads\arh.exe
2009-06-29 18:55 . 2009-06-29 18:55   0   ----a-w-   c:\windows\nsreg.dat
2001-05-24 10:59 . 2008-06-26 15:00   162304   ----a-w-   c:\program files\UNWISE.EXE
.

------- Sigcheck -------


[-] 2007-12-18 19:14   1548288   44A87287F63395AE9E7950D266A73160   c:\windows\system32\sfcfiles.dll

c:\windows\system32\drivers\beep.sys ...  - brak elementu !!
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-26 16377344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-7-11 1205840]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kwaśnik^Menu Start^Programy^Autostart^ikowin32.exe]
path=c:\documents and settings\Kwaśnik\Menu Start\Programy\Autostart\ikowin32.exe
backup=c:\windows\pss\ikowin32.exeStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2009-07-11 69656]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584]
S3 Arfumftr;(Standard Mouse Types) USB RF-Mouse filter driver;c:\windows\system32\drivers\Arfumftr.sys [2004-12-20 7424]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2009-07-11 104344]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://91.196.9.102/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Kwaśnik\Dane aplikacji\Mozilla\Firefox\Profiles\eal4tkp3.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60346&qkw=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-28 18:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-08-28 18:18 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-08-28 16:18

Przed: 11 000 594 432 bajtów wolnych
Po: 14 036 611 072 bajtów wolnych

162   --- E O F ---   2008-03-02 14:44


[wojtas]

1. Pobierz świeży plik ntfs.sys + beep.sys : http://www.speedyshare.com/319409601.html. Wypakuj je i bezpośrednio na dysku C;

Otworz notatnik i wklej w nim to:

File::
C:\windows\system32\heqi.dat

FCopy::
c:\ntfs.sys | c:\windows\system32\dllcache\ntfs.sys
c:\ntfs.sys | c:\windows\system32\drivers\ntfs.sys
c:\beep.sys | c:\windows\system32\dllcache\beep.sys
c:\beep.sys | c:\windows\system32\drivers\beep.sys

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Rozpocznie się usuwanie i powstanie log daj go.

[Natii]

log z combofix

Kod: Zaznacz wszystko

ComboFix 09-08-27.A3 - Kwaśnik 2009-08-29 15:18.5.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.1014.349 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Kwaśnik\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Kwaśnik\Pulpit\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Zapora osobista *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\windows\system32\heqi.dat"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Kwa˜nik\Ustawienia lokalne\Dane aplikacji\nuzuz.bat
c:\documents and settings\Kwa˜nik\Ustawienia lokalne\Dane aplikacji\vajocyluw.bat
c:\windows\system32\heqi.dat

.
--------------- FCopy ---------------

c:\ntfs.sys --> c:\windows\system32\dllcache\ntfs.sys
c:\ntfs.sys --> c:\windows\system32\drivers\ntfs.sys
c:\beep.sys --> c:\windows\system32\dllcache\beep.sys
c:\beep.sys --> c:\windows\system32\drivers\beep.sys
.
(((((((((((((((((((((((((   Pliki utworzone od 2009-07-28 do 2009-08-29  )))))))))))))))))))))))))))))))
.

2009-08-29 13:13 . 2002-09-28 22:00   4224   -c--a-w-   c:\windows\system32\dllcache\beep.sys
2009-08-29 13:13 . 2002-09-28 22:00   4224   ----a-w-   c:\windows\system32\drivers\beep.sys
2009-08-29 13:10 . 2008-04-13 22:45   574976   ------w-   C:\ntfs.sys
2009-08-29 13:10 . 2002-09-28 22:00   4224   ------w-   C:\beep.sys
2009-08-28 14:59 . 2009-08-28 15:00   --------   d-----w-   c:\program files\trend micro
2009-08-28 14:59 . 2009-08-28 15:00   --------   d-----w-   C:\rsit
2009-08-28 14:56 . 2009-08-28 14:56   --------   d--h--w-   c:\windows\PIF
2009-08-27 20:33 . 2009-08-27 20:33   --------   d-----w-   c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2009-08-27 17:38 . 2009-08-27 17:38   --------   d-----w-   c:\windows\system32\wbem\Repository
2009-08-27 17:19 . 2009-08-27 17:19   --------   d-----w-   c:\windows\ERUNT
2009-08-27 14:23 . 2008-03-03 16:21   568   ---ha-w-   c:\windows\nod32fixtemdono.reg
2009-08-27 14:23 . 2008-03-03 12:25   5702   ---ha-w-   c:\windows\nod32restoretemdono.reg
2009-08-27 14:20 . 2009-08-27 14:20   --------   d-----w-   c:\program files\ESET
2009-08-27 14:20 . 2009-08-27 14:20   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\ESET
2009-08-26 18:15 . 2009-08-27 17:34   --------   d-----w-   c:\program files\SpywareGuard

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 17:42 . 2008-03-01 13:59   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-08-27 17:34 . 2009-07-26 11:32   --------   d-----w-   c:\program files\Ares
2009-08-26 17:46 . 2009-08-26 17:46   18127   ----a-w-   c:\program files\Common Files\nibafeholy.db
2009-08-26 17:46 . 2009-08-26 17:46   12836   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\pepaso.dat
2009-08-17 17:38 . 2008-04-27 11:32   --------   d---a-w-   c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-07-27 17:09 . 2009-07-27 17:09   --------   d-----w-   c:\program files\Common Files\PCSuite
2009-07-27 17:08 . 2009-07-27 17:08   --------   d-----w-   c:\program files\Common Files\Nokia
2009-07-27 17:08 . 2009-07-27 17:07   --------   d-----w-   c:\program files\Nokia
2009-07-27 17:08 . 2008-03-06 18:09   --------   d-----w-   c:\program files\DIFX
2009-07-27 17:08 . 2009-07-27 17:08   --------   d-----w-   c:\program files\PC Connectivity Solution
2009-07-27 17:07 . 2009-07-27 17:07   95232   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-07-27 17:07 . 2009-07-27 17:07   8192   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-07-27 17:07 . 2009-07-27 17:07   61440   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-07-27 17:07 . 2009-07-27 17:07   10240   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-07-27 17:06 . 2008-03-06 17:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Installations
2009-07-27 17:06 . 2009-07-27 17:07   33984304   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe
2009-07-17 17:25 . 2008-10-18 16:42   --------   d-----w-   c:\program files\Borland
2009-07-11 17:07 . 2009-07-11 16:42   33   ----a-w-   c:\windows\system32\drivers\adidsl.cfg
2009-07-11 16:41 . 2009-07-11 16:41   --------   d-----w-   c:\program files\SAGEM
2009-06-30 18:02 . 2008-04-15 15:58   --------   d-----w-   c:\program files\EASYWORK
2009-06-30 16:39 . 2009-06-30 16:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\NOS
2009-06-30 16:36 . 2008-03-03 16:28   --------   d-----w-   c:\program files\Common Files\Adobe
2009-06-30 16:33 . 2009-06-30 16:33   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2009-06-30 16:31 . 2009-06-30 16:31   86016   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\NOS\Adobe_Downloads\arh.exe
2009-06-29 18:55 . 2009-06-29 18:55   0   ----a-w-   c:\windows\nsreg.dat
2001-05-24 10:59 . 2008-06-26 15:00   162304   ----a-w-   c:\program files\UNWISE.EXE
.

------- Sigcheck -------

[-] 2008-04-13 22:45   574976   78A08DD6A8D65E697C18E1DB01C5CDCA   c:\windows\system32\dllcache\ntfs.sys
[7] 2004-08-03 20:15   574592   B78BE402C3F63DD55521F73876951CDD   c:\windows\system32\dllcache\cache\ntfs.sys
[-] 2008-04-13 22:45   574976   78A08DD6A8D65E697C18E1DB01C5CDCA   c:\windows\system32\drivers\ntfs.sys

[-] 2007-12-18 19:14   1548288   44A87287F63395AE9E7950D266A73160   c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-26 16377344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-7-11 1205840]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Kwaśnik^Menu Start^Programy^Autostart^ikowin32.exe]
path=c:\documents and settings\Kwaśnik\Menu Start\Programy\Autostart\ikowin32.exe
backup=c:\windows\pss\ikowin32.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2009-07-11 69656]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584]
S3 Arfumftr;(Standard Mouse Types) USB RF-Mouse filter driver;c:\windows\system32\drivers\Arfumftr.sys [2004-12-20 7424]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2009-07-11 104344]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://91.196.9.102/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Kwaśnik\Dane aplikacji\Mozilla\Firefox\Profiles\eal4tkp3.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60346&qkw=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 15:21
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2009-08-29 15:22
ComboFix-quarantined-files.txt  2009-08-29 13:22
ComboFix2.txt  2009-08-28 16:18

Przed: 13 977 866 240 bajtów wolnych
Po: 13 934 133 248 bajtów wolnych

157   --- E O F ---   2008-03-02 14:44


[wojtas]

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )



Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

Autor postu otrzymał pochwałę

[Natii]

Przesyłam raport z Kaspersky

Kod: Zaznacz wszystko

*KASPERSKY ONLINE SCANNER 7.0: raport skanowania*
sobota, 29 sierpień 2009
System operacyjny: Microsoft Windows XP Professional Dodatek Service
Pack 2 (build 2600)
Wersja Kaspersky Online Scanner: 7.0.26.13
Data ostatniej aktualizacji baz danych: Saturday, August 29, 2009 20:15:31
Liczba wpisów: 2705419

*Ustawienia skanowania*
typ baz danych użytych do skanowania    rozszerzone
Skanuj archiwa    tak
Skanuj pocztowe bazy danych    tak
*Obszar skanowania*    Mój komputer
C:\
D:\
E:\
F:\
G:\
*Statystyki skanowania*
Przeskanowanych obiektów    50510
Wykrytych zagrożeń    2
Wyykrytych zainfekowanych obiektów    2
Wykrytych podejrzanych obiektów    0
Czas skanowania    01:13:52


*Nazwa pliku*    *Zagrożenie*    *Liczba zagrożeń*
C:\Qoobox\Quarantine\C\Program
Files\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL.vir   Zainfekowanych:
not-a-virus:WebToolbar.Win32.MyWebSearch.i   1   
C:\WINDOWS\pss\ikowin32.exeStartup   Zainfekowanych:
Backdoor.Win32.Bredolab.le   1   
* Wybrany obszar został przeskanowany.*



Dodano Dzisiaj, 22:00:
A no i wykonałam wszystko to co napisałeś żebym zrobiła

[wojtas]

skasuj:

C:\Qoobox\
C:\WINDOWS\pss\ikowin32.exeStartup

i bedzie ok

[Natii]

skasowałam czy jeszcze coś sprawdzać czy wszystko jest ok ?

[wojtas]

wszystko ok

[Natii]

Dzięki wielkie za pomoc