proszę o sprawdzenie loga

[NaturalKiller]

Logfile of HijackThis v1.99.1
Scan saved at 20:41:47, on 2007-12-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
D:\AQQ\AQQ.exe
D:\DeskSpace\deskspace.exe
D:\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
D:\MOHA\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Paweł\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AQQ] D:\AQQ\AQQ.exe
O4 - HKCU\..\Run: [DeskSpace] D:\DeskSpace\deskspace.exe
O4 - Startup: TransBar.lnk = D:\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: Y'z Shadow.lnk = D:\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\MOHA\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[wojtas]

masz jakis problem z kompem?

[NaturalKiller]

Zablokowało mi Avasta i ciągle wyskakują mi dymki że komputer może być zagrożony.

[wojtas]

daj loga dla pewnosci z combofixa

przeinstaluj avasta....

daj screena z alertow

[NaturalKiller]

ComboFix 07-12-12.3 - Paweł 2007-12-12 21:18:27.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.514 [GMT 1:00]
Running from: C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-11-12 to 2007-12-12 )))))))))))))))))))))))))))))))
.

2007-12-10 16:13 . 2007-12-10 16:13 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Apple Computer
2007-12-10 16:13 . 2007-12-12 21:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-10 16:13 . 2007-12-10 16:13 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-10 16:12 . 2007-12-10 16:12 <DIR> d-------- C:\Program Files\QuickTime
2007-12-10 16:12 . 2007-12-10 16:13 <DIR> d-------- C:\Program Files\iTunes
2007-12-10 16:12 . 2007-12-10 16:12 <DIR> d-------- C:\Program Files\iPod
2007-12-10 16:11 . 2007-12-10 16:11 <DIR> d-------- C:\Program Files\Apple Software Update
2007-12-10 16:11 . 2007-12-10 16:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-12-10 16:10 . 2007-12-10 16:10 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-12-10 16:10 . 2007-12-10 16:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-12-10 11:24 . 2007-12-10 11:24 <DIR> d-------- C:\Documents and Settings\Paweł\DoctorWeb
2007-12-10 11:24 . 2007-12-10 11:24 <DIR> d-------- C:\Documents and Settings\Paweł\DoctorWeb
2007-12-07 14:42 . 2007-12-07 14:42 <DIR> d-------- C:\Program Files\DFX
2007-12-07 14:28 . 2007-12-07 14:28 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Musicmatch
2007-11-30 14:54 . 2007-11-30 14:54 17,154 --a------ C:\opola.JPG
2007-11-30 14:47 . 2007-11-30 14:47 20,512 --a------ C:\bez tytułufdddf.JPG
2007-11-30 14:45 . 2007-11-30 14:45 88,662 --a------ C:\bez tytuługggg.JPG
2007-11-30 14:45 . 2007-11-30 14:45 21,418 --a------ C:\bez tytuługggg.GIF
2007-11-16 22:02 . 2007-11-16 22:02 <DIR> d-------- C:\Documents and Settings\agnieszka\Dane aplikacji\Teleca
2007-11-16 22:02 . 2007-11-16 22:02 <DIR> d-------- C:\Documents and Settings\agnieszka\Dane aplikacji\Sony Ericsson
2007-11-14 23:43 . 2007-11-14 23:43 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-11-14 23:43 . 2007-11-14 23:43 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2007-11-14 21:26 . 2007-11-14 21:26 <DIR> d-------- C:\Documents and Settings\Andrzej\Dane aplikacji\Teleca
2007-11-14 21:25 . 2007-11-14 21:25 <DIR> d-------- C:\Documents and Settings\Andrzej\Dane aplikacji\Sony Ericsson
2007-11-13 17:52 . 2006-11-30 15:14 90,800 -ra------ C:\WINDOWS\system32\drivers\se45unic.sys
2007-11-13 17:52 . 2006-11-30 15:14 88,624 -ra------ C:\WINDOWS\system32\drivers\se45mgmt.sys
2007-11-13 17:52 . 2006-11-30 15:14 86,432 -ra------ C:\WINDOWS\system32\drivers\se45obex.sys
2007-11-13 17:52 . 2006-11-30 15:14 18,704 -ra------ C:\WINDOWS\system32\drivers\se45nd5.sys
2007-11-13 17:52 . 2006-11-30 15:14 4,128 -ra------ C:\WINDOWS\system32\drivers\se45cr.sys
2007-11-13 17:51 . 2006-11-30 15:14 97,088 -ra------ C:\WINDOWS\system32\drivers\se45mdm.sys
2007-11-13 17:51 . 2006-11-30 15:13 61,536 -ra------ C:\WINDOWS\system32\drivers\se45bus.sys
2007-11-13 17:51 . 2006-11-30 15:14 9,360 -ra------ C:\WINDOWS\system32\drivers\se45mdfl.sys
2007-11-13 17:51 . 2006-11-30 15:13 6,240 -ra------ C:\WINDOWS\system32\drivers\se45cmnt.sys
2007-11-13 17:51 . 2006-11-30 15:13 6,240 -ra------ C:\WINDOWS\system32\drivers\se45cm.sys
2007-11-13 17:51 . 2006-11-30 15:14 5,872 -ra------ C:\WINDOWS\system32\drivers\se45whnt.sys
2007-11-13 17:51 . 2006-11-30 15:14 5,872 -ra------ C:\WINDOWS\system32\drivers\se45wh.sys
2007-11-13 17:43 . 2007-11-13 18:23 <DIR> d-------- C:\vcs5BGEffects

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-12 20:10 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Skype
2007-12-12 14:23 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\teamspeak2
2007-12-10 12:22 --------- d-----w C:\Program Files\PeerGuardian2
2007-12-10 11:57 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-12-09 09:26 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Hamachi
2007-12-07 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 12:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-13 16:53 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Teleca
2007-11-10 17:18 --------- d--h--r C:\Documents and Settings\Paweł\Dane aplikacji\SecuROM
2007-11-10 17:11 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Sony Ericsson
2007-11-10 17:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-09 17:26 56,008 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2007-11-09 17:26 4,659 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-11-09 17:26 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-11-08 20:35 --------- d-----w C:\Documents and Settings\Andrzej\Dane aplikacji\OtakuSoftware
2007-11-08 20:19 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\OtakuSoftware
2007-11-07 15:34 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\gtk-2.0
2007-11-05 16:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-11-05 15:47 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-05 15:47 --------- d-----w C:\Program Files\Bonjour
2007-11-05 15:36 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2007-11-04 20:42 --------- d-----w C:\Program Files\WapSter
2007-11-04 20:03 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-31 14:26 --------- d-----w C:\Documents and Settings\Andrzej\Dane aplikacji\Ahead
2007-10-23 16:43 --------- d-----w C:\Program Files\AGEIA Technologies
.

((((((((((((((((((((((((((((( snapshot@2007-12-09_13.10.02.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-08 02:32:45 141,824 ----a-w C:\WINDOWS\catchme.exe
+ 2007-12-09 18:04:27 142,336 ----a-w C:\WINDOWS\catchme.exe
+ 2007-12-10 15:13:10 102,400 ----a-r C:\WINDOWS\Installer\{4F5CE18C-D97D-48FF-A510-A0D90C918294}\iTunesIco.exe
+ 2007-12-10 15:11:40 27,136 ----a-r C:\WINDOWS\Installer\{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}\AppleSoftwareUpdateIco.exe
+ 2007-09-27 19:29:46 235,996 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat
+ 2006-09-19 13:44:04 15,664 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2007-10-31 13:09:14 30,464 -c--a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2006-10-03 18:47:52 109,360 ----a-w C:\WINDOWS\system32\GEARAspi.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\steam\steam.exe" [2007-12-04 14:33]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 15:45]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-03-05 13:28]
"AQQ"="D:\AQQ\AQQ.exe" [2007-02-28 13:18]
"DeskSpace"="D:\DeskSpace\deskspace.exe" [2007-09-18 13:15]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 03:10]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 18:40]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 14:40]
"RegistryMechanic"="" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 23:44 C:\WINDOWS\system32\bthprops.cpl]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]

C:\Documents and Settings\Andrzej\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54]

C:\Documents and Settings\Paweˆ\Menu Start\Programy\Autostart\
TransBar.lnk - D:\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 20:41:18]
Y'z Shadow.lnk - D:\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 08:43:14]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
D:\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 D:\SUPERAntiSpyware\SASWINLO.dll

S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-12-10 15:11:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-12 21:21:14
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> D:\DeskSpace\deskspace151.dll
.
Completion time: 2007-12-12 21:21:53
C:\ComboFix2.txt ... 2007-12-09 13:10
.
2007-09-01 01:01:18 --- E O F ---

[wojtas]

wejdz w panel sterowania> tam w centrum zabezpieczen> po lewej kliknij Zmien sposob informowania mnie przez centrum zabezpieczen i odznacz tamte opcje

Autor postu otrzymał pochwałę

[NaturalKiller]

No fajnie ale teraz Avast nie chce mi się zaktualizować........

[wojtas]

co znaczy nie chce? przeinstalowywales go?

[NaturalKiller]

Ok wszystko działa dzięki