proszę or sprawdzenie loga.

[Medic]

zużycie procesora na 98-100%
( svchost.exe [SYSTEM] praktycznie zjada 50-60% )
Hijac this

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:33:45, on 2008-01-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\VDOTool\TBPanel.exe
D:\Program Files\RivaTuner v2.06\RivaTuner.exe
D:\Program Files\FlashG222et\FlashGet.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Opera\Opera.exe
D:\Program Files\AIDA32 - Personal System Information\aida32.bin
D:\hijackthis.com
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: ryltorment.awardspace.com nprotect.ryl.com.my
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashG222et\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashG222et\getflash.dll
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [RivaTuner] "D:\Program Files\RivaTuner v2.06\RivaTuner.exe" /T
O4 - HKLM\..\Run: [Flashget] D:\Program Files\FlashG222et\FlashGet.exe /min
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - D:\Program Files\FlashG222et\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - D:\Program Files\FlashG222et\jc_link.htm
O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashG222et\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashG222et\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4658 bytes


[Dzi@dek]

O1 - Hosts: ryltorment.awardspace.com nprotect.ryl.com.my

usuń ten wpis w hijackthis.

Daj nowe logi z Combofix oraz Hijackthis.

[Kuba1]

O1 - Hosts: ryltorment.awardspace.com nprotect.ryl.com.my

Znasz to?Jeśli nie zaznacz i wciśnij Fix Checked

Następnie:

Pobierz narzędzie SDFix


*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Dodatkowo daj log z ComboFix

Podsumowując: Wróć z raportem z SDFix oraz logiem z ComboFix.

[Medic]

Kod: Zaznacz wszystko

O1 - Hosts: ryltorment.awardspace.com nprotect.ryl.com.my

to akurat znam mmo pewien.

log z SDfix to napewno raport.txt?

SDFIX

Kod: Zaznacz wszystko

SDFix: Version 1.129

Run by Administrator on 2008-01-19 at 22:26

Microsoft Windows XP [Wersja 5.1.2600]

Running From: D:\DOWNLO~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

COMBOFIX

Kod: Zaznacz wszystko

ComboFix 08-01-20.1 - Aven 2008-01-19 22:38:08.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.231 [GMT 1:00]
Running from: D:\Downloads\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\qmdispatch.dll

.
(((((((((((((((((((((((((   Files Created from 2007-12-20 to 2008-01-20  )))))))))))))))))))))))))))))))
.

2008-01-19 22:37 . 2000-08-31 08:00   51,200   --a------   C:\WINDOWS\NirCmd.exe
2008-01-19 22:31 . 2008-01-19 22:31   1,752   --a------   C:\Documents and Settings\Aven\clean.reg
2008-01-19 22:25 . 2008-01-19 22:26   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-01-19 22:25 . 2007-12-06 00:02   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-19 22:25 . 2007-12-06 00:02   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2008-01-19 22:25 . 2007-12-06 09:29   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2008-01-19 22:25 . 2008-01-19 22:26   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2008-01-19 22:25 . 2007-12-06 00:02   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2008-01-19 22:25 . 2007-12-06 00:02   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2008-01-19 22:25 . 2007-12-06 00:02   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2008-01-19 22:23 . 2008-01-19 22:23   806,912   --a------   C:\SDFix.exe
2008-01-19 21:55 . 2008-01-19 21:55   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Uniblue
2008-01-19 20:43 . 2008-01-19 20:43   <DIR>   d--------   C:\VundoFix Backups
2008-01-19 19:25 . 2008-01-19 19:25   <DIR>   d--------   C:\WINDOWS\OPTIONS
2008-01-19 19:25 . 2008-01-19 19:25   <DIR>   d--------   C:\Program Files\Realtek
2008-01-18 19:04 . 2008-01-18 19:04   552   --a------   C:\WINDOWS\system32\d3d8caps.dat
2008-01-18 18:42 . 2001-10-09 10:21   285,533   --a------   C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2008-01-18 18:42 . 2001-10-09 10:21   217,088   ---------   C:\WINDOWS\alcupd.exe
2008-01-18 18:42 . 2001-10-09 10:21   151,552   ---------   C:\WINDOWS\alcrmv.exe
2008-01-18 18:42 . 2001-10-09 10:21   124,416   ---------   C:\WINDOWS\soundman.exe
2008-01-18 18:35 . 2008-01-18 18:35   <DIR>   d--------   C:\WINDOWS\nview
2008-01-18 18:35 . 2007-10-28 16:52   356,352   --a------   C:\WINDOWS\system32\nvudisp.exe
2008-01-18 18:35 . 2008-01-18 18:35   162,793   --a------   C:\WINDOWS\system32\nvapps.xml
2008-01-18 18:35 . 2007-10-28 16:52   17,737   --a------   C:\WINDOWS\system32\nvdisp.nvu
2008-01-18 18:33 . 2007-10-28 18:02   356,352   --a------   C:\WINDOWS\system32\NVUNINST.EXE
2008-01-18 18:32 . 2008-01-18 18:32   <DIR>   d--------   C:\NVIDIA
2008-01-18 18:21 . 2007-10-28 16:52   7,424,992   --a------   C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-01-18 18:21 . 2004-08-03 22:29   1,897,408   --a--c---   C:\WINDOWS\system32\dllcache\nv4_mini.sys
2008-01-17 18:55 . 2008-01-17 18:55   <DIR>   d--------   C:\Program Files\directx
2008-01-17 16:20 . 2008-01-14 05:16   359,040   --a------   C:\WINDOWS\system32\drivers\tcpip.sys.flg
2008-01-13 15:47 . 2007-10-28 16:52   5,768,320   --a------   C:\WINDOWS\system32\nv4_disp.dll
2008-01-12 18:35 . 1998-11-13 13:10   307,200   --a------   C:\WINDOWS\IsUn0415.exe
2008-01-11 16:41 . 2008-01-11 16:41   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-01-11 15:21 . 2007-04-23 15:54   108,680   -ra------   C:\WINDOWS\system32\drivers\s115mdm.sys
2008-01-11 15:21 . 2007-04-23 15:54   100,488   -ra------   C:\WINDOWS\system32\drivers\s115mgmt.sys
2008-01-11 15:21 . 2007-04-23 15:54   98,568   -ra------   C:\WINDOWS\system32\drivers\s115obex.sys
2008-01-11 15:21 . 2007-04-23 15:54   83,208   -ra------   C:\WINDOWS\system32\drivers\s115bus.sys
2008-01-11 15:21 . 2007-04-23 15:54   15,112   -ra------   C:\WINDOWS\system32\drivers\s115mdfl.sys
2008-01-11 15:21 . 2007-04-23 15:54   12,424   -ra------   C:\WINDOWS\system32\drivers\s115whnt.sys
2008-01-11 15:21 . 2007-04-23 15:54   12,424   -ra------   C:\WINDOWS\system32\drivers\s115wh.sys
2008-01-11 15:21 . 2007-04-23 15:54   12,424   -ra------   C:\WINDOWS\system32\drivers\s115cmnt.sys
2008-01-11 15:21 . 2007-04-23 15:54   12,424   -ra------   C:\WINDOWS\system32\drivers\s115cm.sys
2008-01-11 15:20 . 2008-01-11 15:20   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\Teleca
2008-01-11 15:17 . 2008-01-13 02:14   <DIR>   d----c---   C:\WINDOWS\system32\DRVSTORE
2008-01-11 15:16 . 2008-01-13 02:16   <DIR>   d--------   C:\Program Files\Common Files\Teleca Shared
2008-01-11 15:16 . 2008-01-11 15:16   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\Sony Ericsson
2008-01-10 23:27 . 2008-01-10 23:27   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\Tibia
2008-01-10 15:57 . 2005-01-05 22:43   4,682   --a------   C:\WINDOWS\system32\npptNT2.sys
2008-01-10 15:56 . 2003-07-22 07:17   5,174   --a------   C:\WINDOWS\system32\nppt9x.vxd
2008-01-07 23:02 . 2008-01-07 23:02   <DIR>   d--------   C:\Program Files\OpenAL
2008-01-07 23:02 . 2008-01-07 23:02   409,600   --a------   C:\WINDOWS\system32\wrap_oal.dll
2008-01-06 15:45 . 2001-03-27 16:11   401,462   --a------   C:\WINDOWS\system\MSVCP60.DLL
2008-01-06 14:47 . 2008-01-19 21:55   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\Uniblue
2008-01-06 09:47 . 2008-01-06 09:47   43,520   --a------   C:\WINDOWS\system32\CmdLineExt03.dll
2008-01-05 22:24 . 2008-01-05 22:24   25,296   --a------   C:\WINDOWS\system32\BMXCtrlState-{00000000-00000000-0000000B-00001102-00000002-80651102}.rfx
2008-01-05 22:24 . 2008-01-05 22:24   25,296   --a------   C:\WINDOWS\system32\BMXBkpCtrlState-{00000000-00000000-0000000B-00001102-00000002-80651102}.rfx
2008-01-05 22:24 . 2008-01-05 22:24   16,516   --a------   C:\WINDOWS\system32\BMXStateBkp-{00000000-00000000-0000000B-00001102-00000002-80651102}.rfx
2008-01-05 22:24 . 2008-01-05 22:24   16,516   --a------   C:\WINDOWS\system32\BMXState-{00000000-00000000-0000000B-00001102-00000002-80651102}.rfx
2008-01-05 22:24 . 2008-01-05 22:24   24   --a------   C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000002-80651102}.dat
2008-01-05 22:24 . 2008-01-05 22:24   24   --a------   C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000002-80651102}.dat
2008-01-03 16:09 . 2008-01-03 16:09   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\Media Player Classic
2008-01-02 12:36 . 2008-01-05 22:24   1,080   --a------   C:\WINDOWS\system32\settingsbkup.sfm
2008-01-02 12:36 . 2008-01-05 22:24   1,080   --a------   C:\WINDOWS\system32\settings.sfm
2008-01-02 12:27 . 2008-01-05 22:24   <DIR>   d--------   C:\WINDOWS\system32\Defaults
2008-01-02 12:27 . 1995-01-13 14:10   149,504   ---------   C:\WINDOWS\system32\MFCANS32.DLL
2008-01-02 12:27 . 1995-01-13 14:10   108,032   ---------   C:\WINDOWS\system32\MFCUIA32.DLL
2008-01-02 12:27 . 2008-01-02 12:27   0   --a------   C:\WINDOWS\SBWIN.INI
2008-01-02 12:26 . 2008-01-05 22:24   <DIR>   d--------   C:\WINDOWS\system32\Data
2008-01-02 12:26 . 1999-09-22 23:18   2,259,067   --a------   C:\WINDOWS\system32\default.ecw
2008-01-02 12:26 . 2002-07-19 10:56   270,336   --a------   C:\WINDOWS\system32\SFMS32.DLL
2008-01-02 12:26 . 2001-10-26 17:29   98,304   --a--c---   C:\WINDOWS\system32\dllcache\a3d.dll
2008-01-02 12:26 . 2001-10-26 17:29   98,304   --a------   C:\WINDOWS\system32\a3d.dll
2008-01-02 12:26 . 2002-07-19 11:07   53,248   --a------   C:\WINDOWS\system32\AC3API.DLL
2008-01-02 12:26 . 2001-08-17 14:35   36,864   --a------   C:\WINDOWS\system32\sfman32.dll
2008-01-02 12:13 . 2004-08-03 23:08   10,624   --a------   C:\WINDOWS\system32\drivers\gameenum.sys
2008-01-02 12:13 . 2004-08-03 23:08   10,624   --a--c---   C:\WINDOWS\system32\dllcache\gameenum.sys
2008-01-02 12:13 . 2001-08-17 20:19   3,712   --a------   C:\WINDOWS\system32\drivers\ctljystk.sys
2008-01-02 12:13 . 2001-08-17 20:19   3,712   --a--c---   C:\WINDOWS\system32\dllcache\ctljystk.sys
2007-12-29 13:01 . 2007-12-04 15:44   23,600   --a------   C:\WINDOWS\system32\drivers\TVICHW32.SYS
2007-12-29 13:01 . 2007-12-29 13:01   1,609   --a------   C:\WINDOWS\mozver.dat
2007-12-28 16:35 . 2007-12-28 16:35   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 22:27 . 2007-12-26 22:27   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\teamspeak2
2007-12-26 13:58 . 2007-12-26 13:58   <DIR>   d--------   C:\WINDOWS\Sun
2007-12-26 12:29 . 2007-04-22 16:04   36,864   --a------   C:\WINDOWS\system32\dfkkgsm.dll
2007-12-23 05:18 . 2007-12-23 05:18   <DIR>   d--------   C:\Program Files\VIA
2007-12-23 05:17 . 2003-07-02 04:42   27,904   --a------   C:\WINDOWS\system32\drivers\VIAAGP1.SYS
2007-12-22 15:04 . 2007-12-22 15:04   25,024   --a------   C:\Documents and Settings\Aven\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-22 02:12 . 2007-12-22 16:15   65,536   --a------   C:\WINDOWS\IFinst27.exe
2007-12-21 20:05 . 2007-12-21 20:05   <DIR>   d--------   C:\Downloads
2007-12-21 20:04 . 2007-12-21 20:10   <DIR>   d--------   C:\Documents and Settings\Aven\Dane aplikacji\GetRight

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 21:06   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-01-19 18:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-01-16 20:22   21,840   ----atw   C:\WINDOWS\system32\SIntfNT.dll
2008-01-16 20:22   17,212   ----atw   C:\WINDOWS\system32\SIntf32.dll
2008-01-16 20:22   12,067   ----atw   C:\WINDOWS\system32\SIntf16.dll
2008-01-14 04:16   359,040   ----a-w   C:\WINDOWS\system32\drivers\tcpip.sys
2008-01-11 13:18   ---------   d---a-w   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-29 07:55   ---------   d-----w   C:\Program Files\VDOTool
2007-12-24 12:49   7,680   ----a-w   C:\WINDOWS\system32\ff_vfw.dll
2007-12-18 15:52   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2007-12-18 11:31   108,144   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-12-17 16:03   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\Lavasoft
2007-12-16 14:12   ---------   d-----w   C:\Program Files\Common Files\Adobe
2007-12-15 10:33   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\Winamp
2007-12-12 16:52   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\ScanSoft
2007-12-12 16:48   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-12 16:42   ---------   d-----w   C:\Program Files\ScanSoft
2007-12-11 19:47   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\muvee Technologies
2007-12-11 15:27   ---------   d-----w   C:\Program Files\Common Files\muvee Technologies
2007-12-11 15:24   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\InstallShield
2007-12-11 13:32   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies
2007-12-10 11:54   ---------   d-----w   C:\Program Files\TGTSoft
2007-12-08 21:16   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\MyPhoneExplorer
2007-12-08 20:24   ---------   d-----w   C:\Program Files\Intel Desktop Board
2007-12-07 06:13   ---------   d-----r   C:\Documents and Settings\Aven\Dane aplikacji\Brother
2007-12-06 21:10   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2007-12-06 21:09   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Brother
2007-12-06 20:44   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\Gadu-Gadu
2007-12-06 12:57   685,816   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-06 11:32   ---------   d-----w   C:\Documents and Settings\Aven\Dane aplikacji\Ventrilo
2007-12-06 10:21   ---------   d-----w   C:\Program Files\Java
2007-12-06 10:20   ---------   d-----w   C:\Program Files\Common Files\Java
2007-12-06 08:39   ---------   d--h--w   C:\Program Files\Uninstall Information
2007-12-06 08:34   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-06 08:33   558,142   ----a-w   C:\WINDOWS\java\Packages\Q1JBDZ5F.ZIP
2007-12-06 08:33   155,995   ----a-w   C:\WINDOWS\java\Packages\EOV7VV5N.ZIP
2007-12-06 08:32   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 01:33   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2007-11-29 22:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
2007-10-28 15:52   81,920   ----a-w   C:\WINDOWS\system32\nvwddi.dll
2007-10-28 15:52   81,920   ----a-w   C:\WINDOWS\system32\nvmctray.dll
2007-10-28 15:52   8,531,968   ----a-w   C:\WINDOWS\system32\nvcpl.dll
2007-10-28 15:52   757,760   ----a-w   C:\WINDOWS\system32\nvcplui.exe
2007-10-28 15:52   6,901,760   ----a-w   C:\WINDOWS\system32\nvoglnt.dll
2007-10-28 15:52   6,541,312   ----a-w   C:\WINDOWS\system32\nvdisps.dll
2007-10-28 15:52   5,611,520   ----a-w   C:\WINDOWS\system32\nvdispsr.dll
2007-10-28 15:52   466,944   ----a-w   C:\WINDOWS\system32\nvshell.dll
2007-10-28 15:52   458,752   ----a-w   C:\WINDOWS\system32\nvmccssr.dll
2007-10-28 15:52   45,056   ----a-w   C:\WINDOWS\system32\nvmccsrs.dll
2007-10-28 15:52   442,368   ----a-w   C:\WINDOWS\system32\nvappbar.exe
2007-10-28 15:52   425,984   ----a-w   C:\WINDOWS\system32\keystone.exe
2007-10-28 15:52   380,928   ----a-w   C:\WINDOWS\system32\nvapi.dll
2007-10-28 15:52   35,328   ----a-w   C:\WINDOWS\system32\nvcodins.dll
2007-10-28 15:52   35,328   ----a-w   C:\WINDOWS\system32\nvcod.dll
2007-10-28 15:52   335,872   ----a-w   C:\WINDOWS\system32\nvwrses.dll
2007-10-28 15:52   335,872   ----a-w   C:\WINDOWS\system32\nvwrsel.dll
2007-10-28 15:52   327,680   ----a-w   C:\WINDOWS\system32\nvwrsfr.dll
2007-10-28 15:52   327,680   ----a-w   C:\WINDOWS\system32\nvwrsesm.dll
2007-10-28 15:52   327,680   ----a-w   C:\WINDOWS\system32\nvrshe.dll
2007-10-28 15:52   327,680   ----a-w   C:\WINDOWS\system32\nvrsar.dll
2007-10-28 15:52   323,584   ----a-w   C:\WINDOWS\system32\nvwrspt.dll
2007-10-28 15:52   323,584   ----a-w   C:\WINDOWS\system32\nvwrsit.dll
2007-10-28 15:52   319,488   ----a-w   C:\WINDOWS\system32\nvwrsptb.dll
2007-10-28 15:52   319,488   ----a-w   C:\WINDOWS\system32\nvwrsnl.dll
2007-10-28 15:52   315,392   ----a-w   C:\WINDOWS\system32\nvwrsru.dll
2007-10-28 15:52   315,392   ----a-w   C:\WINDOWS\system32\nvwrshu.dll
2007-10-28 15:52   311,296   ----a-w   C:\WINDOWS\system32\nvwrsde.dll
2007-10-28 15:52   307,200   ----a-w   C:\WINDOWS\system32\nvexpbar.dll
2007-10-28 15:52   303,104   ----a-w   C:\WINDOWS\system32\nvwrstr.dll
2007-10-28 15:52   303,104   ----a-w   C:\WINDOWS\system32\nvwrssl.dll
2007-10-28 15:52   303,104   ----a-w   C:\WINDOWS\system32\nvwrsfi.dll
2007-10-28 15:52   3,715,072   ----a-w   C:\WINDOWS\system32\nvvitvsr.dll
2007-10-28 15:52   3,698,688   ----a-w   C:\WINDOWS\system32\nvvitvs.dll
2007-10-28 15:52   3,407,872   ----a-w   C:\WINDOWS\system32\nvgames.dll
2007-10-28 15:52   3,330,048   ----a-w   C:\WINDOWS\system32\nvgamesr.dll
2007-10-28 15:52   299,008   ----a-w   C:\WINDOWS\system32\nvwrssk.dll
2007-10-28 15:52   299,008   ----a-w   C:\WINDOWS\system32\nvwrsno.dll
2007-10-28 15:52   294,912   ----a-w   C:\WINDOWS\system32\nvwrssv.dll
2007-10-28 15:52   294,912   ----a-w   C:\WINDOWS\system32\nvwrspl.dll
2007-10-28 15:52   294,912   ----a-w   C:\WINDOWS\system32\nvwrsda.dll
2007-10-28 15:52   290,816   ----a-w   C:\WINDOWS\system32\nvwrsth.dll
2007-10-28 15:52   286,720   ----a-w   C:\WINDOWS\system32\nvwrseng.dll
2007-10-28 15:52   286,720   ----a-w   C:\WINDOWS\system32\nvwrscs.dll
2007-10-28 15:52   286,720   ----a-w   C:\WINDOWS\system32\nvnt4cpl.dll
2007-10-28 15:52   282,624   ----a-w   C:\WINDOWS\system32\nvwrsar.dll
2007-10-28 15:52   282,624   ----a-w   C:\WINDOWS\system32\nvrsfr.dll
2007-10-28 15:52   282,624   ----a-w   C:\WINDOWS\system32\nvrses.dll
2007-10-28 15:52   282,624   ----a-w   C:\WINDOWS\system32\nvrsel.dll
2007-10-28 15:52   278,528   ----a-w   C:\WINDOWS\system32\nvwrshe.dll
2007-10-28 15:52   278,528   ----a-w   C:\WINDOWS\system32\nvrsit.dll
2007-10-28 15:52   278,528   ----a-w   C:\WINDOWS\system32\nvrsde.dll
2007-10-28 15:52   274,432   ----a-w   C:\WINDOWS\system32\nvrspt.dll
2007-10-28 15:52   274,432   ----a-w   C:\WINDOWS\system32\nvrsnl.dll
2007-10-28 15:52   274,432   ----a-w   C:\WINDOWS\system32\nvrsesm.dll
2007-10-28 15:52   270,336   ----a-w   C:\WINDOWS\system32\nvrsru.dll
2007-10-28 15:52   266,240   ----a-w   C:\WINDOWS\system32\nvrsptb.dll
2007-10-28 15:52   266,240   ----a-w   C:\WINDOWS\system32\nvrsja.dll
2007-10-28 15:52   258,048   ----a-w   C:\WINDOWS\system32\nvrstr.dll
2007-10-28 15:52   258,048   ----a-w   C:\WINDOWS\system32\nvrssl.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06 167368]
"Uniblue SpeedUpMyPC"="D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-12-07 09:31 9479448]
"Uniblue RegistryBooster 2"="D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 16:06 1885464]
"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]
"Uniblue SpyEraser"="D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" [2008-01-08 09:14 1260296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-10-02 12:19 2165272]
"RivaTuner"="D:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 19:05 2650112]
"Flashget"="D:\Program Files\FlashG222et\FlashGet.exe" [2007-09-25 09:10 2007088]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-28 16:52 8531968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

S3 AIDA32Driver;AIDA32Driver;D:\Program Files\AIDA32 []
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 04:50]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 15:54]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15:54]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 15:54]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 15:54]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 15:54]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 15:31:56 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-01-06 13:47:16 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-01-19 20:56:01 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 22:39:51
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-20 22:40:41
ComboFix-quarantined-files.txt  2008-01-20 21:40:20


[wojtas]

wklej caly raport z sdfixa