proszę o sprawdzenie loga

[ravik1313]

Wklejam tu loga z powodu wolnej pracy internetu oraz ściągania , normalna prędkość wynosi około 64 kb/s a teraz mam od 14 do 20 max skanowanie kompa nic nie daje .

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:44:04, on 2008-02-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe
D:\Program Files\ArcaBit\ArcaUpdate\update.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe
D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe
D:\Program Files\ArcaBit\Common\TaskScheduler.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe
D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
D:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
D:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqDIREC.exe
D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe
C:\Program Files\windows media player\wmplayer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\rav\Pulpit\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.rockstargames.com/register/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AvMenu] D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe
O4 - HKLM\..\Run: [ABRegmon] D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe
O4 - HKLM\..\Run: [ArcaCheck] D:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll
O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe
O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe
O23 - Service: ArcaBit.Core.Configurator - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe
O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe
O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - D:\Program Files\ArcaBit\Common\TaskScheduler.exe
O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - D:\Program Files\ArcaBit\ArcaUpdate\update.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 4297 bytes

"Silent Runners.vbs", revision 55, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Gadu-Gadu" = ""D:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"AvMenu" = "D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" ["ArcaBit"]
"ABRegmon" = "D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" ["ArcaBit"]
"ArcaCheck" = "D:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup" ["ArcaBit"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{D7824897-C8DC-49b4-B790-30F7ED16A5FD}" = "ArcaVir Shell Extension"
-> {HKLM...CLSID} = "ArcaVir Shell Extension"
\InProcServer32\(Default) = "D:\Program Files\ArcaBit\arcavir\avshell.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\Office\OLKFSTUB.DLL" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> TS_LogonListener\DLLName = "TS_LogonListener.dll" ["ArcaBit sp. z o.o."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
ArcaVirShell\(Default) = "{D7824897-C8DC-49b4-B790-30F7ED16A5FD}"
-> {HKLM...CLSID} = "ArcaVir Shell Extension"
\InProcServer32\(Default) = "D:\Program Files\ArcaBit\arcavir\avshell.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
ArcaVirShell\(Default) = "{D7824897-C8DC-49b4-B790-30F7ED16A5FD}"
-> {HKLM...CLSID} = "ArcaVir Shell Extension"
\InProcServer32\(Default) = "D:\Program Files\ArcaBit\arcavir\avshell.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "rav" & "All Users" startup folders:
-----------------------------------------------------

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart
"hp psc 1000 series" -> shortcut to: "D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe" ["Hewlett-Packard Co."]
"hpoddt01.exe" -> shortcut to: "D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"Microsoft Office" -> shortcut to: "D:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Enabled Scheduled Tasks:
------------------------

"FRU Task #Hewlett-Packard#hp psc 1200 series#1202816902" -> launches: "D:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I "#Hewlett-Packard#hp psc 1200 series#1202816902"" [empty string]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

ArcaBit FileMonitor, ABFileMon, ""D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe"" ["ArcaBit"]
ArcaBit NetMonitor, ABNetMon, "D:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe" ["ArcaBit"]
ArcaBit Update Service, AVUpdate, "D:\Program Files\ArcaBit\ArcaUpdate\update.exe" ["ArcaBit"]
ArcaBit.Core.Configurator, ArcaBit.Core.Configurator, ""D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe"" ["ArcaBit"]
ArcaBit.Core.LoggingService, ArcaBit.Core.LoggingService, ""D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe"" ["ArcaBit"]
ArcaBit.TaskScheduler, ArcaBit.TaskScheduler, ""D:\Program Files\ArcaBit\Common\TaskScheduler.exe"" ["ArcaBit sp. z o.o."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
hpzsnt07\Driver = "hpzsnt07.dll" ["HP"]


---------- (launch time: 2008-02-12 19:44:16)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 27 seconds, including 3 seconds for message boxes)

[wojtas]

Wykonaj to co jest podane w tym temacie


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

[ravik1313]

SDFix: Version 1.141

Run by rav on 2008-02-12 at 20:44

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\DOCUME~1\LOCALS~1.003\USTAWI~1\TEMPOR~1\CONTENT.IE5\7JDNLVUA\QWERTY~1.HTM - Deleted
C:\Program Files\Helper\1202748238.dll - Deleted
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll - Deleted
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll - Deleted



Folder C:\Program Files\Helper - Removed


Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 20:48:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\\Program Files\\Steam\\SteamApps\\canyon292\\counter-strike source\\hl2.exe"="E:\\Program Files\\Steam\\SteamApps\\canyon292\\counter-strike source\\hl2.exe:*:Enabled:hl2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 10 Jan 2008 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~14.tmp"
Mon 7 Jan 2008 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~1A.tmp"
Fri 14 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~2E.tmp"
Wed 19 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~34.tmp"
Fri 1 Feb 2008 209,920 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~39.tmp"
Wed 26 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~5.tmp"
Sat 19 Jan 2008 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~6.tmp"
Thu 27 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~6B.tmp"
Mon 4 Feb 2008 209,920 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~7.tmp"
Sat 29 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~9.tmp"
Sun 16 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\Ravo\Ustawienia lokalne\Temp\~A0.tmp"
Fri 5 Oct 2007 197,120 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~16.tmp"
Thu 15 Nov 2007 197,120 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~17.tmp"
Fri 16 Nov 2007 197,120 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~2A.tmp"
Wed 10 Oct 2007 197,120 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~50.tmp"
Thu 22 Nov 2007 197,120 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~75.tmp"
Sat 22 Sep 2007 215,040 A..H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Ustawienia lokalne\Temp\~7A.tmp"
Mon 15 Oct 2007 19,968 ...H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Dane aplikacji\Microsoft\Word\~WRL0005.tmp"
Mon 15 Oct 2007 22,016 ...H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Dane aplikacji\Microsoft\Word\~WRL3036.tmp"
Mon 15 Oct 2007 22,528 ...H. --- "C:\Documents and Settings\Rav.KOCHAăSKIKOMP\Dane aplikacji\Microsoft\Word\~WRL3156.tmp"

Finished!

ComboFix 08-02-13.1 - rav 2008-02-12 20:54:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.603 [GMT 1:00]
Running from: C:\Documents and Settings\rav\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-12 20:43 . 2004-08-04 00:44 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-02-12 20:42 . 2008-02-12 20:42 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-12 20:32 . 2008-02-12 20:50 <DIR> d-------- C:\SDFix
2008-02-12 12:52 . 2008-02-12 12:55 488 --a------ C:\hpfr3420.xml
2008-02-12 12:48 . 2008-02-12 12:48 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Hewlett-Packard
2008-02-12 12:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-12 12:43 . 2008-02-12 12:48 19,558 --a------ C:\WINDOWS\hpoins01.dat
2008-02-12 12:43 . 2003-04-23 01:45 16,606 --------- C:\WINDOWS\hpomdl01.dat
2008-02-12 12:36 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-12 12:36 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-12 11:57 . 2008-02-12 11:57 427 --a------ C:\WINDOWS\ODBC.INI
2008-02-12 11:53 . 2008-02-12 11:53 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Microsoft Web Folders
2008-02-11 22:41 . 2008-02-11 22:44 <DIR> dr------- C:\Sakson's save 100%
2008-02-11 19:36 . 2008-02-11 19:37 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Tibia
2008-02-11 19:34 . 2008-02-11 19:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ArcaBit
2008-02-11 19:33 . 2008-02-11 19:33 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-11 19:33 . 2008-02-11 19:33 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-11 19:32 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji\ArcaBit
2008-02-11 19:17 . 2008-02-12 15:45 <DIR> d-------- C:\Documents and Settings\rav\Gadu-Gadu
2008-02-11 19:12 . 2008-02-11 18:25 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-02-11 19:12 . 2008-02-11 19:12 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-11 19:09 . 2005-11-04 16:55 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll
2008-02-11 19:06 . 2005-04-16 15:20 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2008-02-11 19:04 . 2008-02-11 19:04 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Menu Start
2008-02-11 19:04 . 2008-02-11 19:04 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Menu Start
2008-02-11 19:04 . 2008-02-11 19:04 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-02-11 18:41 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-11 18:41 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\001888_.tmp
2008-02-11 18:32 . 2006-03-09 08:29 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-02-11 18:32 . 2008-02-12 20:50 50,257 --a------ C:\WINDOWS\system32\nvapps.xml
2008-02-11 18:32 . 2006-03-09 08:29 16,960 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-02-11 18:31 . 2006-03-09 17:59 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-02-11 18:31 . 2004-05-02 09:47 23,040 -ra------ C:\WINDOWS\system32\drivers\GVCplDrv.sys
2008-02-11 18:30 . 2006-08-14 14:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-02-11 18:27 . 2008-02-11 18:15 <DIR> d--h----- C:\Documents and Settings\rav\Ustawienia lokalne
2008-02-11 18:27 . 2008-02-11 19:05 <DIR> dr------- C:\Documents and Settings\rav\Ulubione
2008-02-11 18:27 . 2008-02-11 18:20 <DIR> d--h----- C:\Documents and Settings\rav\Szablony
2008-02-11 18:27 . 2008-02-12 20:53 <DIR> d-------- C:\Documents and Settings\rav\Pulpit
2008-02-11 18:27 . 2008-02-12 12:55 <DIR> dr------- C:\Documents and Settings\rav\Moje dokumenty
2008-02-11 18:27 . 2008-02-12 11:53 <DIR> dr------- C:\Documents and Settings\rav\Menu Start
2008-02-11 18:27 . 2008-02-12 12:48 <DIR> dr-h----- C:\Documents and Settings\rav\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-02-11 18:24 . 2008-02-11 18:46 299,552 --a------ C:\WINDOWS\WMSysPrx.prx
2008-02-11 18:24 . 2008-02-11 18:27 25,065 --a------ C:\WINDOWS\system32\wmpscheme.xml
2008-02-11 18:24 . 2008-02-11 18:24 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-02-11 18:24 . 2008-02-11 18:24 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-02-11 18:24 . 2008-02-11 18:24 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT
2008-02-11 18:24 . 2008-02-11 18:24 0 --a------ C:\WINDOWS\control.ini
2008-02-11 18:23 . 2008-02-11 18:24 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-02-11 18:23 . 2008-02-11 18:23 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest
2008-02-11 18:23 . 2008-02-11 18:23 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-02-11 18:21 . 2004-08-04 00:44 678,400 --a------ C:\WINDOWS\system32\inetcomm.dll
2008-02-11 18:20 . 2004-08-04 00:43 1,251,840 --a------ C:\WINDOWS\system32\comsvcs.dll
2008-02-11 18:18 . 2004-08-04 00:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-11 18:18 . 2001-08-17 21:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS\Ustawienia lokalne
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Ulubione
2008-02-11 18:15 . 2008-02-11 18:20 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS\Szablony
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Pulpit
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Moje dokumenty
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> dr------- C:\Documents and Settings\Default User.WINDOWS\Menu Start
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Ulubione
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d--h----- C:\Documents and Settings\All Users.WINDOWS\Szablony
2008-02-11 18:15 . 2008-02-12 12:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Pulpit
2008-02-11 18:15 . 2008-02-12 11:56 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Menu Start
2008-02-11 18:15 . 2008-02-11 18:21 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Dokumenty
2008-02-11 18:14 . 2008-02-11 18:15 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS\Dane aplikacji
2008-02-11 18:14 . 2008-02-12 12:43 <DIR> dr-h----- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji
2008-02-11 18:14 . 2003-04-16 13:00 1,086,182 -ra------ C:\WINDOWS\SET3.tmp
2008-02-11 18:14 . 2003-04-16 13:00 808,524 --a--c--- C:\WINDOWS\system32\dllcache\NT5IIS.CAT
2008-02-11 18:14 . 2003-04-16 13:00 399,670 --a--c--- C:\WINDOWS\system32\dllcache\MAPIMIG.CAT
2008-02-11 18:14 . 2003-04-16 13:00 37,509 --a--c--- C:\WINDOWS\system32\dllcache\MW770.CAT
2008-02-11 18:14 . 2003-04-16 13:00 13,923 -ra------ C:\WINDOWS\SET7.tmp
2008-02-11 18:14 . 2003-04-16 13:00 13,497 --a--c--- C:\WINDOWS\system32\dllcache\HPCRDP.CAT
2008-02-11 18:14 . 2003-04-16 13:00 8,599 --a--c--- C:\WINDOWS\system32\dllcache\IASNT4.CAT
2008-02-11 18:14 . 2003-04-16 13:00 7,407 --a--c--- C:\WINDOWS\system32\dllcache\OEMBIOS.CAT
2008-02-10 16:09 . 2008-02-11 22:37 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-10 16:00 . 2008-02-11 22:38 <DIR> d-------- C:\WINDOWS\San Andreas Mod Installer
2008-02-07 14:12 . 2008-02-07 14:12 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\BSplayer Pro
2008-02-07 14:12 . 2008-02-07 14:16 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\BSplayer
2008-02-04 19:05 . 2008-02-04 19:05 <DIR> d-------- C:\Program Files\REMIDA
2008-01-18 14:10 . 2008-01-18 14:10 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\Gadu-Gadu
2008-01-18 13:55 . 2008-01-18 13:55 <DIR> d-------- C:\Documents and Settings\Ravo\Gadu-Gadu

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 10:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-07 13:23 --------- d-----w C:\Program Files\Real Alternative
2008-02-07 13:22 --------- d-----w C:\Program Files\Common Files\Real
2008-02-07 13:04 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-18 20:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 16:09 --------- d-----w C:\Documents and Settings\Ravo\Dane aplikacji\Microsoft Web Folders
2007-12-21 14:46 --------- d-----w C:\Documents and Settings\Ravo\Dane aplikacji\Creative
2007-12-21 14:39 --------- d-----w C:\Program Files\Creative
2007-12-18 18:03 --------- d-----w C:\Program Files\DAEMON Tools
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12 1849032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-03-09 08:29 7561216]
"nwiz"="nwiz.exe" [2006-03-09 08:29 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-03-09 08:29 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 09:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"AvMenu"="D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" [2008-01-29 15:12 481800]
"ABRegmon"="D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 09:40 303104]
"ArcaCheck"="D:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 12:57 836912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
hp psc 1000 series.lnk - D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 17:21:38 147456]
hpoddt01.exe.lnk - D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 17:11:12 28672]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener]
TS_LogonListener.dll 2007-01-12 15:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll

R1 ABTDI;ABTDI;D:\Program Files\ArcaBit\ArcaVir\ABTDI.sys [2007-05-08 13:45]
R2 ABFileMon;ArcaBit FileMonitor;"D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe" [2007-10-09 11:10]
R2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;"D:\Program Files\ArcaBit\Common\TaskScheduler.exe" [2007-01-12 15:42]
R2 AVUpdate;ArcaBit Update Service;D:\Program Files\ArcaBit\ArcaUpdate\update.exe [2007-02-26 15:04]
R3 ABFLT;ArcaBit File Monitor Driver;D:\PROGRA~1\ArcaBit\ArcaVir\ABFLT.sys [2007-09-12 13:37]
R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;"D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe" [2007-01-11 15:01]
R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;"D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe" [2007-01-11 15:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\setup.EXE /AUTORUN
\Shell\configure\command - F:\setup.EXE
\Shell\install\command - F:\setup.EXE

.
Contents of the 'Scheduled Tasks' folder
"2008-02-12 11:49:02 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1202816902.job"
- D:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 20:55:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-13 20:56:05

teraz jeszcze arcavir wykrył mi downloadery jakieś to usunołem ale wykrył jeszcze Heur.W32 i neida sie go usunąć

[wojtas]

gdzie Ci wykrywa wirusy?

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED


Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\001888_.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[ravik1313]

ComboFix 08-02-13.1 - rav 2008-02-13 21:30:30.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.560 [GMT 1:00]
Running from: C:\Documents and Settings\rav\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\rav\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\001888_.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\001888_.tmp

.
((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-12 20:43 . 2004-08-04 00:44 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-02-12 20:42 . 2008-02-12 20:42 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-12 20:32 . 2008-02-12 20:50 <DIR> d-------- C:\SDFix
2008-02-12 12:52 . 2008-02-12 12:55 488 --a------ C:\hpfr3420.xml
2008-02-12 12:48 . 2008-02-12 12:48 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Hewlett-Packard
2008-02-12 12:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-12 12:43 . 2008-02-12 12:48 19,558 --a------ C:\WINDOWS\hpoins01.dat
2008-02-12 12:43 . 2003-04-23 01:45 16,606 --------- C:\WINDOWS\hpomdl01.dat
2008-02-12 12:36 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-12 12:36 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-12 11:57 . 2008-02-12 11:57 427 --a------ C:\WINDOWS\ODBC.INI
2008-02-12 11:53 . 2008-02-12 11:53 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Microsoft Web Folders
2008-02-11 22:41 . 2008-02-11 22:44 <DIR> dr------- C:\Sakson's save 100%
2008-02-11 19:36 . 2008-02-11 19:37 <DIR> d-------- C:\Documents and Settings\rav\Dane aplikacji\Tibia
2008-02-11 19:34 . 2008-02-11 19:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ArcaBit
2008-02-11 19:33 . 2008-02-11 19:33 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-11 19:33 . 2008-02-11 19:33 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-11 19:32 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji\ArcaBit
2008-02-11 19:17 . 2008-02-12 15:45 <DIR> d-------- C:\Documents and Settings\rav\Gadu-Gadu
2008-02-11 19:12 . 2008-02-11 18:25 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-02-11 19:12 . 2008-02-11 19:12 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-11 19:09 . 2005-11-04 16:55 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll
2008-02-11 19:06 . 2005-04-16 15:20 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2008-02-11 19:04 . 2008-02-11 19:04 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Menu Start
2008-02-11 19:04 . 2008-02-11 19:04 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Menu Start
2008-02-11 19:04 . 2008-02-11 19:04 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-02-11 18:41 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-11 18:32 . 2006-03-09 08:29 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-02-11 18:32 . 2008-02-12 20:50 50,257 --a------ C:\WINDOWS\system32\nvapps.xml
2008-02-11 18:32 . 2006-03-09 08:29 16,960 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-02-11 18:31 . 2006-03-09 17:59 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-02-11 18:31 . 2004-05-02 09:47 23,040 -ra------ C:\WINDOWS\system32\drivers\GVCplDrv.sys
2008-02-11 18:30 . 2006-08-14 14:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-02-11 18:27 . 2008-02-13 20:57 <DIR> d--h----- C:\Documents and Settings\rav\Ustawienia lokalne
2008-02-11 18:27 . 2008-02-11 19:05 <DIR> dr------- C:\Documents and Settings\rav\Ulubione
2008-02-11 18:27 . 2008-02-11 18:20 <DIR> d--h----- C:\Documents and Settings\rav\Szablony
2008-02-11 18:27 . 2008-02-13 21:30 <DIR> d-------- C:\Documents and Settings\rav\Pulpit
2008-02-11 18:27 . 2008-02-13 21:29 <DIR> dr------- C:\Documents and Settings\rav\Moje dokumenty
2008-02-11 18:27 . 2008-02-12 11:53 <DIR> dr------- C:\Documents and Settings\rav\Menu Start
2008-02-11 18:27 . 2008-02-12 12:48 <DIR> dr-h----- C:\Documents and Settings\rav\Dane aplikacji
2008-02-11 18:26 . 2008-02-13 20:56 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-13 20:56 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-13 20:56 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-13 20:56 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Ustawienia lokalne
2008-02-11 18:26 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 19:32 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.004\Dane aplikacji
2008-02-11 18:26 . 2008-02-11 18:26 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-02-11 18:24 . 2008-02-11 18:46 299,552 --a------ C:\WINDOWS\WMSysPrx.prx
2008-02-11 18:24 . 2008-02-11 18:27 25,065 --a------ C:\WINDOWS\system32\wmpscheme.xml
2008-02-11 18:24 . 2008-02-11 18:24 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-02-11 18:24 . 2008-02-11 18:24 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-02-11 18:24 . 2008-02-11 18:24 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT
2008-02-11 18:24 . 2008-02-11 18:24 0 --a------ C:\WINDOWS\control.ini
2008-02-11 18:23 . 2008-02-11 18:24 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-02-11 18:23 . 2008-02-11 18:23 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest
2008-02-11 18:23 . 2008-02-11 18:23 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-02-11 18:21 . 2004-08-04 00:44 678,400 --a------ C:\WINDOWS\system32\inetcomm.dll
2008-02-11 18:20 . 2004-08-04 00:43 1,251,840 --a------ C:\WINDOWS\system32\comsvcs.dll
2008-02-11 18:18 . 2004-08-04 00:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-11 18:18 . 2001-08-17 21:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-11 18:15 . 2008-02-13 20:56 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS\Ustawienia lokalne
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Ulubione
2008-02-11 18:15 . 2008-02-11 18:20 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS\Szablony
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Pulpit
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS\Moje dokumenty
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> dr------- C:\Documents and Settings\Default User.WINDOWS\Menu Start
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Ulubione
2008-02-11 18:15 . 2008-02-11 18:15 <DIR> d--h----- C:\Documents and Settings\All Users.WINDOWS\Szablony
2008-02-11 18:15 . 2008-02-12 12:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Pulpit
2008-02-11 18:15 . 2008-02-12 11:56 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Menu Start
2008-02-11 18:15 . 2008-02-11 18:21 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Dokumenty
2008-02-11 18:14 . 2008-02-11 18:15 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS\Dane aplikacji
2008-02-11 18:14 . 2008-02-12 12:43 <DIR> dr-h----- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji
2008-02-11 18:14 . 2003-04-16 13:00 1,086,182 -ra------ C:\WINDOWS\SET3.tmp
2008-02-11 18:14 . 2003-04-16 13:00 808,524 --a--c--- C:\WINDOWS\system32\dllcache\NT5IIS.CAT
2008-02-11 18:14 . 2003-04-16 13:00 399,670 --a--c--- C:\WINDOWS\system32\dllcache\MAPIMIG.CAT
2008-02-11 18:14 . 2003-04-16 13:00 37,509 --a--c--- C:\WINDOWS\system32\dllcache\MW770.CAT
2008-02-11 18:14 . 2003-04-16 13:00 13,923 -ra------ C:\WINDOWS\SET7.tmp
2008-02-11 18:14 . 2003-04-16 13:00 13,497 --a--c--- C:\WINDOWS\system32\dllcache\HPCRDP.CAT
2008-02-11 18:14 . 2003-04-16 13:00 8,599 --a--c--- C:\WINDOWS\system32\dllcache\IASNT4.CAT
2008-02-11 18:14 . 2003-04-16 13:00 7,407 --a--c--- C:\WINDOWS\system32\dllcache\OEMBIOS.CAT
2008-02-10 16:09 . 2008-02-11 22:37 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-10 16:00 . 2008-02-11 22:38 <DIR> d-------- C:\WINDOWS\San Andreas Mod Installer
2008-02-07 14:12 . 2008-02-07 14:12 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\BSplayer Pro
2008-02-07 14:12 . 2008-02-07 14:16 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\BSplayer
2008-02-04 19:05 . 2008-02-04 19:05 <DIR> d-------- C:\Program Files\REMIDA
2008-01-18 14:10 . 2008-01-18 14:10 <DIR> d-------- C:\Documents and Settings\Ravo\Dane aplikacji\Gadu-Gadu
2008-01-18 13:55 . 2008-01-18 13:55 <DIR> d-------- C:\Documents and Settings\Ravo\Gadu-Gadu

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 10:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-07 13:23 --------- d-----w C:\Program Files\Real Alternative
2008-02-07 13:22 --------- d-----w C:\Program Files\Common Files\Real
2008-02-07 13:04 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-18 20:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 16:09 --------- d-----w C:\Documents and Settings\Ravo\Dane aplikacji\Microsoft Web Folders
2007-12-21 14:46 --------- d-----w C:\Documents and Settings\Ravo\Dane aplikacji\Creative
2007-12-21 14:39 --------- d-----w C:\Program Files\Creative
2007-12-18 18:03 --------- d-----w C:\Program Files\DAEMON Tools
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12 1849032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-03-09 08:29 7561216]
"nwiz"="nwiz.exe" [2006-03-09 08:29 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-03-09 08:29 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 09:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"AvMenu"="D:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" [2008-01-29 15:12 481800]
"ABRegmon"="D:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 09:40 303104]
"ArcaCheck"="D:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 12:57 836912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
hp psc 1000 series.lnk - D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 17:21:38 147456]
hpoddt01.exe.lnk - D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 17:11:12 28672]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener]
TS_LogonListener.dll 2007-01-12 15:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll

R1 ABTDI;ABTDI;D:\Program Files\ArcaBit\ArcaVir\ABTDI.sys [2007-05-08 13:45]
R2 ABFileMon;ArcaBit FileMonitor;"D:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe" [2007-10-09 11:10]
R2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;"D:\Program Files\ArcaBit\Common\TaskScheduler.exe" [2007-01-12 15:42]
R2 AVUpdate;ArcaBit Update Service;D:\Program Files\ArcaBit\ArcaUpdate\update.exe [2007-02-26 15:04]
R3 ABFLT;ArcaBit File Monitor Driver;D:\PROGRA~1\ArcaBit\ArcaVir\ABFLT.sys [2007-09-12 13:37]
R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;"D:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe" [2007-01-11 15:01]
R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;"D:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe" [2007-01-11 15:03]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-12 11:49:02 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1202816902.job"
- D:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 21:31:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-13 21:32:00
ComboFix-quarantined-files.txt 2008-02-13 20:31:46
ComboFix2.txt 2008-02-13 19:56:05

tylko skonczył i arcavir mi wykrył w Temporary Internet Files\Conect.IE5\0YBCVTF1\iftkk[1].html Downloader.Diehard.dv

[wojtas]

zastosuj jeszcze raz ATF_Cleaner i bedzie czysto

Autor postu otrzymał pochwałę

[ravik1313]

Dzięki za wszystko