prosze o sprawdzenie loga

[woytek2]

oporne te pliki sa bardzo
avenger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tdebkwdc

*******************

Script file located at: \??\C:\Documents and Settings\jedwgjxp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open registry key \Registry\Machine\System\CurrentControlSet\Services\jxeefiis for deletion
Unload of driver jxeefiis failed!

Could not process line:
jxeefiis
Status: 0xc0000022



Could not open file C:\WINDOWS\system32\c_g1803.dll for deletion
Deletion of file C:\WINDOWS\system32\c_g1803.dll failed!

Could not process line:
C:\WINDOWS\system32\c_g1803.dll
Status: 0xc0000022



Could not open file C:\WINDOWS\system32\drivers\vmtwqxza.dat for deletion
Deletion of file C:\WINDOWS\system32\drivers\vmtwqxza.dat failed!

Could not process line:
C:\WINDOWS\system32\drivers\vmtwqxza.dat
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.

combofix

ComboFix 07-11-19.4C - wojtek 2007-12-06 21:55:25.9 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.463 [GMT 1:00]
Running from: C:\Documents and Settings\wojtek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-06 13:17 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-06 12:40 <DIR> d--hs---- C:\FOUND.000
2007-12-06 12:35 <DIR> d-------- C:\Program Files\FileASSASSIN
2007-12-04 23:51 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-02 20:44 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-12-02 20:44 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-12-02 20:44 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-02 20:43 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-02 20:39 <DIR> d-------- C:\Program Files\Activision
2007-12-02 15:03 <DIR> d-------- C:\Downloads
2007-12-02 15:03 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\GetRight
2007-11-29 10:38 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2007-11-26 12:05 <DIR> d-------- C:\Program Files\Soulseek-Test
2007-11-24 15:19 89,088 --a------ C:\WINDOWS\system32\c_g1803.dll
2007-11-24 15:19 19,456 C:\WINDOWS\system32\drivers\vmtwqxza.dat
2007-11-11 10:07 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-10 13:13 8,704 --a------ C:\WINDOWS\system32\dllcache\kbdjpn.dll
2007-11-10 13:13 8,192 --a------ C:\WINDOWS\system32\dllcache\kbdkor.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd106.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101b.dll
2007-11-10 13:13 5,632 --a------ C:\WINDOWS\system32\dllcache\kbd103.dll
2007-11-09 13:32 <DIR> d-------- C:\VundoFix Backups
2007-11-09 08:31 <DIR> d-------- C:\!KillBox
2007-11-09 08:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-09 08:12 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-09 08:12 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-09 08:12 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-09 08:12 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-09 08:11 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\PC Tools
2007-11-09 08:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-09 08:07 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-08 22:58 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\Apple Computer
2007-11-08 22:54 <DIR> d-------- C:\Program Files\Apple Software Update
2007-11-08 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-08 22:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-08 17:43 <DIR> d-------- C:\Program Files\BitTorrent_DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent
2007-11-08 12:48 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-31 12:37 --------- d-----w C:\Documents and Settings\jacek\Dane aplikacji\Talkback
2007-10-23 15:20 229,727 ----a-w C:\WINDOWS\Burn4Free_Toolbar_Uninstaller_7375.exe
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free Toolbar
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free
2007-10-21 08:54 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Media Player Classic
2007-10-15 20:34 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Talkback
2007-10-03 09:53 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-09-06 11:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 11:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-07-27 21:54 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2007-12-04_23.04.48.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2007-12-05 16:51:04 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
+ 2007-12-05 16:51:04 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2007-12-06 20:54:02 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{983CFA1B-7559-45CB-B7D2-FA8CF03C9F75}]
2001-10-26 17:27 89088 --a------ C:\WINDOWS\system32\c_g1803.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" []
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-11-08 17:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16:08 C:\WINDOWS\RTHDCPL.exe]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 14:01 C:\WINDOWS\sm56hlpr.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-10-19 20:16]
"SDTray"="f:\Spyware Doctor\SDTrayApp.exe" [2007-10-02 16:27]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

R0 jxeefiis;jxeefiis;C:\WINDOWS\system32\drivers\vmtwqxza.dat
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R2 MSSQL$INSERTGT;SQL Server (INSERTGT);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINSERTGT
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

.
Contents of the 'Scheduled Tasks' folder
"2007-11-26 11:06:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 21:56:59
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 21:57:38
C:\ComboFix3.txt ... 2007-12-05 22:01
C:\ComboFix2.txt ... 2007-12-05 22:59
.
--- E O F ---

[ Dodano: Dzisiaj o 21:59 ]
a wpisu skasowac sie nie da niestety

[wojtas]

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\system32\c_g1803.dll
C:\WINDOWS\system32\drivers\vmtwqxza.dat

i daj loga z gmera + combofixa:

gmer:
Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

[woytek2]

"wystapil blad podczas kasowania pliku" zarowno przy probie skasowania c_g1803 jak i vmtwqxza
log z awaryjnego nie chcial sie zapisac(wieszal sie)

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-12-06 22:58:33
Windows 5.1.2600 Dodatek Service Pack 2


---- Services - GMER 1.0.13 ----

Service .NET CLR Data
Service .NET CLR Networking
Service .NET Data Provider for Oracle
Service .NET Data Provider for SqlServer
Service .NETFramework
Service C:\WINDOWS\system32\DRIVERS\a347bus.sys [BOOT] a347bus
Service C:\WINDOWS\System32\Drivers\a347scsi.sys [BOOT] a347scsi
Service [SYSTEM] Aavmker4
Service [DISABLED] Abiosdsk
Service [DISABLED] abp480n5
Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI
Service C:\WINDOWS\system32\DRIVERS\ACPIEC.sys [BOOT] ACPIEC
Service [DISABLED] adpu160m
Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec
Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD
Service [DISABLED] Aha154x
Service [DISABLED] aic78u2
Service [DISABLED] aic78xx
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter
Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG
Service [DISABLED] AliIde
Service [DISABLED] amsint
Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt
Service C:\WINDOWS\system32\DRIVERS\arp1394.sys [MANUAL] Arp1394
Service [DISABLED] asc
Service [DISABLED] asc3350p
Service [DISABLED] asc3550
Service ASP.NET
Service ASP.NET_2.0.50727
Service C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [MANUAL] aspnet_state
Service [AUTO] aswMon2
Service [MANUAL] aswRdr
Service [SYSTEM] aswTdi
Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv
Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac
Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi
Service [DISABLED] Atdisk
Service C:\WINDOWS\system32\Ati2evxx.exe [AUTO] Ati HotKey Poller
Service C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag
Service Atierecord
Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc
Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv
Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub
Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus
Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [MANUAL] avast! Mail Scanner
Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [MANUAL] avast! Web Scanner
Service BattC
Service [SYSTEM] Beep
Service C:\WINDOWS\system32\svchost.exe [MANUAL] BITS
Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser
Service C:\DOCUME~1\wojtek\USTAWI~1\Temp\catchme.sys [MANUAL] catchme
Service [DISABLED] cbidf2k
Service [DISABLED] cd20xrnt
Service [SYSTEM] Cdaudio
Service [DISABLED] Cdfs
Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom
Service [SYSTEM] Changer
Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc
Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv
Service C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [MANUAL] clr_optimization_v2.0.50727_32
Service C:\WINDOWS\system32\DRIVERS\CmBatt.sys [MANUAL] CmBatt
Service [DISABLED] CmdIde
Service C:\WINDOWS\system32\DRIVERS\compbatt.sys [BOOT] Compbatt
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp
Service ContentFilter
Service ContentIndex
Service [DISABLED] Cpqarray
Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc
Service [DISABLED] dac2w2k
Service [DISABLED] dac960nt
Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp
Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk
Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin
Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot
Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio
Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload
Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver
Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache
Service [DISABLED] dpti2o
Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud
Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc
Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog
Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem
Service [DISABLED] Fastfat
Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility
Service [SYSTEM] Fdc
Service [SYSTEM] Fips
Service [SYSTEM] Flpydisk
Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr
Service [SYSTEM] Fs_Rec
Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk
Service C:\WINDOWS\System32\FTRTSVC.exe [AUTO] FTRTSVC
Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer
Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc
Service C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [MANUAL] HDAudBus
Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc
Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ
Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] HidUsb
Service [DISABLED] hpn
Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP
Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter
Service [SYSTEM] i2omgmt
Service [DISABLED] i2omp
Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt
Service C:\WINDOWS\system32\DRIVERS\iaStor.sys [BOOT] iaStor
Service C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [MANUAL] IDriverT
Service C:\WINDOWS\system32\drivers\ikfilesec.sys [BOOT] IKFileSec
Service C:\WINDOWS\system32\drivers\iksysflt.sys [SYSTEM] IKSysFlt
Service C:\WINDOWS\system32\drivers\iksyssec.sys [SYSTEM] IKSysSec
Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi
Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService
Service inetaccs
Service [DISABLED] ini910u
Service Inport
Service C:\WINDOWS\system32\drivers\RtkHDAud.sys [MANUAL] IntcAzAudAddService
Service [DISABLED] IntelIde
Service C:\WINDOWS\system32\DRIVERS\intelppm.sys [SYSTEM] intelppm
Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw
Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver
Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp
Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat
Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec
Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM
Service ISAPISearch
Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp
Service system32\drivers\vmtwqxza.dat [BOOT] jxeefiis
Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass
Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer
Service [BOOT] KSecDD
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation
Service [SYSTEM] lbrtfdc
Service ldap
Service LicenseService
Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger
Service [SYSTEM] mnmdd
Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc
Service [MANUAL] Modem
Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass
Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid
Service [BOOT] MountMgr
Service [DISABLED] mraid35x
Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV
Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb
Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC
Service [SYSTEM] Msfs
Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer
Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV
Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK
Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM
Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios
Service C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [AUTO] MSSQL$INSERTGT
Service C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [DISABLED] MSSQLServerADHelper
Service [BOOT] Mup
Service [BOOT] NDIS
Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi
Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio
Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan
Service [MANUAL] NDProxy
Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS
Service C:\WINDOWS\system32\DRIVERS\netbt.sys [DISABLED] NetBT
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm
Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon
Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman
Service C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [MANUAL] NETw3x32
Service C:\WINDOWS\system32\DRIVERS\nic1394.sys [MANUAL] NIC1394
Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla
Service [SYSTEM] Npfs
Service [DISABLED] Ntfs
Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc
Service [SYSTEM] Null
Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt
Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd
Service C:\WINDOWS\system32\DRIVERS\ohci1394.sys [BOOT] ohci1394
Service [MANUAL] Parport
Service [BOOT] PartMgr
Service [AUTO] ParVdm
Service C:\WINDOWS\system32\PCAMPR5.SYS [MANUAL] PCAMPR5
Service C:\WINDOWS\system32\PCANDIS5.SYS [MANUAL] PCANDIS5
Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI
Service [SYSTEM] PCIDump
Service C:\WINDOWS\system32\DRIVERS\pciide.sys [BOOT] PCIIde
Service [DISABLED] Pcmcia
Service [MANUAL] PDCOMP
Service [MANUAL] PDFRAME
Service [MANUAL] PDRELI
Service [MANUAL] PDRFRAME
Service [DISABLED] perc2
Service [DISABLED] perc2hib
Service PerfDisk
Service PerfNet
Service PerfOS
Service PerfProc
Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay
Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent
Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport
Service [SYSTEM] PQNTDrv
Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage
Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched
Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink
Service [DISABLED] ql1080
Service [DISABLED] Ql10wnt
Service [DISABLED] ql12160
Service [DISABLED] ql1240
Service [DISABLED] ql1280
Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto
Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan
Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe
Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti
Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss
Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD
Service RDPDD
Service C:\WINDOWS\system32\DRIVERS\rdpdr.sys [MANUAL] rdpdr
Service RDPNP
Service [MANUAL] RDPWD
Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr
Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook
Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess
Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry
Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator
Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs
Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP
Service C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [MANUAL] RTL8023xp
Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs
Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr
Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule
Service f:\Spyware Doctor\svcntaux.exe [AUTO] sdAuxService
Service f:\Spyware Doctor\swdsvc.exe [AUTO] sdCoreService
Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv
Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon
Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS
Service [AUTO] Serial
Service C:\WINDOWS\System32\drivers\sfdrv01.sys [BOOT] sfdrv01
Service C:\WINDOWS\System32\drivers\sfhlp02.sys [BOOT] sfhlp02
Service [SYSTEM] Sfloppy
Service C:\WINDOWS\System32\drivers\sfsync03.sys [BOOT] sfsync03
Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess
Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection
Service [DISABLED] Simbad
Service C:\WINDOWS\system32\DRIVERS\smserial.sys [MANUAL] smserial
Service [DISABLED] Sparrow
Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter
Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler
Service C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [AUTO] SQLBrowser
Service C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [AUTO] SQLWriter
Service C:\WINDOWS\system32\DRIVERS\sr.sys [BOOT] sr
Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice
Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv
Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV
Service C:\WINDOWS\system32\svchost.exe [MANUAL] stisvc
Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum
Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv
Service [DISABLED] symc810
Service [DISABLED] symc8xx
Service [DISABLED] sym_hi
Service [DISABLED] sym_u3
Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio
Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv
Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip
Service [MANUAL] TDPIPE
Service [MANUAL] TDTCP
Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService
Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes
Service C:\WINDOWS\system32\tlntsvr.exe [DISABLED] TlntSvr
Service [DISABLED] TosIde
Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks
Service TSDDD
Service C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [MANUAL] TVICHW32
Service [DISABLED] Udfs
Service [DISABLED] ultra
Service C:\WINDOWS\system32\wdfmgr.exe [AUTO] UMWdf
Service UnlockerDriver5
Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update
Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost
Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS
Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci
Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub
Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR
Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci
Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave
Service [DISABLED] ViaIde
Service [BOOT] VolSnap
Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS
Service VxD
Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time
Service W3SVC
Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp
Service [MANUAL] WDICA
Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud
Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient
Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt
Service [MANUAL] Winsock
Service WinSock2
Service WinTrust
Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN
Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi
Service C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [SYSTEM] WmiAcpi
Service WmiApRpl
Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv
Service [SYSTEM] WS2IFSL
Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc
Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv
Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC
Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov
Service {5BB3F9DF-2285-47B2-9562-07D226A1AD71}
Service {B002D845-89DF-48CD-99D3-F1332D1A9206}
Service {FD2B8FDD-83EE-4FA4-BE7B-23C801043EB5}

---- EOF - GMER 1.0.13 ----

gdzie szukac loga z gmera?

[wojtas]

Wklej do Notatnika:

del service jxeefiis
ATTRIB -R -S -H C:\WINDOWS\system32\drivers\vmtwqxza.dat
ATTRIB -R -S -H C:\WINDOWS\system32\c_g1803.dll
DEL C:\WINDOWS\system32\drivers\vmtwqxza.dat
DEL C:\WINDOWS\system32\c_g1803.dll

Z menu Notatnika >>> Plik >>> Zapisz pod nazwą DEL.TXT >>> plik umieść w C:\WINDOWS ( nigdzie indziej!)

start do konsoli odzyskiwania
Wpisz komendę: BATCH DEL.TXT . potem reset kompa zrob i daj nowe logi

[woytek2]

parametr nie jest prawidlowy x3
nie znaleziono pasujacych plikow ale teraz widze ze pokasowalo je

hijack

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 21:44:10, on 2007-12-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
f:\Spyware Doctor\svcntaux.exe
C:\WINDOWS\system32\Ati2evxx.exe
f:\Spyware Doctor\swdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitTorrent_DNA\dna.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\wojtek\Pulpit\HiJackThis_v2.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - f:\GetRight\xx2gr.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SDTray] "f:\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download with GetRight - f:\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - f:\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD2B8FDD-83EE-4FA4-BE7B-23C801043EB5}: NameServer = 194.204.159.1,194.204.152.34
O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - f:\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - f:\Spyware Doctor\swdsvc.exe

--
End of file - 6707 bytes

kombo

ComboFix 07-11-19.4C - wojtek 2007-12-07 21:45:23.10 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.542 [GMT 1:00]
Running from: C:\Documents and Settings\wojtek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))
.

2007-12-06 13:17 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-06 12:40 <DIR> d--hs---- C:\FOUND.000
2007-12-06 12:35 <DIR> d-------- C:\Program Files\FileASSASSIN
2007-12-04 23:51 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-02 20:44 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-12-02 20:44 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-12-02 20:44 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-02 20:43 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-02 20:39 <DIR> d-------- C:\Program Files\Activision
2007-12-02 15:03 <DIR> d-------- C:\Downloads
2007-12-02 15:03 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\GetRight
2007-11-29 10:38 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2007-11-26 12:05 <DIR> d-------- C:\Program Files\Soulseek-Test
2007-11-11 10:07 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-10 13:13 8,704 --a------ C:\WINDOWS\system32\dllcache\kbdjpn.dll
2007-11-10 13:13 8,192 --a------ C:\WINDOWS\system32\dllcache\kbdkor.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd106.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101b.dll
2007-11-10 13:13 5,632 --a------ C:\WINDOWS\system32\dllcache\kbd103.dll
2007-11-09 13:32 <DIR> d-------- C:\VundoFix Backups
2007-11-09 08:31 <DIR> d-------- C:\!KillBox
2007-11-09 08:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-09 08:12 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-09 08:12 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-09 08:12 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-09 08:12 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-09 08:11 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\PC Tools
2007-11-09 08:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-09 08:07 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-08 22:58 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\Apple Computer
2007-11-08 22:54 <DIR> d-------- C:\Program Files\Apple Software Update
2007-11-08 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-08 22:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-08 17:43 <DIR> d-------- C:\Program Files\BitTorrent_DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent
2007-11-08 12:48 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-31 12:37 --------- d-----w C:\Documents and Settings\jacek\Dane aplikacji\Talkback
2007-10-23 15:20 229,727 ----a-w C:\WINDOWS\Burn4Free_Toolbar_Uninstaller_7375.exe
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free Toolbar
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free
2007-10-21 08:54 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Media Player Classic
2007-10-15 20:34 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Talkback
2007-10-03 09:53 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-07-27 21:54 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2007-12-04_23.04.48.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2007-12-05 16:51:04 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
+ 2001-07-14 16:32:24 69,632 ----a-w C:\WINDOWS\setup.pss\setupupd\temp\wsdueng.dll
+ 2007-12-05 16:51:04 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2007-12-07 20:40:00 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_5d8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" []
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-11-08 17:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16:08 C:\WINDOWS\RTHDCPL.exe]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 14:01 C:\WINDOWS\sm56hlpr.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-10-19 20:16]
"SDTray"="f:\Spyware Doctor\SDTrayApp.exe" [2007-10-02 16:27]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R2 MSSQL$INSERTGT;SQL Server (INSERTGT);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINSERTGT
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
S0 jxeefiis;jxeefiis;C:\WINDOWS\system32\drivers\vmtwqxza.dat

.
Contents of the 'Scheduled Tasks' folder
"2007-11-26 11:06:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 21:46:36
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 21:47:07
C:\ComboFix3.txt ... 2007-12-05 22:59
C:\ComboFix2.txt ... 2007-12-06 21:57
.
--- E O F ---

[wojtas]

w trybie awaryjnym sprobuj:

start>uruchom>cmd>wpisz

sc stop jxeefiis

enter

sc delete jxeefiis

enter

[woytek2]

combo

ComboFix 07-11-19.4C - wojtek 2007-12-08 18:49:19.11 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.497 [GMT 1:00]
Running from: C:\Documents and Settings\wojtek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))
.

2007-12-06 13:17 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-06 12:40 <DIR> d--hs---- C:\FOUND.000
2007-12-06 12:35 <DIR> d-------- C:\Program Files\FileASSASSIN
2007-12-04 23:51 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-02 20:44 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-12-02 20:44 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-12-02 20:44 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-02 20:43 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-02 20:39 <DIR> d-------- C:\Program Files\Activision
2007-12-02 15:03 <DIR> d-------- C:\Downloads
2007-12-02 15:03 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\GetRight
2007-11-29 10:38 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2007-11-26 12:05 <DIR> d-------- C:\Program Files\Soulseek-Test
2007-11-11 10:07 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-10 13:13 8,704 --a------ C:\WINDOWS\system32\dllcache\kbdjpn.dll
2007-11-10 13:13 8,192 --a------ C:\WINDOWS\system32\dllcache\kbdkor.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd106.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101c.dll
2007-11-10 13:13 6,144 --a------ C:\WINDOWS\system32\dllcache\kbd101b.dll
2007-11-10 13:13 5,632 --a------ C:\WINDOWS\system32\dllcache\kbd103.dll
2007-11-09 13:32 <DIR> d-------- C:\VundoFix Backups
2007-11-09 08:31 <DIR> d-------- C:\!KillBox
2007-11-09 08:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-09 08:12 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-09 08:12 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-09 08:12 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-09 08:12 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-11-09 08:11 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\PC Tools
2007-11-09 08:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-09 08:07 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-08 22:58 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\Apple Computer
2007-11-08 22:54 <DIR> d-------- C:\Program Files\Apple Software Update
2007-11-08 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-08 22:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-08 17:43 <DIR> d-------- C:\Program Files\BitTorrent_DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent DNA
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\wojtek\Dane aplikacji\BitTorrent
2007-11-08 12:48 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-31 12:37 --------- d-----w C:\Documents and Settings\jacek\Dane aplikacji\Talkback
2007-10-23 15:20 229,727 ----a-w C:\WINDOWS\Burn4Free_Toolbar_Uninstaller_7375.exe
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free Toolbar
2007-10-23 15:20 --------- d-----w C:\Program Files\Burn4Free
2007-10-21 08:54 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Media Player Classic
2007-10-15 20:34 --------- d-----w C:\Documents and Settings\wojtek\Dane aplikacji\Talkback
2007-10-03 09:53 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-07-27 21:54 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2007-12-04_23.04.48.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-12-03 11:52:40 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-04 22:51:54 3,080,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2007-12-04 22:51:54 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2007-12-05 16:51:04 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
+ 2001-07-14 16:32:24 69,632 ----a-w C:\WINDOWS\setup.pss\setupupd\temp\wsdueng.dll
+ 2007-12-05 16:51:04 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2007-12-08 17:46:32 16,384 ----a-w C:\WINDOWS\TEMP\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" []
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-11-08 17:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16:08 C:\WINDOWS\RTHDCPL.exe]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 14:01 C:\WINDOWS\sm56hlpr.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-10-19 20:16]
"SDTray"="f:\Spyware Doctor\SDTrayApp.exe" [2007-10-02 16:27]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R2 MSSQL$INSERTGT;SQL Server (INSERTGT);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINSERTGT
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

.
Contents of the 'Scheduled Tasks' folder
"2007-11-26 11:06:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 18:50:40
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-08 18:51:09
C:\ComboFix2.txt ... 2007-12-07 21:47
C:\ComboFix3.txt ... 2007-12-06 21:57
.
--- E O F ---

hj

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:52:43, on 2007-12-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
f:\Spyware Doctor\svcntaux.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\BitTorrent_DNA\dna.exe
f:\Spyware Doctor\swdsvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\BitTorrent\bittorrent.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\wojtek\Pulpit\HiJackThis_v2.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - f:\GetRight\xx2gr.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SDTray] "f:\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download with GetRight - f:\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - f:\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD2B8FDD-83EE-4FA4-BE7B-23C801043EB5}: NameServer = 194.204.159.1,194.204.152.34
O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - f:\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - f:\Spyware Doctor\swdsvc.exe

--
End of file - 6531 bytes

[wojtas]

C:\VundoFix Backups
C:\!KillBox

skasuj te pogrubione i bedzie ok juz

[woytek2]

skasowane...

dzieki wielkie za poswiecony mi czas

pzdr