proszę o sprawdzenie loga

[bengacz]

Proszę o sprawdzenie loga. Ostatnio strasznie mi zamula i podczas grania przez internet rozłancza mi się internet. Z góry dziekuje za poświęcony czas.

Logfile of HijackThis v1.99.1
Scan saved at 17:24:11, on 2008-02-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\test\Gadu-Gadu\gg.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Rafałek\Pulpit\sdstart.exe
D:\DOCUME~1\RAFAEK~1\USTAWI~1\Temp\is-CRNJK.tmp\is-I78L9.tmp
D:\Program Files\Spyware Doctor\pctsAuxs.exe
D:\Program Files\Spyware Doctor\pctsSvc.exe
D:\Program Files\Spyware Doctor\pctsTray.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe
D:\Program Files\Spyware Doctor\Update.exe
D:\Documents and Settings\Rafałek\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optimus.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {8D7E3DBF-875F-A4A5-5F5B-F79A84F24DCD} - D:\WINDOWS\system32\ojjoi.dll (file missing)
O2 - BHO: (no name) - {99E6AC0F-12BB-374C-E855-37761A3501C3} - D:\WINDOWS\system32\bvwasq.dll (file missing)
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [ISTray] "D:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2925] command /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1280] cmd /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\test\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skoqmfwr] D:\WINDOWS\system32\?ppPatch\d?xplore.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8887] command /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7284] cmd /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CDF4F6-78D3-413E-8D46-30DBE78574ED}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Dzi@dek]

Usuń podane wpisy w hijackthis:

O2 - BHO: (no name) - {8D7E3DBF-875F-A4A5-5F5B-F79A84F24DCD} - D:\WINDOWS\system32\ojjoi.dll (file missing)
O2 - BHO: (no name) - {99E6AC0F-12BB-374C-E855-37761A3501C3} - D:\WINDOWS\system32\bvwasq.dll (file missing)
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O4 - HKLM\..\RunOnce: [SpybotDeletingA2925] command /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1280] cmd /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKCU\..\Run: [Skoqmfwr] D:\WINDOWS\system32\?ppPatch\d?xplore.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8887] command /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7284] cmd /c del "D:\WINDOWS\SchedLgU.Txt_tobedeleted"
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)

Daj nowe logi z Combofix oraz Hijackthis.

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[bengacz]

SDFix: Version 1.136

Run by Rafałek on 2008-02-02 at 23:56

Microsoft Windows XP [Wersja 5.1.2600]

Running From: D:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found






Removing Temp Files...

ADS Check:

ComboFix 08-02.03.1 - Rafałek 2008-02-02 23:32:44.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.341 [GMT 1:00]
Running from: D:\Documents and Settings\Rafałek\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Documents and Settings\Rafałek\Dane aplikacji\ASEMBL~1
D:\Documents and Settings\Rafałek\Dane aplikacji\SMANTE~1
D:\Documents and Settings\Rafałek\Dane aplikacji\SSTEM~1
D:\Documents and Settings\Rafałek\Dane aplikacji\YSTEM~1
D:\Documents and Settings\Rafałek\Moje dokumenty\CURITY~1
D:\Documents and Settings\Rafałek\Moje dokumenty\ICROSO~1.NET
D:\Documents and Settings\Rafałek\Moje dokumenty\SEMBLY~1
D:\Documents and Settings\Rafałek\Moje dokumenty\YSTEM~1
D:\Program Files\Common Files\icroso~1.net
D:\Program Files\mcroso~1.net
D:\Program Files\myglobalsearch
D:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
D:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
D:\WINDOWS\cookies.ini
D:\WINDOWS\dobe~1
D:\WINDOWS\ppatch~1
D:\WINDOWS\system32\bbaqaqdc.dll
D:\WINDOWS\system32\bwgyvktw.dll
D:\WINDOWS\system32\cdqaqabb.ini
D:\WINDOWS\system32\epmhgdxs.ini
D:\WINDOWS\system32\gmdkvitp.ini
D:\WINDOWS\system32\ihxvnwhk.ini
D:\WINDOWS\system32\jqbnubyy.dll
D:\WINDOWS\system32\khwnvxhi.dll
D:\WINDOWS\system32\mcrh.tmp
D:\WINDOWS\system32\mcroso~1
D:\WINDOWS\system32\mcroso~1\M?crosoft\
D:\WINDOWS\system32\nrolmoby.dll
D:\WINDOWS\system32\pppatc~1
D:\WINDOWS\system32\ptivkdmg.dll
D:\WINDOWS\system32\qodrqxfu.ini
D:\WINDOWS\system32\racle~1
D:\WINDOWS\system32\scurit~1
D:\WINDOWS\system32\smbols~1
D:\WINDOWS\system32\sxdghmpe.dll
D:\WINDOWS\system32\sykbywlt.dll
D:\WINDOWS\system32\tlwybkys.ini
D:\WINDOWS\system32\ufxqrdoq.dll
D:\WINDOWS\system32\wnscpicom32.exe
D:\WINDOWS\system32\wtkvygwb.ini
D:\WINDOWS\system32\ybomlorn.ini
D:\WINDOWS\system32\yybunbqj.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-02 to 2008-02-02 )))))))))))))))))))))))))))))))
.

2008-02-02 23:18 . 2008-02-02 23:18 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ustawienia lokalne
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ulubione
2008-02-02 23:18 . 2006-12-02 04:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Szablony
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Pulpit
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Moje dokumenty
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Menu Start
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Dane aplikacji
2008-02-02 20:20 . 2008-02-02 20:20 <DIR> d-------- D:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-02-02 17:16 . 2008-02-02 17:26 <DIR> d-------- D:\Program Files\Spyware Doctor
2008-02-02 17:16 . 2007-12-10 14:53 81,288 --a------ D:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-02 17:16 . 2007-12-10 14:53 66,952 --a------ D:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-02 17:16 . 2007-12-10 14:53 41,864 --a------ D:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-02 17:16 . 2007-12-10 14:53 29,576 --a------ D:\WINDOWS\system32\drivers\kcom.sys
2008-01-30 15:35 . 2008-01-30 15:36 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-30 15:35 . 2008-01-30 15:42 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-28 21:23 . 2008-01-28 21:23 <DIR> d-------- D:\Program Files\Games-Masters.com
2008-01-13 04:30 . 2008-01-13 04:30 <DIR> d-------- D:\Program Files\DivX
2008-01-11 01:29 . 2008-01-11 01:29 54,608 --a------ D:\WINDOWS\system32\xfcodec.dll
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Szablony
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Dane aplikacji
2008-01-03 15:42 . 2008-01-03 15:49 71,988 --a------ D:\WINDOWS\system32\screen1.shark
2008-01-03 15:39 . 2008-01-03 15:39 0 --a------ D:\WINDOWS\system32\pstorage.shark
2008-01-03 15:33 . 2008-01-03 15:33 200,704 --a------ D:\WINDOWS\system32\matrixchat.svr
2008-01-03 15:30 . 2008-01-03 15:30 53,760 --a------ D:\WINDOWS\system32\zlib.dll
2008-01-03 15:30 . 2008-01-03 15:30 52,224 --a------ D:\WINDOWS\system32\jpg.dll
2008-01-03 15:30 . 2008-01-03 15:30 40,960 --a------ D:\WINDOWS\system32\lamastuff.svr
2008-01-03 15:29 . 2008-01-03 15:38 108,336 --a------ D:\WINDOWS\system32\mswinsck.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 19:52 --------- d---a-w D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 11:38 --------- d-----w D:\Program Files\Opera
2008-01-17 12:53 --------- d-s---w D:\Program Files\Xfire
2007-12-25 11:39 --------- d-----w D:\Program Files\Liceum klasa 2 - Chemia - podstawowa
2007-12-06 18:24 --------- d-----w D:\Program Files\mIRC
2007-10-20 11:06 240,806 --sh--w D:\WINDOWS\system32\kjllm.bak2
2007-10-17 14:57 244,120 --sh--w D:\WINDOWS\system32\kjllm.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
"Gadu-Gadu"="D:\Program Files\test\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 D:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10 339968]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"Zone Labs Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-11-14 23:51 755472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"Symantec NetDriver Warning"="D:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Arivvala]
D:\Program Files\a?sembly\?ttrib.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 D:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teae]
D:\WINDOWS\system32\MCROSO~1\nopdb.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Dihyhe"=D:\WINDOWS\??pPatch\??rss.exe

S0 xmasscsi;xmasscsi;D:\WINDOWS\system32\Drivers\xmasscsi.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BD70F805-B0E2-FD03-BA5D-EA38FD0E4000}]
D:\WINDOWS\system32\RUNDLL.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 23:36:03
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\system32\Ati2evxx.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-02-02 23:37:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 22:37:43





Logfile of HijackThis v1.99.1
Scan saved at 00:08:54, on 2008-02-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\test\Gadu-Gadu\gg.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Documents and Settings\Rafałek\Pulpit\HijackThis_v1.99.1.exe
D:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optimus.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\test\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CDF4F6-78D3-413E-8D46-30DBE78574ED}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

Zrobiłem jak kazaliście.

[Dzi@dek]

Otwórz notatnik i wklej:

File::
D:\WINDOWS\system32\screen1.shark
D:\WINDOWS\system32\pstorage.shark
D:\WINDOWS\system32\matrixchat.svr
D:\WINDOWS\system32\zlib.dll
D:\WINDOWS\system32\jpg.dll
D:\WINDOWS\system32\lamastuff.svr
D:\WINDOWS\system32\mswinsck.ocx
D:\WINDOWS\system32\kjllm.bak2
D:\WINDOWS\system32\kjllm.ini2
D:\WINDOWS\system32\RUNDLL.exe

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Arivvala]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BD70F805-B0E2-FD03-BA5D-EA38FD0E4000}]

Plik Zapisz jako... CFScript - najlepiej jeśli zapiszesz w
takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
Potwierdz zresetuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

Zastosuj Vundofix

[bengacz]

ComboFix 08-02.03.1 - Rafałek 2008-02-03 18:54:24.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.344 [GMT 1:00]
Running from: D:\Documents and Settings\Rafałek\Pulpit\ComboFix.exe
Command switches used :: D:\Documents and Settings\Rafałek\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-02 23:52 . 2008-02-03 00:10 <DIR> d-------- D:\SDFix
2008-02-02 23:52 . 2008-02-02 23:52 1,218,381 --a------ D:\SDFix.exe
2008-02-02 23:18 . 2008-02-02 23:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ustawienia lokalne
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ulubione
2008-02-02 23:18 . 2006-12-02 04:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Szablony
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Pulpit
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Moje dokumenty
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Menu Start
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Dane aplikacji
2008-02-02 20:20 . 2008-02-02 20:20 <DIR> d-------- D:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-01-30 15:35 . 2008-01-30 15:36 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-30 15:35 . 2008-01-30 15:42 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-28 21:23 . 2008-01-28 21:23 <DIR> d-------- D:\Program Files\Games-Masters.com
2008-01-13 04:30 . 2008-01-13 04:30 <DIR> d-------- D:\Program Files\DivX
2008-01-11 01:29 . 2008-01-11 01:29 54,608 --a------ D:\WINDOWS\system32\xfcodec.dll
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Szablony
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Dane aplikacji
2008-01-03 15:42 . 2008-01-03 15:49 71,988 --a------ D:\WINDOWS\system32\screen1.shark
2008-01-03 15:39 . 2008-01-03 15:39 0 --a------ D:\WINDOWS\system32\pstorage.shark
2008-01-03 15:33 . 2008-01-03 15:33 200,704 --a------ D:\WINDOWS\system32\matrixchat.svr
2008-01-03 15:30 . 2008-01-03 15:30 53,760 --a------ D:\WINDOWS\system32\zlib.dll
2008-01-03 15:30 . 2008-01-03 15:30 52,224 --a------ D:\WINDOWS\system32\jpg.dll
2008-01-03 15:30 . 2008-01-03 15:30 40,960 --a------ D:\WINDOWS\system32\lamastuff.svr
2008-01-03 15:29 . 2008-01-03 15:38 108,336 --a------ D:\WINDOWS\system32\mswinsck.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 23:04 --------- d---a-w D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 11:38 --------- d-----w D:\Program Files\Opera
2008-01-17 12:53 --------- d-s---w D:\Program Files\Xfire
2008-01-08 15:40 --------- d-----w D:\Documents and Settings\Rafałek\Dane aplikacji\Skype
2007-12-25 11:39 --------- d-----w D:\Program Files\Liceum klasa 2 - Chemia - podstawowa
2007-12-08 13:58 3,278,848 ----a-w D:\WINDOWS\Internet Logs\xDB4.tmp
2007-12-06 18:24 --------- d-----w D:\Program Files\mIRC
2007-11-29 22:30 200,704 ----a-w D:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w D:\WINDOWS\system32\libdivx.dll
2007-11-02 20:44 50,383 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_06_small.dmp.zip
2007-11-02 20:44 49,634 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_01_small.dmp.zip
2007-10-20 16:25 1,398,272 ----a-w D:\WINDOWS\Internet Logs\xDB3.tmp
2007-10-20 10:18 44,544 ----a-w D:\WINDOWS\Internet Logs\xDB1.tmp
2007-10-20 10:18 329,728 ----a-w D:\WINDOWS\Internet Logs\xDB2.tmp
2007-10-20 10:15 37,338 ----a-w D:\WINDOWS\Internet Logs\GLB6_2nd_2007_10_20_12_14_22_small.dmp.zip
2007-10-18 14:39 45,079 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_16_36_11_small.dmp.zip
2007-10-20 11:06 240,806 --sh--w D:\WINDOWS\system32\kjllm.bak2
2007-10-17 14:57 244,120 --sh--w D:\WINDOWS\system32\kjllm.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
"Gadu-Gadu"="D:\Program Files\test\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 D:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10 339968]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"Zone Labs Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-11-14 23:51 755472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

D:\Documents and Settings\Rafaˆek\Menu Start\Programy\Autostart\
Xfire.lnk - D:\Program Files\Xfire\xfire.exe [2008-01-11 01:29:50 2872144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 D:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teae]
D:\WINDOWS\system32\MCROSO~1\nopdb.exe

S0 xmasscsi;xmasscsi;D:\WINDOWS\system32\Drivers\xmasscsi.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 18:55:59
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 18:56:25
ComboFix-quarantined-files.txt 2008-02-03 17:56:16




Logfile of HijackThis v1.99.1
Scan saved at 19:02:21, on 2008-02-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\test\Gadu-Gadu\gg.exe
D:\Program Files\Xfire\xfire.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Documents and Settings\Rafałek\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optimus.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\test\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CDF4F6-78D3-413E-8D46-30DBE78574ED}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

Już widze róznice dzięki z góry xD

[wojtas]

logi daj w tagi

[bengacz]

Logfile of HijackThis v1.99.1
Scan saved at 20:40:47, on 2008-02-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\test\Gadu-Gadu\gg.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Rafałek\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optimus.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\test\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CDF4F6-78D3-413E-8D46-30DBE78574ED}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 08-02.03.1 - Rafałek 2008-02-03 19:51:52.3 - NTFSx86
Running from: D:\Documents and Settings\Rafałek\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-02 23:52 . 2008-02-03 00:10 <DIR> d-------- D:\SDFix
2008-02-02 23:52 . 2008-02-02 23:52 1,218,381 --a------ D:\SDFix.exe
2008-02-02 23:18 . 2008-02-03 18:56 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ustawienia lokalne
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ulubione
2008-02-02 23:18 . 2006-12-02 04:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Szablony
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Pulpit
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Moje dokumenty
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Menu Start
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Dane aplikacji
2008-02-02 20:20 . 2008-02-02 20:20 <DIR> d-------- D:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-01-30 15:35 . 2008-01-30 15:36 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-30 15:35 . 2008-01-30 15:42 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-28 21:23 . 2008-01-28 21:23 <DIR> d-------- D:\Program Files\Games-Masters.com
2008-01-13 04:30 . 2008-01-13 04:30 <DIR> d-------- D:\Program Files\DivX
2008-01-11 01:29 . 2008-01-11 01:29 54,608 --a------ D:\WINDOWS\system32\xfcodec.dll
2008-01-07 15:26 . 2008-02-03 18:56 <DIR> d-------- D:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Szablony
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Dane aplikacji
2008-01-03 15:42 . 2008-01-03 15:49 71,988 --a------ D:\WINDOWS\system32\screen1.shark
2008-01-03 15:39 . 2008-01-03 15:39 0 --a------ D:\WINDOWS\system32\pstorage.shark
2008-01-03 15:33 . 2008-01-03 15:33 200,704 --a------ D:\WINDOWS\system32\matrixchat.svr
2008-01-03 15:30 . 2008-01-03 15:30 53,760 --a------ D:\WINDOWS\system32\zlib.dll
2008-01-03 15:30 . 2008-01-03 15:30 52,224 --a------ D:\WINDOWS\system32\jpg.dll
2008-01-03 15:30 . 2008-01-03 15:30 40,960 --a------ D:\WINDOWS\system32\lamastuff.svr
2008-01-03 15:29 . 2008-01-03 15:38 108,336 --a------ D:\WINDOWS\system32\mswinsck.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 23:04 --------- d---a-w D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 11:38 --------- d-----w D:\Program Files\Opera
2008-01-17 12:53 --------- d-s---w D:\Program Files\Xfire
2008-01-08 15:40 --------- d-----w D:\Documents and Settings\Rafałek\Dane aplikacji\Skype
2007-12-25 11:39 --------- d-----w D:\Program Files\Liceum klasa 2 - Chemia - podstawowa
2007-12-08 13:58 3,278,848 ----a-w D:\WINDOWS\Internet Logs\xDB4.tmp
2007-12-06 18:24 --------- d-----w D:\Program Files\mIRC
2007-11-29 22:30 200,704 ----a-w D:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w D:\WINDOWS\system32\libdivx.dll
2007-11-02 20:44 50,383 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_06_small.dmp.zip
2007-11-02 20:44 49,634 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_01_small.dmp.zip
2007-10-20 16:25 1,398,272 ----a-w D:\WINDOWS\Internet Logs\xDB3.tmp
2007-10-20 10:18 44,544 ----a-w D:\WINDOWS\Internet Logs\xDB1.tmp
2007-10-20 10:18 329,728 ----a-w D:\WINDOWS\Internet Logs\xDB2.tmp
2007-10-20 10:15 37,338 ----a-w D:\WINDOWS\Internet Logs\GLB6_2nd_2007_10_20_12_14_22_small.dmp.zip
2007-10-18 14:39 45,079 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_16_36_11_small.dmp.zip
2007-10-20 11:06 240,806 --sh--w D:\WINDOWS\system32\kjllm.bak2
2007-10-17 14:57 244,120 --sh--w D:\WINDOWS\system32\kjllm.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
"Gadu-Gadu"="D:\Program Files\test\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 D:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10 339968]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"Zone Labs Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-11-14 23:51 755472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

D:\Documents and Settings\Rafaˆek\Menu Start\Programy\Autostart\
Xfire.lnk - D:\Program Files\Xfire\xfire.exe [2008-01-11 01:29:50 2872144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 D:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teae]
D:\WINDOWS\system32\MCROSO~1\nopdb.exe

S0 xmasscsi;xmasscsi;D:\WINDOWS\system32\Drivers\xmasscsi.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 19:53:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 19:54:21
ComboFix-quarantined-files.txt 2008-02-03 18:54:07
ComboFix2.txt 2008-02-03 17:56:26

[ Dodano: Dzisiaj o 20:44 ]
ComboFix 08-02.03.1 - Rafałek 2008-02-03 19:51:52.3 - NTFSx86
Running from: D:\Documents and Settings\Rafałek\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-02 23:52 . 2008-02-03 00:10 <DIR> d-------- D:\SDFix
2008-02-02 23:52 . 2008-02-02 23:52 1,218,381 --a------ D:\SDFix.exe
2008-02-02 23:18 . 2008-02-03 18:56 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ustawienia lokalne
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ulubione
2008-02-02 23:18 . 2006-12-02 04:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Szablony
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Pulpit
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Moje dokumenty
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Menu Start
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Dane aplikacji
2008-02-02 20:20 . 2008-02-02 20:20 <DIR> d-------- D:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-01-30 15:35 . 2008-01-30 15:36 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-30 15:35 . 2008-01-30 15:42 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-28 21:23 . 2008-01-28 21:23 <DIR> d-------- D:\Program Files\Games-Masters.com
2008-01-13 04:30 . 2008-01-13 04:30 <DIR> d-------- D:\Program Files\DivX
2008-01-11 01:29 . 2008-01-11 01:29 54,608 --a------ D:\WINDOWS\system32\xfcodec.dll
2008-01-07 15:26 . 2008-02-03 18:56 <DIR> d-------- D:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Szablony
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Dane aplikacji
2008-01-03 15:42 . 2008-01-03 15:49 71,988 --a------ D:\WINDOWS\system32\screen1.shark
2008-01-03 15:39 . 2008-01-03 15:39 0 --a------ D:\WINDOWS\system32\pstorage.shark
2008-01-03 15:33 . 2008-01-03 15:33 200,704 --a------ D:\WINDOWS\system32\matrixchat.svr
2008-01-03 15:30 . 2008-01-03 15:30 53,760 --a------ D:\WINDOWS\system32\zlib.dll
2008-01-03 15:30 . 2008-01-03 15:30 52,224 --a------ D:\WINDOWS\system32\jpg.dll
2008-01-03 15:30 . 2008-01-03 15:30 40,960 --a------ D:\WINDOWS\system32\lamastuff.svr
2008-01-03 15:29 . 2008-01-03 15:38 108,336 --a------ D:\WINDOWS\system32\mswinsck.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 23:04 --------- d---a-w D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 11:38 --------- d-----w D:\Program Files\Opera
2008-01-17 12:53 --------- d-s---w D:\Program Files\Xfire
2008-01-08 15:40 --------- d-----w D:\Documents and Settings\Rafałek\Dane aplikacji\Skype
2007-12-25 11:39 --------- d-----w D:\Program Files\Liceum klasa 2 - Chemia - podstawowa
2007-12-08 13:58 3,278,848 ----a-w D:\WINDOWS\Internet Logs\xDB4.tmp
2007-12-06 18:24 --------- d-----w D:\Program Files\mIRC
2007-11-29 22:30 200,704 ----a-w D:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w D:\WINDOWS\system32\libdivx.dll
2007-11-02 20:44 50,383 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_06_small.dmp.zip
2007-11-02 20:44 49,634 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_01_small.dmp.zip
2007-10-20 16:25 1,398,272 ----a-w D:\WINDOWS\Internet Logs\xDB3.tmp
2007-10-20 10:18 44,544 ----a-w D:\WINDOWS\Internet Logs\xDB1.tmp
2007-10-20 10:18 329,728 ----a-w D:\WINDOWS\Internet Logs\xDB2.tmp
2007-10-20 10:15 37,338 ----a-w D:\WINDOWS\Internet Logs\GLB6_2nd_2007_10_20_12_14_22_small.dmp.zip
2007-10-18 14:39 45,079 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_16_36_11_small.dmp.zip
2007-10-20 11:06 240,806 --sh--w D:\WINDOWS\system32\kjllm.bak2
2007-10-17 14:57 244,120 --sh--w D:\WINDOWS\system32\kjllm.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
"Gadu-Gadu"="D:\Program Files\test\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 D:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10 339968]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"Zone Labs Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-11-14 23:51 755472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

D:\Documents and Settings\Rafaˆek\Menu Start\Programy\Autostart\
Xfire.lnk - D:\Program Files\Xfire\xfire.exe [2008-01-11 01:29:50 2872144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 D:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teae]
D:\WINDOWS\system32\MCROSO~1\nopdb.exe

S0 xmasscsi;xmasscsi;D:\WINDOWS\system32\Drivers\xmasscsi.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 19:53:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 19:54:21
ComboFix-quarantined-files.txt 2008-02-03 18:54:07
ComboFix2.txt 2008-02-03 17:56:26 [quote]

[wojtas]

Otworz notatnik i wklej w nim to:

File::
D:\WINDOWS\system32\screen1.shark
D:\WINDOWS\system32\pstorage.shark
D:\WINDOWS\system32\matrixchat.svr
D:\WINDOWS\system32\zlib.dll
D:\WINDOWS\system32\jpg.dll
D:\WINDOWS\system32\kjllm.bak2
D:\WINDOWS\system32\kjllm.ini2
D:\WINDOWS\system32\lamastuff.svr
D:\WINDOWS\system32\mswinsck.ocx

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[bengacz]

ComboFix 08-02.03.1 - Rafałek 2008-02-04 16:27:49.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.360 [GMT 1:00]
Running from: D:\Documents and Settings\Rafałek\Pulpit\Nowy folder (3)\ComboFix.exe
Command switches used :: D:\Documents and Settings\Rafałek\Pulpit\Nowy folder (3)\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
D:\WINDOWS\system32\jpg.dll
D:\WINDOWS\system32\kjllm.bak2
D:\WINDOWS\system32\kjllm.ini2
D:\WINDOWS\system32\lamastuff.svr
D:\WINDOWS\system32\matrixchat.svr
D:\WINDOWS\system32\mswinsck.ocx
D:\WINDOWS\system32\pstorage.shark
D:\WINDOWS\system32\screen1.shark
D:\WINDOWS\system32\zlib.dll
.

((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-02 23:52 . 2008-02-04 16:13 <DIR> d-------- D:\SDFix
2008-02-02 23:52 . 2008-02-02 23:52 1,218,381 --a------ D:\SDFix.exe
2008-02-02 23:18 . 2008-02-04 16:21 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ustawienia lokalne
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Ulubione
2008-02-02 23:18 . 2006-12-02 04:37 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Szablony
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Pulpit
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Moje dokumenty
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d-------- D:\Documents and Settings\Administrator.SKLEP-56016C523\Menu Start
2008-02-02 23:18 . 2006-12-01 20:32 <DIR> d--h----- D:\Documents and Settings\Administrator.SKLEP-56016C523\Dane aplikacji
2008-02-02 20:20 . 2008-02-02 20:20 <DIR> d-------- D:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-01-30 15:35 . 2008-01-30 15:36 <DIR> d-------- D:\WINDOWS\system32\ActiveScan
2008-01-30 15:35 . 2008-01-30 15:42 30,590 --a------ D:\WINDOWS\system32\pavas.ico
2008-01-28 21:23 . 2008-01-28 21:23 <DIR> d-------- D:\Program Files\Games-Masters.com
2008-01-13 04:30 . 2008-01-13 04:30 <DIR> d-------- D:\Program Files\DivX
2008-01-11 01:29 . 2008-01-11 01:29 54,608 --a------ D:\WINDOWS\system32\xfcodec.dll
2008-01-07 15:26 . 2008-02-04 16:21 <DIR> d-------- D:\Documents and Settings\Administrator\Ustawienia lokalne
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Szablony
2008-01-07 15:26 . 2008-01-07 15:28 <DIR> d-------- D:\Documents and Settings\Administrator\Dane aplikacji

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 23:04 --------- d---a-w D:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 11:38 --------- d-----w D:\Program Files\Opera
2008-01-17 12:53 --------- d-s---w D:\Program Files\Xfire
2008-01-08 15:40 --------- d-----w D:\Documents and Settings\Rafałek\Dane aplikacji\Skype
2007-12-25 11:39 --------- d-----w D:\Program Files\Liceum klasa 2 - Chemia - podstawowa
2007-12-08 13:58 3,278,848 ----a-w D:\WINDOWS\Internet Logs\xDB4.tmp
2007-12-06 18:24 --------- d-----w D:\Program Files\mIRC
2007-11-29 22:30 200,704 ----a-w D:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w D:\WINDOWS\system32\libdivx.dll
2007-11-02 20:44 50,383 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_06_small.dmp.zip
2007-11-02 20:44 49,634 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_11_02_21_41_01_small.dmp.zip
2007-10-20 16:25 1,398,272 ----a-w D:\WINDOWS\Internet Logs\xDB3.tmp
2007-10-20 10:18 44,544 ----a-w D:\WINDOWS\Internet Logs\xDB1.tmp
2007-10-20 10:18 329,728 ----a-w D:\WINDOWS\Internet Logs\xDB2.tmp
2007-10-20 10:15 37,338 ----a-w D:\WINDOWS\Internet Logs\GLB6_2nd_2007_10_20_12_14_22_small.dmp.zip
2007-10-18 14:39 45,079 ----a-w D:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_16_36_11_small.dmp.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
"Gadu-Gadu"="D:\Program Files\test\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 D:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10 339968]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"Zone Labs Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-11-14 23:51 755472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

D:\Documents and Settings\Rafaˆek\Menu Start\Programy\Autostart\
Xfire.lnk - D:\Program Files\Xfire\xfire.exe [2008-01-11 01:29:50 2872144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 D:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teae]
D:\WINDOWS\system32\MCROSO~1\nopdb.exe

S0 xmasscsi;xmasscsi;D:\WINDOWS\system32\Drivers\xmasscsi.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 16:28:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-04 16:29:09
ComboFix-quarantined-files.txt 2008-02-04 15:29:00
ComboFix2.txt 2008-02-04 15:21:04
ComboFix3.txt 2008-02-04 14:59:24
ComboFix4.txt 2008-02-03 18:54:22
ComboFix5.txt 2008-02-03 17:56:26

[ Dodano: Dzisiaj o 16:33 ]
Logfile of HijackThis v1.99.1
Scan saved at 16:32:41, on 2008-02-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\test\Gadu-Gadu\gg.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Documents and Settings\Rafałek\Pulpit\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optimus.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\test\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CDF4F6-78D3-413E-8D46-30DBE78574ED}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Dzi@dek]

Czysto

[bengacz]

Dzięki bardzo za pomoc xD