Zamulający internet.

[Alban]

Witam.
Od dłuższego czasu internet chodzi baaardzo wolno.. Każdy poleca mi format. U koleżanki zadziałało. Ja chciałbym to jednak zrobić bez niego. Szkoda mi tych wszystkich plików.. Gdzie może leżeć problem?

Log z Combofix:

Kod: Zaznacz wszystko

ComboFix 08-09-13.03 - Dobre 2008-09-22 17:16:01.6 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.468 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe

[color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -
.

(((((((((((((((((((((((((   Pliki utworzone od 2008-08-22 do 2008-09-22  )))))))))))))))))))))))))))))))
.

2008-09-20 15:16 . 2008-09-20 15:16   24   --a------   C:\WINDOWS\system32\sysogg.dll
2008-09-20 14:56 . 2008-09-20 15:15   <DIR>   d--------   C:\Program Files\Ogg Converter
2008-09-19 19:41 . 2008-09-19 23:32   <DIR>   d--------   C:\Documents and Settings\Dobre\Dane aplikacji\uTorrent
2008-09-17 20:36 . 2008-09-17 20:36   <DIR>   d--------   C:\Program Files\Sunbelt Software
2008-09-17 20:27 . 2008-09-17 20:27   <DIR>   d--------   C:\Program Files\CCleaner
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Program Files\AMP Font Viewer

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 15:16   ---------   d-----w   C:\Program Files\cFosSpeed
2008-09-22 15:04   ---------   d-----w   C:\Program Files\Zylom Games
2008-09-22 15:03   ---------   d-----w   C:\Program Files\Common Files\Stardock
2008-09-22 14:56   ---------   d-----w   C:\Program Files\Online TV Player 4
2008-09-22 14:55   ---------   d-----w   C:\Program Files\Java
2008-09-22 14:53   ---------   d-----w   C:\Program Files\Apple Software Update
2008-09-22 10:42   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-09-22 09:36   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-09-21 17:42   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-09-20 10:25   ---------   d-----w   C:\Program Files\7-Zip
2008-09-14 09:03   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-09-13 19:52   ---------   d-----w   C:\Program Files\Real Alternative
2008-09-04 14:26   ---------   d-----w   C:\Program Files\Steam
2008-08-20 14:54   ---------   d-----w   C:\Program Files\Robster Productions
2008-08-18 14:45   ---------   d-----w   C:\Program Files\A4Tech
2008-08-07 09:29   ---------   d-----w   C:\Program Files\HP
2008-08-07 09:28   ---------   d-----w   C:\Program Files\Common Files\Hewlett-Packard
2008-08-07 09:19   ---------   d-----w   C:\Program Files\Common Files\HP
2008-08-03 16:31   ---------   d-----w   C:\Documents and Settings\domowy\Dane aplikacji\Skype
2008-07-18 20:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10   45,768   ----a-w   C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 20:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-06-24 16:24   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-23 15:41   662,016   ----a-w   C:\WINDOWS\system32\wininet.dll
2006-07-05 15:07   81,920   ----a-w   C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.
[code]<pre>
----a-w           190,976 2005-04-26 11:08:40  C:\Documents and Settings\Dobre\Pulpit\Dawid\ZDJĘCIA\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe
</pre>[/code]


(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 1150976]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Xfire.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 18:39 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2007-02-12 12:01 1149440 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 02:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-08-07 20:36 1271032 c:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
"C:\\Program Files\\Steam\\steamapps\\moongrave\\counter-strike\\hl.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:D:\\Program Files\\StarCraft Brood War by Monikon\\starcraft.exe
"6112:UDP"= 6112:UDP:starcraft.exe

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12352]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 438912]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 58288]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - C:\Documents and Settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 17:16:26
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-22 17:19:53
ComboFix-quarantined-files.txt  2008-09-22 15:19:25
ComboFix2.txt  2008-09-13 20:37:51
ComboFix3.txt  2008-04-11 11:33:36
ComboFix4.txt  2008-04-01 09:31:04
ComboFix5.txt  2008-09-22 15:15:47

Przed: 1,799,667,712 bajt˘w wolnych
Po: 1,857,437,696 bajt˘w wolnych

207   --- E O F ---   2008-08-22 19:15:03


Log z HJ:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:57, on 2008-09-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\StarCraft Brood War by Monikon\Launcher\Launcher.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TI WLAN] C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O8 - Extra context menu item: Open With JPEGCompress - res://C:\Program Files\JPEGCompress\owjc.dll/CONTEXT_HANDLE.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {987ECFCE-E607-4D52-B2C5-2EA1F6F303C4} (WinlessActiveX Control) - http://www.pangya.com/PangyaLauncher/PangyaLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS5\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS6\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS7\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS8\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS9\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS10\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS11\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS12\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS13\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS14\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS15\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS16\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS17\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS18\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS19\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS20\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS21\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS22\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS23\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS24\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS25\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS26\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS27\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS28\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS29\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS30\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS31\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS32\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

--
End of file - 9614 bytes


[wojtas]

te plik/i :

C:\WINDOWS\system32\sysogg.dll

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

[djarta]

te plik/i :

C:\WINDOWS\system32\sysogg.dll

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

Ten plik jest zainfekowany - tak więc:

Wklej do Notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\sysogg.dll


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.


================================
K.

[Alban]

C:\WINDOWS\system32\sysogg.dll


przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

Kod: Zaznacz wszystko

File:      sysogg.dll
Status:    
OK
MD5:    b8a3b5312a12c1c157ae74a868316001
Packers detected:    
-

Kod: Zaznacz wszystko

Plik sysogg.dll otrzymany 2008.09.23 19:41:56 (CET)
Obecny status: Ładowanie ... w kolejce oczekuje skanowanie zakończono NIE ZNALEZIONO ZATRZYMANE
Wynik: 0/36 (0%)

Wszędzie nic, na żadnym skanerze.

FixIEDef usunął te pliki:

Kod: Zaznacz wszystko

C:\autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\tmp.txt

Wszystko wykonane poza skanem z Kaspersky'ego. Brak czasu. Loga od niego zamieszczę jutro.
Dodam, że po 30% skanowania (niestety musiałem przerwać) znalazło 3 wirusy, 2 zainfekowane pliki i 2 podejrzane.

Dodano 24.09.2008 13:35:19:
Raport z Kaspersky Online Scan:

Kod: Zaznacz wszystko

   KASPERSKY ONLINE SCANNER REPORT
24 wrzesień 2008 13:36:58
System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600)
Kaspersky Online Scanner wersja: 5.0.98.1
Ostatnia aktualizacja Kaspersky Anti-Virus24/09/2008
Liczba wpisów w bazie danych Kaspersky Anti-Virus1254646
Ustawienia skanowania
Skanowanie przy użyciu następujących baz danych    rozszerzone
Skanuj archiwa    tak
Skanuj pocztowe bazy danych    tak
Obszar skanowania    Mój komputer
A:\
C:\
D:\
E:\
F:\
G:\
Statystyki skanowania
Liczba skanowanych obiektów    92366
Liczba wykrytych wirusów    4
Liczba zainfekowanych obiektów    13
Liczba podejrzanych obiektów    2
Czas trwania skanowania    02:23:24

Nazwa zainfekowanego obiektu    Nazwa wirusa    Ostatnie działanie
C:\!FixIEDef\amvo.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\!FixIEDef\amvo0.dll    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\!FixIEDef\autorun.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\3o.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\MachineKeys\d953eda3e26304d35e06e3f99844845b_6eb18489-c04b-40fd-af3b-a16dc330e955    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy\Recovery\VcodeceMedia.zip/uninst.exe    Podejrzanych: Password-protected-EXE    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy\Recovery\VcodeceMedia.zip    ZIP: podejrzany - 1    pominięty
C:\Documents and Settings\Dobre\Cookies\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cert8.db    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\content-prefs.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\downloads.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\formhistory.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\key3.db    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\parent.lock    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\permissions.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\places.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\places.sqlite-journal    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\search.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\Dobre\NtUser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\Dobre\Pulpit\Girls_Bravo_01v2[E12B26B6].avi.part    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\1784D1DFd01    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_001_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_002_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_003_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_MAP_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\urlclassifier3.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Historia\History.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Historia\History.IE5\MSHist012008092420080925\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\2m9mdmy.dll    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.urs    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\etilqs_O0U63mJdTdQ6td5Q2xM3    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\Sma2.tmp    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Cookies\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\LocalService\ntuser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\NetworkService\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\NetworkService\ntuser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\logs\sw_ae-20080924-093357.log    Object is locked    pominięty
C:\System Volume Information\MountPointManagerRemoteDatabase    Object is locked    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482623.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482624.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482648.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482649.dll    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log    Object is locked    pominięty
C:\WINDOWS\CSC\00000001    Object is locked    pominięty
C:\WINDOWS\Debug\PASSWD.LOG    Object is locked    pominięty
C:\WINDOWS\SchedLgU.Txt    Object is locked    pominięty
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log    Object is locked    pominięty
C:\WINDOWS\Sti_Trace.log    Object is locked    pominięty
C:\WINDOWS\system32\config\AppEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\default    Object is locked    pominięty
C:\WINDOWS\system32\config\default.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SAM    Object is locked    pominięty
C:\WINDOWS\system32\config\SAM.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SecEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\SECURITY    Object is locked    pominięty
C:\WINDOWS\system32\config\SECURITY.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\software    Object is locked    pominięty
C:\WINDOWS\system32\config\software.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SysEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\system    Object is locked    pominięty
C:\WINDOWS\system32\config\system.LOG    Object is locked    pominięty
C:\WINDOWS\system32\drivers\sptd.sys    Object is locked    pominięty
C:\WINDOWS\system32\h323log.txt    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP    Object is locked    pominięty
C:\WINDOWS\TEMP\Perflib_Perfdata_230.dat    Object is locked    pominięty
C:\WINDOWS\wiadebug.log    Object is locked    pominięty
C:\WINDOWS\wiaservc.log    Object is locked    pominięty
C:\WINDOWS\WindowsUpdate.log    Object is locked    pominięty
D:\3o.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\autorun.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
D:\System Volume Information\MountPointManagerRemoteDatabase    Object is locked    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482625.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482626.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
Proces skanowania został zakończony.


[djarta]

C:\WINDOWS\system32\sysogg.dll


przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

Kod: Zaznacz wszystko

File:      sysogg.dll
Status:    
OK
MD5:    b8a3b5312a12c1c157ae74a868316001
Packers detected:    
-

Kod: Zaznacz wszystko

Plik sysogg.dll otrzymany 2008.09.23 19:41:56 (CET)
Obecny status: Ładowanie ... w kolejce oczekuje skanowanie zakończono NIE ZNALEZIONO ZATRZYMANE
Wynik: 0/36 (0%)

Wszędzie nic, na żadnym skanerze.


Nie wiem czemu ale żaden ze skanerów go nie wykrył - dziwne. Ale i tak daję ten plik do usuwania.

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko

Files to delete:
C:\3o.exe
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\2m9mdmy.dll
D:\3o.exe
D:\autorun.inf
C:\WINDOWS\system32\sysogg.dll

Folders to delete:
C:\!FixIEDef
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578


Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt


============================
K.

Autor postu otrzymał pochwałę

[Alban]

Kod: Zaznacz wszystko

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\3o.exe" deleted successfully.
File "C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\2m9mdmy.dll" deleted successfully.
File "D:\3o.exe" deleted successfully.
File "D:\autorun.inf" deleted successfully.
File "C:\WINDOWS\system32\sysogg.dll" deleted successfully.
Folder "C:\!FixIEDef" deleted successfully.
Folder "C:\Documents and Settings\Dobre\Ustawienia lokalne\temp" deleted successfully.

Error:  could not delete folder "C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578"
Deletion of folder "C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578" failed!
Status: 0xc0000022 (STATUS_ACCESS_DENIED)


Completed script processing.

*******************

Finished!  Terminate.


[djarta]

Pobierz ComboFix,ale nie uruchamiaj


Wklej do Notatnika:

Kod: Zaznacz wszystko

Folder::
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.


=============================
K.

[Alban]

Kod: Zaznacz wszystko

ComboFix 08-09-22.06 - Dobre 2008-09-24 17:53:56.7 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.492 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
Użyto następujących komend :: C:\Documents and Settings\Dobre\Pulpit\CFScript.txt
* Utworzono nowy punkt przywracania

[color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482623.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482624.inf
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482627.cfg
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482628.mfl
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482629.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482630.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482631.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482643.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482644.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482646.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482647.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482648.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482649.dll
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482650.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482651.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482652.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482653.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482654.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482655.inf
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482656.PNF
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482657.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482658.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482659.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482660.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482661.INI
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482662.mfl
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482663.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482664.cfg
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482665.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482666.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482667.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482668.properties
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482669.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482670.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482671.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482674.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482675.sys
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482676.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482677.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482678.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482679.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482680.dll
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482681.inf
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482682.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482683.dll
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482686.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482687.dll
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482688.exe
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482689.bat
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482690.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482691.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482692.hlp
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482693.inf
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482694.ini
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482695.INI
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482696.lnk
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482697.cfg
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482698.bat
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482699.bat
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.1
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.2
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.3
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\drivetable.txt
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\RestorePointSize
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\rp.log
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-484763869-1303643608-725345543-1003
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-484763869-1303643608-725345543-1005
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-484763869-1303643608-725345543-1005
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\ComDb.Dat
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\domain.txt
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\snapshot\Repository\FS\OBJECTS.MAP
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-08-24 do 2008-09-24  )))))))))))))))))))))))))))))))
.

2008-09-24 17:05 . 2008-03-18 09:15   100,836   -r-hs----   C:\3o.exe
2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Program Files\Diskeeper Corporation
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Diskeeper Corporation
2008-09-20 14:56 . 2008-09-20 15:15   <DIR>   d--------   C:\Program Files\Ogg Converter
2008-09-19 19:41 . 2008-09-19 23:32   <DIR>   d--------   C:\Documents and Settings\Dobre\Dane aplikacji\uTorrent
2008-09-18 02:41 . 2008-09-18 02:41   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll
2008-09-17 20:27 . 2008-09-17 20:27   <DIR>   d--------   C:\Program Files\CCleaner
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Program Files\AMP Font Viewer

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 15:52   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-09-23 17:33   ---------   d-----w   C:\Program Files\Tlen.pl
2008-09-23 13:42   ---------   d-s---w   C:\Program Files\Xfire
2008-09-23 13:09   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-09-22 16:04   ---------   d-----w   C:\Program Files\Guitar Pro 5
2008-09-22 15:03   ---------   d-----w   C:\Program Files\Common Files\Stardock
2008-09-22 14:57   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-09-22 14:55   ---------   d-----w   C:\Program Files\Java
2008-09-22 14:53   ---------   d-----w   C:\Program Files\Apple Software Update
2008-09-22 14:53   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-09-22 09:38   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-09-21 17:42   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-09-20 10:25   ---------   d-----w   C:\Program Files\7-Zip
2008-09-14 09:03   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-09-13 19:52   ---------   d-----w   C:\Program Files\Real Alternative
2008-09-04 14:26   ---------   d-----w   C:\Program Files\Steam
2008-08-18 14:45   ---------   d-----w   C:\Program Files\A4Tech
2008-08-07 09:29   ---------   d-----w   C:\Program Files\HP
2008-08-07 09:28   ---------   d-----w   C:\Program Files\Common Files\Hewlett-Packard
2008-08-07 09:19   ---------   d-----w   C:\Program Files\Common Files\HP
2008-08-03 16:31   ---------   d-----w   C:\Documents and Settings\domowy\Dane aplikacji\Skype
2008-07-18 20:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10   45,768   ----a-w   C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 20:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-06-24 16:24   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2006-07-05 15:07   81,920   ----a-w   C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 1150976]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Xfire.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 18:39 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-08-07 20:36 1271032 c:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
"C:\\Program Files\\Steam\\steamapps\\moongrave\\counter-strike\\hl.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:D:\\Program Files\\StarCraft Brood War by Monikon\\starcraft.exe
"6112:UDP"= 6112:UDP:starcraft.exe

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12352]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 438912]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 58288]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - USUNIĘTO PUSTE WPISY - - - -

MSConfigStartUp-Sony Ericsson PC Suite - C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-24 17:55:42
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-24 17:57:08
ComboFix-quarantined-files.txt  2008-09-24 15:57:04

Przed: 4˙653˙441˙024 bajt˘w wolnych
Po: 4,630,863,872 bajt˘w wolnych

291   --- E O F ---   2008-08-22 19:15:03


[wojtas]

wklej do notatnika:

File::
C:\3o.exe
D:\3o.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania. + nowy log ze skaneru kaspera

[Alban]

Kod: Zaznacz wszystko

ComboFix 08-09-22.06 - Dobre 2008-09-24 21:35:06.8 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.482 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
Użyto następujących komend :: C:\Documents and Settings\Dobre\Pulpit\CFScript.txt
* Utworzono nowy punkt przywracania

[color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]

FILE ::
C:\3o.exe
D:\3o.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\3o.exe
D:\3o.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-08-24 do 2008-09-24  )))))))))))))))))))))))))))))))
.

2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Program Files\Diskeeper Corporation
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Diskeeper Corporation
2008-09-20 14:56 . 2008-09-20 15:15   <DIR>   d--------   C:\Program Files\Ogg Converter
2008-09-19 19:41 . 2008-09-19 23:32   <DIR>   d--------   C:\Documents and Settings\Dobre\Dane aplikacji\uTorrent
2008-09-18 02:41 . 2008-09-18 02:41   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll
2008-09-17 20:27 . 2008-09-17 20:27   <DIR>   d--------   C:\Program Files\CCleaner
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Program Files\AMP Font Viewer

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 19:23   ---------   d-----w   C:\Program Files\Tlen.pl
2008-09-24 15:52   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-09-23 13:42   ---------   d-s---w   C:\Program Files\Xfire
2008-09-23 13:09   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-09-22 16:04   ---------   d-----w   C:\Program Files\Guitar Pro 5
2008-09-22 15:03   ---------   d-----w   C:\Program Files\Common Files\Stardock
2008-09-22 14:57   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-09-22 14:55   ---------   d-----w   C:\Program Files\Java
2008-09-22 14:53   ---------   d-----w   C:\Program Files\Apple Software Update
2008-09-22 14:53   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-09-22 09:38   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-09-21 17:42   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-09-20 10:25   ---------   d-----w   C:\Program Files\7-Zip
2008-09-14 09:03   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-09-13 19:52   ---------   d-----w   C:\Program Files\Real Alternative
2008-09-04 14:26   ---------   d-----w   C:\Program Files\Steam
2008-08-18 14:45   ---------   d-----w   C:\Program Files\A4Tech
2008-08-07 09:29   ---------   d-----w   C:\Program Files\HP
2008-08-07 09:28   ---------   d-----w   C:\Program Files\Common Files\Hewlett-Packard
2008-08-07 09:19   ---------   d-----w   C:\Program Files\Common Files\HP
2008-08-03 16:31   ---------   d-----w   C:\Documents and Settings\domowy\Dane aplikacji\Skype
2008-07-18 20:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10   45,768   ----a-w   C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 20:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-06-24 16:24   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2006-07-05 15:07   81,920   ----a-w   C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((   snapshot@2008-09-24_17.56.50.01   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-24 15:08:22   53,608   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-09-24 19:20:12   53,608   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-09-24 15:08:22   68,450   ----a-w   C:\WINDOWS\system32\perfc015.dat
+ 2008-09-24 19:20:12   68,450   ----a-w   C:\WINDOWS\system32\perfc015.dat
- 2008-09-24 15:08:22   383,562   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-09-24 19:20:12   383,562   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-09-24 15:08:22   439,528   ----a-w   C:\WINDOWS\system32\perfh015.dat
+ 2008-09-24 19:20:12   439,528   ----a-w   C:\WINDOWS\system32\perfh015.dat
+ 2008-09-24 19:16:12   16,384   ----atw   C:\WINDOWS\TEMP\Perflib_Perfdata_23c.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 1150976]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Xfire.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 18:39 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-08-07 20:36 1271032 c:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
"C:\\Program Files\\Steam\\steamapps\\moongrave\\counter-strike\\hl.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:D:\\Program Files\\StarCraft Brood War by Monikon\\starcraft.exe
"6112:UDP"= 6112:UDP:starcraft.exe

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12352]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 438912]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 58288]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-24 21:37:06
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-24 21:38:34
ComboFix-quarantined-files.txt  2008-09-24 19:38:25
ComboFix2.txt  2008-09-24 15:57:09

Przed: 4˙711˙424˙000 bajt˘w wolnych
Po: 4,687,339,520 bajt˘w wolnych

213   --- E O F ---   2008-08-22 19:15:03


Kod: Zaznacz wszystko

   KASPERSKY ONLINE SCANNER REPORT
25 wrzesień 2008 00:04:15
System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600)
Kaspersky Online Scanner wersja: 5.0.98.1
Ostatnia aktualizacja Kaspersky Anti-Virus24/09/2008
Liczba wpisów w bazie danych Kaspersky Anti-Virus1255995
Ustawienia skanowania
Skanowanie przy użyciu następujących baz danych    rozszerzone
Skanuj archiwa    tak
Skanuj pocztowe bazy danych    tak
Obszar skanowania    Mój komputer
A:\
C:\
D:\
E:\
F:\
G:\
Statystyki skanowania
Liczba skanowanych obiektów    92429
Liczba wykrytych wirusów    4
Liczba zainfekowanych obiektów    32
Liczba podejrzanych obiektów    2
Czas trwania skanowania    02:12:02

Nazwa zainfekowanego obiektu    Nazwa wirusa    Ostatnie działanie
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\MachineKeys\d953eda3e26304d35e06e3f99844845b_6eb18489-c04b-40fd-af3b-a16dc330e955    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat    Object is locked    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy\Recovery\VcodeceMedia.zip/uninst.exe    Podejrzanych: Password-protected-EXE    pominięty
C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy\Recovery\VcodeceMedia.zip    ZIP: podejrzany - 1    pominięty
C:\Documents and Settings\Dobre\Cookies\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cert8.db    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\content-prefs.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\downloads.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\formhistory.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\key3.db    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\parent.lock    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\permissions.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\places.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\places.sqlite-journal    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\search.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl\Profiles\dawid-albanowicz\DataBase\chats.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl\Profiles\dawid-albanowicz\DataBase\chats.idx    Object is locked    pominięty
C:\Documents and Settings\Dobre\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\Dobre\NtUser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\Dobre\Pulpit\Girls_Bravo_04[241407C5].avi.part    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\E0A09653d01    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_001_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_002_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_003_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\Cache\_CACHE_MAP_    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\urlclassifier3.sqlite    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Historia\History.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Historia\History.IE5\MSHist012008092420080925\index.dat    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\temp\etilqs_UJ6uNlULC7cKYWp1QGfB    Object is locked    pominięty
C:\Documents and Settings\Dobre\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Cookies\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\LocalService\ntuser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat    Object is locked    pominięty
C:\Documents and Settings\NetworkService\NTUSER.DAT    Object is locked    pominięty
C:\Documents and Settings\NetworkService\ntuser.dat.LOG    Object is locked    pominięty
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat    Object is locked    pominięty
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    pominięty
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\logs\sw_ae-20080924-211611.log    Object is locked    pominięty
C:\QooBox\Quarantine\C\3o.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\autorun.inf.vir    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482623.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482624.inf.vir    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482648.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482649.dll.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482671.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482675.sys.vir    Zainfekowanych: Hoax.Win32.Agent.fu    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482679.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482680.dll.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482681.inf.vir    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482682.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482687.dll.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482693.inf.vir    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\QooBox\Quarantine\C\WINDOWS\system32\amvo.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\C\WINDOWS\system32\amvo0.dll.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\D\3o.exe.vir    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\QooBox\Quarantine\D\autorun.inf.vir    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\System Volume Information\MountPointManagerRemoteDatabase    Object is locked    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482702.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482703.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482707.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482708.dll    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP580\A1482767.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
C:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP580\change.log    Object is locked    pominięty
C:\WINDOWS\CSC\00000001    Object is locked    pominięty
C:\WINDOWS\Debug\PASSWD.LOG    Object is locked    pominięty
C:\WINDOWS\SchedLgU.Txt    Object is locked    pominięty
C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb    Object is locked    pominięty
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log    Object is locked    pominięty
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb    Object is locked    pominięty
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log    Object is locked    pominięty
C:\WINDOWS\Sti_Trace.log    Object is locked    pominięty
C:\WINDOWS\system32\CatRoot2\edb.log    Object is locked    pominięty
C:\WINDOWS\system32\CatRoot2\tmp.edb    Object is locked    pominięty
C:\WINDOWS\system32\config\AppEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\default    Object is locked    pominięty
C:\WINDOWS\system32\config\default.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SAM    Object is locked    pominięty
C:\WINDOWS\system32\config\SAM.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SecEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\SECURITY    Object is locked    pominięty
C:\WINDOWS\system32\config\SECURITY.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\software    Object is locked    pominięty
C:\WINDOWS\system32\config\software.LOG    Object is locked    pominięty
C:\WINDOWS\system32\config\SysEvent.Evt    Object is locked    pominięty
C:\WINDOWS\system32\config\system    Object is locked    pominięty
C:\WINDOWS\system32\config\system.LOG    Object is locked    pominięty
C:\WINDOWS\system32\h323log.txt    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA    Object is locked    pominięty
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP    Object is locked    pominięty
C:\WINDOWS\TEMP\Perflib_Perfdata_23c.dat    Object is locked    pominięty
C:\WINDOWS\wiadebug.log    Object is locked    pominięty
C:\WINDOWS\wiaservc.log    Object is locked    pominięty
C:\WINDOWS\WindowsUpdate.log    Object is locked    pominięty
D:\System Volume Information\MountPointManagerRemoteDatabase    Object is locked    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482625.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482626.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482672.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482673.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482684.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482685.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482704.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP579\A1482705.inf    Zainfekowanych: Trojan-PSW.Win32.OnLineGames.upg    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP580\A1482768.exe    Zainfekowanych: Packed.Win32.PolyCrypt.h    pominięty
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP580\change.log    Object is locked    pominięty
Proces skanowania został zakończony.


Zapomniałem usunąć folder Qoobox ale już usunąłem.

[wojtas]

wklej to:

Folder::
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578

i przeciagnij na ikonke combofixa i daj nowego loga ze skanu

Autor postu otrzymał pochwałę

[Alban]

Kod: Zaznacz wszystko

ComboFix 08-09-22.06 - Dobre 2008-09-25 21:53:11.9 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.477 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
Użyto następujących komend :: C:\Documents and Settings\Dobre\Pulpit\CFScript.log
* Utworzono nowy punkt przywracania

[color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482625.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482626.inf
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482632.dll
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482633.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482634.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482635.ini
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482636.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482637.ilg
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482638.ini
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482639.fnt
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482640.fnt
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482641.fnt
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482642.fnt
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482645.inf
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482672.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482673.inf
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482684.exe
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\A1482685.inf
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.1
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.2
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\change.log.3
D:\System Volume Information\_restore{256ED0C9-FBD4-474E-A8BD-0EA58684CF7F}\RP578\RestorePointSize

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-08-25 do 2008-09-25  )))))))))))))))))))))))))))))))
.

2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2008-09-23 21:28 . 2008-09-23 21:28   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Program Files\Diskeeper Corporation
2008-09-23 20:33 . 2008-09-23 20:33   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Diskeeper Corporation
2008-09-20 14:56 . 2008-09-20 15:15   <DIR>   d--------   C:\Program Files\Ogg Converter
2008-09-19 19:41 . 2008-09-19 23:32   <DIR>   d--------   C:\Documents and Settings\Dobre\Dane aplikacji\uTorrent
2008-09-18 02:41 . 2008-09-18 02:41   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll
2008-09-17 20:27 . 2008-09-17 20:27   <DIR>   d--------   C:\Program Files\CCleaner
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Program Files\AMP Font Viewer

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-25 05:26   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-09-24 19:23   ---------   d-----w   C:\Program Files\Tlen.pl
2008-09-23 13:42   ---------   d-s---w   C:\Program Files\Xfire
2008-09-23 13:09   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-09-22 16:04   ---------   d-----w   C:\Program Files\Guitar Pro 5
2008-09-22 15:03   ---------   d-----w   C:\Program Files\Common Files\Stardock
2008-09-22 14:57   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-09-22 14:55   ---------   d-----w   C:\Program Files\Java
2008-09-22 14:53   ---------   d-----w   C:\Program Files\Apple Software Update
2008-09-22 14:53   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-09-22 09:38   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-09-21 17:42   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-09-20 10:25   ---------   d-----w   C:\Program Files\7-Zip
2008-09-14 09:03   ---------   d-----w   C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-09-13 19:52   ---------   d-----w   C:\Program Files\Real Alternative
2008-09-04 14:26   ---------   d-----w   C:\Program Files\Steam
2008-08-18 14:45   ---------   d-----w   C:\Program Files\A4Tech
2008-08-07 09:29   ---------   d-----w   C:\Program Files\HP
2008-08-07 09:28   ---------   d-----w   C:\Program Files\Common Files\Hewlett-Packard
2008-08-07 09:19   ---------   d-----w   C:\Program Files\Common Files\HP
2008-08-03 16:31   ---------   d-----w   C:\Documents and Settings\domowy\Dane aplikacji\Skype
2008-07-18 20:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10   45,768   ----a-w   C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 20:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2006-07-05 15:07   81,920   ----a-w   C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 1150976]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Xfire.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 18:39 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-08-07 20:36 1271032 c:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
"C:\\Program Files\\Steam\\steamapps\\moongrave\\counter-strike\\hl.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:D:\\Program Files\\StarCraft Brood War by Monikon\\starcraft.exe
"6112:UDP"= 6112:UDP:starcraft.exe

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12352]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 438912]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 58288]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-25 21:55:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-25 21:56:40
ComboFix-quarantined-files.txt  2008-09-25 19:56:37
ComboFix2.txt  2008-09-24 19:38:35

Przed: 4˙493˙950˙976 bajt˘w wolnych
Po: 4,467,355,648 bajt˘w wolnych

218   --- E O F ---   2008-08-22 19:15:03


[Okocza]

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp (ewentualnie tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

Autor postu otrzymał pochwałę

[Alban]

1 - Gotowe
2 - Gotowe
3 - Gotowe
4 - Gotowe
5 - Nic nie ma
6 - Wszystko co niepotrzebne już dawno powyłączałem.

[Okocza]

Alban, w takim razie okej