Rootkit

[deVil113]

mam problem z pasożytem. wcześniej miałem problem z koniem trojańskim (kon-trojanski-vt108407.html). Po upływie ok. tygodnia wyskoczył mi komunikat, że znaleziono pasożyta (http://www.fotosik.pl/pokaz_obrazek/053d158dae0ace64.html - http://www.fotosik.pl/pokaz_obrazek/d0842293c1c462d8.html) Gdy wybieram jedną z opcji wyłącza się a po chwili znów się pokazuje. co zrobić?

[Lukesh]

Zastosuj sie do wskazowek z tematu: bad-generic-host-process-for-win32-services-vt79489.html
Zrob skan on-line http://www.ewido.com
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
na sam koniec wstaw logi z HJ: hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[deVil113]

SDFix:

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by Maciek on 2009-03-23 at 19:03

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\DOCUME~1\MACIEK\MASZ.EXE - Deleted
C:\autorun.inf - Deleted
C:\Documents and Settings\Maciek\Ulubione\Cheap Pharmacy Online.url - Deleted
C:\Documents and Settings\Maciek\Ulubione\VIP Casino.url - Deleted
C:\WINDOWS\system32\c.ico - Deleted
C:\WINDOWS\system32\m.ico - Deleted
C:\WINDOWS\system32\s.ico - Deleted
C:\WINDOWS\system32\TFTP1004 - Deleted
C:\WINDOWS\system32\TFTP3176 - Deleted
C:\WINDOWS\system32\TFTP3524 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\Documents and Settings\Maciek\Ulubione\Search Online.url - Deleted
C:\WINDOWS\k.txt - Deleted
C:\WINDOWS\system32\i - Deleted





Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-23 19:18:58
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:eb,3a,47,e8,cd,ef,95,0b,1e,c0,2f,54,29,06,84,4b,90,0a,a4,20,88,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,13,9d,f0,3c,79,ab,41,22,87,75,54,79,25,8e,8e,0c,95,..
"khjeh"=hex:10,83,8a,2c,0f,0a,2b,17,24,5c,eb,65,d6,49,0f,2f,50,3a,30,d1,79,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1a,bb,81,af,75,0e,f7,4a,9c,7a,df,d2,d7,46,3b,73,f8,e6,7e,32,97,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:5b,05,47,bf,0c,db,7f,d3,d9,05,a5,e5,64,9c,9a,d7,a3,2c,e5,4a,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:6f,e2,9a,e4,c0,ab,5e,34,e0,fd,68,51,d0,50,08,13,82,22,00,2b,92,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:6f,e2,9a,e4,c0,ab,5e,34,e0,fd,68,51,d0,50,08,13,82,22,00,2b,92,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:eb,3a,47,e8,cd,ef,95,0b,1e,c0,2f,54,29,06,84,4b,90,0a,a4,20,88,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,13,9d,f0,3c,79,ab,41,22,87,75,54,79,25,8e,8e,0c,95,..
"khjeh"=hex:10,83,8a,2c,0f,0a,2b,17,24,5c,eb,65,d6,49,0f,2f,50,3a,30,d1,79,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1a,bb,81,af,75,0e,f7,4a,9c,7a,df,d2,d7,46,3b,73,f8,e6,7e,32,97,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:5b,05,47,bf,0c,db,7f,d3,d9,05,a5,e5,64,9c,9a,d7,a3,2c,e5,4a,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:6f,e2,9a,e4,c0,ab,5e,34,e0,fd,68,51,d0,50,08,13,82,22,00,2b,92,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:6f,e2,9a,e4,c0,ab,5e,34,e0,fd,68,51,d0,50,08,13,82,22,00,2b,92,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000ad
"TracesSuccessful"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"D:\tzar\TZAR (PC- Juego) EspaDol\autorun.exe"="autorun"
"D:\tzar\TZAR (PC- Juego) EspaDol\instalar.exe"="Director Player"
"D:\tzar\TZAR (PC- Juego) EspaDol\Instalar\TrailerTG.exe"="Director Player"
"D:\tzar\TZAR (PC- Juego) EspaDol\Instalar\TzarCampaign.exe"="TZAR: The Burden of the Crown Campaign Editor"
"D:\tzar\TZAR (PC- Juego) EspaDol\Instalar\Tzar.exe"="Tzar"
"D:\tzar\TZAR (PC- Juego) EspaDol\Instalar\Setup.exe"="Setup2"
"D:\tzar\TZAR (PC- Juego) EspaDol\Unintzar.exe"="Director Player"
"C:\Documents and Settings\Maciek\Pulpit\TZAR (PC- Juego) EspaDol\Instalar\TzarCampaign.exe"="TZAR: The Burden of the Crown Campaign Editor"
"C:\Documents and Settings\Maciek\Pulpit\TZAR (PC- Juego) EspaDol\instalar.exe"="Director Player"
"C:\Documents and Settings\Maciek\Pulpit\TZAR (PC- Juego) EspaDol\Instalar\Tzar.exe"="Tzar"
"C:\Documents and Settings\Maciek\Pulpit\TZAR (PC- Juego) EspaDol\autorun.exe"="autorun"
"C:\Documents and Settings\Maciek\Pulpit\tzar- (pc- juego-estrategia) idm espaDol.exe"="tzar- (pc- juego-estrategia) idm espańol"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"msantis.exe"="msantis.exe:*:Enabled:SYSTEM"
"C:\\WINDOWS\\System32\\winupgrd.exe"="C:\\WINDOWS\\System32\\winupgrd.exe:*:Enabled:Windows File Upgrader"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"D:\\Program Files\\BitTorrent\\bittorrent.exe"="D:\\Program Files\\BitTorrent\\bittorrent.exe:*:Disabled:BitTorrent"
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Disabled:BitTorrent DNA"
"D:\\bloo\\BlueSoleil.exe"="D:\\bloo\\BlueSoleil.exe:*:Enabled:BlueSoleil"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 11 Mar 2009       107,190 ..SHR --- "C:\cb.exe"
Mon 16 Mar 2009       111,363 ..SHR --- "C:\luk1ylq.com"
Mon 23 Mar 2009       100,864 ..SHR --- "C:\WINDOWS\system32\nmdfgds0.dll"
Sat 21 Mar 2009       100,864 ..SHR --- "C:\WINDOWS\system32\nmdfgds1.dll"
Sat 21 Mar 2009       109,141 ..SHR --- "C:\WINDOWS\system32\olhrwef.exe"
Sun 19 Aug 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 19 Aug 2007           401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv16.bak"
Thu 20 Dec 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]



ComboFix:

Kod: Zaznacz wszystko

ComboFix 09-03-22.01 - Maciek 2009-03-23 19:29:37.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.255.30 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Maciek\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090322-0] *On-access scanning enabled* (Updated)
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Maciek\Dane aplikacji\.#
C:\gyn.cmd
C:\jm3cx96.bat
C:\uxkl0apt.bat
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
C:\xsia.bat
C:\yh.cmd
D:\Autorun.inf
D:\gyn.cmd
D:\jm3cx96.bat
D:\uxkl0apt.bat
D:\xsia.bat
D:\yh.cmd

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-02-23 do 2009-03-23  )))))))))))))))))))))))))))))))
.

2009-03-23 18:57 . 2009-03-23 19:21   <DIR>   d--------   C:\SDFix
2009-03-23 18:43 . 2009-03-23 18:43   <DIR>   d--------   c:\windows\ERUNT
2009-03-23 12:17 . 2009-03-23 12:17   <DIR>   d--------   c:\program files\XviD
2009-03-23 12:17 . 2003-03-15 23:15   90,112   --a------   c:\windows\unvise32.exe
2009-03-19 21:19 . 2009-03-23 19:31   <DIR>   d--h-----   c:\documents and settings\Administrator\Ustawienia lokalne
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Ulubione
2009-03-19 21:19 . 2007-07-23 19:04   <DIR>   d--h-----   c:\documents and settings\Administrator\Szablony
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Pulpit
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Moje dokumenty
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   dr-------   c:\documents and settings\Administrator\Menu Start
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   dr-h-----   c:\documents and settings\Administrator\Dane aplikacji
2009-03-19 21:19 . 2009-03-19 21:19   <DIR>   d--------   c:\documents and settings\Administrator
2009-03-16 21:04 . 2009-03-16 21:04   <DIR>   d--------   c:\program files\Lavalys
2009-03-16 20:12 . 2009-03-16 20:12   111,363   -r-hs----   C:\luk1ylq.com
2009-03-14 22:15 . 2009-03-11 19:07   107,190   -r-hs----   C:\cb.exe
2009-03-11 21:26 . 2009-03-21 22:39   119   --a------   c:\windows\wow.cfg
2009-02-28 23:13 . 2009-03-10 20:06   <DIR>   d--------   c:\documents and settings\Maciek\new_page_1_files
2009-02-28 20:33 . 2009-03-02 18:43   <DIR>   d--------   c:\program files\SopCast
2009-02-27 20:42 . 2009-02-27 22:29   <DIR>   d--------   c:\documents and settings\Maciek\index_files

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-23 18:23   ---------   d-----w   c:\program files\Wanadoo
2009-03-21 18:22   ---------   d-----w   c:\program files\BitComet
2009-03-11 20:27   ---------   d-----w   c:\program files\Winamp
2009-03-10 21:45   ---------   d-----w   c:\documents and settings\Maciek\Dane aplikacji\Image Zone Express
2009-02-05 22:40   ---------   d-----w   c:\program files\CCleaner
2009-01-25 20:09   ---------   d-----w   c:\documents and settings\Maciek\Dane aplikacji\MSN6
2009-01-25 20:09   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\MSN6
2009-01-24 12:22   ---------   d-----w   c:\program files\Real Alternative
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2002-12-09 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\TaskbarIcon.exe" [2002-12-09 45056]
"avast!"="d:\alwils~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-07-23 962661]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
PS2 Keyboard English Edition 2.0.lnk - c:\program files\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe [2008-08-26 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"msantis.exe"= msantis.exe:SYSTEM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25579:TCP"= 25579:TCP:*:Disabled:BitComet 25579 TCP
"25579:UDP"= 25579:UDP:*:Disabled:BitComet 25579 UDP
"25606:TCP"= 25606:TCP:BitComet 25606 TCP
"25606:UDP"= 25606:UDP:BitComet 25606 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-04 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-06-04 20560]
S2 Local Service;Local Service;"c:\windows\msantis.exe" --> c:\windows\msantis.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\jm3cx96.bat
\Shell\open\Command - C:\jm3cx96.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\jm3cx96.bat
\Shell\open\Command - D:\jm3cx96.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\CMycha.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3daefcc-dcd2-11dd-b26c-4d6564696130}]
\Shell\AutoRun\command - F:\gyn.cmd
\Shell\open\Command - F:\gyn.cmd
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-MsgCenterExe - c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe
HKLM-Run-adiras - adiras.exe
HKLM-Run-Windows File Upgrader - winupgrd.exe
HKU-Default-Run-SYSTEM - winmgrd.exe
HKU-Default-RunServices-SYSTEM - winmgrd.exe
Notify-WgaLogon - (no file)


.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://edownload.grisoft.cz/ewidoOnlineScan.cab
FF - ProfilePath - c:\documents and settings\Maciek\Dane aplikacji\Mozilla\Firefox\Profiles\7ud1mmbt.default\
FF - component: c:\documents and settings\Maciek\Dane aplikacji\Mozilla\Firefox\Profiles\7ud1mmbt.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava11.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava12.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava131_03.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava32.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPOJI600.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPNAVY.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-23 19:31:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-03-23 19:34:48
ComboFix-quarantined-files.txt  2009-03-23 18:34:37

Przed: 8,201,670,656 bajtów wolnych
Po: 8,223,821,824 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

158   --- E O F ---   2009-02-24 22:09:04


z HJ:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:51:33, on 2009-03-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\Alwil Software\Avast4\aswUpdSv.exe
D:\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Alwil Software\Avast4\ashMaiSv.exe
D:\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Maciek\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PS2 Keyboard English Edition 2.0.lnk = ?
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://edownload.grisoft.cz/ewidoOnlineScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D246E22D-6569-42EA-ACAD-AD26BFBAE17C}: NameServer = 217.30.129.149 217.30.137.200
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Local Service - Unknown owner - C:\WINDOWS\msantis.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6606 bytes


[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\luk1ylq.com
C:\cb.exe
d:\luk1ylq.com
d:\cb.exe
c:\windows\msantis.exe
C:\WINDOWS\system32\olhrwef.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3daefcc-dcd2-11dd-b26c-4d6564696130}]

Driver::
Local Service

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

[deVil113]

ComboFix:

Kod: Zaznacz wszystko

ComboFix 09-03-22.01 - Maciek 2009-03-23 21:27:01.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.255.27 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Maciek\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Maciek\Pulpit\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090322-0] *On-access scanning enabled* (Updated)
* Utworzono nowy punkt przywracania

FILE ::
C:\cb.exe
C:\luk1ylq.com
c:\windows\msantis.exe
c:\windows\system32\olhrwef.exe
d:\cb.exe
d:\luk1ylq.com
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\cb.exe
C:\luk1ylq.com
d:\cb.exe
d:\luk1ylq.com

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_LOCAL_SERVICE
-------\Service_Local Service


(((((((((((((((((((((((((   Pliki utworzone od 2009-02-23 do 2009-03-23  )))))))))))))))))))))))))))))))
.

2009-03-23 18:57 . 2009-03-23 19:21   <DIR>   d--------   C:\SDFix
2009-03-23 18:43 . 2009-03-23 18:43   <DIR>   d--------   c:\windows\ERUNT
2009-03-23 12:17 . 2009-03-23 12:17   <DIR>   d--------   c:\program files\XviD
2009-03-23 12:17 . 2003-03-15 23:15   90,112   --a------   c:\windows\unvise32.exe
2009-03-19 21:19 . 2009-03-23 21:29   <DIR>   d--h-----   c:\documents and settings\Administrator\Ustawienia lokalne
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Ulubione
2009-03-19 21:19 . 2007-07-23 19:04   <DIR>   d--h-----   c:\documents and settings\Administrator\Szablony
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Pulpit
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   d--------   c:\documents and settings\Administrator\Moje dokumenty
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   dr-------   c:\documents and settings\Administrator\Menu Start
2009-03-19 21:19 . 2007-07-23 19:58   <DIR>   dr-h-----   c:\documents and settings\Administrator\Dane aplikacji
2009-03-19 21:19 . 2009-03-19 21:19   <DIR>   d--------   c:\documents and settings\Administrator
2009-03-16 21:04 . 2009-03-16 21:04   <DIR>   d--------   c:\program files\Lavalys
2009-03-11 21:26 . 2009-03-23 21:30   119   --a------   c:\windows\wow.cfg
2009-02-28 23:13 . 2009-03-10 20:06   <DIR>   d--------   c:\documents and settings\Maciek\new_page_1_files
2009-02-28 20:33 . 2009-03-02 18:43   <DIR>   d--------   c:\program files\SopCast
2009-02-27 20:42 . 2009-02-27 22:29   <DIR>   d--------   c:\documents and settings\Maciek\index_files

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-23 20:36   ---------   d-----w   c:\program files\Wanadoo
2009-03-21 18:22   ---------   d-----w   c:\program files\BitComet
2009-03-11 20:27   ---------   d-----w   c:\program files\Winamp
2009-03-10 21:45   ---------   d-----w   c:\documents and settings\Maciek\Dane aplikacji\Image Zone Express
2009-02-05 22:40   ---------   d-----w   c:\program files\CCleaner
2009-01-25 20:09   ---------   d-----w   c:\documents and settings\Maciek\Dane aplikacji\MSN6
2009-01-25 20:09   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\MSN6
2009-01-24 12:22   ---------   d-----w   c:\program files\Real Alternative
.

(((((((((((((((((((((((((((((   SnapShot@2009-03-23_19.33.00.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28   163,328   ----a-w   c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-03-23 20:32:14   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_608.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2002-12-09 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\TaskbarIcon.exe" [2002-12-09 45056]
"avast!"="d:\alwils~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-07-23 962661]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]
PS2 Keyboard English Edition 2.0.lnk - c:\program files\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe [2008-08-26 262144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"msantis.exe"= msantis.exe:SYSTEM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25579:TCP"= 25579:TCP:*:Disabled:BitComet 25579 TCP
"25579:UDP"= 25579:UDP:*:Disabled:BitComet 25579 UDP
"25606:TCP"= 25606:TCP:BitComet 25606 TCP
"25606:UDP"= 25606:UDP:BitComet 25606 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-04 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-06-04 20560]

--- Inne Usługi/Sterowniki w Pamięci ---

*Deregistered* - ALG
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - AudioSrv
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Browser
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - hpqcxs08
*Deregistered* - hpqddsvc
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - Net Driver HPZ12
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Pml Driver HPZ12
*Deregistered* - PnkBstrA
*Deregistered* - ProtectedStorage
*Deregistered* - RasAuto
*Deregistered* - RasMan
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ServiceLayer
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - stisvc
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\CMycha.exe
.
.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://edownload.grisoft.cz/ewidoOnlineScan.cab
FF - ProfilePath - c:\documents and settings\Maciek\Dane aplikacji\Mozilla\Firefox\Profiles\7ud1mmbt.default\
FF - component: c:\documents and settings\Maciek\Dane aplikacji\Mozilla\Firefox\Profiles\7ud1mmbt.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava11.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava12.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava131_03.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava32.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPOJI600.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPNAVY.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-23 21:33:21
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
d:\alwil software\Avast4\aswUpdSv.exe
d:\alwil software\Avast4\ashServ.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
d:\alwil software\Avast4\ashMaiSv.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
d:\alwil software\Avast4\ashWebSv.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Czas ukończenia: 2009-03-23 21:39:50 - komputer został uruchomiony ponownie [Maciek]
ComboFix-quarantined-files.txt  2009-03-23 20:39:45
ComboFix2.txt  2009-03-23 18:34:50

Przed: 9,805,037,568 bajtów wolnych
Po: 9,725,321,216 bajtów wolnych

211   --- E O F ---   2009-02-24 22:09:04


[wojtas]

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.