log do sprawdzenia

[Longer_007]

Czasem komp ma jakies zawiasy i raz za czas dysk pracuje jak zwariowany mimo braku obciazenia.

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 23:45:12, on 2008-02-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
D:\Program Files\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Last.fm\LastFMHelper.exe
D:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
E:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\INTERIAPL\Stefan\Stefan.exe
D:\Program Files\Opera\Opera.exe
D:\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - e:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - e:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [avast!] d:\Program Files\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] d:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] d:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Stefan] d:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [e:_program files_corel_cor3c] E:\Program Files\Corel\Corel Graphics 12\Programs\CorUpd.exe /Watch /r="Software\Corel\CorelDRAW\12.0"
O4 - HKCU\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Program Files\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - E:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe



[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Longer_007]

Combofix:

Kod: Zaznacz wszystko

ComboFix 08-02.05.3 - Longer 2008-02-09  0:31:04.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1020 [GMT 1:00]
Running from: D:\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Longer\Dane aplikacji\inst.exe

.
(((((((((((((((((((((((((   Files Created from 2008-01-08 to 2008-02-08  )))))))))))))))))))))))))))))))
.

2008-02-09 00:27 . 2004-08-03 23:44   422,400   --a------   C:\kmd.exe
2008-02-09 00:24 . 2008-02-09 00:24   1,751   --a------   C:\Documents and Settings\Longer\clean.reg
2008-02-09 00:20 . 2008-02-09 00:20   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-02-09 00:19 . 2007-07-07 19:56   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-02-09 00:19 . 2007-07-07 19:56   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2008-02-09 00:19 . 2007-07-07 18:32   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2008-02-09 00:19 . 2008-02-09 00:21   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2008-02-09 00:19 . 2007-07-07 19:56   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2008-02-09 00:19 . 2007-07-07 19:56   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2008-02-09 00:19 . 2008-02-09 00:19   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2008-02-08 21:01 . 2008-02-08 23:37   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited
2008-02-01 20:05 . 2008-01-01 00:00   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-01-29 21:23 . 2008-02-01 11:29   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-01-29 21:23 . 2008-01-29 21:23   1,409   --a------   C:\WINDOWS\QTFont.for
2008-01-26 21:00 . 2008-01-26 21:00   <DIR>   d--------   C:\Program Files\Autodesk
2008-01-26 20:54 . 2007-09-05 01:46   92,544   --a------   C:\WINDOWS\system32\drivers\mcdbus.sys
2008-01-26 20:48 . 2008-01-26 20:48   <DIR>   d--------   C:\Documents and Settings\Longer\Dane aplikacji\DAEMON Tools
2008-01-26 20:06 . 2008-01-26 20:06   3,932,214   --a------   C:\WINDOWS\BricoPack Wallpaper.bmp
2008-01-26 20:06 . 2008-01-26 20:06   64,419   --a------   C:\WINDOWS\BricoPackUninst.cmd
2008-01-26 20:03 . 2008-01-26 20:06   6,116   --a------   C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-01-26 20:02 . 2008-01-26 20:02   <DIR>   d--------   C:\WINDOWS\BricoPacks
2008-01-23 17:57 . 2007-05-16 16:45   1,124,720   --a------   C:\WINDOWS\system32\D3DCompiler_34.dll
2008-01-23 17:57 . 2007-05-16 16:45   443,752   --a------   C:\WINDOWS\system32\d3dx10_34.dll
2008-01-23 17:57 . 2007-06-20 20:46   266,088   --a------   C:\WINDOWS\system32\xactengine2_8.dll
2008-01-23 17:57 . 2007-06-20 20:45   18,280   --a------   C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-18 11:39 . 2008-01-19 11:28   <DIR>   d-a------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-18 11:39 . 2006-05-25 14:52   162,304   --a------   C:\WINDOWS\system32\ztvunrar36.dll
2008-01-18 11:39 . 2005-08-26 00:50   77,312   --a------   C:\WINDOWS\system32\ztvunace26.dll
2008-01-18 11:39 . 2002-03-06 00:00   75,264   --a------   C:\WINDOWS\system32\unacev2.dll
2008-01-18 11:39 . 2006-06-19 12:01   69,632   --a------   C:\WINDOWS\system32\ztvcabinet.dll
2008-01-18 01:17 . 2008-01-22 15:41   1,456   --a------   C:\WINDOWS\unins000.dat
2008-01-10 23:35 . 2008-01-10 23:35   <DIR>   d--------   C:\Program Files\Common Files\DirectX

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 19:46   ---------   d-----w   C:\Program Files\SystemRequirementsLab
2008-02-08 19:32   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-02-07 20:04   ---------   d-----w   C:\Documents and Settings\Longer\Dane aplikacji\Vso
2008-02-07 14:16   ---------   d-----w   C:\Documents and Settings\Longer\Dane aplikacji\U3
2008-01-31 18:39   7,680   ----a-w   C:\WINDOWS\system32\ff_vfw.dll
2008-01-27 09:42   ---------   d-----w   C:\Program Files\Common Files\Autodesk Shared
2008-01-27 09:42   ---------   d-----w   C:\Program Files\backburner 2
2008-01-26 20:03   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-01-26 19:44   716,272   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2008-01-26 19:06   219,648   ----a-w   C:\WINDOWS\system32\uxtheme.dll
2008-01-07 23:25   22,328   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-07 23:25   107,832   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-01-06 11:58   ---------   d-----w   C:\Documents and Settings\Longer\Dane aplikacji\Skype
2007-12-31 18:52   ---------   d-----w   C:\Program Files\Common Files\Logitech
2007-12-31 18:51   ---------   d-----w   C:\Program Files\Logitech
2007-12-26 14:46   ---------   d-----w   C:\Documents and Settings\Longer\Dane aplikacji\Earthsim
2007-12-26 14:46   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Earthsim
2007-12-21 17:06   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\ATI
2007-12-21 17:03   ---------   d-----w   C:\Program Files\ATI Technologies
2007-12-21 13:33   108,144   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-12-21 13:33   ---------   d--h--r   C:\Documents and Settings\Longer\Dane aplikacji\SecuROM
2007-12-18 10:03   ---------   d-----w   C:\Documents and Settings\Longer\Dane aplikacji\ICSharpCode
2007-12-16 13:02   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2007-12-16 12:40   22,328   ----a-w   C:\Documents and Settings\Longer\Dane aplikacji\PnkBstrK.sys
2007-12-10 22:10   94,208   ----a-w   C:\Documents and Settings\Longer\Dane aplikacji\ezplay.sys
2007-12-10 22:10   47,360   ----a-w   C:\Documents and Settings\Longer\Dane aplikacji\pcouffin.sys
2007-12-10 21:30   94,208   ----a-w   C:\WINDOWS\system32\drivers\ezplay.sys
2007-12-10 21:30   47,360   ----a-w   C:\WINDOWS\system32\drivers\pcouffin.sys
2007-12-05 13:17   593,920   ------w   C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 03:05   368,640   ----a-w   C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04   269,312   ----a-w   C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56   147,456   ----a-w   C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55   43,520   ----a-w   C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55   26,112   ----a-w   C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55   122,880   ----a-w   C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55   122,880   ----a-w   C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54   307,200   ----a-w   C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53   53,248   ----a-w   C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53   495,616   ----a-w   C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48   9,535,488   ----a-w   C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44   3,175,584   ----a-w   C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33   1,640,192   ----a-w   C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19   385,024   ----a-w   C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17   17,408   ----a-w   C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:14   180,224   ----a-w   C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11   499,712   ----a-w   C:\WINDOWS\system32\ati2cqag.dll
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-11-12 12:53   51,233,144   ----a-w   C:\directx_apr2007_redist.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Stefan"="d:\Program Files\INTERIAPL\Stefan\Stefan.exe" [2007-08-29 14:30 685056]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"e:_program files_corel_cor3c"="E:\Program Files\Corel\Corel Graphics 12\Programs\CorUpd.exe" [ ]
"SMSystemAnalyzer"="d:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe" [2006-12-20 11:38 557056]
"LogitechSoftwareUpdate"="D:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 23:05 630784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 20:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-10-31 21:15 163840 C:\WINDOWS\system32\VTTrayp.exe]
"avast!"="d:\Program Files\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"AudioDeck"="C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 22:42 577536 C:\WINDOWS\soundman.exe]
"CorelDRAW Graphics Suite 11b"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"LogitechVideoRepair"="d:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="d:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\Longer\Menu Start\Programy\Autostart\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-10 12:07:42 110592]
Last.fm Helper.lnk - D:\Program Files\Last.fm\LastFMHelper.exe [2007-07-25 16:28:29 110592]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 04:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 04:39]
S3 XDva016;XDva016;C:\WINDOWS\system32\XDva016.sys []
S3 XDva020;XDva020;C:\WINDOWS\system32\XDva020.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 14:52:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 00:32:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  AudioDeck = C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-09  0:33:34
ComboFix-quarantined-files.txt  2008-02-08 23:33:19
.
2008-01-10 09:58:32   --- E O F --- 


Report.txt :

Kod: Zaznacz wszystko

SDFix: Version 1.138

Run by Administrator on 2008-02-09 at 00:21

Microsoft Windows XP [Wersja 5.1.2600]

Running From: D:\SDFIX\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Hijack:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 00:41:41, on 2008-02-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
D:\Program Files\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\INTERIAPL\Stefan\Stefan.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Last.fm\LastFMHelper.exe
D:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
E:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
D:\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - e:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - e:\Program Files\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [avast!] d:\Program Files\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] d:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] d:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Stefan] d:\Program Files\INTERIAPL\Stefan\Stefan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [e:_program files_corel_cor3c] E:\Program Files\Corel\Corel Graphics 12\Programs\CorUpd.exe /Watch /r="Software\Corel\CorelDRAW\12.0"
O4 - HKCU\..\Run: [SMSystemAnalyzer] "d:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "D:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Program Files\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - E:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

[Dzi@dek]

Kod: Zaznacz wszystko

C:\kmd.exe

Skasuj ten plik i OK.