komunikat o "kompromitującej zawartości"...

[PersiL]

DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtUommNe.dll
C:\WINDOWS\system32\vtUommNe.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vtUommNe.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\eNmmoUtv.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\nurtcajb.dll
C:\WINDOWS\system32\nurtcajb.dll NOT unregistered.
C:\WINDOWS\system32\nurtcajb.dll moved successfully.
File/Folder C:\WINDOWS\system32\lejvgyyu.exe not found.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05182008_192003

Files moved on Reboot...
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtUommNe.dll
C:\WINDOWS\system32\vtUommNe.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vtUommNe.dll scheduled to be moved on reboot

Taki wynik.

[Okocza]

uruchomiłeś ponownie kompa

[PersiL]

Tak, to już wynik po restarcie.

[wojtas]

daj nowy log

[PersiL]

ComboFix 08-05-15.3 - Admin 2008-05-18 21:08:41.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1473 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\mwlwknsd.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-18 16:57 . 2008-05-18 17:06 <DIR> d-------- C:\!KillBox
2008-05-18 16:33 . 2008-05-18 16:33 117,312 --a------ C:\WINDOWS\system32\dsnkwlwm.dll
2008-05-18 16:30 . 2008-05-18 21:22 109,807 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-18 16:22 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-18 16:33 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-18 16:55 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-18 21:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-18 21:22 5,490,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-18 21:18 103,456 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-18 21:17 87,068 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-18 21:17 15,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --------- C:\WINDOWS\system32\vtUommNe.dll
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 13:35 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-18 12:50 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-18 05:04 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 15:41 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-27 08:40 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 22:28 2,102,272 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-21 14:32 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-20 08:01 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-15 03:39 14,848 ----a-w C:\WINDOWS\system32\psapi32.dll
2008-03-14 17:06 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-02-20 18:53 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 06:53 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 16:48:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-12-31 19:53:13 117,312 ----a-w C:\WINDOWS\system32\feeixvpe.dll
+ 2006-12-31 19:56:50 2,112 ----a-w C:\WINDOWS\system32\hgqhirlo.exe
+ 2006-12-31 19:52:18 124,992 ----a-w C:\WINDOWS\system32\ipvctcch.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF28971C-330F-447E-B6D1-7EA86CBA480C}]
2008-05-14 19:00 369664 --------- C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]
"00f165aa"="C:\WINDOWS\system32\dsnkwlwm.dll" [2008-05-18 16:33 117312]
"BM03c25636"="C:\WINDOWS\system32\eeplxfdp.dll" [2008-05-18 21:22 124992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
R3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-18 16:48:26 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 21:19:08
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
C:\WINDOWS\system32\CTXFISPI.EXE
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-18 21:24:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 16:54:06
ComboFix2.txt 2008-05-18 12:03:08
ComboFix3.txt 2008-05-18 11:23:39
ComboFix4.txt 2008-05-18 07:06:07
ComboFix5.txt 2008-05-18 05:23:59

Pre-Run: 5,080,121,344 bajtów wolnych
Post-Run: 5,080,498,176 bajt˘w wolnych

361 --- E O F --- 2008-03-14 17:56:09

[wojtas]

podstawa:

Wykonaj to co jest podane w tym temacie

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

C:\WINDOWS\system32\dsnkwlwm.dll
C:\WINDOWS\BM03c25636.xml
C:\WINDOWS\system32\feeixvpe.dll
C:\WINDOWS\system32\hgqhirlo.exe
C:\WINDOWS\system32\ipvctcch.dll
C:\WINDOWS\system32\vtUommNe.dll

Kliknij w Execute i zatwierdz reset kompa.

potem wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF28971C-330F-447E-B6D1-7EA86CBA480C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00f165aa"=-
"BM03c25636"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....


potem wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=-
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

Autor postu otrzymał pochwałę

[PersiL]

Po wszystkich operacjach które podałeś:

The Avenger:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\dsnkwlwm.dll" not found!
Deletion of file "C:\WINDOWS\system32\dsnkwlwm.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\BM03c25636.xml" deleted successfully.
File "C:\WINDOWS\system32\feeixvpe.dll" deleted successfully.
File "C:\WINDOWS\system32\hgqhirlo.exe" deleted successfully.
File "C:\WINDOWS\system32\ipvctcch.dll" deleted successfully.
File "C:\WINDOWS\system32\vtUommNe.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

ComboFix:

ComboFix 08-05-15.3 - Admin 2008-05-19 14:43:56.9 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1758 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\glfgvpte.ini
C:\WINDOWS\system32\qidmttfi.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 )))))))))))))))))))))))))))))))
.

2008-05-18 21:24 . 2008-05-18 21:24 294 ---hs---- C:\WINDOWS\system32\mwlwknsd.ini
2008-05-18 16:57 . 2008-05-18 17:06 <DIR> d-------- C:\!KillBox
2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-18 16:22 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-19 14:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-19 14:43 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-19 06:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-19 14:28 6,295,328 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-19 14:28 148,768 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-19 14:28 92,084 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-19 14:28 16,136 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-19 09:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-18 17:21 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-18 13:35 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 15:41 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-27 08:40 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 22:28 2,102,272 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-21 14:32 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-20 08:01 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-15 03:39 14,848 ----a-w C:\WINDOWS\system32\psapi32.dll
2008-03-14 17:06 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-02-20 18:53 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 06:53 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-19 10:13:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6E2A6483-9F76-4689-88B2-4EC00CDED07B}]
C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-19 09:30:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-19 14:45:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
Completion time: 2008-05-19 14:46:48
ComboFix-quarantined-files.txt 2008-05-19 10:16:36
ComboFix2.txt 2008-05-18 16:54:18
ComboFix3.txt 2008-05-18 12:03:08
ComboFix4.txt 2008-05-18 11:23:39
ComboFix5.txt 2008-05-18 07:06:07

Pre-Run: 5,115,121,664 bajtów wolnych
Post-Run: 5,101,215,744 bajtów wolnych

331 --- E O F --- 2008-03-14 17:56:09

[Okocza]

Kod: Zaznacz wszystko

C:\WINDOWS\system32\mwlwknsd.ini

usuń ręcznie lub wklej do notatnika w postaci:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\mwlwknsd.ini

i przeciagnij na ikone combofixa

pozniej:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

[PersiL]

Oczyściłem kompa i chyba w końcu udało się pozbyć całego syfu. Jak na razie nie zauważyłem nic podejrzanego. Wszystko działa tak, jak należy

Dzięki wam za pomoc.


_______________________________________


A jednak Kaspersky wykrył mi jeszcze pozostałości po adware w kilku plikach , których nie może skasować - prawdopodobnie są to zapisy przywracania systemu. Dziwi mnie tylko to, że tak jak należało wyłączyłem przywracanie systemu już po 1 poście. Teraz znów je wyłączyłem, więc te dane powinny zostać skasowane. Ale czy na pewno? I czy (zakładając że nie będę robił przywracania systemu) te pliki mi grożą następną infekcją?

Oto ścieżka do jednego z nich:

C:\System Volume Information\_restore{30D19E91-7647-4CB9-8A8C-910F9A6B0707}\RP2\A0006227.dll