komunikat o "kompromitującej zawartości"...

**Posty:** 65 · przez **PersiL** 16 Maj 2008, 20:05

Jakiś czas temu zmieniałem antywirusa. Przez jakieś 15 min komp pozostał bez ochrony, i najwidoczniej nałapałem jakiegoś szajstwa... co jakiś czas wyskakuje komunikat, że na moim komputerze wykryto "kompromitującą zawartość" i abym ją jak najszybciej skasował przy pomocy ich programu... Jak zwykle...

Proszę o pomoc przy sprawdzaniu loga:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22, on 2008-05-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\CF28522.exe
C:\Documents and Settings\Admin\Pulpit\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\CF28522.exe
C:\ComboFix\handle.cfexe
C:\ComboFix\sed.cfexe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /S
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [00f165aa] rundll32.exe "C:\WINDOWS\system32\acxeaiyl.dll",b
O4 - HKLM\..\Run: [BM03c25636] Rundll32.exe "C:\WINDOWS\system32\ndmjjjix.dll",s
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\XP\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\XP\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205516758031
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7018 bytes

**Posty:** 8001 · przez **Okocza** 16 Maj 2008, 20:06

PersiL napisał(a):O4 - HKLM\..\Run: [00f165aa] rundll32.exe "C:\WINDOWS\system32\acxeaiyl.dll",b
O4 - HKLM\..\Run: [BM03c25636] Rundll32.exe "C:\WINDOWS\system32\ndmjjjix.dll",s

jeśli czytałeś zasady o hijacku to wiesz co z tym zrobić.

daj log z combofixa

**Posty:** 65 · przez **PersiL** 16 Maj 2008, 21:05

W sumie to trochę dziwna sprawa, ale nie znalazłem tych procesów w trybie awaryjnym...

Za to skasowałem te:

O4 - HKLM\..\Run: [00f165aa] rundll32.exe "C:\WINDOWS\system32\cvgfmema.dll",b
O4 - HKLM\..\Run: [BM03c25636] Rundll32.exe "C:\WINDOWS\system32\mhaehlnb.dll",s

Wydawało mi się że są podejrzane, więc je usunąłem. Jak na razie wszystko działa (komunikat się nie pokazuje, a poza tym działają już niektóre strony internetowe na które wtedy nie mogłem za nic wejść (np wyniki wyszukiwania google!).

Dzięki za pomoc!

**Posty:** 8001 · przez **Okocza** 16 Maj 2008, 21:06

daj log z combofixa - masz zawiruoswany system...

**Posty:** 65 · przez **PersiL** 17 Maj 2008, 13:48

ComboFix 08-05-15.3 - Admin 2008-05-17 11:35:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1473 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\amemfgvc.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\rnromoyi.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 )))))))))))))))))))))))))))))))
.

2008-05-17 13:23 . 2008-05-17 13:24 417 --ahs---- C:\WINDOWS\system32\eNmmoUtv.ini
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-17 11:30 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-16 19:57 . 2008-05-16 19:57 126,016 --a------ C:\WINDOWS\system32\mhaehlnb.dll
2008-05-16 19:54 . 2008-05-16 19:54 294 ---hs---- C:\WINDOWS\system32\lyiaexca.ini
2008-05-16 13:43 . 2008-05-16 13:43 126,016 --a------ C:\WINDOWS\system32\ndmjjjix.dll
2008-05-16 13:43 . 2008-05-16 19:56 109,807 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-17 13:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-17 13:26 4,727,328 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-17 13:22 88,352 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-17 13:20 76,628 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-17 13:20 13,484 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:09 . 2008-05-14 19:09 57,344 --a------ C:\WINDOWS\system32\hgGwXqPi.dll
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\yayxXOGx.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\iifcyyxW.dll
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia
2008-04-17 20:40 . 2008-04-17 20:40 <DIR> d-------- C:\Program Files\Astroburn
2008-04-17 20:40 . 2008-04-17 21:12 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Astroburn

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-17 04:08 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-14 13:16 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-14 13:01 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-14 13:01 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-27 08:40 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 22:28 2,102,272 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-21 14:32 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-20 08:01 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-17 11:37 --------- d-----w C:\Program Files\AGEIA Technologies
2008-03-17 11:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield Installation Information
2008-03-15 03:39 14,848 ----a-w C:\WINDOWS\system32\psapi32.dll
2008-03-14 17:06 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-02-20 18:53 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 06:53 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 14:00

log jest urwany. daj cały.

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

**Posty:** 65 · przez **PersiL** 17 Maj 2008, 23:01

ComboFix 08-05-15.3 - Admin 2008-05-17 22:51:51.3 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\tcddbfjp.ini
C:\WINDOWS\system32\xshggnus.exe
.
---- Previous Run -------
.
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\amemfgvc.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\rnromoyi.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 )))))))))))))))))))))))))))))))
.

2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-17 17:02 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-17 17:02 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 14:27 . 2008-05-17 14:27 116,288 --a------ C:\WINDOWS\system32\pjfbddct.dll
2008-05-17 14:24 . 2008-05-17 14:24 126,016 --a------ C:\WINDOWS\system32\ecbgfjyx.dll
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-17 22:55 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-16 19:57 . 2008-05-16 19:57 126,016 --a------ C:\WINDOWS\system32\mhaehlnb.dll
2008-05-16 19:54 . 2008-05-16 19:54 294 ---hs---- C:\WINDOWS\system32\lyiaexca.ini
2008-05-16 13:43 . 2008-05-16 13:43 126,016 --a------ C:\WINDOWS\system32\ndmjjjix.dll
2008-05-16 13:43 . 2008-05-17 22:37 109,826 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-17 17:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-17 22:50 5,159,200 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-17 22:50 91,936 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-17 22:50 82,700 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-17 22:50 13,868 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:09 . 2008-05-14 19:09 57,344 --a------ C:\WINDOWS\system32\hgGwXqPi.dll
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\yayxXOGx.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\iifcyyxW.dll.vir
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia
2008-04-17 20:40 . 2008-04-17 20:40 <DIR> d-------- C:\Program Files\Astroburn
2008-04-17 20:40 . 2008-04-17 21:12 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Astroburn

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 10:01 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-17 04:08 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-17 11:37 --------- d-----w C:\Program Files\AGEIA Technologies
2008-03-17 11:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield Installation Information
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{506FABB1-FE09-45FE-BC53-6CB2C98A54A8}]
2008-03-15 08:09 14848 --a------ C:\WINDOWS\system32\psapi32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{789A8BED-FB99-4AC4-8630-F062CFA1E021}]
2008-05-14 19:00 369664 --a------ C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"00f165aa"="C:\WINDOWS\system32\pjfbddct.dll" [2008-05-17 14:27 116288]
"BM03c25636"="C:\WINDOWS\system32\ecbgfjyx.dll" [2008-05-17 14:24 126016]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-17 17:30:05 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 22:55:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
Completion time: 2008-05-17 22:57:08 - machine was rebooted [Admin]
ComboFix-quarantined-files.txt 2008-05-17 18:27:03

Pre-Run: 5,174,845,440 bajtów wolnych
Post-Run: 5,165,162,496 bajt˘w wolnych

337 --- E O F --- 2008-03-14 17:56:09

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 23:08

wygeneruj ten log po zabawie ze Smitfraudfix'em

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 10:03

ComboFix 08-05-15.3 - Admin 2008-05-18 9:49:59.4 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1728 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2

.
((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-18 01:02 . 2008-05-18 01:02 126,016 --a------ C:\WINDOWS\system32\qlahmfeh.dll
2008-05-17 22:59 . 2008-05-17 22:59 294 ---hs---- C:\WINDOWS\system32\tcddbfjp.ini
2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-17 17:02 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 14:27 . 2008-05-17 14:27 116,288 --a------ C:\WINDOWS\system32\pjfbddct.dll
2008-05-17 14:24 . 2008-05-17 14:24 126,016 --a------ C:\WINDOWS\system32\ecbgfjyx.dll
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-17 22:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-18 09:51 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-16 19:57 . 2008-05-16 19:57 126,016 --a------ C:\WINDOWS\system32\mhaehlnb.dll
2008-05-16 19:54 . 2008-05-16 19:54 294 ---hs---- C:\WINDOWS\system32\lyiaexca.ini
2008-05-16 13:43 . 2008-05-16 13:43 126,016 --a------ C:\WINDOWS\system32\ndmjjjix.dll
2008-05-16 13:43 . 2008-05-17 22:59 109,807 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-17 22:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-18 09:46 5,257,760 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-18 09:46 92,704 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-18 09:46 84,020 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-18 09:46 13,940 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:09 . 2008-05-14 19:09 57,344 --a------ C:\WINDOWS\system32\hgGwXqPi.dll
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\yayxXOGx.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\iifcyyxW.dll.vir
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 05:04 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-17 18:31 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 05:21:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{506FABB1-FE09-45FE-BC53-6CB2C98A54A8}]
2008-03-15 08:09 14848 --a------ C:\WINDOWS\system32\psapi32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCAB62AD-ABA0-4B45-BA03-A4B1179ECB28}]
2008-05-14 19:00 369664 --a------ C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"00f165aa"="C:\WINDOWS\system32\pjfbddct.dll" [2008-05-17 14:27 116288]
"BM03c25636"="C:\WINDOWS\system32\qlahmfeh.dll" [2008-05-18 01:02 126016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-18 04:30:04 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 09:52:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
Completion time: 2008-05-18 9:53:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 05:23:54
ComboFix2.txt 2008-05-17 18:27:09

Pre-Run: 5,189,992,448 bajtów wolnych
Post-Run: 5,179,375,616 bajt˘w wolnych

332 --- E O F --- 2008-03-14 17:56:09

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 10:17

wyłącz przywracanie systemu - uruchom awaryjny i:

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: Files:: C:\WINDOWS\system32\qlahmfeh.dll C:\WINDOWS\system32\tcddbfjp.ini C:\WINDOWS\system32\pjfbddct.dll C:\WINDOWS\system32\ecbgfjyx.dll C:\WINDOWS\system32\mhaehlnb.dll C:\WINDOWS\system32\lyiaexca.ini C:\WINDOWS\system32\ndmjjjix.dll C:\WINDOWS\BM03c25636.xml C:\WINDOWS\system32\hgGwXqPi.dll C:\WINDOWS\system32\vtUommNe.dll C:\WINDOWS\system32\yayxXOGx.dll C:\WINDOWS\system32\iifcyyxW.dll.vir Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{506FABB1-FE09-45FE-BC53-6CB2C98A54A8}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCAB62AD-ABA0-4B45-BA03-A4B1179ECB28}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00f165aa"="C:\WINDOWS\system32\pjfbddct.dll"=- "BM03c25636"="C:\WINDOWS\system32\qlahmfeh.dll”=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 11:38

Po tym procesie:

ComboFix 08-05-15.3 - Admin 2008-05-18 11:29:12.5 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1761 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\efqplfum.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\pwkiaanf.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-18 11:32 . 2008-05-18 11:32 396 --ahs---- C:\WINDOWS\system32\eNmmoUtv.ini
2008-05-18 10:05 . 2008-05-18 10:05 116,288 --a------ C:\WINDOWS\system32\muflpqfe.dll
2008-05-18 10:00 . 2008-05-18 10:00 126,016 --a------ C:\WINDOWS\system32\qfnqrlvj.dll
2008-05-18 01:02 . 2008-05-18 01:02 126,016 --a------ C:\WINDOWS\system32\qlahmfeh.dll
2008-05-17 22:59 . 2008-05-18 09:59 354 ---hs---- C:\WINDOWS\system32\tcddbfjp.ini
2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-17 17:02 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 14:24 . 2008-05-17 14:24 126,016 --a------ C:\WINDOWS\system32\ecbgfjyx.dll
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-18 09:54 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-18 11:32 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-16 19:57 . 2008-05-16 19:57 126,016 --a------ C:\WINDOWS\system32\mhaehlnb.dll
2008-05-16 19:54 . 2008-05-16 19:54 294 ---hs---- C:\WINDOWS\system32\lyiaexca.ini
2008-05-16 13:43 . 2008-05-16 13:43 126,016 --a------ C:\WINDOWS\system32\ndmjjjix.dll
2008-05-16 13:43 . 2008-05-18 10:32 109,816 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-17 22:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-18 11:24 5,291,808 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-18 11:24 93,984 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-18 11:24 84,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-18 11:24 14,060 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:09 . 2008-05-14 19:09 57,344 --a------ C:\WINDOWS\system32\hgGwXqPi.dll
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\yayxXOGx.dll
2008-05-14 18:54 . 2008-05-14 18:54 57,344 --a------ C:\WINDOWS\system32\iifcyyxW.dll.vir
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 05:04 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-17 18:31 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 07:02:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 07:03:05 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_2c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{35CFE522-609B-4313-8C48-9CA8F5C85104}]
2008-05-14 19:00 369664 --a------ C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]
"00f165aa"="C:\WINDOWS\system32\muflpqfe.dll" [2008-05-18 10:05 116288]
"BM03c25636"="C:\WINDOWS\system32\bhlpikxe.dll" [2008-05-18 11:35 124992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-18 06:30:01 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 11:32:30
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\eNmmoUtv.ini 396 bytes

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-18 11:36:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 07:06:04
ComboFix2.txt 2008-05-18 05:23:59
ComboFix3.txt 2008-05-17 18:27:09

Pre-Run: 5,163,687,936 bajtów wolnych
Post-Run: 5,153,431,552 bajt˘w wolnych

345 --- E O F --- 2008-03-14 17:56:09

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 11:45

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

Kod: Zaznacz wszystko: C:\WINDOWS\system32\muflpqfe.dll C:\WINDOWS\system32\qfnqrlvj.dll C:\WINDOWS\system32\qlahmfeh.dll C:\WINDOWS\system32\ecbgfjyx.dll C:\WINDOWS\system32\ecbgfjyx.dll C:\WINDOWS\system32\mhaehlnb.dll C:\WINDOWS\system32\lyiaexca.ini C:\WINDOWS\system32\ndmjjjix.dll C:\WINDOWS\BM03c25636.xml C:\WINDOWS\system32\hgGwXqPi.dll C:\WINDOWS\system32\vtUommNe.dll C:\WINDOWS\system32\yayxXOGx.dll C:\WINDOWS\system32\iifcyyxW.dll.vir

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Po całej operacji należy zresetować komputer

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 12:20

Wynik przenoszenia:

DllUnregisterServer procedure not found in C:\WINDOWS\system32\muflpqfe.dll
C:\WINDOWS\system32\muflpqfe.dll NOT unregistered.
C:\WINDOWS\system32\muflpqfe.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\qfnqrlvj.dll
C:\WINDOWS\system32\qfnqrlvj.dll NOT unregistered.
C:\WINDOWS\system32\qfnqrlvj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\qlahmfeh.dll
C:\WINDOWS\system32\qlahmfeh.dll NOT unregistered.
C:\WINDOWS\system32\qlahmfeh.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ecbgfjyx.dll
C:\WINDOWS\system32\ecbgfjyx.dll NOT unregistered.
C:\WINDOWS\system32\ecbgfjyx.dll moved successfully.
File/Folder C:\WINDOWS\system32\ecbgfjyx.dll not found.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mhaehlnb.dll
C:\WINDOWS\system32\mhaehlnb.dll NOT unregistered.
C:\WINDOWS\system32\mhaehlnb.dll moved successfully.
C:\WINDOWS\system32\lyiaexca.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ndmjjjix.dll
C:\WINDOWS\system32\ndmjjjix.dll NOT unregistered.
C:\WINDOWS\system32\ndmjjjix.dll moved successfully.
C:\WINDOWS\BM03c25636.xml moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\hgGwXqPi.dll
C:\WINDOWS\system32\hgGwXqPi.dll NOT unregistered.
C:\WINDOWS\system32\hgGwXqPi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtUommNe.dll
C:\WINDOWS\system32\vtUommNe.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vtUommNe.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\yayxXOGx.dll
C:\WINDOWS\system32\yayxXOGx.dll NOT unregistered.
C:\WINDOWS\system32\yayxXOGx.dll moved successfully.
C:\WINDOWS\system32\iifcyyxW.dll.vir moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 01012007_002313

Files moved on Reboot...
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtUommNe.dll
C:\WINDOWS\system32\vtUommNe.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vtUommNe.dll scheduled to be moved on reboot.

Niestety nie poprawiło to błędów. Nadal komp się muli, a niektóre strony www nie działają. Czy może to być wina tego, że ostatni proces robiłem nie w trybie awaryjnym a zwykłym?

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 12:22

każde czyszczenie powinno się robić w awaryjnym z wyłączonym przywracaniem systemu... daj log z combofixa po tym czyszczeniu... kilka razy bawiłeś się już skanerami Vundo :?:

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 15:57

Tak, już kilka razy nimi skanowałem, ale nic nie wykryły.

Oto log:

ComboFix 08-05-15.3 - Admin 2008-05-18 15:45:54.6 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1763 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\efqplfum.ini
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\epvxieef.ini
C:\WINDOWS\system32\gpjydhcv.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-18 15:41 . 2008-05-18 15:41 0 --a------ C:\WINDOWS\BM03c25636.xml
2008-05-18 11:35 . 2008-05-18 11:35 124,992 --a------ C:\WINDOWS\system32\bhlpikxe.dll
2008-05-17 22:59 . 2008-05-18 09:59 354 ---hs---- C:\WINDOWS\system32\tcddbfjp.ini
2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-17 17:02 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-18 11:36 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-18 15:48 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-18 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-18 15:43 5,307,936 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-18 15:43 95,776 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-18 15:43 84,692 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-18 15:43 14,228 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 05:04 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-17 18:31 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 11:18:49 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 11:20:36 124,992 ----a-w C:\WINDOWS\system32\clidvqac.dll
+ 2006-12-31 19:53:13 117,312 ----a-w C:\WINDOWS\system32\feeixvpe.dll
+ 2006-12-31 19:56:50 2,112 ----a-w C:\WINDOWS\system32\hgqhirlo.exe
+ 2006-12-31 19:52:18 124,992 ----a-w C:\WINDOWS\system32\ipvctcch.dll
+ 2008-05-18 11:19:56 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_23c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ED376956-8802-4CE5-BE67-0BE402FA84AE}]
2008-05-14 19:00 369664 --a------ C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]
"00f165aa"="C:\WINDOWS\system32\bnlatsjo.dll" [2008-05-18 15:52 117312]
"BM03c25636"="C:\WINDOWS\system32\clidvqac.dll" [2008-05-18 15:50 124992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-18 11:10:58 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 15:49:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\clidvqac.dll 124992 bytes executable
C:\WINDOWS\system32\bnlatsjo.dll 117312 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-18 15:53:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 11:23:36
ComboFix2.txt 2008-05-18 07:06:07
ComboFix3.txt 2008-05-18 05:23:59
ComboFix4.txt 2008-05-17 18:27:09

Pre-Run: 5,149,085,696 bajtów wolnych
Post-Run: 5,134,811,136 bajt˘w wolnych

342 --- E O F --- 2008-03-14 17:56:09

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 16:05

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\BM03c25636.xml C:\WINDOWS\system32\bhlpikxe.dll C:\WINDOWS\system32\tcddbfjp.ini C:\WINDOWS\system32\clidvqac.dll C:\WINDOWS\system32\bnlatsjo.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ED376956-8802-4CE5-BE67-0BE402FA84AE}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00f165aa"="C:\WINDOWS\system32\bnlatsjo.dll"=- "BM03c25636"="C:\WINDOWS\system32\clidvqac.dll"=-

wiadomo - przeciągasz na ikone Cf i nowy log..

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 16:33

ComboFix 08-05-15.3 - Admin 2008-05-18 16:26:26.7 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1628 [GMT 4.5:30]
Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\BM03c25636.xml
C:\WINDOWS\system32\bhlpikxe.dll
C:\WINDOWS\system32\bnlatsjo.dll
C:\WINDOWS\system32\clidvqac.dll
C:\WINDOWS\system32\tcddbfjp.ini
.
/wow section - STAGE 38
pv: No matching processes found
Składnia polecenia jest niepoprawna.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM03c25636.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bhlpikxe.dll
C:\WINDOWS\system32\bnlatsjo.dll
C:\WINDOWS\system32\clidvqac.dll
C:\WINDOWS\system32\eNmmoUtv.ini
C:\WINDOWS\system32\eNmmoUtv.ini2
C:\WINDOWS\system32\nxnitcsi.exe
C:\WINDOWS\system32\ojstalnb.ini
C:\WINDOWS\system32\tcddbfjp.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-17 21:02 . 2008-05-17 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Touchstone
2008-05-17 17:02 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-17 17:02 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-17 17:02 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-17 17:02 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-17 17:02 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-17 17:02 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-17 17:02 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-17 17:02 . 2008-05-18 16:22 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-17 15:52 . 2008-05-17 15:52 <DIR> d-------- C:\VundoFix Backups
2008-05-17 14:52 . 2008-05-18 09:47 2,880 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-17 10:43 . 2008-05-17 10:43 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\TuneUp Software
2008-05-17 10:43 . 2008-05-17 10:43 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-17 10:43 . 2008-02-27 13:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-05-17 10:42 . 2008-05-17 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-16 20:44 . 2008-05-16 20:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 20:41 . 2008-05-18 15:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-16 20:41 . 2008-01-30 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-16 20:41 . 2008-05-16 20:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-16 20:41 . 2008-01-30 18:45 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-16 20:41 . 2008-05-16 20:41 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-16 20:41 . 2008-05-18 16:28 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.dat.LOG
2008-05-14 19:32 . 2008-05-14 19:40 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-14 19:32 . 2008-05-14 19:40 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-14 19:31 . 2008-05-18 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-14 19:31 . 2008-05-18 15:43 5,307,936 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-14 19:31 . 2008-05-18 15:43 95,776 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-14 19:31 . 2008-05-18 15:43 84,692 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-14 19:31 . 2008-05-18 15:43 14,228 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-14 19:00 . 2008-05-14 19:00 369,664 --a------ C:\WINDOWS\system32\vtUommNe.dll
2008-05-11 19:31 . 2008-05-11 19:31 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-11 19:31 . 2008-05-11 19:32 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\teamspeak2
2008-05-11 19:31 . 2008-05-11 19:31 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-11 15:29 . 2008-05-11 15:29 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-11 10:15 . 2008-05-11 10:15 <DIR> d-------- C:\Garmin
2008-05-11 10:15 . 2006-02-20 20:25 17,536 -ra------ C:\WINDOWS\system32\drivers\grmn0200.sys
2008-05-11 10:15 . 2003-09-23 16:42 17,024 -ra------ C:\WINDOWS\system32\drivers\grmngen.sys
2008-05-11 10:15 . 2006-04-11 21:51 16,512 -ra------ C:\WINDOWS\system32\drivers\grmn0400.sys
2008-05-11 10:15 . 2006-07-11 21:50 11,776 -ra------ C:\WINDOWS\system32\drivers\grmn1200.sys
2008-05-11 10:15 . 2003-09-23 16:42 7,296 -ra------ C:\WINDOWS\system32\drivers\grmnusb.sys
2008-05-11 09:22 . 2006-06-27 05:40 12,800 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-05-11 09:22 . 2006-06-27 05:40 3,584 -----c--- C:\WINDOWS\system32\dllcache\WgaLogon.dll
2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\Google
2008-05-10 13:42 . 2008-05-10 13:42 <DIR> d-------- C:\Program Files\AVIConverter
2008-05-10 13:01 . 2008-05-10 13:01 38 --a------ C:\WINDOWS\avisplitter.INI
2008-05-02 15:39 . 2008-05-02 15:39 2,337,865 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-01 20:48 . 2004-08-18 13:04 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-05-01 14:32 . 2008-05-01 14:42 <DIR> d-------- C:\Program Files\Counter-Strike
2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-01 10:26 . 2008-05-01 10:26 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire
2008-04-27 18:37 . 2008-04-27 18:37 <DIR> d-------- C:\Program Files\RivaTuner v2.08
2008-04-27 18:34 . 2008-04-27 18:42 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-04-27 13:32 . 2008-04-27 13:32 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-04-27 13:08 . 2008-04-27 13:08 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-04-27 13:08 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-04-27 13:08 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-27 13:08 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-27 13:08 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-04-27 07:59 . 2008-04-27 08:00 <DIR> d-------- C:\Program Files\Wesola_Szkola_3
2008-04-24 21:36 . 2008-04-24 21:36 <DIR> d-------- C:\Program Files\CCleaner
2008-04-23 02:59 . 2008-04-23 02:59 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-22 07:51 . 2008-04-22 07:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-20 23:56 . 2008-04-21 00:07 31,517,232 --a------ C:\Program Files\54533.exe
2008-04-20 16:58 . 2008-04-20 17:59 <DIR> d-------- C:\Program Files\Maja2
2008-04-20 08:06 . 2008-04-20 08:07 <DIR> d-------- C:\WINDOWS\AM
2008-04-20 08:06 . 2008-04-20 08:06 <DIR> d-------- C:\Program Files\AidemMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-18 05:04 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
2008-05-17 18:31 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-17 16:31 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Xfire
2008-05-17 15:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-17 08:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\foobar2000
2008-05-17 06:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 15:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-14 14:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-11 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-10 06:30 --------- d-----w C:\Program Files\Xfire
2008-05-10 06:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Ubisoft
2008-05-10 06:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 17:40 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-02 11:09 22,328 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys
2008-05-02 11:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-05-01 09:21 --------- d-----w C:\Program Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-01 09:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-17 16:42 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Astroburn
2008-04-17 16:10 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 16:10 --------- d-----w C:\Program Files\Astroburn
2008-04-16 13:45 --------- d-----w C:\Program Files\Wesola_Szkola_2
2008-04-13 07:30 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-13 04:01 --------- d-----w C:\Program Files\%temp&
2008-04-08 16:15 --------- d-----w C:\Program Files\ESET
2008-04-08 16:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-06 13:44 --------- d-----w C:\Program Files\eMule
2008-04-06 11:40 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Kopia Ubisoft
2008-04-05 07:42 --------- d-----w C:\Program Files\Aspecto Software
2008-04-04 15:58 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-03 08:55 --------- d-----w C:\Program Files\NiemPol
2008-04-02 16:28 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\dvdcss
2008-04-02 12:57 --------- d-----w C:\Program Files\Microsoft Works
2008-04-02 12:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-02 12:03 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 07:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\FLV Extract
2008-03-29 16:34 --------- d-----w C:\Program Files\Unlocker
2008-03-24 13:36 --------- d-----w C:\Program Files\MegauploadToolbar
2008-03-24 13:36 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\MegauploadToolbar
2008-03-24 08:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-24 08:22 --------- d-----w C:\Program Files\Windows Live
2008-03-24 08:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-03-23 18:24 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2008-03-23 18:20 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2008-03-23 11:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype
2008-03-23 11:50 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\skypePM
2008-03-23 11:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2008-03-23 11:49 --------- d-----w C:\Program Files\Skype
2008-03-23 11:49 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 11:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 11:48 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-03-23 11:48 --------- d-----w C:\Program Files\DIFX
2008-03-23 11:48 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-03-22 16:04 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-03-22 13:50 --------- d-----w C:\Program Files\PQDVD
2008-03-22 13:31 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-03-21 17:45 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2008-03-21 14:37 --------- d-----w C:\Program Files\CoD RconTool
2008-03-20 16:58 --------- d-----w C:\Program Files\proDAD
2008-03-20 16:58 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\proDAD
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-SAL
2008-03-20 16:41 --------- d-----w C:\Program Files\AdorageI-GfxDatas
2008-03-20 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle Studio
2008-03-20 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle
2008-03-20 12:03 --------- d-----w C:\Program Files\Pinnacle
2008-03-19 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-19 15:52 --------- d-----w C:\Program Files\Bonjour
2008-03-19 15:43 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-14 02:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-03 09:55 5,702 ---ha-w C:\WINDOWS\nod32restoretemdono.reg
2008-01-30 13:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008013020080131\index.dat
2008-01-30 13:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_22.56.56.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 18:24:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 11:58:22 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-12-31 19:53:13 117,312 ----a-w C:\WINDOWS\system32\feeixvpe.dll
+ 2006-12-31 19:56:50 2,112 ----a-w C:\WINDOWS\system32\hgqhirlo.exe
+ 2006-12-31 19:52:18 124,992 ----a-w C:\WINDOWS\system32\ipvctcch.dll
+ 2008-05-18 11:59:29 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_4f8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5055CF49-ABDE-4340-8F87-18FEA530C517}]
2008-05-14 19:00 369664 --a------ C:\WINDOWS\system32\vtUommNe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:14 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 17:55 57344]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-01-17 04:12 200704]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 12:40 2691072]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]
"00f165aa"="C:\WINDOWS\system32\bnlatsjo.dll" [ ]
"BM03c25636"="C:\WINDOWS\system32\nurtcajb.dll" [2008-05-18 16:30 124992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-04 04:14 137216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="regsvr32 /s /n /i:U shell32" []
"nltide_3"="advpack.dll" [2007-12-07 06:28 124928 C:\WINDOWS\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUommNe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 11:50 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2007-11-12 21:43 19456 C:\WINDOWS\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2007-11-12 21:43 19968 C:\WINDOWS\system32\CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 21:21 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2001-08-06 19:49 196608 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:51 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"idsvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"AVP"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"F:\\Call of Duty 2 XP\\CoD2MP_s.exe"=
"F:\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\RM.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\Studio.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\PMSRegisterFile.exe"=
"E:\\XP\\Pinnacle Studio\\programs\\umi.exe"=
"D:\\cs1.5\\hl.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Call of Duty 4 MW\\iw3mp.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"F:\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Polish\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5092:TCP"= 5092:TCP:aaa
"5092:UDP"= 5092:UDP:aaaa
"4470:TCP"= 4470:TCP:11
"4470:UDP"= 4470:UDP:12

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 22:00]
S2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 04:14]
S3 BENDER;Pinnacle DV/AV Capture;C:\WINDOWS\system32\drivers\bender.sys [2006-12-01 02:30]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt [2007-10-17 03:30]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2007-11-12 21:34]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-17 10:43]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-18 11:10:58 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 16:28:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\eNmmoUtv.ini 396 bytes
C:\WINDOWS\system32\nurtcajb.dll 124992 bytes executable
C:\WINDOWS\system32\lejvgyyu.exe 2112 bytes executable

scan completed successfully
hidden files: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\K:\Dane\everestultimate420(dobreprogramy.pl)\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\vtUommNe.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-18 16:33:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 12:03:05
ComboFix2.txt 2008-05-18 11:23:39
ComboFix3.txt 2008-05-18 07:06:07
ComboFix4.txt 2008-05-18 05:23:59
ComboFix5.txt 2008-05-17 18:27:09

Pre-Run: 5,181,292,544 bajtów wolnych
Post-Run: 5,171,531,776 bajt˘w wolnych

350 --- E O F --- 2008-03-14 17:56:09

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 16:41

Kod: Zaznacz wszystko: C:\WINDOWS\system32\vtUommNe.dll C:\WINDOWS\system32\eNmmoUtv.ini C:\WINDOWS\system32\nurtcajb.dll C:\WINDOWS\system32\lejvgyyu.exe

usuń te pliki ręcznie z dysku

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5055CF49-ABDE-4340-8F87-18FEA530C517}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00f165aa"=- "BM03c25636"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 65 · przez **PersiL** 18 Maj 2008, 19:17

Klucz dodałem, ale z tych czterech plików drugiego nie znalazłem na dysku, a udało mi się skasować tylko ostatni. 1 i 3 nie dało się usunąć. Nawet w trybie awaryjnym, programami Unlocker ani Killbox nie dało się z nimi nic zrobić. Mam może spróbować je skasować przez Linuxa?

**Posty:** 8001 · przez **Okocza** 18 Maj 2008, 19:19

możesz spróbować. spróbuj jeszcze otmove it

jeśli chcesz to dam Ci zaraz poradnik jak to zrobić.

komunikat o "kompromitującej zawartości"...

Komunikat o "kompromitującej zawartości"...

Kto jest na forum