Wirus win32:trojan-gen. {other}

[Rubid]

Witam.

Mam problem z wirusem Win32:Trojan-gen. {Other}, avast go wykrywa jednak nic nie może z mim zrobić a sam boje się grzebać w plikach systemowych. Od czasu zarażenia komputer chodzi około 5 krotnie wolniej niż zazwyczaj. Proszę o szybką pomoc


oto mój log

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:08:04, on 2008-08-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\braviax.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
O1 - Hosts: 78.46.45.81 L2authd.lineage2.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2F55A1E9-EE3D-4B19-8B5F-378DEB2F893C} - C:\WINDOWS\system32\byXQiGwW.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RestartNeroSetup] "C:\DOCUME~1\user\USTAWI~1\Temp\Nero Web\SetupXu.exe" MODE="update"  STARTMODE="2"  USERSEL="3"  FAMILYNAME="Nero 7"  RUNSETUPXU="1"  UPGRADE="1"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [WinAntispyware2008] "C:\Program Files\WinAntispyware2008\WinAntispyware2008.exe" /hide
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5202CF8-D539-4DE9-8301-EBBE12B5BCB1}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: byXQiGwW - byXQiGwW.dll (file missing)
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9020 bytes


[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[Rubid]

Dzięki pomogło, dla pewności log:

Kod: Zaznacz wszystko

[b]SDFix: Version 1.217 [/b]
Run by user on 2008-08-19 at 00:43

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\Documents and Settings\user\Menu Start\Programy\WinAntispyware2008\Uninstall.lnk - Deleted
C:\Documents and Settings\user\Menu Start\Programy\WinAntispyware2008\WinAntispyware2008.lnk - Deleted
C:\Program Files\WinAntispyware2008\comp.dat - Deleted
C:\Program Files\WinAntispyware2008\htmlayout.dll - Deleted
C:\Program Files\WinAntispyware2008\pthreadVC2.dll - Deleted
C:\Program Files\WinAntispyware2008\WinAntispyware2008.cfg - Deleted
C:\Program Files\WinAntispyware2008\WinAntispyware2008.dll - Deleted
C:\Program Files\WinAntispyware2008\WinAntispyware2008.exe - Deleted
C:\Program Files\WinAntispyware2008\wscui.cpl - Deleted
C:\Program Files\WinAntispyware2008\data\daily.cvd - Deleted
C:\Program Files\WinAntispyware2008\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest - Deleted
C:\Program Files\WinAntispyware2008\Microsoft.VC80.CRT\msvcm80.dll - Deleted
C:\Program Files\WinAntispyware2008\Microsoft.VC80.CRT\msvcp80.dll - Deleted
C:\Program Files\WinAntispyware2008\Microsoft.VC80.CRT\msvcr80.dll - Deleted



Folder C:\Documents and Settings\user\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed
Folder C:\Documents and Settings\user\Menu Start\Programy\WinAntispyware2008 - Removed
Folder C:\Program Files\WinAntispyware2008 - Removed


Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 00:53:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f7,7b,eb,6a,1c,28,de,d5,fb,0b,d8,02,37,f4,36,e1,01,a0,b5,a1,72,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f7,7b,eb,6a,1c,28,de,d5,fb,0b,d8,02,37,f4,36,e1,01,a0,b5,a1,72,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:47,b0,49,ba,a0,70,61,0e,95,cf,02,98,9e,a7,84,c7,8e,b1,be,c4,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:70,c3,ff,e8,65,55,0d,8b,13,90,88,31,0e,b4,08,e0,b2,9f,e5,b3,5b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance]
"Object List"="9142 9142 9148 9148"
"Last Counter"=dword:000023c2
"Last Help"=dword:000023c3
"First Help"=dword:000023b7
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:37,4b,50,de,0b,9f,c1,e4,78,4d,c9,ce,e2,d0,13,f0,ae,2f,e5,97,d5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:37,4b,50,de,0b,9f,c1,e4,78,4d,c9,ce,e2,d0,13,f0,ae,2f,e5,97,d5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:47,b0,49,ba,a0,70,61,0e,95,cf,02,98,9e,a7,84,c7,8e,b1,be,c4,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:70,c3,ff,e8,65,55,0d,8b,13,90,88,31,0e,b4,08,e0,b2,9f,e5,b3,5b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"="C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Nero Web\\SetupXu.exe"="C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Nero Web\\SetupXu.exe:*:Enabled:Nero ProductSetup"
"C:\\Program Files\\Miranda IM\\miranda32.exe"="C:\\Program Files\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM"
"C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"="C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe:*:Enabled:Supreme Commander"
"C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"="C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander"
"C:\\Program Files\\Cerberus\\Cerberus.exe"="C:\\Program Files\\Cerberus\\Cerberus.exe:*:Enabled:Cerberus FTP Server"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:BF2"
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"="C:\\Program Files\\BitTornado\\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"="C:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe:*:Enabled:Jedi Academy MultiPlayer"
"C:\\Program Files\\Cryo\\SAGA\\Saga.exe"="C:\\Program Files\\Cryo\\SAGA\\Saga.exe:*:Enabled:Dreked"
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"="C:\\Program Files\\THQ\\Dawn of War\\W40k.exe:*:Enabled:W40K"
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe:*:Enabled:DarkCrusade"
"C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"="C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe:*:Enabled:WarhammerR: Mark of Chaost"
"C:\\Program Files\\Panzer Elite Action\\pea.exe"="C:\\Program Files\\Panzer Elite Action\\pea.exe:*:Enabled:pea"
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm Demo\\Soulstorm.exe"="C:\\Program Files\\THQ\\Dawn of War - Soulstorm Demo\\Soulstorm.exe:*:Enabled:Soulstorm"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\WoW-2.0.0-enUS-Installer-downloader.exe"="C:\\WoW-2.0.0-enUS-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"E:\\WoW-2.0.0-enUS-Installer-downloader.exe"="E:\\WoW-2.0.0-enUS-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\WoW-2.0.0-enGB-Installer-downloader.exe"="D:\\WoW-2.0.0-enGB-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"="C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe:*:Enabled:Soulstorm"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"D:\\WormsForts\\WormsForts\\WF.exe"="D:\\WormsForts\\WormsForts\\WF.exe:*:Enabled:WF"
"C:\\Program Files\\Pollux Gamelabs\\Lost Empire - Immortals (DEMO)\\LostEmpire.exe"="C:\\Program Files\\Pollux Gamelabs\\Lost Empire - Immortals (DEMO)\\LostEmpire.exe:*:Enabled:Lost Empire - Immortals"
"C:\\Program Files\\Strategy First\\Disciples 2 Gold Elves\\Discipl2.exe"="C:\\Program Files\\Strategy First\\Disciples 2 Gold Elves\\Discipl2.exe:*:Enabled:Disciples II v3.01"
"C:\\Sierra\\Counter-Strike\\cstrike.exe"="C:\\Sierra\\Counter-Strike\\cstrike.exe:*:Enabled:CounterStrike Launcher"
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"="E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM)"
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"="E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe:*:Enabled:etqwded.exe"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"E:\\Program Files\\thq\\RelicCOH.exe"="E:\\Program Files\\thq\\RelicCOH.exe:*:Enabled:Company of Heroes - Opposing Fronts"
"C:\\games\\RedFaction\\RedFaction.exe"="C:\\games\\RedFaction\\RedFaction.exe:*:Enabled:Red Faction Launcher"
"C:\\games\\RedFaction\\rf.exe"="C:\\games\\RedFaction\\rf.exe:*:Enabled:Red Faction"
"C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget"
"E:\\Program Files\\Cyanide\\Loki\\Loki.exe"="E:\\Program Files\\Cyanide\\Loki\\Loki.exe:*:Enabled:Loki"
"E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"="E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe:*:Enabled:Loki - AutoRun"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sun 16 Dec 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 19 Aug 2005       121,237 A..HR --- "C:\Program Files\THQ\Dawn of War\Disk1Check.EXE"
Thu 29 Nov 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu  8 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT1.tmp"

[b]Finished![/b]



hijack

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:19, on 2008-08-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RestartNeroSetup] "C:\DOCUME~1\user\USTAWI~1\Temp\Nero Web\SetupXu.exe" MODE="update"  STARTMODE="2"  USERSEL="3"  FAMILYNAME="Nero 7"  RUNSETUPXU="1"  UPGRADE="1"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5202CF8-D539-4DE9-8301-EBBE12B5BCB1}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 8511 bytes


Kod: Zaznacz wszystko

ComboFix 08-08-18.01 - user 2008-08-19 22:20:47.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1527 [GMT 2:00]
Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\user\Cookies\user@ad.yieldmanager[2].txt
C:\Documents and Settings\user\Cookies\user@ads.joemonster[1].txt
C:\Documents and Settings\user\Cookies\user@casalemedia[2].txt
C:\Documents and Settings\user\Cookies\user@clicktorrent[2].txt
C:\Documents and Settings\user\Cookies\user@deviantart[1].txt
C:\Documents and Settings\user\Cookies\user@ehg-viacom.hitbox[1].txt
C:\Documents and Settings\user\Cookies\user@insightexpressai[1].txt
C:\Documents and Settings\user\Cookies\user@metacafe[1].txt
C:\Documents and Settings\user\Cookies\user@revsci[2].txt
C:\Documents and Settings\user\Cookies\user@tradedoubler[2].txt
C:\Documents and Settings\user\Cookies\user@web.checkm8[2].txt
C:\Documents and Settings\user\Cookies\user@www.kodiakoutback[2].txt
C:\Documents and Settings\user\Cookies\ypaziw.db
C:\Documents and Settings\user\UserData
C:\Documents and Settings\user\UserData\75JC5IGQ\IsOnIE7tbPromo[1].xml
C:\Documents and Settings\user\UserData\H7C5S1TH\oWindowsUpdate[1].xml
C:\Documents and Settings\user\UserData\index.dat
C:\Documents and Settings\user\Ustawienia lokalne\Temporary Internet Files\vahojabeh.bin
C:\WINDOWS\system32\swsystem.dll

.
(((((((((((((((((((((((((   Files Created from 2008-07-19 to 2008-08-19  )))))))))))))))))))))))))))))))
.

2008-08-19 00:39 . 2008-08-19 00:39   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-08-19 00:35 . 2008-08-19 00:56   <DIR>   d--------   C:\SDFix
2008-08-19 00:30 . 2008-08-19 00:30   3,636   --a------   C:\WINDOWS\system32\tmp.reg
2008-08-19 00:16 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-08-19 00:16 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-08-19 00:16 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-08-19 00:16 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-08-19 00:16 . 2008-08-14 21:52   82,432   --a------   C:\WINDOWS\system32\IEDFix.C.exe
2008-08-19 00:16 . 2008-08-18 12:19   82,432   --a------   C:\WINDOWS\system32\404Fix.exe
2008-08-19 00:16 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-08-19 00:16 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-08-19 00:16 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-08-18 23:13 . 2008-08-18 23:13   <DIR>   d--------   C:\Program Files\Trend Micro
2008-08-18 19:43 . 2008-08-18 19:43   45,768   --a------   C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-08-18 17:29 . 2008-08-18 17:29   4,096   --a------   C:\WINDOWS\d3dx.dat
2008-08-18 16:47 . 2008-08-18 16:47   19,726   --a------   C:\Documents and Settings\user\Dane aplikacji\kutifynoge.com
2008-08-18 16:47 . 2008-08-18 16:47   19,003   --a------   C:\WINDOWS\alimani.db
2008-08-18 16:47 . 2008-08-18 16:47   18,793   --a------   C:\WINDOWS\jobefexijy.exe
2008-08-18 16:47 . 2008-08-18 16:47   18,084   --a------   C:\WINDOWS\gukizoco.exe
2008-08-18 16:47 . 2008-08-18 16:47   16,511   --a------   C:\WINDOWS\pahurova.scr
2008-08-18 16:47 . 2008-08-18 16:47   14,751   --a------   C:\WINDOWS\system32\suzato._dl
2008-08-18 16:47 . 2008-08-18 16:47   14,748   --a------   C:\Documents and Settings\user\Dane aplikacji\ywuq.dat
2008-08-18 16:47 . 2008-08-18 16:47   13,942   --a------   C:\WINDOWS\ihoceja.db
2008-08-18 16:47 . 2008-08-18 16:47   12,896   --a------   C:\WINDOWS\uwylevo._dl
2008-08-18 16:47 . 2008-08-18 16:47   12,673   --a------   C:\WINDOWS\system32\apyk.com
2008-08-18 16:47 . 2008-08-18 16:47   10,710   --a------   C:\Program Files\Common Files\gijoqefy.pif
2008-08-18 16:47 . 2008-08-18 16:47   10,584   --a------   C:\WINDOWS\wamed.exe
2008-08-18 16:47 . 2008-08-18 16:47   10,496   --a------   C:\WINDOWS\heho._sy
2008-08-18 16:45 . 2008-08-18 16:45   71,992   --a------   C:\WINDOWS\system32\winstra2.exe
2008-08-18 16:35 . 2008-08-18 16:35   69,632   --a------   C:\atm.dll
2008-08-18 14:51 . 2008-08-18 14:51   <DIR>   d--------   C:\WINDOWS\Farm Frenzy 2
2008-08-18 13:21 . 2008-08-18 14:21   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FarmFrenzy2
2008-08-18 05:24 . 2008-08-18 05:24   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\PlayFirst
2008-08-18 05:24 . 2008-08-18 05:24   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst
2008-08-18 04:45 . 2008-08-18 04:55   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\VirtualFarm
2008-08-18 03:21 . 2008-08-18 14:27   <DIR>   d--------   C:\Program Files\Alawar
2008-08-18 03:21 . 2008-08-18 04:21   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Farm Frenzy
2008-08-13 23:09 . 2008-08-13 23:09   <DIR>   d--------   C:\Program Files\Ulead Systems
2008-08-13 21:57 . 2008-08-13 23:10   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2008-08-13 21:54 . 2008-08-13 21:54   <DIR>   d--------   C:\Program Files\MagicISO
2008-08-11 14:42 . 2008-08-11 15:38   <DIR>   d--------   C:\Program Files\D-Fend
2008-08-11 14:31 . 2008-08-11 14:31   <DIR>   d--------   C:\LONGSOFT
2008-08-10 01:33 . 2008-08-10 12:44   <DIR>   d--------   C:\Program Files\Fish Tycoon
2008-08-10 01:04 . 2008-08-10 01:04   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\Summer Athletics 2008
2008-08-10 01:02 . 2007-10-12 15:14   3,734,536   --a------   C:\WINDOWS\system32\d3dx9_36.dll
2008-08-10 01:02 . 2007-10-12 15:14   1,374,232   --a------   C:\WINDOWS\system32\D3DCompiler_36.dll
2008-08-10 01:02 . 2007-10-02 09:56   444,776   --a------   C:\WINDOWS\system32\d3dx10_36.dll
2008-08-10 01:02 . 2007-10-22 03:39   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
2008-08-09 19:38 . 2008-08-09 19:38   122   --a------   C:\WINDOWS\kaillera.ini
2008-08-07 21:52 . 2008-08-09 19:37   <DIR>   d--------   C:\Downloads
2008-08-07 21:48 . 2008-08-07 21:48   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\FlashGet
2008-07-29 17:07 . 2008-07-29 17:07   <DIR>   d--------   C:\Program Files\FLStudio4
2008-07-29 17:07 . 2002-07-08 00:14   1,294,336   --a------   C:\WINDOWS\system32\vorbis.acm
2008-07-27 18:19 . 2008-07-27 18:19   <DIR>   d--------   C:\Program Files\Lineage II
2008-07-24 12:11 . 2008-07-24 12:17   <DIR>   d--------   C:\WINDOWS\NV2963560.TMP
2008-07-22 19:32 . 2008-07-22 19:35   <DIR>   d--------   C:\Program Files\Switlle
2008-07-22 19:26 . 2008-07-22 19:32   <DIR>   d--------   C:\Program Files\GameTop.com
2008-07-22 19:25 . 2008-08-19 02:42   <DIR>   d--------   C:\games

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 20:27   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\Skype
2008-08-19 20:26   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-08-19 20:17   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-08-19 20:17   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\OpenOffice.org2
2008-08-19 20:16   ---------   d-----w   C:\Program Files\lg_fwupdate
2008-08-19 18:01   ---------   d-----w   C:\Program Files\eMule
2008-08-19 15:46   196,608   ----a-w   C:\WINDOWS\system32\drivers\nStandard.bin
2008-08-18 17:42   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-08-18 15:28   ---------   d-----w   C:\Program Files\Codemasters
2008-08-18 14:47   19,821   ----a-w   C:\Program Files\Common Files\viga._sy
2008-08-18 14:47   18,854   ----a-w   C:\Program Files\Common Files\owibakygiz.dl
2008-08-13 21:09   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-08-13 16:15   ---------   d-----w   C:\Program Files\DOSBox-0.63
2008-08-09 20:01   ---------   d-----w   C:\Program Files\FlashGet
2008-08-06 10:05   ---------   d-----w   C:\Program Files\Electronic Arts
2008-07-27 17:40   ---------   d-----w   C:\Program Files\LucasArts
2008-07-20 20:18   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\teamspeak2
2008-07-18 16:49   ---------   d-----w   C:\Program Files\Nuclear Coffee
2008-07-16 15:17   ---------   d-----w   C:\Program Files\Ubisoft
2008-07-16 15:17   ---------   d-----w   C:\Program Files\Strategy First
2008-07-11 21:19   ---------   d-----w   C:\Program Files\JoWooD
2008-07-11 18:20   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\SPORE Creature Creator
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-06 22:19   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\Ulead Systems
2008-07-06 21:35   ---------   d-----w   C:\Program Files\Windows Media Components
2008-07-06 21:35   ---------   d-----w   C:\Program Files\Common Files\InterVideo
2008-07-06 20:39   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\GetRightToGo
2008-07-05 07:38   ---------   d-----w   C:\Program Files\Common Files\Blizzard Entertainment
2008-07-04 18:26   ---------   d-----w   C:\Program Files\GraveLand.pl
2008-06-24 16:24   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-23 16:42   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-06-23 12:01   107,888   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2008-06-20 17:42   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45   360,320   ------w   C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44   138,368   ------w   C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52   225,920   ------w   C:\WINDOWS\system32\drivers\tcpip6.sys
2008-05-23 10:08   22,328   ----a-w   C:\Documents and Settings\user\Dane aplikacji\PnkBstrK.sys
2008-05-23 10:08   103,736   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-05-23 10:07   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2007-12-03 20:09   32   ----a-w   C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2006-06-23 22:48   32,768   ----a-r   C:\WINDOWS\inf\UpdateUSB.exe
.

------- Sigcheck -------

2004-08-04 00:44  504832  0344407089b08548d4feba62bb0f32d0   C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2007-08-02 14:00  506880  051a52001d625f316ce81a539bd25192   C:\WINDOWS\system32\winlogon.exe
2007-08-02 14:00  506880  051a52001d625f316ce81a539bd25192   C:\WINDOWS\system32\dllcache\winlogon.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 13:39 21760296]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 06:17 81920]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 10:37 380928]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 16:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 23:55 54832]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2007-11-29 15:14 249856]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-09 20:18 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 14:11 267048]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-07-23 13:55 341232]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-08-02 14:00 15360]

C:\Documents and Settings\user\Menu Start\Programy\Autostart\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 15:41:28 393216]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2008-03-31 03:40:57 882176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Miranda IM\\miranda32.exe"=
"C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"D:\\Program Files\\eMule\\emule.exe"=
"D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Cryo\\SAGA\\Saga.exe"=
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"E:\\WoW-2.0.0-enUS-Installer-downloader.exe"=
"D:\\WoW-2.0.0-enGB-Installer-downloader.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\WormsForts\\WormsForts\\WF.exe"=
"C:\\Sierra\\Counter-Strike\\cstrike.exe"=
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"E:\\Program Files\\thq\\RelicCOH.exe"=
"E:\\Program Files\\Cyanide\\Loki\\Loki.exe"=
"E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-05-31 15:29]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 08:12]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-05-31 15:29]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\user\USTAWI~1\Temp\gAGP440p.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0042907c-ad4f-11dc-998f-000e5055283a}]
\Shell\Auto\command - I:\UFO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56d796e3-9e7c-11dc-b013-001d605588d1}]
\Shell\AutoRun\command - F:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cfac2b2-cb76-11dc-b179-000e5055283a}]
\Shell\Auto\command - H:\UFO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c39e75b0-aa80-11dc-9987-000e5055283a}]
\Shell\AutoRun\command - 6x8be16.cmd
\Shell\explore\Command - 6x8be16.cmd
\Shell\open\Command - 6x8be16.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4dde4f6-024f-11dd-b665-000e5055283a}]
\Shell\Auto\command - UFO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\igsqnlhh.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 22:27:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-19 22:30:04
ComboFix-quarantined-files.txt  2008-08-19 20:29:58

Pre-Run: 10,535,170,048 bajtów wolnych
Post-Run: 13,587,816,448 bajtów wolnych

251   --- E O F ---   2008-08-15 01:01:31


[wojtas]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0042907c-ad4f-11dc-998f-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cfac2b2-cb76-11dc-b179-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c39e75b0-aa80-11dc-9987-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4dde4f6-024f-11dd-b665-000e5055283a}]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\WINDOWS\alimani.db
C:\WINDOWS\jobefexijy.exe
C:\WINDOWS\gukizoco.exe
C:\WINDOWS\pahurova.scr
C:\WINDOWS\system32\suzato._dl
C:\Documents and Settings\user\Dane aplikacji\ywuq.dat
C:\WINDOWS\ihoceja.db
C:\WINDOWS\uwylevo._dl
C:\WINDOWS\system32\apyk.com
C:\Program Files\Common Files\gijoqefy.pif
C:\WINDOWS\wamed.exe
C:\WINDOWS\heho._sy
C:\WINDOWS\system32\winstra2.exe
C:\atm.dll
C:\SDFix
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\WS2Fix.exe

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Po całej operacji należy zresetować komputer i wracasz z logami

[Rubid]

Po naciśnięciu przycisku moveit w programie Ot moveit avasta znalazła wirusa i zawiesiła program czy tak miało byc?

[alamakota]

W takim razie na czas usuwania wyłącz avast`a.

[Rubid]

oraz nie moge wprowadzić tej cześci

Kod: Zaznacz wszystko

C:\atm.dll
C:\SDFix
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\WS2Fix.exe

Zawiesza sie na atm.dill

[wojtas]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0042907c-ad4f-11dc-998f-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cfac2b2-cb76-11dc-b179-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c39e75b0-aa80-11dc-9987-000e5055283a}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4dde4f6-024f-11dd-b665-000e5055283a}]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

i daj nowe logi

[Rubid]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36:37, on 2008-08-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Miranda IM\miranda32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5202CF8-D539-4DE9-8301-EBBE12B5BCB1}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9169 bytes


Kod: Zaznacz wszystko

ComboFix 08-08-19.03 - user 2008-08-20 21:38:42.4 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1434 [GMT 2:00]
Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-07-20 to 2008-08-20  )))))))))))))))))))))))))))))))
.

2008-08-20 12:43 . 2008-08-20 12:43   <DIR>   d--------   C:\_OTMoveIt
2008-08-20 03:13 . 2008-08-20 03:13   <DIR>   d--------   C:\Program Files\MegauploadToolbar
2008-08-20 03:13 . 2008-08-20 03:13   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Megaupload
2008-08-20 02:56 . 2008-08-20 02:56   <DIR>   d--------   C:\Program Files\Megaupload
2008-08-20 02:56 . 2008-08-20 03:18   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\MegauploadToolbar
2008-08-20 02:56 . 2008-08-20 02:56   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\Megaupload
2008-08-20 02:56 . 2008-08-20 02:56   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\EmailNotifier
2008-08-20 02:56 . 2008-08-20 03:13   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\EmailNotifier
2008-08-19 00:39 . 2008-08-19 00:39   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-08-19 00:35 . 2008-08-19 00:56   <DIR>   d--------   C:\SDFix
2008-08-19 00:30 . 2008-08-19 00:30   3,636   --a------   C:\WINDOWS\system32\tmp.reg
2008-08-19 00:16 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-08-19 00:16 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-08-19 00:16 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-08-19 00:16 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-08-19 00:16 . 2008-08-14 21:52   82,432   --a------   C:\WINDOWS\system32\IEDFix.C.exe
2008-08-19 00:16 . 2008-08-18 12:19   82,432   --a------   C:\WINDOWS\system32\404Fix.exe
2008-08-19 00:16 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-08-19 00:16 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-08-19 00:16 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-08-18 23:13 . 2008-08-18 23:13   <DIR>   d--------   C:\Program Files\Trend Micro
2008-08-18 19:43 . 2008-08-18 19:43   45,768   --a------   C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-08-18 17:29 . 2008-08-18 17:29   4,096   --a------   C:\WINDOWS\d3dx.dat
2008-08-18 16:47 . 2008-08-18 16:47   19,726   --a------   C:\Documents and Settings\user\Dane aplikacji\kutifynoge.com
2008-08-18 16:35 . 2008-08-18 16:35   69,632   --a------   C:\atm.dll
2008-08-18 14:51 . 2008-08-18 14:51   <DIR>   d--------   C:\WINDOWS\Farm Frenzy 2
2008-08-18 13:21 . 2008-08-18 14:21   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\FarmFrenzy2
2008-08-18 05:24 . 2008-08-18 05:24   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\PlayFirst
2008-08-18 05:24 . 2008-08-18 05:24   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst
2008-08-18 04:45 . 2008-08-18 04:55   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\VirtualFarm
2008-08-18 03:21 . 2008-08-18 14:27   <DIR>   d--------   C:\Program Files\Alawar
2008-08-18 03:21 . 2008-08-18 04:21   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Farm Frenzy
2008-08-13 23:09 . 2008-08-13 23:09   <DIR>   d--------   C:\Program Files\Ulead Systems
2008-08-13 21:57 . 2008-08-13 23:10   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2008-08-13 21:54 . 2008-08-13 21:54   <DIR>   d--------   C:\Program Files\MagicISO
2008-08-11 14:42 . 2008-08-11 15:38   <DIR>   d--------   C:\Program Files\D-Fend
2008-08-11 14:31 . 2008-08-11 14:31   <DIR>   d--------   C:\LONGSOFT
2008-08-10 01:33 . 2008-08-10 12:44   <DIR>   d--------   C:\Program Files\Fish Tycoon
2008-08-10 01:04 . 2008-08-10 01:04   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\Summer Athletics 2008
2008-08-10 01:02 . 2007-10-12 15:14   3,734,536   --a------   C:\WINDOWS\system32\d3dx9_36.dll
2008-08-10 01:02 . 2007-10-12 15:14   1,374,232   --a------   C:\WINDOWS\system32\D3DCompiler_36.dll
2008-08-10 01:02 . 2007-10-02 09:56   444,776   --a------   C:\WINDOWS\system32\d3dx10_36.dll
2008-08-10 01:02 . 2007-10-22 03:39   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
2008-08-09 19:38 . 2008-08-09 19:38   122   --a------   C:\WINDOWS\kaillera.ini
2008-08-07 21:52 . 2008-08-09 19:37   <DIR>   d--------   C:\Downloads
2008-08-07 21:48 . 2008-08-07 21:48   <DIR>   d--------   C:\Documents and Settings\user\Dane aplikacji\FlashGet
2008-07-29 17:07 . 2008-07-29 17:07   <DIR>   d--------   C:\Program Files\FLStudio4
2008-07-29 17:07 . 2002-07-08 00:14   1,294,336   --a------   C:\WINDOWS\system32\vorbis.acm
2008-07-27 18:19 . 2008-07-27 18:19   <DIR>   d--------   C:\Program Files\Lineage II
2008-07-24 12:11 . 2008-07-24 12:17   <DIR>   d--------   C:\WINDOWS\NV2963560.TMP
2008-07-22 19:32 . 2008-07-22 19:35   <DIR>   d--------   C:\Program Files\Switlle
2008-07-22 19:26 . 2008-07-22 19:32   <DIR>   d--------   C:\Program Files\GameTop.com
2008-07-22 19:25 . 2008-08-19 02:42   <DIR>   d--------   C:\games

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-20 19:42   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-08-20 19:34   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\Skype
2008-08-20 19:33   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-08-20 19:33   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\OpenOffice.org2
2008-08-20 19:32   ---------   d-----w   C:\Program Files\lg_fwupdate
2008-08-20 12:42   196,608   ----a-w   C:\WINDOWS\system32\drivers\nStandard.bin
2008-08-20 11:56   ---------   d-----w   C:\Program Files\eMule
2008-08-20 00:56   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-08-18 15:28   ---------   d-----w   C:\Program Files\Codemasters
2008-08-18 14:47   19,821   ----a-w   C:\Program Files\Common Files\viga._sy
2008-08-18 14:47   18,854   ----a-w   C:\Program Files\Common Files\owibakygiz.dl
2008-08-13 21:09   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-08-13 16:15   ---------   d-----w   C:\Program Files\DOSBox-0.63
2008-08-09 20:01   ---------   d-----w   C:\Program Files\FlashGet
2008-08-06 10:05   ---------   d-----w   C:\Program Files\Electronic Arts
2008-07-27 17:40   ---------   d-----w   C:\Program Files\LucasArts
2008-07-20 20:18   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\teamspeak2
2008-07-18 16:49   ---------   d-----w   C:\Program Files\Nuclear Coffee
2008-07-16 15:17   ---------   d-----w   C:\Program Files\Ubisoft
2008-07-16 15:17   ---------   d-----w   C:\Program Files\Strategy First
2008-07-11 21:19   ---------   d-----w   C:\Program Files\JoWooD
2008-07-11 18:20   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\SPORE Creature Creator
2008-07-07 20:33   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-06 22:19   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\Ulead Systems
2008-07-06 21:35   ---------   d-----w   C:\Program Files\Windows Media Components
2008-07-06 21:35   ---------   d-----w   C:\Program Files\Common Files\InterVideo
2008-07-06 20:39   ---------   d-----w   C:\Documents and Settings\user\Dane aplikacji\GetRightToGo
2008-07-05 07:38   ---------   d-----w   C:\Program Files\Common Files\Blizzard Entertainment
2008-07-04 18:26   ---------   d-----w   C:\Program Files\GraveLand.pl
2008-06-24 16:24   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-23 16:42   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-06-23 12:01   107,888   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2008-06-20 17:42   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45   360,320   ------w   C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44   138,368   ------w   C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52   225,920   ------w   C:\WINDOWS\system32\drivers\tcpip6.sys
2008-05-23 10:08   22,328   ----a-w   C:\Documents and Settings\user\Dane aplikacji\PnkBstrK.sys
2008-05-23 10:08   103,736   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-05-23 10:07   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2007-12-03 20:09   32   ----a-w   C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2006-06-23 22:48   32,768   ----a-r   C:\WINDOWS\inf\UpdateUSB.exe
.

------- Sigcheck -------

2004-08-04 00:44  504832  0344407089b08548d4feba62bb0f32d0   C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2007-08-02 14:00  506880  051a52001d625f316ce81a539bd25192   C:\WINDOWS\system32\winlogon.exe
2007-08-02 14:00  506880  051a52001d625f316ce81a539bd25192   C:\WINDOWS\system32\dllcache\winlogon.exe
.
(((((((((((((((((((((((((((((   snapshot@2008-08-19_22.29.13.32   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-18 20:32:23   188,028   ----a-w   C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat
+ 2008-08-18 20:32:23   188,028   ----a-w   C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat.bak
+ 2003-03-18 19:12:12   1,047,552   ----a-w   C:\WINDOWS\system32\mfc71u.dll
- 2008-08-19 20:19:55   165,974   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-08-20 19:36:05   167,486   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-08-19 20:19:55   217,928   ----a-w   C:\WINDOWS\system32\perfc015.dat
+ 2008-08-20 19:36:05   219,944   ----a-w   C:\WINDOWS\system32\perfc015.dat
- 2008-08-19 20:19:55   635,492   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-08-20 19:36:05   638,156   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-08-19 20:19:55   778,908   ----a-w   C:\WINDOWS\system32\perfh015.dat
+ 2008-08-20 19:36:05   782,976   ----a-w   C:\WINDOWS\system32\perfh015.dat
- 2008-05-03 00:18:55   25,372   ----a-w   C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-08-20 01:08:19   195,688   ----a-w   C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-08-20 19:31:58   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_588.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]
2008-08-04 22:44   1947080   --a------   C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 22:44 1947080]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 22:44 1947080]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 13:39 21760296]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 06:17 81920]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 10:37 380928]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 16:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 23:55 54832]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2007-11-29 15:14 249856]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-09 20:18 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 14:11 267048]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-07-23 13:55 341232]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-08-02 14:00 15360]

C:\Documents and Settings\user\Menu Start\Programy\Autostart\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 15:41:28 393216]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2008-03-31 03:40:57 882176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Miranda IM\\miranda32.exe"=
"C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"D:\\Program Files\\eMule\\emule.exe"=
"D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Cryo\\SAGA\\Saga.exe"=
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"E:\\WoW-2.0.0-enUS-Installer-downloader.exe"=
"D:\\WoW-2.0.0-enGB-Installer-downloader.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\WormsForts\\WormsForts\\WF.exe"=
"C:\\Sierra\\Counter-Strike\\cstrike.exe"=
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"E:\\Program Files\\thq\\RelicCOH.exe"=
"E:\\Program Files\\Cyanide\\Loki\\Loki.exe"=
"E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-05-31 15:29]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 08:12]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-05-31 15:29]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\user\USTAWI~1\Temp\gAGP440p.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56d796e3-9e7c-11dc-b013-001d605588d1}]
\Shell\AutoRun\command - F:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\igsqnlhh.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 21:43:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-20 21:45:41
ComboFix-quarantined-files.txt  2008-08-20 19:45:35
ComboFix2.txt  2008-08-19 20:30:06

Pre-Run: 13,367,033,856 bajtów wolnych
Post-Run: 13,354,823,680 bajtów wolnych

240   --- E O F ---   2008-08-15 01:01:31


Kod: Zaznacz wszystko

[b]SDFix: Version 1.217 [/b]
Run by user on 2008-08-20 at 23:32

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 23:43:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f7,7b,eb,6a,1c,28,de,d5,fb,0b,d8,02,37,f4,36,e1,01,a0,b5,a1,72,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:54,f3,11,2b,05,e4,bd,76,ff,19,af,4a,41,3b,e4,e6,f0,63,9b,39,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f7,7b,eb,6a,1c,28,de,d5,fb,0b,d8,02,37,f4,36,e1,01,a0,b5,a1,72,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3d,ae,5b,d5,c2,55,86,95,a6,e9,a0,1b,4b,93,90,08,99,ee,06,d0,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:47,b0,49,ba,a0,70,61,0e,95,cf,02,98,9e,a7,84,c7,8e,b1,be,c4,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:70,c3,ff,e8,65,55,0d,8b,13,90,88,31,0e,b4,08,e0,b2,9f,e5,b3,5b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:09,71,d6,ab,36,5c,d9,5d,02,77,89,0b,50,09,e3,3b,54,4b,62,bd,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:37,4b,50,de,0b,9f,c1,e4,78,4d,c9,ce,e2,d0,13,f0,ae,2f,e5,97,d5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:c1,17,ae,a8,58,6a,da,aa,9c,ff,82,bd,0a,a6,7a,b5,a6,07,b3,71,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:37,4b,50,de,0b,9f,c1,e4,78,4d,c9,ce,e2,d0,13,f0,ae,2f,e5,97,d5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:f7,81,9e,89,d3,31,77,e2,75,78,25,a0,5a,54,92,1a,bf,e2,ad,d0,a3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:71,95,0b,bb,61,f7,d6,2b,a2,52,f8,7c,f0,cb,1d,32,98,5c,a0,ad,38,..
"p0"="C:\Program Files\DAEMON Tools Pro\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,9f,c9,ef,f0,de,0d,0a,61,73,5b,20,b9,21,0d,26,db,c1,..
"hdf12"=hex:47,b0,49,ba,a0,70,61,0e,95,cf,02,98,9e,a7,84,c7,8e,b1,be,c4,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,3d,b0,e7,f0,da,88,83,bf,05,85,44,02,ea,02,45,61,40,..
"hdf12"=hex:70,c3,ff,e8,65,55,0d,8b,13,90,88,31,0e,b4,08,e0,b2,9f,e5,b3,5b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:82,18,0e,dd,9a,fa,11,3b,92,a5,6d,5f,51,9d,44,e3,6e,87,8b,d9,3c,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"="C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\\Program Files\\Miranda IM\\miranda32.exe"="C:\\Program Files\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM"
"C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"="C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe:*:Enabled:Supreme Commander"
"C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"="C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="D:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:BF2"
"C:\\Program Files\\BitTornado\\btdownloadgui.exe"="C:\\Program Files\\BitTornado\\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Cryo\\SAGA\\Saga.exe"="C:\\Program Files\\Cryo\\SAGA\\Saga.exe:*:Enabled:Dreked"
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"="C:\\Program Files\\THQ\\Dawn of War\\W40k.exe:*:Enabled:W40K"
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe:*:Enabled:DarkCrusade"
"C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"="C:\\Program Files\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe:*:Enabled:WarhammerR: Mark of Chaost"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"E:\\WoW-2.0.0-enUS-Installer-downloader.exe"="E:\\WoW-2.0.0-enUS-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\WoW-2.0.0-enGB-Installer-downloader.exe"="D:\\WoW-2.0.0-enGB-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"="C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe:*:Enabled:Soulstorm"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"D:\\WormsForts\\WormsForts\\WF.exe"="D:\\WormsForts\\WormsForts\\WF.exe:*:Enabled:WF"
"C:\\Sierra\\Counter-Strike\\cstrike.exe"="C:\\Sierra\\Counter-Strike\\cstrike.exe:*:Enabled:CounterStrike Launcher"
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"="E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM)"
"E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"="E:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe:*:Enabled:etqwded.exe"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"E:\\Program Files\\thq\\RelicCOH.exe"="E:\\Program Files\\thq\\RelicCOH.exe:*:Enabled:Company of Heroes - Opposing Fronts"
"E:\\Program Files\\Cyanide\\Loki\\Loki.exe"="E:\\Program Files\\Cyanide\\Loki\\Loki.exe:*:Enabled:Loki"
"E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"="E:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe:*:Enabled:Loki - AutoRun"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sun 16 Dec 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 19 Aug 2005       121,237 A..HR --- "C:\Program Files\THQ\Dawn of War\Disk1Check.EXE"
Thu 29 Nov 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu  8 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT1.tmp"

[b]Finished![/b]



[huber2t]

fix w hijackthis

O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL

Otwórz notatnik i wklej do niego:

Kod: Zaznacz wszystko

Driver::
gAGP440p


Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na wklej.eu , http://wklejto.pl lub na http://wklej.org a w poście dajesz tylko link

[Rubid]

http://wklejto.pl/8492

[huber2t]

Log wyglada na czysty

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!