Zrobiłem wszystko tak jak kazałeś. Z mojego punktu widzenia, nic się nie zmieniło. Ale proszę, oto log`i:
Hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54:11, on 2007-11-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\umonit.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
E:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
E:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
E:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Dawid\Pulpit\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {586D31F0-EB52-4EE1-BB58-4889278A704C} - C:\WINDOWS\system32\ddayw.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: {6f33f0d5-ffcd-c67a-ba74-4c782d62521f} - {f12526d2-87c4-47ab-a76c-dcff5d0f33f6} - C:\WINDOWS\system32\iqwkjagw.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\oysztwiy.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "E:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "E:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [d06553e3] rundll32.exe "C:\WINDOWS\system32\srksuulx.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitComet] "E:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\xvjqdikm.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 6352 bytes
Combofix
ComboFix 07-11-08.1 - Dawid 2007-11-15 18:56:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.196 [GMT 1:00]
Running from: C:\Documents and Settings\Dawid\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Pulpit\Live Safety Center.lnk
C:\Documents and Settings\Administrator\Pulpit\Online Security Guide.lnk
C:\Documents and Settings\Administrator\Ulubione\Online Security Guide.lnk
C:\Documents and Settings\All Users\Menu Start\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Start\Online Security Guide.lnk
C:\Documents and Settings\Dawid\Pulpit\Live Safety Center.lnk
C:\Documents and Settings\Dawid\Pulpit\Online Security Guide.lnk
C:\Documents and Settings\Dawid\Ulubione\Online Security Guide.lnk
C:\WINDOWS\system32\oysztwiy.dllbox
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.
2007-11-15 18:24 79,936 --a------ C:\WINDOWS\system32\iqwkjagw.dll
2007-11-15 18:21 85,056 --a------ C:\WINDOWS\system32\srksuulx.dll
2007-11-15 18:19 71,232 --a------ C:\WINDOWS\system32\igmaxeui.exe
2007-11-15 18:16 71,232 --a------ C:\WINDOWS\system32\hjxbgilw.exe
2007-11-15 18:13 85,056 --a------ C:\WINDOWS\system32\vgkkmaxf.dll
2007-11-15 18:11 <DIR> d-------- C:\VundoFix Backups
2007-11-15 18:10 71,232 --a------ C:\WINDOWS\system32\tmfhgsln.exe
2007-11-15 18:08 3,110 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-15 18:06 71,232 --a------ C:\WINDOWS\system32\ncouanyc.exe
2007-11-15 18:02 85,056 --a------ C:\WINDOWS\system32\mcjvskhl.dll
2007-11-15 17:59 79,936 --a------ C:\WINDOWS\system32\lmmpesjw.dll
2007-11-15 17:53 71,232 --a------ C:\WINDOWS\system32\xvjqdikm.exe
2007-11-15 16:56 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-14 19:49 71,232 --a------ C:\WINDOWS\system32\ifstlwmi.exe
2007-11-14 19:46 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-11-14 19:46 298,104 --a------ C:\WINDOWS\system32\imon.dll
2007-11-14 19:46 79,424 --a------ C:\WINDOWS\system32\kwpwvkjc.dll
2007-11-14 19:46 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-11-14 19:43 85,056 --a------ C:\WINDOWS\system32\ktnogrhm.dll
2007-11-14 19:37 79,424 --a------ C:\WINDOWS\system32\qpwsdpiq.dll
2007-11-14 17:52 100,881 ---hs---- C:\WINDOWS\system32\wyadd.ini2
2007-11-14 16:35 <DIR> d-------- C:\WINDOWS\system32\%BlstFolder%
2007-11-14 16:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2007-11-13 18:00 80,448 --a------ C:\WINDOWS\system32\yentjaor.dll
2007-11-13 17:02 1,422 --a------ C:\Documents and Settings\Dawid\clean.reg
2007-11-13 16:54 <DIR> d-------- C:\WINDOWS\ERUNT
2007-11-13 16:49 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-11-13 16:49 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2007-11-13 16:49 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2007-11-13 16:49 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2007-11-13 16:49 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2007-11-13 16:49 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2007-11-13 16:49 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2007-11-13 16:02 144,480 --a------ C:\WINDOWS\system32\oysztwiy.dll.vir
2007-11-13 16:01 144,480 --a------ C:\WINDOWS\system32\hkkuqdmc.dll
2007-11-13 15:55 80,448 --a------ C:\WINDOWS\system32\uvrwjvdc.dll
2007-11-11 08:44 79,936 --a------ C:\WINDOWS\system32\awphfqum.dll
2007-11-11 08:42 100,628 ---hs---- C:\WINDOWS\system32\wyadd.bak2
2007-11-10 18:43 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-11-10 18:43 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-10 15:47 36,352 --a------ C:\WINDOWS\system32\cbxxuro.dll
2007-11-10 15:47 6,470 ---hs---- C:\WINDOWS\system32\wyadd.bak1
2007-11-10 15:46 319,072 --------- C:\WINDOWS\system32\ddayw.dll
2007-11-10 15:45 36,352 --a------ C:\WINDOWS\system32\xxyyyvs.dll
2007-11-10 15:45 36,352 --a------ C:\WINDOWS\system32\khfdefd.dll
2007-11-10 15:42 36,352 --a------ C:\WINDOWS\system32\vturqro.dll
2007-11-10 15:41 36,352 --a------ C:\WINDOWS\system32\qomkiih.dll.vir
2007-11-10 14:32 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\temp
2007-11-01 22:58 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-11-01 22:56 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-11-01 22:56 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-11-01 22:56 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-10-28 12:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2007-10-28 12:00 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-27 09:48 <DIR> d-------- C:\Downloads
2007-10-27 09:48 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\GetRightToGo
2007-10-26 17:16 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-10-26 17:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-10-26 17:10 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\Winamp
2007-10-26 14:44 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\Megaupload
2007-10-26 14:19 304,640 --a------ C:\WINDOWS\IsUn0415.exe
2007-10-20 18:04 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-10-19 12:24 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\Publish Providers
2007-10-19 12:21 <DIR> d-------- C:\Program Files\Microsoft SQL Server
2007-10-19 12:21 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\Sony
2007-10-19 12:21 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll
2007-10-19 12:21 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll
2007-10-19 12:20 <DIR> d-------- C:\Program Files\Vstplugins
2007-10-19 12:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony
2007-10-19 12:07 <DIR> d-------- C:\Documents and Settings\Dawid\Dane aplikacji\Sony Setup
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-11 08:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-02 22:33 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Skype
2007-11-01 16:31 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\dvdcss
2007-10-28 11:01 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-20 11:29 --------- d-----w C:\Program Files\DivX
2007-10-15 18:21 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Hamachi
2007-10-07 15:27 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Teleca
2007-10-07 15:26 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-10-07 15:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2007-10-07 15:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2007-10-07 15:22 6,144 ----a-w C:\WINDOWS\system32\drivers\k750cm.sys
2007-10-07 15:22 5,744 ----a-w C:\WINDOWS\system32\drivers\k750wh.sys
2007-10-07 15:22 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-07 11:23 --------- d-----w C:\Program Files\Skype
2007-10-07 11:23 --------- d-----w C:\Program Files\Common Files\Skype
2007-10-07 11:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-10-03 18:36 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\SopCast
2007-10-02 11:59 --------- d-----w C:\Program Files\Intel Desktop Board
2007-09-30 09:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-09-28 19:38 25,544 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-27 16:46 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Apple Computer
2007-09-27 16:43 --------- d-----w C:\Program Files\Apple Software Update
2007-09-27 16:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-09-27 16:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-09-25 11:49 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-25 11:47 --------- d-----w C:\Program Files\Ahead
2007-09-24 19:32 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Media Player Classic
2007-09-24 17:51 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Microsoft Web Folders
2007-09-24 17:50 --------- d-----w C:\Program Files\microsoft frontpage
2007-09-23 15:27 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\vlc
2007-09-23 15:18 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\DAEMON Tools Pro
2007-09-23 15:13 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-23 15:09 --------- d-----w C:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu
2007-09-23 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-09-23 14:37 --------- d-----w C:\Program Files\Windows Journal Viewer
2007-09-23 14:37 --------- d-----w C:\Program Files\Java
2007-09-23 14:37 --------- d-----w C:\Program Files\Common Files\Java
2007-09-23 14:32 --------- d-----w C:\Program Files\AMD
2007-09-23 14:28 --------- d-----w C:\Program Files\Realtek AC97
2007-09-23 14:26 --------- d-----w C:\Program Files\Gigabyte
2007-09-23 12:44 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((( snapshot@2007-11-15_17.04.46.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-13 09:21:41 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-11-13 22:40:48 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
- 2007-11-13 15:54:14 3,981,312 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2007-11-15 17:41:21 815,104 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2007-11-13 15:54:14 32,768 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-11-15 17:41:21 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CC14938-8420-44F8-AAE6-9B88FB72EAE8}]
2007-11-10 15:46 319072 --------- C:\WINDOWS\system32\ddayw.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f12526d2-87c4-47ab-a76c-dcff5d0f33f6}]
2007-11-15 18:24 79936 --a------ C:\WINDOWS\system32\iqwkjagw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]
[HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]
[HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 16:20]
"nwiz"="nwiz.exe" [2005-06-15 16:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 16:20]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 20:42 C:\WINDOWS\SOUNDMAN.EXE]
"UMonit"="C:\WINDOWS\system32\umonit.exe" [2003-08-21 16:47]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 21:05]
"DAEMON Tools"="E:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"QuickTime Task"="E:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"BearShare"="E:\Program Files\BearShare\BearShare.exe" []
"Sony Ericsson PC Suite"="E:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17]
"WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"d06553e3"="C:\WINDOWS\system32\srksuulx.dll" [2007-11-15 18:21]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-14 19:46]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"BitComet"="E:\Program Files\BitComet\BitComet.exe" [2006-02-13 18:02]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 23:55]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:20:56]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddayw.dll
R3 fixustor;fixustor;C:\WINDOWS\system32\drivers\fixustor.sys
R3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
.
Contents of the 'Scheduled Tasks' folder
"2007-11-10 14:53:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 19:00:21
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-15 19:01:54 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-15 17:05
.
--- E O F ---
Oto log z hijack`a, jeśli trzeba , mogę wkleić również log`a z combofix`a.
