Jak mam sie pozbyc tego wirusa?

[M.Hart (Michal Hartman)]

No więc tak, chciałem sobie zobaczyć jakiś fajny filmik na jakiejś stronie (dałbym linka, ale nie pamiętam adresu, a historię wykasowałem), patrzę - żeby odtworzyć trzeba ściągnąć jakiś ActiveX. Ja, n00b, JESZCZE nie wiem, co to jest, ściągam, instaluję, na drugi dzien wlaczam kompa mam wirusa. Próbowałem to usuwać Spybotem, Dalej wywala mi komunikaty o trojanie i pojawiają mi się podejrzane linki do programów antywirusowych Czy ktoś może mi pomóc?

A to skan z HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 16:34:07, on 2007-11-13

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe

C:\Program Files\Common Files\YourPrivacyGuard\mc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\ATKKBService.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\GameSpy\Comrade\Comrade.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\NEOSTR~1\neostradatp.exe

C:\PROGRA~1\NEOSTR~1\ComComp.exe

C:\PROGRA~1\NEOSTR~1\Toaster.exe

C:\PROGRA~1\NEOSTR~1\Inactivity.exe

C:\PROGRA~1\NEOSTR~1\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\NEOSTR~1\Watch.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\M.Hartman\Desktop\dss.exe

C:\DOCUME~1\MC2F4~1.HAR\Desktop\HIJACK~1\M.Hartman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll

O2 - BHO: MSVPS System - {D5375315-6567-4DCA-8344-C78AA4B89C11} - C:\WINDOWS\oprevfqv.dll

O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll

O3 - Toolbar: The bonsws - {E3ED01B7-EAF2-4A33-989C-B95E65DA0415} - C:\WINDOWS\bonsws.dll

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM…\Run: [salestart] “C:\Program Files\Common Files\YourPrivacyGuard\mc.exe” dm=http://yourprivacyguard.com;’>http://yourprivacyguard.com; ad=http://yourprivacyguard.com

O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [bitTorrent] “C:\Program Files\BitTorrent\bittorrent.exe” --force_start_minimized

O4 - HKCU…\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 8193965578

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup … 1066365437

O17 - HKLM\System\CCS\Services\Tcpip…{6BC74059-9CBD-4199-BADA-4B1F8848B3C1}: NameServer = 194.204.159.1 217.98.63.164

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: ddkret - {179D7EE0-37FA-4E00-B12E-1CCFE20108EC} - C:\WINDOWS\ddkret.dll

O21 - SSODL: nopctrl - {FF21F71B-FF1C-4DE9-BB4E-6A94B493149D} - C:\WINDOWS\nopctrl.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

[LostWorld]

Pobierz : SmitFraudFix

Tryb numer 2 i wklejasz raport **(C:\SmitfraudFix.txt).**Oczywiście w trybie awaryjnym.

[Gutek]

Po SmitFraudFix - Daj log z ComboFix

[M.Hart (Michal Hartman)]

Raport z SmitFraudFix :

SmitFraudFix v2.252 Scan done at 21:24:47.60, 2007-11-13 Run from C:\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri’s WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CS2\Services\Tcpip…{6BC74059-9CBD-4199-BADA-4B1F8848B3C1}: NameServer=194.204.159.1 217.98.63.164 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning not selected. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End Raport z ComboFix: ComboFix 07-11-08.1 - Michal 2007-11-13 21:26:20.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.800 [GMT 1:00] Running from: C:\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\All Users\Application Data.\salesmonitor C:\Documents and Settings\All Users\Documents\MCE Logs\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\My Playlists\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists[u]0[/u]00FD354\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists[u]0[/u]00FD354\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Music\Sync Playlists\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Pictures\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Desktop_.ini C:\Documents and Settings\All Users\Documents\My Videos\Desktop_.ini C:\Documents and Settings\All Users\Documents\Recorded TV\Desktop_.ini C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\Desktop_.ini C:\WINDOWS\dat.txt C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\rs.txt . ((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))) . 2007-11-13 21:02 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-13 17:22 2,244 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-13 15:56 Co teraz mam zrobic?? [color=green]Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE Pozdrawiam Gutek2222 [/color]

[Gutek]

Najpierw automat później jeszcze raz log z Combo(po automacie)

Pobierz program SDFix

[M.Hart (Michal Hartman)]

SDFix: Version 1.114 Run by Michal on 2007-11-13 at 23:38 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\Program Files\RichVideoCodec\Uninstall.exe - Deleted C:\WINDOWS\bonsws.dll - Deleted C:\WINDOWS\ddkret.dll - Deleted C:\WINDOWS\nopctrl.dll - Deleted C:\WINDOWS\sawkip.exe - Deleted Folder C:\Program Files\RichVideoCodec - Removed Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-13 23:47:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:76e915d5 “s2”=dword:1dae4f66 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] scanning hidden registry entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 18 Apr 2007 68,586 A.SHR — “C:\Documents and Settings\All Users\Documents\Games.exe” Tue 13 Nov 2007 0 A…H. — “C:\Documents and Settings\M.H\Local Settings\Temp\BITB0.tmp” Thu 4 Apr 2002 23,040 A…H. — “C:\Documents and Settings\M.H\My Documents\Kuba~WRL0224.tmp” Thu 20 Sep 2007 0 A…H. — “C:\WINDOWS\SoftwareDistribution\Download\8d097da1e8c89a333191843e23dfc161\BIT2.tmp” Mon 14 Nov 2005 29,854,720 A…H. — “C:\Documents and Settings\M.H\My Documents\Iwona\Praca~WRL0004.tmp” Sat 13 Oct 2007 313,731 A…H. — “C:\Deckard\System Scanner\backup\DOCUME~1\MC2F4~1.HAR\LOCALS~1\Temp\BIT4E8.tmp” Sat 13 Oct 2007 313,731 A…H. — “C:\Deckard\System Scanner\backup\DOCUME~1\MC2F4~1.HAR\LOCALS~1\Temp\BIT4EC.tmp” Sat 13 Oct 2007 313,731 A…H. — “C:\Deckard\System Scanner\backup\DOCUME~1\MC2F4~1.HAR\LOCALS~1\Temp\BIT4F9.tmp” Wed 8 Aug 2007 85,946 A…H. — “C:\Deckard\System Scanner\backup\DOCUME~1\MC2F4~1.HAR\LOCALS~1\Temp\BIT71E.tmp” Finished!

[Gutek]

Teraz log z Combo proszę

[M.Hart (Michal Hartman)]

ComboFix 07-11-08.1 - Michl 2007-11-14 15:49:01.3 - NTFSx86 MINIMAL Running from: C:\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-14 to 2007-11-14 ))))))))))))))))))))))))))))))) . 2007-11-13 23:37 2007-11-13 22:51 2007-11-13 22:50 2007-11-13 22:50 2007-11-13 22:50 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-13 22:50 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-13 22:50 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-13 22:50 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-13 22:50 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-13 21:02 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-13 17:22 2,244 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-13 15:56 2007-11-13 15:51 2007-11-08 18:47 2007-10-20 19:51 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-14 14:47 1,042 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err 2007-11-14 14:43 --------- d-----w C:\Program Files\neostrada tp 2007-11-13 21:48 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-13 21:48 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-13 14:45 --------- d-----w C:\Documents and Settings\M.H\Application Data\Skype 2007-11-08 17:47 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-02 00:55 --------- d-----w C:\Documents and Settings\M.H\Application Data\BitTorrent 2007-10-22 01:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll 2007-10-22 01:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll 2007-10-12 18:09 --------- d-----w C:\Program Files\Omni-Bot 2007-10-12 13:14 3,734,536 ----a-w C:\WINDOWS\system32\d3dx9_36.dll 2007-10-12 13:14 1,374,232 ----a-w C:\WINDOWS\system32\D3DCompiler_36.dll 2007-10-02 07:56 444,776 ----a-w C:\WINDOWS\system32\d3dx10_36.dll 2007-09-18 09:41 --------- d-----w C:\Documents and Settings\M.Hartman\Application Data\InstallShield 2007-08-24 00:50 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-16 09:57 417,792 ----a-w C:\Documents and Settings\M.H\GL4JavbJauGljJNI14.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-13_21.07.21,12 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-13 09:21:41 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-11-13 22:37:37 5,873,664 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT + 2007-11-13 22:37:37 368,640 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2007-11-13 09:21:41 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-11-13 22:37:22 5,873,664 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT + 2007-11-13 22:37:22 368,640 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat - 2007-11-13 17:01:31 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-13 22:49:27 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-13 17:01:31 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-13 22:49:27 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat - 2006-01-09 08:36:06 40,960 ----a-w C:\WINDOWS\system32\swsc.exe + 2006-11-29 16:21:29 370,688 ----a-w C:\WINDOWS\system32\swsc.exe - 2006-12-01 04:20:34 79,360 ----a-w C:\WINDOWS\system32\swxcacls.exe + 2006-12-01 04:20:32 212,480 ----a-w C:\WINDOWS\system32\swxcacls.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 13:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 15:55] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-08-11 14:43] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-19 10:39] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] “MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2004-08-10 13:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-10 13:00] “Gadu-Gadu”=“D:\Gadu-Gadu\gg.exe” [2007-01-30 15:58] “BitTorrent”=“C:\Program Files\BitTorrent\bittorrent.exe” [2007-03-02 00:11] “Comrade.exe”=“C:\Program Files\GameSpy\Comrade\Comrade.exe” [2007-05-27 03:19] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “InstallVisualStyle”=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles “InstallTheme”=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^M.Hartman^Start Menu^Programs^Startup^MagicDisc.lnk] path=C:\Documents and Settings\M.Hartman\Start Menu\Programs\Startup\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^M.Hartman^Start Menu^Programs^Startup^UniSpiker-2.6.lnk] path=C:\Documents and Settings\M.Hartman\Start Menu\Programs\Startup\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] “C:\Program Files\BitTorrent\bittorrent.exe” --force_start_minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray] “C:\Program Files\Creative\Shared Files\CamTray.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] “D:\D-Tools\daemon.exe” -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Expressivo] “C:\Program Files\ivo\Expressivo\expressivo.exe” -t [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCDEmuApp.exe] D:\PowerISO\SCDEmuApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys S3 ASPI;Advanced SCSI Programming Interface Driver;??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 NETDLWL;D-Link Air Wireless Adapter(DL) NT Driver;C:\WINDOWS\system32\DRIVERS\NETDLWL.SYS S3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3649cbe7-bb89-11db-8701-000e50f3c58a}] \Shell\AutoRun\command - H:\Autorun.exe . Contents of the ‘Scheduled Tasks’ folder “2007-11-13 13:54:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe “2007-05-17 16:43:05 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1171388588.job” - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-14 15:50:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-14 15:51:37 C:\ComboFix2.txt … 2007-11-13 21:28 . — E O F —

[Gutek]

Już powinno być Ok

[M.Hart (Michal Hartman)]

Dzieki wielkie za pomoc Gutek2222 i Lost World :mrgreen:

Juz jest wszystko ok