Połączenie z serwerem zostało zresetowane

[system]

Dzisiaj pojawil mi sie dziwny komunikat Ale tylko gdy wchodze na strone rapidshare.com inne chodzą normalnie. W Firefoxie jak w IE jest to samo Strona nawet sie nie ładuje odrazu wywala komunikat :

"Przerwane połączenie

Połączenie z serwerem zostało zresetowane podczas wczytywania strony.

Połączenie sieciowe zostało przerwane podczas negocjacji. Spróbuj ponownie."

Wklejam loga z hijacka

Logfile of HijackThis v1.99.1 Scan saved at 19:58:02, on 2008-08-08 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Documents and Settings\Szef\Pulpit\launch.exe C:\DOCUME~1\Szef\USTAWI~1\Temp\RarSFX0_start.exe C:\DOCUME~1\Szef\USTAWI~1\Temp\RarSFX0\setup.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Szef\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL F2 - REG:system.ini: Shell= F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O4 - HKLM…\Run: [startCCC] “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM…\Run: [egui] “C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” /hide /waitservice O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [CTSyncU.exe] “C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [wsctf.exe] wsctf.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

[nj1 (nj_)]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/

 R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

 O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)

O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe

 O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

fix w hjt

daj loga z combofixa

[system]

ComboFix 08-08-08.04 - Szef 2008-08-08 20:22:54.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1310 [GMT 2:00] Running from: C:\Documents and Settings\Szef\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 ))))))))))))))))))))))))))))))) . 2008-08-08 18:59 . 2008-08-08 19:14 2008-08-08 18:38 . 2008-08-08 18:38 2008-08-05 22:36 . 2008-08-05 22:36 2008-08-05 22:35 . 2008-08-05 22:43 2008-08-05 22:35 . 2008-08-05 22:35 2008-08-05 22:35 . 2008-08-08 17:45 2008-08-04 14:54 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-04 14:54 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-08-04 14:53 . 2008-08-04 14:53 2008-08-04 14:53 . 2008-08-04 14:53 2008-08-03 22:38 . 2008-08-03 22:49 2008-08-03 22:05 . 2008-08-03 22:05 2008-08-03 21:58 . 2008-08-03 21:59 2008-08-03 21:58 . 2008-08-03 21:58 2008-08-03 21:55 . 2008-08-03 21:55 2008-08-03 21:55 . 1999-08-31 13:36 335,872 --a------ C:\WINDOWS\system32\msaudio.ocx 2008-08-03 21:49 . 2008-08-03 21:49 2008-08-03 21:49 . 2008-08-03 21:49 43,698 --a------ C:\WINDOWS\system32\xvid-uninstall.exe 2008-08-03 21:48 . 2008-08-03 21:48 2008-08-03 21:48 . 2008-08-03 21:49 2008-08-03 21:33 . 2008-04-14 00:16 51,200 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2008-08-03 21:33 . 2008-04-14 00:16 51,200 --a–c— C:\WINDOWS\system32\dllcache\msdv.sys 2008-08-03 21:33 . 2008-04-14 00:16 38,912 --a------ C:\WINDOWS\system32\drivers\avc.sys 2008-08-03 21:33 . 2008-04-14 00:16 38,912 --a–c— C:\WINDOWS\system32\dllcache\avc.sys 2008-08-03 21:32 . 2008-04-14 00:16 48,128 --a------ C:\WINDOWS\system32\drivers\61883.sys 2008-08-03 21:32 . 2008-04-14 00:16 48,128 --a–c— C:\WINDOWS\system32\dllcache\61883.sys 2008-07-27 05:55 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS 2008-07-27 05:55 . 2001-08-17 21:56 7,552 --a–c— C:\WINDOWS\system32\dllcache\sonypvu1.sys 2008-07-24 09:41 . 2008-07-24 09:58 2008-07-24 09:25 . 2008-08-08 20:24 2008-07-24 09:25 . 2008-07-18 15:23 732,888 -ra------ C:\WINDOWS\system32\drivers\cfosspeed.sys 2008-07-24 09:25 . 2008-07-18 15:23 290,008 --a------ C:\WINDOWS\system32\cfosspeed.dll 2008-07-22 15:13 . 2008-08-05 17:35 76 --a------ C:\WINDOWS\Route.INI 2008-07-22 15:03 . 2008-07-22 15:05 2008-07-09 17:24 . 2008-08-05 17:33 2008-07-09 17:23 . 2008-07-09 17:23 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-08 16:57 --------- d-----w C:\Program Files\FlashGet 2008-08-08 14:51 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2008-08-06 10:29 --------- d-----w C:\Documents and Settings\Szef\Dane aplikacji\Image Zone Express 2008-08-04 13:15 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-08-02 15:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-07-31 08:58 --------- d-----w C:\Documents and Settings\Szef\Dane aplikacji\Skype 2008-07-31 08:17 --------- d-----w C:\Documents and Settings\Szef\Dane aplikacji\skypePM 2008-07-10 21:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search Destroy 2008-07-01 12:13 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-29 12:13 --------- d-----w C:\Program Files\Real Alternative 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 13:05 --------- d-----w C:\Program Files\Spybot - Search Destroy 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-14 17:36 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 16:56 34,312 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys 2008-06-10 16:48 53,256 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys 2008-06-10 16:47 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys 2008-05-17 17:24 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-17 17:22 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-05-11 15:57 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-05-09 10:56 90,112 ----a-w C:\WINDOWS\system32\wshext.dll 2008-05-09 10:56 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll 2008-05-09 10:56 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll 2008-05-09 10:56 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe 2008-03-31 19:53 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-04-29 17:09 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008042920080430\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-07-24_10.48.42.78 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-20 16:44:19 65,536 ----a-r C:\WINDOWS\Installer{30C19FF2-7FBA-4D09-B9DE-1659977F64F6}\NewShortcut1.A6CC6977_F7B4_4C0B_9510_BCD847D4BDB2.exe + 2008-08-06 10:28:19 65,536 ----a-r C:\WINDOWS\Installer{30C19FF2-7FBA-4D09-B9DE-1659977F64F6}\NewShortcut1.A6CC6977_F7B4_4C0B_9510_BCD847D4BDB2.exe + 2008-08-04 12:53:52 10,134 ----a-r C:\WINDOWS\Installer{EC9E8EAA-2F25-4265-A77B-DA3AE3FF8EC3}\callmsi.exe + 2008-08-04 12:53:52 136,448 ----a-r C:\WINDOWS\Installer{EC9E8EAA-2F25-4265-A77B-DA3AE3FF8EC3}\egui.exe + 2006-12-31 02:16:36 313,344 ----a-w C:\WINDOWS\system32\avisynth.dll - 2008-04-14 20:51:12 139,264 ----a-w C:\WINDOWS\system32\cscript.exe + 2008-05-07 09:07:23 135,168 ----a-w C:\WINDOWS\system32\cscript.exe + 2004-05-26 12:37:34 719,872 ----a-w C:\WINDOWS\system32\devil.dll + 2008-06-20 11:40:08 138,496 -c----w C:\WINDOWS\system32\dllcache\afd.sys + 2008-05-07 09:07:23 135,168 -c----w C:\WINDOWS\system32\dllcache\cscript.exe + 2008-06-20 17:48:53 147,968 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll + 2008-05-09 10:56:45 512,000 -c----w C:\WINDOWS\system32\dllcache\jscript.dll + 2008-06-20 17:48:53 246,784 -c----w C:\WINDOWS\system32\dllcache\mswsock.dll + 2008-05-09 10:56:45 180,224 -c----w C:\WINDOWS\system32\dllcache\scrobj.dll + 2008-05-09 10:56:45 172,032 -c----w C:\WINDOWS\system32\dllcache\scrrun.dll + 2008-06-20 11:51:12 361,600 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys + 2008-06-20 11:08:27 225,856 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys + 2008-05-09 10:56:45 430,080 -c----w C:\WINDOWS\system32\dllcache\vbscript.dll + 2008-05-08 11:24:44 155,648 -c----w C:\WINDOWS\system32\dllcache\wscript.exe + 2008-05-09 10:56:45 90,112 -c----w C:\WINDOWS\system32\dllcache\wshext.dll - 2008-04-14 20:50:28 147,968 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2008-06-20 17:48:53 147,968 ----a-w C:\WINDOWS\system32\dnsapi.dll - 2008-04-29 17:10:06 1,557,336 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-08-04 09:24:25 1,557,360 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2008-04-14 20:50:36 512,000 ----a-w C:\WINDOWS\system32\jscript.dll + 2008-05-09 10:56:45 512,000 ----a-w C:\WINDOWS\system32\jscript.dll - 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-11-30 11:21:28 19,320 ------w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 12:40:46 19,320 ------w C:\WINDOWS\system32\spmsg.dll - 2007-09-04 15:56:10 164,352 ----a-w C:\WINDOWS\system32\unrar.dll + 2002-10-15 22:54:04 153,088 ----a-w C:\WINDOWS\system32\unrar.dll + 2002-12-11 08:19:32 368,640 ----a-w C:\WINDOWS\system32\vobsub.dll . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] “{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}”= “C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL” [2008-08-05 22:35 66912] [HKEY_CLASSES_ROOT\clsid{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE~\Browser Helper Objects{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-08-05 22:35 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2008-04-14 22:51 15360] “CTSyncU.exe”=“C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe” [2006-08-07 10:06 700416] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2008-03-20 12:04 2127296] “wsctf.exe”=“wsctf.exe” [bU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “StartCCC”=“C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2006-11-10 13:35 90112] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2007-03-01 16:57 153136] “cFosSpeed”=“C:\Program Files\cFosSpeed\cFosSpeed.exe” [2008-07-18 15:23 867544] “egui”=“C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” [2008-06-10 18:52 1447168] “RTHDCPL”=“RTHDCPL.EXE” [2007-03-21 08:49 16126464 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2008-04-14 22:51 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “vidc.asv2”= asusasv2.dll HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD] --a------ 2007-10-23 18:48 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-06-01 11:21 153136 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-03-14 13:55 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a------ 2007-09-25 10:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] --a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 22:51 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-06 18:21 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusDisableNotify”=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] “DisableMonitoring”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “C:\Program Files\Gadu-Gadu\gg.exe”= “E:\Gry\TestDriver\TestDriveUnlimited.exe”= “C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe”= “C:\Program Files\FlashGet\flashget.exe”= “C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”= “C:\Program Files\Microsoft Office\Office12\GROOVE.EXE”= “C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= “C:\Program Files\Bonjour\mDNSResponder.exe”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “E:\Gry\Call of Duty 4 - Modern Warfare\iw3mp.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”= “C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”= “C:\Program Files\HP\Digital Imaging\bin\hposid01.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”= “C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe”= “C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe”= “C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”= “C:\Program Files\EA Sports\UEFA EURO 2008\EURO08.exe”= “C:\Program Files\Skype\Phone\Skype.exe”= “C:\Program Files\Vuze\Azureus.exe”= R1 EIO_XP;EIO_XP;C:\WINDOWS\system32\drivers\EIO_XP.sys [2006-06-14 14:44] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56] R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-10-23 18:48] R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18:12] R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-10-23 18:48] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2006-03-02 14:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{310d7e4a-072c-11dd-9a8a-001d607a4536}] \Shell\AutoRun\command - K:\EXPLORER.EXE \Shell\explore\Command - K:\EXPLORER.EXE \Shell\open\Command - K:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{56e99918-4678-11dd-9ba8-001d607a4536}] \Shell\AutoRun\command - K:\EXPLORER.EXE \Shell\explore\Command - K:\EXPLORER.EXE \Shell\open\Command - K:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{5f239630-4f3d-11dd-9bd5-001d607a4536}] \Shell\AutoRun\command - K:\EXPLORER.EXE \Shell\explore\Command - K:\EXPLORER.EXE \Shell\open\Command - K:\ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{d18daa9a-5b8f-11dd-9bec-001d607a4536}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - K:\ \Shell\open\Command - K:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f3418091-4ac2-11dd-9bb9-001d607a4536}] \Shell\AutoRun\command - K:\EXPLORER.EXE \Shell\explore\Command - K:\EXPLORER.EXE \Shell\open\Command - K:\EXPLORER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}] “C:\Program Files\Common Files\LightScribe\LSRunOnce.exe” . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Szef\Dane aplikacji\Mozilla\Firefox\Profiles\ja6fccze.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.wp.pl/ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-08 20:24:27 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-08 20:25:09 ComboFix-quarantined-files.txt 2008-08-08 18:25:05 ComboFix2.txt 2008-07-24 08:52:38 ComboFix3.txt 2008-07-24 08:48:59 ComboFix4.txt 2008-03-30 13:43:46 Pre-Run: 20,433,514,496 bajtów wolnych Post-Run: 20,482,068,480 bajtów wolnych 249 — E O F — 2008-08-06 10:27:35

[Gutek]

DAEMON Tools Lite odinstaluj.

Wklej do Notatnika:

Folder::

C:\Program Files\AskSBar


Registry::

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"=-

[-HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16t=253052

[system]

to samo cały czas… LOG : http://wklejto.pl/7586

[Gutek]

Jak masz podłączonego pendriva to użyj:

-BitDefender Pica Removal Tool

• PRT (Perlovga Removal Tool)

Opis - TUTAJ

Dodatkowo skan http://www.kaspersky.pl/virusscanner.html