Pomocy, wyskakuje mi ciągle jedna i ta sama strona internet

[K_A]

Pomocy, nie moge zupełnie korzystac z internetu, po kliknięciu na link wskakuje mi ciągle jakaś stronka,

wklejam logi i bardzo prosze o pomoc

Logfile of HijackThis v1.99.1 Scan saved at 23:54:15, on 2007-05-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\svhost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe E:\Corel\programs\MFIndexer.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\K i A rulez\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://64.28.180.123/privacyASP.php R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [net32] C:\WINDOWS\svhost.exe O4 - HKCU…\Run: [VoipStunt] “C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe” -nosplash -minimized O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [bitComet] “C:\Program Files\BitComet\BitComet.exe” /tray O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = E:\Corel\programs\MFIndexer.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O16 - DPF: {1F831FAC-42FC-11D4-95A6-0080AD30DCE1} (NOXLATE) - file://E:\AutoCad\InstFred.ocx O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday) - file://E:\AutoCad\AcDcToday.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\AutoCad\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{90B6712C-62FE-4795-9E46-1742F8A97D7B}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{946D2946-0389-4F5B-886E-E3B90FBD1555}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{EB30B5CD-3776-4C16-A1CA-414AA06FEDD9}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O17 - HKLM\System\CS1\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O17 - HKLM\System\CS2\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Klient DNS DnscacheThemes (DnscacheThemes) - Unknown owner - C:\WINDOWS\system32\adsldpb.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “VoipStunt” = ““C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe” -nosplash -minimized” [file not found] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “BitComet” = ““C:\Program Files\BitComet\BitComet.exe” /tray” [“www.BitComet.com”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “eMuleAutoStart” = “D:\eMule\emule.exe -AutoStart” [“http://www.emule-project.net”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “SkyTel” = “SkyTel.EXE” [“Realtek Semiconductor Corp.”] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “RemoteControl” = ““C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] “net32” = “C:\WINDOWS\svhost.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [file not found] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}(Default) = (no title provided) -> {HKLM…CLSID} = “Skype add-on (mastermind)” \InProcServer32(Default) = “C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL” [“Skype Technologies S.A.”] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}(Default) = “BitComet ClickCapture” -> {HKLM…CLSID} = “BitComet Helper” \InProcServer32(Default) = “C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll” [“BitComet”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{0A082D00-EC93-11D0-B1E6-80580BC10627}” = “Corel Media Folder Root Menu Handler” -> {HKLM…CLSID} = “Corel Media Folder Root Menu Handler” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” = “Folder To Corel Media Folder Menu Handler” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{854AF161-1AE1-11D1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{E856F161-1AE5-11d1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{CDB89701-262F-11D1-AB9C-00C0F00683EB}” = “Corel Media Find Folder” -> {HKLM…CLSID} = “Corel Media Find Folder” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{F8152501-455F-11D1-B1E6-444553540000}” = “Corel Media Folder Copy Hook Handler” -> {HKLM…CLSID} = “Corel Media Folder Copy Hook Handler” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] “{8E524B0D-04F0-11D1-B74A-00A0C90646A4}” = “IconFactTemp.NSIconHandlerFactory” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “E:\Corel\programs\CNSFlt80.dll” [“Corel Corporation”] “{A2AC368A-F883-11D0-B745-00A0C90646A4}” = “NSFiltManDll.FiltManCom” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “E:\Corel\programs\CNSFlt80.dll” [“Corel Corporation”] “{B63FCD5A-2396-11D1-B762-00A0C90646A4}” = “*f” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “E:\Corel\programs\CMFFnd80.dll” [“Corel Corporation”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <> “System” = “kdqqf.exe” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “E:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder(Default) = “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “E:\Corel\programs\CMFFld80.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “E:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\K i A rulez\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “K i A rulez” & “All Users” startup folders: ------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “BlueSoleil” -> shortcut to: “C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe” [“IVT Corporation”] “Corel MEDIA FOLDERS INDEXER 8” -> shortcut to: "E:\Corel\programs\MFIndexer.exe " [“Corel Corporation”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {77BF5300-1474-4EC7-9980-D32B190E9B07}\ “ButtonText” = “Skype” “CLSIDExtension” = “{77BF5300-1474-4EC7-9980-D32B190E9B07}” -> {HKLM…CLSID} = “Skype add-on (button)” \InProcServer32(Default) = “C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL” [“Skype Technologies S.A.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] BlueSoleil Hid Service, BlueSoleil Hid Service, “C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe” [null data] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 32 seconds, including 10 seconds for message boxes)] Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE Pozdrawiam Gutek2222

[Gutek]

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O4 - HKLM…\Run: [net32] C:\WINDOWS\svhost.exe O17 - HKLM\System\CCS\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{90B6712C-62FE-4795-9E46-1742F8A97D7B}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{946D2946-0389-4F5B-886E-E3B90FBD1555}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip…{EB30B5CD-3776-4C16-A1CA-414AA06FEDD9}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O17 - HKLM\System\CS1\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O17 - HKLM\System\CS2\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86 O23 - Service: Klient DNS DnscacheThemes (DnscacheThemes) - Unknown owner - C:\WINDOWS\system32\adsldpb.exe

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz Klient DNS DnscacheThemes Usuń wpisy HJT, a pliki ręcznie

Daj log z Combofix

[K_A]

[“K i A rulez” - 2007-05-20 0:40:26 Dodatek Service Pack 2

ComboFix 07-05.20.3.V - Running from: “C:\Documents and Settings\K i A rulez\Pulpit”

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\vxgamet1.exe

C:\WINDOWS\system32\kernels64.exe

C:\WINDOWS\x.exe

C:\WINDOWS\y.exe

C:\WINDOWS\svhost.exe

C:\WINDOWS\system32\kdqqf.exe

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-20 ))))))))))))))))))))))))))))))))))

2007-05-18 20:44 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2007-05-18 20:44 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2007-05-18 20:44 129,784 --------- C:\WINDOWS\system32\pxafs.dll

2007-05-18 20:44

2007-05-18 20:43

2007-05-18 20:29

2007-05-18 20:29

2007-05-18 20:28 4,109,584 --a------ C:\Program Files\gg77.exe

2007-05-18 20:17

2007-05-14 20:24 31,204 -r-hs---- C:\WINDOWS\system32\adsldpb.exe

2007-05-12 17:33

2007-05-09 17:41 32,660 -r-hs---- C:\WINDOWS\system32\12520850x.exe

2007-04-30 17:13 29,188 -r-hs---- C:\WINDOWS\system32\1041b.exe

2007-04-30 08:26 427 --ahs---- C:\WINDOWS\system32\1625399423.dat

2007-04-30 08:26 28,516 -r-hs---- C:\WINDOWS\system32\acctresv.exe

2007-04-27 20:02

2007-04-20 19:33

2007-04-20 19:18 71,168 --------- C:\WINDOWS\system32\3dviewer.dll

2007-04-20 19:18 532,240 -ra------ C:\WINDOWS\system32\MSEXCH35.DLL

2007-04-20 19:18 403,216 -ra------ C:\WINDOWS\system32\MSREPL35.DLL

2007-04-20 19:18 37,136 -ra------ C:\WINDOWS\system32\MSJINT35.DLL

2007-04-20 19:18 368,912 -ra------ C:\WINDOWS\system32\VBAR332.DLL

2007-04-20 19:18 290,816 -ra------ C:\WINDOWS\system32\MSXBSE35.DLL

2007-04-20 19:18 254,976 -ra------ C:\WINDOWS\system32\MSEXCL35.DLL

2007-04-20 19:18 253,952 -ra------ C:\WINDOWS\system32\MSPDOX35.DLL

2007-04-20 19:18 251,664 -ra------ C:\WINDOWS\system32\MSRD2X35.DLL

2007-04-20 19:18 24,336 -ra------ C:\WINDOWS\system32\MSJTER35.DLL

2007-04-20 19:18 169,984 -ra------ C:\WINDOWS\system32\MSLTUS35.DLL

2007-04-20 19:18 166,912 -ra------ C:\WINDOWS\system32\MSTEXT35.DLL

2007-04-20 19:18 1,039,360 -ra------ C:\WINDOWS\system32\MSJET35.DLL

2007-04-20 19:17 960,000 --------- C:\WINDOWS\system32\evysh7.dll

2007-04-20 19:17 553,984 --------- C:\WINDOWS\system32\rave.dll

2007-04-20 19:17 411,136 --------- C:\WINDOWS\system32\scint78.dll

2007-04-20 19:17 32,768 --------- C:\WINDOWS\system32\cmgr32.dll

2007-04-20 19:17 108,032 --------- C:\WINDOWS\system32\sh33w32.dll

2007-04-20 19:16 909,312 --------- C:\WINDOWS\system32\qd3d.dll

2007-04-20 19:16 39,095 --------- C:\WINDOWS\iccsigs.dat

2007-04-20 19:16 345,600 --------- C:\WINDOWS\system32\qtim32.dll

2007-04-20 19:15 90,112 --------- C:\WINDOWS\system32\evysh7us.dll

2007-04-20 19:11

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-19 22:42:41 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Skype

2007-05-17 12:03:08 -------- d-----w C:\Program Files\Google

2007-05-12 15:41:45 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-05-12 15:41:30 -------- d–h--w C:\Program Files\InstallShield Installation Information

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-18 13:38:28 -------- d-----w C:\Program Files\Common Files\InstallShield

2007-04-14 16:33:05 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Google

2007-04-14 16:20:28 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll

2007-04-14 16:20:21 -------- d-----w C:\Program Files\BitComet

2007-03-31 19:18:01 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Autodesk

2007-03-31 19:17:12 -------- d-----w C:\Program Files\Common Files\WexTech Shared

2007-03-31 19:17:11 -------- d-----w C:\Program Files\WexTech

2007-03-31 19:17:11 -------- d-----w C:\Program Files\Common Files\LHSPF

2007-03-31 19:16:55 47 ----a-w C:\AUTOEXEC.BAT

2007-03-31 19:16:55 -------- d-----w C:\Program Files\Common Files\Autodesk Shared

2007-03-25 17:42:04 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat

2007-03-25 17:42:04 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat

2007-03-24 19:01:35 -------- d-----w C:\Program Files\Elaborate Bytes

2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys

2007-02-13 19:03:32 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll

2007-02-13 19:03:25 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll

2007-02-13 19:03:04 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll

2007-02-13 19:03:01 45,056 ----a-w C:\WINDOWS\system32\ogg.dll

2007-02-13 19:03:00 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll

2007-02-13 19:02:28 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll

2007-02-13 19:02:24 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll

2007-02-13 19:02:00 765,952 ----a-w C:\WINDOWS\system32\xvidcore.dll

2007-02-13 18:00:07 1,493,863 ----a-w C:\Program Files\ALLPlayer.exe

2007-02-12 20:54:26 4 ----a-w C:\WINDOWS\system32\stfv.bin

2007-02-12 12:05:04 29,184 ----a-w C:\WINDOWS\system32\perfont.exe

2007-02-12 12:05:04 24,064 ----a-w C:\WINDOWS\system32\msmsn.exe

2007-02-12 12:05:04 22,784 ----a-w C:\WINDOWS\system32\netstat2.exe

2007-02-12 12:05:04 10,240 ----a-w C:\WINDOWS\system32\winmuse.exe

2007-02-12 12:05:03 9,472 ----a-w C:\WINDOWS\system32\mpsegment.exe

2007-02-12 12:05:03 8,704 ----a-w C:\WINDOWS\system32\performent202.dll

2007-02-12 12:05:03 32,256 ----a-w C:\WINDOWS\system32\anti_troj.exe

2007-02-12 12:05:03 20,736 ----a-w C:\WINDOWS\system32\POPCORN72.EXE

2007-02-12 12:05:03 18,432 ----a-w C:\WINDOWS\system32\dload.exe

2007-02-12 12:05:03 15,616 ----a-w C:\WINDOWS\system32\proqlaim.exe

2007-02-12 12:05:03 15,360 ----a-w C:\WINDOWS\system32\iewd.exe

2007-02-12 12:05:02 20,736 ----a-w C:\WINDOWS\system32\win32hp.dll

2007-02-12 12:05:02 19,968 ----a-w C:\WINDOWS\system32\VXH8JKDQ6.EXE

2007-02-12 12:05:02 12,288 ----a-w C:\WINDOWS\system32\VXH8JKDQ2.EXE

2007-02-12 12:05:00 25,600 ----a-w C:\WINDOWS\spp3.dll

2007-02-12 12:04:57 8,960 ----a-w C:\WINDOWS\wininet32.exe

2007-02-12 12:04:57 29,184 ----a-w C:\WINDOWS\dialup.exe

2007-02-12 12:04:57 14,848 ----a-w C:\WINDOWS\xplugin.dll

2007-02-12 12:04:57 10,752 ----a-w C:\WINDOWS\runwin32.exe

2007-02-12 12:04:56 32,768 ----a-w C:\WINDOWS\win32e.exe

2007-02-12 12:04:56 27,904 ----a-w C:\WINDOWS\systemcritical.exe

2007-02-12 12:04:56 19,456 ----a-w C:\WINDOWS\time.exe

2007-02-12 12:04:56 15,360 ----a-w C:\WINDOWS\win64.exe

2007-02-12 12:04:56 14,336 ----a-w C:\WINDOWS\users32.exe

2007-02-12 12:04:56 13,568 ----a-w C:\WINDOWS\waol.exe

2007-02-12 12:04:56 11,520 ----a-w C:\WINDOWS\winajbm.dll

2007-02-12 12:04:56 10,752 ----a-w C:\WINDOWS\winmgnt.exe

2007-02-12 12:04:56 10,496 ----a-w C:\WINDOWS\window.exe

2007-02-12 12:04:55 30,208 ----a-w C:\WINDOWS\cpan.dll

2007-02-12 12:04:55 27,648 ----a-w C:\WINDOWS\olehelp.exe

2007-02-12 12:04:55 23,552 ----a-w C:\WINDOWS\avpcc.dll

2007-02-12 12:04:55 14,080 ----a-w C:\WINDOWS\notepad32.exe

2007-02-12 12:04:55 13,568 ----a-w C:\WINDOWS\clrssn.exe

2007-02-12 12:04:55 13,056 ----a-w C:\WINDOWS\systeem.exe

2007-02-12 12:04:55 11,776 ----a-w C:\WINDOWS\mtwirl32.dll

2007-02-12 12:04:54 17,664 ----a-w C:\WINDOWS\accesss.exe

2007-02-12 12:04:54 13,312 ----a-w C:\WINDOWS\system32\ace16win.dll

2007-02-12 12:04:54 13,056 ----a-w C:\WINDOWS\inetdctr.dll

2007-02-12 12:03:51 12 ----a-w C:\WINDOWS\system32\oiso.bin

2007-02-12 12:03:51 0 ----a-w C:\WINDOWS\system32\lfd.dat

2007-02-11 12:06:23 9,453,630 ----a-w C:\Program Files\vlc-0.8.6a-win32.exe

2007-02-10 11:41:19 20,888 ----a-w C:\DOCUME~1\KIARUL~1\DANEAP~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]

{22BF413B-C6D2-4d91-82A9-A0F997BA588C}=C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL [2006-12-18 18:30]

{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll [2007-03-29 16:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42]

“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-06-01 11:22]

“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-06-01 11:22]

“SkyTel”=“SkyTel.EXE” []

“RTHDCPL”=“RTHDCPL.EXE” []

“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 21:24]

“nwiz”=“nwiz.exe” [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 12:50]

“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“VoipStunt”=“C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe” []

“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-12-18 18:32]

“BitComet”=“C:\Program Files\BitComet\BitComet.exe” [2007-04-03 20:04]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 16:36]

“eMuleAutoStart”=“D:\eMule\emule.exe” [2006-09-14 16:15]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070520-003832-459

O23 - Service: Klient DNS DnscacheThemes (DnscacheThemes) - Unknown owner - C:\WINDOWS\system32\adsldpb.exe

backup-20070520-003832-936

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86

backup-20070520-003832-441

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86

backup-20070520-003832-448

O17 - HKLM\System\CS1\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86

backup-20070520-003832-313

O17 - HKLM\System\CCS\Services\Tcpip…{946D2946-0389-4F5B-886E-E3B90FBD1555}: NameServer = 85.255.116.50,85.255.112.86

backup-20070520-003832-281

O4 - HKLM…\Run: [net32] C:\WINDOWS\svhost.exe

backup-20070520-003832-491

O17 - HKLM\System\CCS\Services\Tcpip…{90B6712C-62FE-4795-9E46-1742F8A97D7B}: NameServer = 85.255.116.50,85.255.112.86

backup-20070520-003832-501

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

backup-20070520-003832-580

O17 - HKLM\System\CCS\Services\Tcpip…{EB30B5CD-3776-4C16-A1CA-414AA06FEDD9}: NameServer = 85.255.116.50,85.255.112.86

backup-20070520-003832-676

O17 - HKLM\System\CCS\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86

backup-20070520-003832-779

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.50 85.255.112.86

backup-20070520-003832-856

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

backup-20070520-003832-196

O17 - HKLM\System\CS2\Services\Tcpip…{1365A766-A3C5-4EF1-9EB6-52BC6A236214}: NameServer = 85.255.116.50,85.255.112.86

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-20 00:42:14

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

********************************************************************

Completion time: 2007-05-20 0:43:21 - machine was rebooted

C:\ComboFix-quarantined-files.txt … 2007-05-20 00:43

— E O F —]

nie wiem tylko jak mam usunąć te pliki recznie?

sorki ale nie bardzo znam sie

[Gutek]

O23 - Service: Klient DNS DnscacheThemes (DnscacheThemes) - Unknown owner - C:\WINDOWS\system32\adsldpb.exe

w sumie tego nie znam?

C:\WINDOWS\system32\12520850x.exe C:\WINDOWS\system32\1041b.exe C:\WINDOWS\system32\1625399423.dat C:\WINDOWS\system32\acctresv.exe C:\WINDOWS\system32\win32hp.dll C:\WINDOWS\system32\VXH8JKDQ6.EXE C:\WINDOWS\system32\VXH8JKDQ2.EXE C:\WINDOWS\spp3.dll C:\WINDOWS\wininet32.exe C:\WINDOWS\dialup.exe C:\WINDOWS\xplugin.dll C:\WINDOWS\runwin32.exe C:\WINDOWS\win32e.exe C:\WINDOWS\systemcritical.exe C:\WINDOWS\time.exe C:\WINDOWS\win64.exe C:\WINDOWS\users32.exe C:\WINDOWS\waol.exe C:\WINDOWS\winajbm.dll C:\WINDOWS\winmgnt.exe C:\WINDOWS\window.exe C:\WINDOWS\cpan.dll C:\WINDOWS\olehelp.exe C:\WINDOWS\avpcc.dll C:\WINDOWS\notepad32.exe C:\WINDOWS\clrssn.exe C:\WINDOWS\systeem.exe C:\WINDOWS\mtwirl32.dll C:\WINDOWS\accesss.exe C:\WINDOWS\system32\ace16win.dll C:\WINDOWS\inetdctr.dll :\WINDOWS\system32\oiso.bin C:\WINDOWS\system32\lfd.dat C:\Program Files\vlc-0.8.6a-win32.exe

w try bie awaryjnym szukasz plików i usuwasz ręcznie wskazane pliki

[K_A]

dzięki za pomoc,

usunęłam ręcznie pliki, ale svhost.exe i adsldpb.exe komputer nie odnalazł

mam nadzieję, że teraz będzie dobrze działał.

wielkie dzięki!

[Gutek]

Daj nowe logi z Combo

[K_A]

[“K i A rulez” - 2007-05-20 18:49:47 Dodatek Service Pack 2

ComboFix 07-05.20.3.V - Running from: “C:\Documents and Settings\K i A rulez\Pulpit\dobre programy”

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-20 ))))))))))))))))))))))))))))))))))

2007-05-20 11:58 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 00:43 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-05-18 20:44 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2007-05-18 20:44 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2007-05-18 20:44 129,784 --------- C:\WINDOWS\system32\pxafs.dll

2007-05-18 20:44

2007-05-18 20:43

2007-05-18 20:29

2007-05-18 20:29

2007-05-18 20:28 4,109,584 --a------ C:\Program Files\gg77.exe

2007-05-18 20:17

2007-05-14 20:24 31,204 -r-hs---- C:\WINDOWS\system32\adsldpb.exe

2007-05-12 17:33

2007-05-09 17:41 32,660 -r-hs---- C:\WINDOWS\system32\12520850x.exe

2007-04-30 17:13 29,188 -r-hs---- C:\WINDOWS\system32\1041b.exe

2007-04-30 08:26 427 --ahs---- C:\WINDOWS\system32\1625399423.dat

2007-04-30 08:26 28,516 -r-hs---- C:\WINDOWS\system32\acctresv.exe

2007-04-27 20:02

2007-04-20 19:33

2007-04-20 19:18 71,168 --------- C:\WINDOWS\system32\3dviewer.dll

2007-04-20 19:18 532,240 -ra------ C:\WINDOWS\system32\MSEXCH35.DLL

2007-04-20 19:18 403,216 -ra------ C:\WINDOWS\system32\MSREPL35.DLL

2007-04-20 19:18 37,136 -ra------ C:\WINDOWS\system32\MSJINT35.DLL

2007-04-20 19:18 368,912 -ra------ C:\WINDOWS\system32\VBAR332.DLL

2007-04-20 19:18 290,816 -ra------ C:\WINDOWS\system32\MSXBSE35.DLL

2007-04-20 19:18 254,976 -ra------ C:\WINDOWS\system32\MSEXCL35.DLL

2007-04-20 19:18 253,952 -ra------ C:\WINDOWS\system32\MSPDOX35.DLL

2007-04-20 19:18 251,664 -ra------ C:\WINDOWS\system32\MSRD2X35.DLL

2007-04-20 19:18 24,336 -ra------ C:\WINDOWS\system32\MSJTER35.DLL

2007-04-20 19:18 169,984 -ra------ C:\WINDOWS\system32\MSLTUS35.DLL

2007-04-20 19:18 166,912 -ra------ C:\WINDOWS\system32\MSTEXT35.DLL

2007-04-20 19:18 1,039,360 -ra------ C:\WINDOWS\system32\MSJET35.DLL

2007-04-20 19:17 960,000 --------- C:\WINDOWS\system32\evysh7.dll

2007-04-20 19:17 553,984 --------- C:\WINDOWS\system32\rave.dll

2007-04-20 19:17 411,136 --------- C:\WINDOWS\system32\scint78.dll

2007-04-20 19:17 32,768 --------- C:\WINDOWS\system32\cmgr32.dll

2007-04-20 19:17 108,032 --------- C:\WINDOWS\system32\sh33w32.dll

2007-04-20 19:16 909,312 --------- C:\WINDOWS\system32\qd3d.dll

2007-04-20 19:16 39,095 --------- C:\WINDOWS\iccsigs.dat

2007-04-20 19:16 345,600 --------- C:\WINDOWS\system32\qtim32.dll

2007-04-20 19:15 90,112 --------- C:\WINDOWS\system32\evysh7us.dll

2007-04-20 19:11

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-20 12:52:23 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Skype

2007-05-17 12:03:08 -------- d-----w C:\Program Files\Google

2007-05-12 15:41:45 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-05-12 15:41:30 -------- d–h--w C:\Program Files\InstallShield Installation Information

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-18 13:38:28 -------- d-----w C:\Program Files\Common Files\InstallShield

2007-04-14 16:33:05 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Google

2007-04-14 16:20:28 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll

2007-04-14 16:20:21 -------- d-----w C:\Program Files\BitComet

2007-03-31 19:18:01 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Autodesk

2007-03-31 19:17:12 -------- d-----w C:\Program Files\Common Files\WexTech Shared

2007-03-31 19:17:11 -------- d-----w C:\Program Files\WexTech

2007-03-31 19:17:11 -------- d-----w C:\Program Files\Common Files\LHSPF

2007-03-31 19:16:55 47 ----a-w C:\AUTOEXEC.BAT

2007-03-31 19:16:55 -------- d-----w C:\Program Files\Common Files\Autodesk Shared

2007-03-25 17:42:04 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat

2007-03-25 17:42:04 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat

2007-03-24 19:01:35 -------- d-----w C:\Program Files\Elaborate Bytes

2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys

2007-02-13 19:03:32 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll

2007-02-13 19:03:25 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll

2007-02-13 19:03:04 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll

2007-02-13 19:03:01 45,056 ----a-w C:\WINDOWS\system32\ogg.dll

2007-02-13 19:03:00 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll

2007-02-13 19:02:28 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll

2007-02-13 19:02:24 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll

2007-02-13 19:02:00 765,952 ----a-w C:\WINDOWS\system32\xvidcore.dll

2007-02-13 18:00:07 1,493,863 ----a-w C:\Program Files\ALLPlayer.exe

2007-02-12 20:54:26 4 ----a-w C:\WINDOWS\system32\stfv.bin

2007-02-12 12:05:04 29,184 ----a-w C:\WINDOWS\system32\perfont.exe

2007-02-12 12:05:04 24,064 ----a-w C:\WINDOWS\system32\msmsn.exe

2007-02-12 12:05:04 22,784 ----a-w C:\WINDOWS\system32\netstat2.exe

2007-02-12 12:05:04 10,240 ----a-w C:\WINDOWS\system32\winmuse.exe

2007-02-12 12:05:03 9,472 ----a-w C:\WINDOWS\system32\mpsegment.exe

2007-02-12 12:05:03 8,704 ----a-w C:\WINDOWS\system32\performent202.dll

2007-02-12 12:05:03 32,256 ----a-w C:\WINDOWS\system32\anti_troj.exe

2007-02-12 12:05:03 20,736 ----a-w C:\WINDOWS\system32\POPCORN72.EXE

2007-02-12 12:05:03 18,432 ----a-w C:\WINDOWS\system32\dload.exe

2007-02-12 12:05:03 15,616 ----a-w C:\WINDOWS\system32\proqlaim.exe

2007-02-12 12:05:03 15,360 ----a-w C:\WINDOWS\system32\iewd.exe

2007-02-10 11:41:19 20,888 ----a-w C:\DOCUME~1\KIARUL~1\DANEAP~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]

{22BF413B-C6D2-4d91-82A9-A0F997BA588C}=C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL [2006-12-18 18:30]

{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll [2007-03-29 16:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42]

“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-06-01 11:22]

“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-06-01 11:22]

“SkyTel”=“SkyTel.EXE” []

“RTHDCPL”=“RTHDCPL.EXE” []

“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 21:24]

“nwiz”=“nwiz.exe” [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 12:50]

“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“VoipStunt”=“C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe” []

“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-12-18 18:32]

“BitComet”=“C:\Program Files\BitComet\BitComet.exe” [2007-04-03 20:04]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 16:36]

“eMuleAutoStart”=“D:\eMule\emule.exe” [2006-09-14 16:15]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-20 18:50:14

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

********************************************************************

Completion time: 2007-05-20 18:50:30

C:\ComboFix-quarantined-files.txt … 2007-05-20 18:50

C:\ComboFix2.txt … 2007-05-20 00:43

— E O F —

]

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\adsldpb.exe C:\WINDOWS\system32\12520850x.exe C:\WINDOWS\system32\1041b.exe C:\WINDOWS\system32\1625399423.dat C:\WINDOWS\system32\acctresv.exe C:\WINDOWS\system32\perfont.exe C:\WINDOWS\system32\msmsn.exe C:\WINDOWS\system32\netstat2.exe C:\WINDOWS\system32\winmuse.exe

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowy log z Combo

[K_A]

[“K i A rulez” - 2007-05-20 19:52:54 Dodatek Service Pack 2

ComboFix 07-05.20.3.V - Running from: “C:\Documents and Settings\K i A rulez\Pulpit\dobre programy”

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-20 ))))))))))))))))))))))))))))))))))

2007-05-20 19:50

2007-05-20 11:58 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 11:58

2007-05-20 00:43 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-05-18 20:44 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2007-05-18 20:44 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2007-05-18 20:44 129,784 --------- C:\WINDOWS\system32\pxafs.dll

2007-05-18 20:44

2007-05-18 20:43

2007-05-18 20:29

2007-05-18 20:29

2007-05-18 20:28 4,109,584 --a------ C:\Program Files\gg77.exe

2007-05-18 20:17

2007-05-14 20:24 31,204 -r-hs---- C:\WINDOWS\system32\adsldpb.exe

2007-05-12 17:33

2007-05-09 17:41 32,660 -r-hs---- C:\WINDOWS\system32\12520850x.exe

2007-04-30 17:13 29,188 -r-hs---- C:\WINDOWS\system32\1041b.exe

2007-04-30 08:26 427 --ahs---- C:\WINDOWS\system32\1625399423.dat

2007-04-30 08:26 28,516 -r-hs---- C:\WINDOWS\system32\acctresv.exe

2007-04-27 20:02

2007-04-20 19:33

2007-04-20 19:18 71,168 --------- C:\WINDOWS\system32\3dviewer.dll

2007-04-20 19:18 532,240 -ra------ C:\WINDOWS\system32\MSEXCH35.DLL

2007-04-20 19:18 403,216 -ra------ C:\WINDOWS\system32\MSREPL35.DLL

2007-04-20 19:18 37,136 -ra------ C:\WINDOWS\system32\MSJINT35.DLL

2007-04-20 19:18 368,912 -ra------ C:\WINDOWS\system32\VBAR332.DLL

2007-04-20 19:18 290,816 -ra------ C:\WINDOWS\system32\MSXBSE35.DLL

2007-04-20 19:18 254,976 -ra------ C:\WINDOWS\system32\MSEXCL35.DLL

2007-04-20 19:18 253,952 -ra------ C:\WINDOWS\system32\MSPDOX35.DLL

2007-04-20 19:18 251,664 -ra------ C:\WINDOWS\system32\MSRD2X35.DLL

2007-04-20 19:18 24,336 -ra------ C:\WINDOWS\system32\MSJTER35.DLL

2007-04-20 19:18 169,984 -ra------ C:\WINDOWS\system32\MSLTUS35.DLL

2007-04-20 19:18 166,912 -ra------ C:\WINDOWS\system32\MSTEXT35.DLL

2007-04-20 19:18 1,039,360 -ra------ C:\WINDOWS\system32\MSJET35.DLL

2007-04-20 19:17 960,000 --------- C:\WINDOWS\system32\evysh7.dll

2007-04-20 19:17 553,984 --------- C:\WINDOWS\system32\rave.dll

2007-04-20 19:17 411,136 --------- C:\WINDOWS\system32\scint78.dll

2007-04-20 19:17 32,768 --------- C:\WINDOWS\system32\cmgr32.dll

2007-04-20 19:17 108,032 --------- C:\WINDOWS\system32\sh33w32.dll

2007-04-20 19:16 909,312 --------- C:\WINDOWS\system32\qd3d.dll

2007-04-20 19:16 39,095 --------- C:\WINDOWS\iccsigs.dat

2007-04-20 19:16 345,600 --------- C:\WINDOWS\system32\qtim32.dll

2007-04-20 19:15 90,112 --------- C:\WINDOWS\system32\evysh7us.dll

2007-04-20 19:11

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-20 12:52:23 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Skype

2007-05-17 12:03:08 -------- d-----w C:\Program Files\Google

2007-05-12 15:41:45 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-05-12 15:41:30 -------- d–h--w C:\Program Files\InstallShield Installation Information

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-18 13:38:28 -------- d-----w C:\Program Files\Common Files\InstallShield

2007-04-14 16:33:05 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Google

2007-04-14 16:20:28 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll

2007-04-14 16:20:21 -------- d-----w C:\Program Files\BitComet

2007-03-31 19:18:01 -------- d-----w C:\DOCUME~1\KIARUL~1\DANEAP~1\Autodesk

2007-03-31 19:17:12 -------- d-----w C:\Program Files\Common Files\WexTech Shared

2007-03-31 19:17:11 -------- d-----w C:\Program Files\WexTech

2007-03-31 19:17:11 -------- d-----w C:\Program Files\Common Files\LHSPF

2007-03-31 19:16:55 47 ----a-w C:\AUTOEXEC.BAT

2007-03-31 19:16:55 -------- d-----w C:\Program Files\Common Files\Autodesk Shared

2007-03-25 17:42:04 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat

2007-03-25 17:42:04 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat

2007-03-24 19:01:35 -------- d-----w C:\Program Files\Elaborate Bytes

2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys

2007-02-13 19:03:32 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll

2007-02-13 19:03:25 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll

2007-02-13 19:03:04 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll

2007-02-13 19:03:01 45,056 ----a-w C:\WINDOWS\system32\ogg.dll

2007-02-13 19:03:00 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll

2007-02-13 19:02:28 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll

2007-02-13 19:02:24 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll

2007-02-13 19:02:00 765,952 ----a-w C:\WINDOWS\system32\xvidcore.dll

2007-02-13 18:00:07 1,493,863 ----a-w C:\Program Files\ALLPlayer.exe

2007-02-12 20:54:26 4 ----a-w C:\WINDOWS\system32\stfv.bin

2007-02-12 12:05:04 29,184 ----a-w C:\WINDOWS\system32\perfont.exe

2007-02-12 12:05:04 24,064 ----a-w C:\WINDOWS\system32\msmsn.exe

2007-02-12 12:05:04 22,784 ----a-w C:\WINDOWS\system32\netstat2.exe

2007-02-12 12:05:04 10,240 ----a-w C:\WINDOWS\system32\winmuse.exe

2007-02-12 12:05:03 9,472 ----a-w C:\WINDOWS\system32\mpsegment.exe

2007-02-12 12:05:03 8,704 ----a-w C:\WINDOWS\system32\performent202.dll

2007-02-12 12:05:03 32,256 ----a-w C:\WINDOWS\system32\anti_troj.exe

2007-02-12 12:05:03 20,736 ----a-w C:\WINDOWS\system32\POPCORN72.EXE

2007-02-12 12:05:03 18,432 ----a-w C:\WINDOWS\system32\dload.exe

2007-02-12 12:05:03 15,616 ----a-w C:\WINDOWS\system32\proqlaim.exe

2007-02-12 12:05:03 15,360 ----a-w C:\WINDOWS\system32\iewd.exe

2007-02-10 11:41:19 20,888 ----a-w C:\DOCUME~1\KIARUL~1\DANEAP~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]

{22BF413B-C6D2-4d91-82A9-A0F997BA588C}=C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL [2006-12-18 18:30]

{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll [2007-03-29 16:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42]

“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-06-01 11:22]

“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-06-01 11:22]

“SkyTel”=“SkyTel.EXE” []

“RTHDCPL”=“RTHDCPL.EXE” []

“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 21:24]

“nwiz”=“nwiz.exe” [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 12:50]

“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“VoipStunt”=“C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe” []

“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-12-18 18:32]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 16:36]

“BitComet”=“C:\Program Files\BitComet\BitComet.exe” [2007-04-03 20:04]

“eMuleAutoStart”=“D:\eMule\emule.exe” [2006-09-14 16:15]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Corel MEDIA FOLDERS INDEXER 8.LNK]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Corel MEDIA FOLDERS INDEXER 8.LNK

backup=C:\WINDOWS\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]

“C:\Program Files\BitComet\BitComet.exe” /tray

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* -WRGRYMFU

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-20 19:53:32

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

********************************************************************

Completion time: 2007-05-20 19:53:48

C:\ComboFix-quarantined-files.txt … 2007-05-20 19:53

C:\ComboFix2.txt … 2007-05-20 18:50

C:\ComboFix3.txt … 2007-05-20 00:43

— E O F —

]

[Gutek]

C:\WINDOWS\system32\adsldpb.exe C:\WINDOWS\system32\12520850x.exe C:\WINDOWS\system32\1041b.exe C:\WINDOWS\system32\1625399423.dat C:\WINDOWS\system32\acctresv.exe C:\WINDOWS\system32\perfont.exe C:\WINDOWS\system32\msmsn.exe C:\WINDOWS\system32\netstat2.exe C:\WINDOWS\system32\winmuse.exe

te pliki maja polecieć coś źle zrobiłaś są nadal

[K_A]

za pierwszym razem wyskoczyło mi

[//////////////////////////////////////////

Avenger Pre-Processor log

//////////////////////////////////////////

Error]

nastepnym razem poszło lepiej, komputer sie zrestartował i wyskoczyło

[Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\bjjrwwrv


*******************


Script file located at: \??\C:\Documents and Settings\luparhft.txt

Script file opened successfully.


Script file read successfully


Backups directory opened successfully at C:\Avenger


*******************


Beginning to process script file:


File C:\WINDOWS\system32\adsldpb.exe deleted successfully.

File C:\WINDOWS\system32\12520850x.exe deleted successfully.

File C:\WINDOWS\system32\1041b.exe deleted successfully.

File C:\WINDOWS\system32\1625399423.dat deleted successfully.

File C:\WINDOWS\system32\acctresv.exe deleted successfully.

File C:\WINDOWS\system32\perfont.exe deleted successfully.

File C:\WINDOWS\system32\msmsn.exe deleted successfully.

File C:\WINDOWS\system32\netstat2.exe deleted successfully.

File C:\WINDOWS\system32\winmuse.exe deleted successfully.


Completed script processing.


*******************


Finished! Terminate.]

wklejam log z combofix

[Gutek]

Już jest Ok

[K_A]

dziękuję Tobie bardzo!