explorer.exe nie działa, log z Combofix

Mam jakieś wirusy eksplorer niechce działać ot kody z combofixa
ComboFix 08-09-12.09 - bajerski 2008-09-13 15:04:57.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2651 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\bajerski\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

((((((((((((((((((((((((( Pliki utworzone od 2008-08-13 do 2008-09-13 )))))))))))))))))))))))))))))))
.

2008-09-13 14:34 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmpB.tmp
2008-09-13 11:01 . 2008-09-13 11:01 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-09-12 20:42 . 2008-09-12 20:42 <DIR> d-------- C:\Program Files\Alwil Software
2008-09-12 19:51 . 2008-09-13 15:05 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-09-12 19:51 . 2008-06-17 18:52 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-09-12 19:51 . 2008-06-17 16:58 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-09-12 19:51 . 2008-06-17 18:52 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-09-12 19:51 . 2008-06-17 18:52 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-09-12 19:51 . 2008-06-17 18:52 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-09-12 19:51 . 2008-06-17 18:52 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-09-12 19:51 . 2008-09-12 19:51 <DIR> d-------- C:\Documents and Settings\Administrator
2008-09-12 15:37 . 2008-09-12 13:34 344,064 --a------ C:\WINDOWS\vmgspntbbfg.dll
2008-09-12 15:37 . 2008-09-12 13:34 192,512 --a------ C:\WINDOWS\fqbewlna.dll
2008-09-12 15:37 . 2008-09-12 13:34 102,400 --a------ C:\WINDOWS\mqgldfvo.exe
2008-09-10 21:57 . 2008-09-10 22:05 <DIR> d-------- C:\Downloads
2008-09-10 21:37 . 2004-08-03 23:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2008-09-10 18:28 . 2008-09-10 18:29 <DIR> d-------- C:\Program Files\eSkiMoS R2
2008-09-06 20:28 . 2008-09-06 20:28 <DIR> d-------- C:\Program Files\Vimicro
2008-08-30 11:17 . 2008-08-30 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\tlen.pl
2008-08-26 16:43 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp1BC.tmp
2008-08-26 16:43 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp1BB.tmp
2008-08-26 16:30 . 2008-08-26 16:30 <DIR> d-------- C:\Program Files\Codemasters
2008-08-26 15:08 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
2008-08-26 15:08 . 2008-07-12 08:18 1,493,528 --a------ C:\WINDOWS\system32\D3DCompiler_39.dll
2008-08-26 15:08 . 2008-07-31 10:40 509,448 --a------ C:\WINDOWS\system32\XAudio2_2.dll
2008-08-26 15:08 . 2008-07-12 08:18 467,984 --a------ C:\WINDOWS\system32\d3dx10_39.dll
2008-08-26 15:08 . 2008-07-31 10:41 238,088 --a------ C:\WINDOWS\system32\xactengine3_2.dll
2008-08-26 15:08 . 2008-07-31 10:41 68,616 --a------ C:\WINDOWS\system32\XAPOFX1_1.dll
2008-08-24 15:31 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp114.tmp
2008-08-24 15:31 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp113.tmp
2008-08-16 15:57 . 2008-08-16 15:57 <DIR> d-------- C:\Documents and Settings\bajerski\Dane aplikacji\Buena Vista Games

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-13 09:50 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\uTorrent
2008-09-13 09:34 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\foobar2000
2008-09-12 19:52 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\Tlen.pl
2008-09-12 18:07 --------- d-----w C:\Program Files\Tlen.pl
2008-09-10 19:38 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\Image Zone Express
2008-09-07 11:20 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\Skype
2008-09-07 11:00 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\skypePM
2008-09-06 18:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-06 18:10 --------- d-----w C:\Program Files\7-Zip
2008-08-30 10:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-26 14:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Codemasters
2008-08-25 12:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-08-25 12:23 --------- d-----w C:\Program Files\Ubisoft
2008-08-24 13:31 --------- d-----w C:\Program Files\OpenAL
2008-08-09 12:00 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\FreeCall
2008-08-07 12:33 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\InstallShield
2008-08-03 10:22 1,788 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP
2008-07-30 13:21 --------- d-----w C:\Program Files\SiSoftware
2008-07-27 17:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-07-27 17:46 --------- d-----w C:\Program Files\Microsoft Works
2008-07-27 17:45 --------- d-----w C:\Program Files\MSBuild
2008-07-26 15:44 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-07-24 09:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-24 09:20 --------- d-----w C:\Program Files\AGEIA Technologies
2008-07-24 09:20 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\Touchstone
2008-07-24 09:11 --------- d-----w C:\Documents and Settings\bajerski\Dane aplikacji\Leadertech
2008-07-24 09:04 --------- d-----w C:\Program Files\Turok
2008-07-21 20:11 --------- d-----w C:\Program Files\uTorrent
2008-07-21 03:59 --------- d-----w C:\Program Files\Opera
2008-06-26 13:41 304,160 ----a-w C:\SPC220NC.DAT
.

------- Sigcheck -------

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-09-12_20.12.09.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-06 14:22:02 114,688 ----a-w C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
+ 2008-08-06 14:30:48 202,168 ----a-w C:\WINDOWS\system32\Adobe\Director\SwDir.dll
+ 2008-08-06 14:22:42 499,712 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Control.dll
+ 2008-08-06 13:45:40 1,798,144 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\dirapi.dll
+ 2008-08-06 14:22:44 9,216 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\DynaPlayer.dll
+ 2008-08-06 13:35:52 706,048 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gi.dll
+ 2008-08-06 13:35:52 1,145,896 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gt.exe
+ 2008-08-06 13:35:52 52,288 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gtapi.dll
+ 2008-08-06 13:42:04 892,928 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\iml32.dll
+ 2008-08-06 13:35:52 54,656 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\pccuapi.dll
+ 2008-08-06 14:21:14 266,240 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll
+ 2008-08-06 14:24:14 446,464 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Proj.dll
+ 2008-08-06 14:30:30 447,928 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1100465.exe
+ 2008-08-06 14:24:56 114,688 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwInit.exe
+ 2008-08-06 14:21:04 94,208 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2008-08-06 13:35:52 50,808 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL
+ 1999-06-25 08:55:30 149,504 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\UNWISE.EXE
- 2008-06-20 19:46:12 245,760 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
+ 2008-09-12 18:36:02 245,760 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
- 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-01-17 15:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-09-13 12:32:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CAD4711C-D8E5-4184-8745-51AC1F355659}]
2008-09-12 13:34 344064 --a------ C:\WINDOWS\vmgspntbbfg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7976222E-DC29-45CD-87EA-9D2397B52D0E}"= "C:\WINDOWS\fqbewlna.dll" [2008-09-12 192512]

[HKEY_CLASSES_ROOT\clsid\{7976222e-dc29-45cd-87ea-9d2397b52d0e}]
[HKEY_CLASSES_ROOT\fqbewlna.1]
[HKEY_CLASSES_ROOT\TypeLib\{EB6C6828-14CB-4366-B9BD-B554A029A2CB}]
[HKEY_CLASSES_ROOT\fqbewlna]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2008-08-25 5853160]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 233472]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"BigDog303"="C:\WINDOWS\VM303_STI.EXE" [2005-10-25 61440]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 C:\WINDOWS\system32\stmctrl.dll]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 C:\WINDOWS\system32\HdAShCut.exe]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\FreeCall.com\\FreeCall\\FreeCall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Turok\\Binaries\\TurokGame.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\RpcSandraSrv.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Java\\jre1.6.0_06\\launch4j-tmp\\JDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 684265]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5e172b7-5709-11dd-839a-001bfcf165d2}]
\Shell\AutoRun\command - M:\x.com
\Shell\explore\Command - M:\x.com
\Shell\open\Command - M:\x.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e7202aab-5e1f-11dd-83ab-001bfcf165d2}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\bajerski\Dane aplikacji\Mozilla\Firefox\Profiles\rgik72aj.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - onet.pl
FF -: plugin - C:\Program Files\Opera\program\plugins\NPOFF12.DLL
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 15:05:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-09-13 15:05:55
ComboFix-quarantined-files.txt 2008-09-13 13:05:51
ComboFix2.txt 2008-09-13 12:55:14
ComboFix3.txt 2008-09-13 12:40:36
ComboFix4.txt 2008-09-12 18:12:26

Przed: 26,310,397,952 bajt˘w wolnych
Po: 26,299,486,208 bajt˘w wolnych

219

Do wyleczenia pendrive z wirusów użyj
Perlovga Removal Tool
Flash Disinfector
lub format

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod:

File::
C:\WINDOWS\system32\tmpB.tmp
C:\WINDOWS\vmgspntbbfg.dll
C:\WINDOWS\fqbewlna.dll
C:\WINDOWS\mqgldfvo.exe
C:\WINDOWS\system32\tmp1BC.tmp
C:\WINDOWS\system32\tmp1BB.tmp
C:\WINDOWS\system32\tmp114.tmp
C:\WINDOWS\system32\tmp113.tmp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CAD4711C-D8E5-4184-8745-51AC1F355659}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7976222E-DC29-45CD-87EA-9D2397B52D0E}"=-
[-HKEY_CLASSES_ROOT\clsid\{7976222e-dc29-45cd-87ea-9d2397b52d0e}]
[-HKEY_CLASSES_ROOT\fqbewlna.1]
[-HKEY_CLASSES_ROOT\TypeLib\{EB6C6828-14CB-4366-B9BD-B554A029A2CB}]
[-HKEY_CLASSES_ROOT\fqbewlna]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=-
"BigDog303"=-
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-
"GrooveMonitor"=-
"nwiz"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5e172b7-5709-11dd-839a-001bfcf165d2}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e7202aab-5e1f-11dd-83ab-001bfcf165d2}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link