kolejne sprawdzenie loga, spyware itp

[anurit]

ComboFix 08-06-16.5 - Administrator 2008-06-19 15:04:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2364 [GMT 2:00]
Running from: D:\install\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk
C:\Documents and Settings\Administrator\Dane aplikacji\shclmpj0e109
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008\How to Register Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008\Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008\Register Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\Malware Protector 2008\Uninstall.lnk
C:\Documents and Settings\All Users\Pulpit\Malware Protector 2008.lnk
C:\Program Files\shclmpj0e109
C:\WINDOWS\adaway.lic
C:\WINDOWS\system32\blphcjmpj0e109.scr
C:\WINDOWS\system32\phcjmpj0e109.bmp

.
((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.

2008-06-19 14:30 . 2008-06-19 14:30 <DIR> d-------- C:\Documents and Settings\LocalService\Pulpit
2008-06-19 14:17 . 2008-06-19 14:18 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-06-19 14:17 . 2008-06-19 14:18 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-06-19 14:04 . 2008-06-19 14:18 <DIR> d-------- C:\Program Files\Symantec
2008-06-19 14:04 . 2008-06-19 14:18 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-06-19 14:04 . 2008-06-19 14:18 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-06-19 11:26 . 2008-06-19 11:26 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-19 11:26 . 2008-06-19 11:26 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-19 11:25 . 2008-06-19 11:25 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-06-19 11:25 . 2008-06-19 15:08 4,368,928 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-19 11:25 . 2008-06-19 15:08 483,360 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-19 11:25 . 2008-06-19 15:08 36,260 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-19 11:25 . 2008-06-19 15:08 3,780 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-18 17:24 . 2008-06-18 17:14 60,928 --a------ C:\WINDOWS\system32\3CC.tmp
2008-06-18 17:03 . 2008-06-18 16:53 60,928 --a------ C:\WINDOWS\system32\3BA.tmp
2008-06-18 16:39 . 2008-06-19 11:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-06-18 16:10 . 2008-06-18 16:10 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-17 12:23 . 2008-06-18 16:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-12 03:01 . 2008-06-12 03:01 197 --a------ C:\WINDOWS\system32\MRT.INI
2008-06-11 12:01 . 2008-04-14 17:53 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 12:01 . 2008-04-14 17:53 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-19 13:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-19 12:28 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-19 12:24 --------- d-----w C:\Program Files\Norton AntiVirus
2008-06-19 12:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-06-19 07:28 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\OpenOffice.org2
2008-06-03 13:31 --------- d-----w C:\Program Files\SyncBack
2008-06-03 09:38 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Desktopicon
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll
2008-04-25 16:21 26,964 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-04-25 07:47 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InfraRecorder
2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-21 11:20 --------- d-----w C:\Program Files\InfraRecorder
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
2008-04-25 18:22 62728 --a------ C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 17:30 249856]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-18 11:52 282624]
"SMshclmpj0e109"="C:\Program Files\shclmpj0e109\shclmpj0e109.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 01:04 84640]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 19:22 26248]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21 201992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 21:16:50 113664]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Suitcase Startup.lnk - C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe [2008-04-14 10:23:20 3153920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winso81.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R2 atchksrv;Intel(R) Active Management Technology System Status Service;C:\Program Files\Intel\AMT\atchksrv.exe [2007-05-29 16:14]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-09-13 14:54]
R2 LMS;Intel(R) Active Management Technology Local Management Service;C:\Program Files\Intel\AMT\LMS.exe [2007-05-29 16:14]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2006-10-27 20:18]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
S0 Winso81;Winso81;C:\WINDOWS\system32\Drivers\Winso81.sys []
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2006-06-05 04:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7503e6d-e917-11dc-a02e-001676daf477}]
\Shell\AutoRun\command - G:\cl.bat
\Shell\explore\Command - G:\cl.bat
\Shell\open\Command - G:\cl.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc4cb9a5-ef12-11db-9f41-001676daf477}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7696f53-2096-11dc-9f74-001676daf477}]
\Shell\AutoRun\command - G:\OnSpcLCK.exe

*Newly Created Service* - ERASERUTILREBOOTDRV
.
Contents of the 'Scheduled Tasks' folder
"2008-06-19 12:11:18 C:\WINDOWS\Tasks\Norton AntiVirus - Uruchom pełne skanowanie systemu - Administrator.job"

[huber2t]

otwórz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

Z menu Notatnika Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg

Uruchom ten plik, uruchom ponownie komputer

Do wyleczenia pendrive z wirusów użyj
Perlovga Removal Tool
Flash Disinfector
lub format

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum