log combo

[wiecho]

sprawdze log comboComboFix 08-07-04.3 - x 2008-07-05 14:12:00.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.615 [GMT 2:00]
Running from: C:\Documents and Settings\x\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.

2008-06-28 15:41 . 2008-06-28 15:41 <DIR> d-------- C:\Program Files\Sun
2008-06-28 15:40 . 2008-06-28 15:40 <DIR> d-------- C:\Program Files\Java
2008-06-28 15:40 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-28 15:38 . 2008-06-28 15:38 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-25 11:38 . 2008-06-25 11:38 <DIR> d-------- C:\Program Files\No-IP
2008-06-22 16:17 . 2008-06-22 16:17 <DIR> d-------- C:\Program Files\Hamachi
2008-06-22 16:01 . 2008-06-27 11:15 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Hamachi
2008-06-22 16:01 . 2008-06-22 16:17 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-06-22 12:48 . 2008-06-23 22:07 81 --a------ C:\WINDOWS\Route.INI
2008-06-21 17:46 . 2008-06-21 17:46 <DIR> d-------- C:\Program Files\NokiaFREE Unlock Codes Calculator
2008-06-21 15:20 . 2008-06-24 13:23 <DIR> d-------- C:\Tibia
2008-06-18 18:30 . 2008-06-18 18:30 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\TMNT Demo
2008-06-18 18:29 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-06-18 18:28 . 2008-06-18 18:28 <DIR> d-------- C:\Program Files\Ubisoft
2008-06-18 18:25 . 2008-06-18 18:26 <DIR> d-------- C:\Program Files\Heavyweight Thunder
2008-06-18 13:25 . 2008-06-18 13:28 401 --a------ C:\WINDOWS\wininit.ini
2008-06-18 12:46 . 2008-06-18 12:46 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\DAEMON Tools
2008-06-14 16:35 . 2008-06-14 16:35 <DIR> d-------- C:\Program Files\RonOTS Client
2008-06-11 14:24 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 14:24 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 12:35 . 2008-07-04 20:29 <DIR> d-------- C:\Program Files\AdVantage
2008-06-10 12:31 . 2008-06-18 12:46 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-08 09:19 . 2008-06-08 09:19 <DIR> d-------- C:\Program Files\EA SPORTS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 08:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-30 19:12 --------- d-----w C:\Documents and Settings\x\Dane aplikacji\Tibia
2008-06-21 13:19 --------- d-----w C:\Program Files\Tibia
2008-06-18 16:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-08 07:08 --------- d-----w C:\Documents and Settings\x\Dane aplikacji\Azureus
2008-06-03 20:26 --------- d-----w C:\Program Files\Azureus
2008-05-30 16:12 --------- d-----w C:\Program Files\Counter-Strike
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 16:58 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-24 07:50 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2005-10-20 20:58 3,869 ----a-w C:\Program Files\Nazwy misji.txt
2005-10-20 20:51 2,411 ----a-w C:\Program Files\Polonizacja v.0.91 - Readme.txt
2005-07-30 19:03 2,321 ----a-w C:\Program Files\Polonizacja - Readme.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-03-07 02:49 8425472]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-03-07 02:49 81920]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="C:\Documents and Settings\x\Pulpit\Gry\InCD\InCD.exe" [2005-01-27 19:17 1381376]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 08:27 16207872 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-03-07 02:49 1622016 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Atari\\TacticalOps\\System\\TacticalOps.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaf0187e-c903-11dc-9f3f-0016e633f47c}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-07-05 11:35:23 C:\WINDOWS\Tasks\User_Feed_Synchronization-{57E7115C-DA63-4456-B5C9-7209C02F3830}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 14:13:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-05 14:13:44
ComboFix-quarantined-files.txt 2008-07-05 12:13:39
ComboFix2.txt 2008-07-05 10:49:47

Pre-Run: 1,168,302,080 bajtów wolnych
Post-Run: 1,159,847,936 bajtów wolnych

126 --- E O F --- 2008-06-20 20:11:55

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

Folder::
C:\Program Files\AdVantage


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaf0187e-c903-11dc-9f3f-0016e633f47c}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na wklejto a w poście dajesz tylko link