ponowne problemy (!!!) proszę o sprawdzenie loga

[ora007]

Log z ComboFix:

ComboFix 08-04-27.3 - Ola 2008-05-07 13:03:21.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.151 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-04-07 to 2008-05-07 )))))))))))))))))))))))))))))))
.

2008-05-07 12:41 . 2008-05-07 12:36 71,680 --------- C:\WINDOWS\system32\trz52.tmp
2008-04-21 09:39 . 2008-04-21 09:39 <DIR> d-------- C:\Program Files\Alwil Software
2008-04-17 09:54 . 2008-04-17 09:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-17 09:54 . 2008-04-17 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-14 10:01 . 2008-04-14 10:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 21:50 . 2008-04-10 21:50 <DIR> d---s---- C:\Documents and Settings\Ola\UserData
2008-04-09 21:10 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 14:51 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-04-16 14:00 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-04-16 12:41 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-04-05 17:56 --------- d-----w C:\Program Files\Avast4
2008-04-05 17:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-05 12:08 --------- d-----w C:\Program Files\PITy
2008-03-25 11:21 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Image Zone Express
2008-03-25 11:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-25 10:46 --------- d-----w C:\Program Files\HP
2008-03-25 10:46 --------- d-----w C:\Program Files\Hewlett-Packard
2008-03-25 10:46 --------- d-----w C:\Program Files\Common Files\HP
2008-03-25 10:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-03-25 10:42 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\HP
2008-03-25 09:54 --------- d-----w C:\Program Files\PDFCreator
2008-03-25 09:54 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\PDFCreator
2008-03-24 19:50 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-24 19:49 --------- d-----w C:\Program Files\Microsoft Works
2008-03-24 11:05 --------- d-----w C:\Program Files\Java
2008-03-24 11:01 --------- d-----w C:\Program Files\Common Files\Java
2008-03-23 20:13 892,928 ----a-w C:\WINDOWS\system32\iconv.dll
2008-03-23 20:12 405,504 ----a-w C:\WINDOWS\system32\libmplayer.dll
2008-03-23 20:12 3,138,560 ----a-w C:\WINDOWS\system32\libavcodec.dll
2008-03-23 20:12 126,976 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-23 20:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2008-03-23 20:11 56,832 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2008-03-23 20:11 54,784 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2008-03-23 20:11 397,312 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2008-03-23 20:11 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2008-03-23 20:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2008-03-23 20:11 188,416 ----a-w C:\WINDOWS\system32\ff_theora.dll
2008-03-23 20:11 172,032 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2008-03-23 20:11 143,360 ----a-w C:\WINDOWS\system32\ff_libmad.dll
2008-03-23 20:11 135,168 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
2008-03-23 20:11 118,784 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2008-03-23 20:11 102,912 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2008-03-23 20:10 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll
2008-03-23 20:10 45,056 ----a-w C:\WINDOWS\system32\ogg.dll
2008-03-23 20:10 391,168 ----a-w C:\WINDOWS\system32\i263_32.drv
2008-03-23 20:10 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll
2008-03-23 20:10 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll
2008-03-23 20:10 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll
2008-03-23 20:09 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-03-23 20:09 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-23 20:09 163,840 ----a-w C:\WINDOWS\system32\ts.dll
2008-03-23 20:09 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
2008-03-23 20:09 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
2008-03-23 20:09 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
2008-03-23 20:09 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
2008-03-23 20:09 108,032 ----a-w C:\WINDOWS\system32\avi.dll
2008-03-23 20:08 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll
2008-03-23 20:08 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll
2008-03-23 20:08 --------- d-----w C:\Program Files\Real Alternative
2008-03-23 20:07 --------- d-----w C:\Program Files\QT Lite
2008-03-23 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-23 15:31 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 15:29 --------- d-----w C:\Program Files\Skype
2008-03-23 15:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-23 15:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 15:05 --------- d-----w C:\Program Files\BearShare Applications
2008-03-23 15:03 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Winamp
2008-03-23 14:58 --------- d-----w C:\Program Files\Winamp
2008-03-23 14:57 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu
2008-03-23 14:55 --------- d-----w C:\Program Files\Gadu-Gadu
2008-03-23 14:50 --------- d-----w C:\Program Files\MarBit
2008-03-23 12:53 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-23 12:53 --------- d-----w C:\Program Files\Ahead
2008-03-23 10:08 --------- d-----w C:\Program Files\totalcmd
2008-03-23 10:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-23 10:06 --------- d-----w C:\Program Files\Thomson
2008-03-22 20:21 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Logitech
2008-03-22 20:18 --------- d-----w C:\Program Files\SetPoint
2008-03-22 20:18 --------- d-----w C:\Program Files\Common Files\Logitech
2008-03-22 20:17 --------- d-----w C:\Program Files\Fingerprint Sensor
2008-03-22 20:17 --------- d-----w C:\Program Files\ASUS Security Center
2008-03-22 20:15 --------- d-----w C:\Program Files\Synaptics
2008-03-22 20:15 --------- d-----w C:\Program Files\Asus
2008-03-22 20:14 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-22 20:13 --------- d-----w C:\Program Files\Realtek
2008-03-22 20:05 --------- d-----w C:\Program Files\Intel
2008-03-22 13:00 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-22 12:59 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@={666C7836-A9B6-4AB4-94ED-DC238C81E925}

[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 14:06 40048]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll 2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16c1b408-1c07-11dd-9b8b-0018de1019ed}]
\Shell\AutoRun\command - I:\x6.bat
\Shell\explore\Command - I:\x6.bat
\Shell\open\Command - I:\x6.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b6e-fffb-11dc-9b1e-0018de1019ed}]
\Shell\AutoRun\command - I:\x6.bat
\Shell\explore\Command - I:\x6.bat
\Shell\open\Command - I:\x6.bat

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-07 13:04:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UMonit = C:\WINDOWS\system32\UMonit.exe??f??|????????????????????????????????????????????????LQ??????????????????????pP????'?0??????|p??|????m??|d??w???????????????w????????????????LQ??????????????\Q???????Q?????w??????????'???'??????S???>'???'???'?TJ(??????S??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-07 13:04:56
ComboFix-quarantined-files.txt 2008-05-07 11:04:53

Pre-Run: 4,881,326,080 bajtów wolnych
Post-Run: 4,880,261,120 bajtów wolnych

188

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\trz52.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.