prosba o sprawdzenie loga z combofix

[artibaj]

prosba o sprawdzenie loga z combofix

ComboFix 08-07-13.12 - artibaj 2008-07-14 15:28:51.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.817 [GMT 2:00]
Running from: C:\Documents and Settings\artibaj\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\amitggxe.ini
C:\WINDOWS\system32\atoeshqf.ini
C:\WINDOWS\system32\auxgfcuu.dll
C:\WINDOWS\system32\awtSJcBt.dll
C:\WINDOWS\system32\bmaejase.ini
C:\WINDOWS\system32\ftnmkihm.ini
C:\WINDOWS\system32\GgggOXyb.ini
C:\WINDOWS\system32\GgggOXyb.ini2
C:\WINDOWS\system32\hdgyjifn.ini
C:\WINDOWS\system32\hgGywXon.dll
C:\WINDOWS\system32\hgjTBJlm.ini
C:\WINDOWS\system32\hgjTBJlm.ini2
C:\WINDOWS\system32\hguxmmgj.dll
C:\WINDOWS\system32\htvboypr.dll
C:\WINDOWS\system32\hxnmxihq.ini
C:\WINDOWS\system32\jlhcjejo.dll
C:\WINDOWS\system32\jtbpkqnq.dll
C:\WINDOWS\system32\mcjpfmwn.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJAPJby.dll
C:\WINDOWS\system32\mlJAqqOe.dll
C:\WINDOWS\system32\nfijygdh.dll
C:\WINDOWS\system32\ojejchlj.ini
C:\WINDOWS\system32\pbmkodty.ini
C:\WINDOWS\system32\pWHknqru.ini
C:\WINDOWS\system32\pWHknqru.ini2
C:\WINDOWS\system32\qoMeEvuR.dll
C:\WINDOWS\system32\trcguhby.ini
C:\WINDOWS\system32\tuvSljiH.dll
C:\WINDOWS\system32\urqNgGWQ.dll
C:\WINDOWS\system32\urqnkHWp.dll
C:\WINDOWS\system32\uucfgxua.ini
C:\WINDOWS\system32\vtUkllJb.dll
C:\WINDOWS\system32\wvUnKAPh.dll
C:\WINDOWS\system32\ybhugcrt.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TCPSR


((((((((((((((((((((((((( Files Created from 2008-06-14 to 2008-07-14 )))))))))))))))))))))))))))))))
.

2008-07-13 20:35 . 2008-07-13 20:35 <DIR> d-------- C:\Program Files\GlobFX Technologies
2008-07-12 18:48 . 2008-07-12 18:48 <DIR> d-------- C:\Program Files\Aleo Software
2008-07-12 18:48 . 2008-07-12 18:48 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Aleo Software
2008-07-12 18:25 . 2008-07-12 18:49 <DIR> d-------- C:\Program Files\HooTech
2008-07-12 18:07 . 2008-07-12 18:08 <DIR> d-------- C:\Program Files\123 Swift Sound Extractor
2008-07-12 17:06 . 2008-07-12 17:06 <DIR> d-------- C:\Program Files\123 Flash Sound Extractor
2008-07-12 17:06 . 2008-07-12 17:06 1,117,184 --a------ C:\WINDOWS\system32\swfExt.dll
2008-07-12 17:06 . 2008-07-12 17:06 37,888 --a------ C:\WINDOWS\system32\flash_lib.dll
2008-07-12 16:59 . 2008-07-12 16:59 <DIR> d-------- C:\Program Files\Eltima Software
2008-07-12 16:57 . 2008-07-12 16:57 <DIR> d-------- C:\Program Files\Fortop Digital
2008-07-12 16:57 . 2008-07-12 16:57 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-12 14:28 . 2008-07-12 14:28 91,648 --------- C:\WINDOWS\system32\efiaiscc.zva
2008-07-09 19:48 . 2008-07-09 19:48 <DIR> d-------- C:\Program Files\Szkola podstawowa klasa 5 - Przyroda
2008-07-09 19:48 . 1998-10-07 13:54 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2008-07-07 17:04 . 2008-07-07 17:04 47,896 --a------ C:\WINDOWS\system32\nlhxwjsl.dll
2008-07-07 17:01 . 2008-07-13 14:46 110,415 --a------ C:\WINDOWS\BM0f41ff1b.xml
2008-07-06 17:10 . 2008-07-06 17:10 47,846 --a------ C:\WINDOWS\system32\lstceyqw.dll
2008-07-06 17:07 . 2008-07-06 17:07 43,466 --a------ C:\WINDOWS\system32\wgumdlxj.dll
2008-07-06 17:04 . 2008-07-06 17:04 47,846 --a------ C:\WINDOWS\system32\yjdjaoan.dll
2008-07-06 16:59 . 2008-07-06 16:59 42,056 --a------ C:\WINDOWS\system32\wvvgmuux.dll
2008-07-06 16:54 . 2008-07-06 16:56 <DIR> d--h----- C:\Documents and Settings\artibaj\Dane aplikacji\IFLTemp
2008-07-05 17:43 . 2008-07-05 17:47 381 --a------ C:\WINDOWS\FPStudio.INI
2008-07-05 17:40 . 2008-07-05 17:48 <DIR> d--h----- C:\Documents and Settings\artibaj\Dane aplikacji\FVSTemp
2008-07-02 23:53 . 2008-07-02 23:53 976 --a------ C:\WINDOWS\EnglishTranslator.INI
2008-07-02 17:43 . 2008-07-02 17:43 <DIR> dr-h----- C:\Documents and Settings\artibaj\Dane aplikacji\SecuROM
2008-07-02 17:43 . 2008-07-02 17:43 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-06-30 21:00 . 2008-06-30 21:00 <DIR> d-------- C:\Program Files\Google
2008-06-30 00:18 . 2008-07-13 13:51 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-06-29 19:14 . 2008-06-29 19:14 <DIR> d-------- C:\Program Files\Techland
2008-06-29 10:38 . 2008-06-29 10:41 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\BSplayer Pro
2008-06-29 10:37 . 2008-06-29 10:37 <DIR> d-------- C:\Program Files\Webteh
2008-06-28 19:18 . 2008-06-28 19:19 <DIR> d--h----- C:\Program Files\Zero G Registry
2008-06-28 19:17 . 2008-06-28 19:17 <DIR> d--h----- C:\Documents and Settings\artibaj\InstallAnywhere
2008-06-28 15:38 . 2008-06-28 15:38 <DIR> d-------- C:\totalcmd
2008-06-28 15:38 . 2008-06-28 20:42 715 --a------ C:\WINDOWS\wincmd.ini
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\UC.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\RAR.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\LHA.PIF
2008-06-28 15:38 . 2008-04-24 06:58 545 --a------ C:\WINDOWS\ARJ.PIF
2008-06-22 22:25 . 2008-06-22 22:25 <DIR> d-------- C:\Program Files\CHM To PDF Converter PRO
2008-06-21 21:37 . 2008-06-21 21:37 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Apple Computer
2008-06-19 22:55 . 2008-06-19 22:55 <DIR> d-------- C:\Program Files\Bil Software
2008-06-19 22:26 . 2008-06-19 22:33 815 --a------ C:\WINDOWS\mgreg.ini
2008-06-19 22:25 . 2008-06-19 22:32 <DIR> d-------- C:\Program Files\Mgtweak
2008-06-19 22:25 . 2008-06-19 22:26 52 --a------ C:\WINDOWS\mgwin.ini
2008-06-19 21:16 . 2008-07-12 11:18 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Thinstall
2008-06-19 17:51 . 2008-06-19 17:51 <DIR> d-------- C:\Program Files\A4Tech
2008-06-19 17:51 . 2007-02-11 05:51 36,864 --a------ C:\WINDOWS\system32\Amhooker.dll
2008-06-19 17:51 . 2007-02-10 10:04 14,336 --a------ C:\WINDOWS\system32\drivers\Amps2prt.sys
2008-06-19 17:51 . 2007-02-11 07:55 13,824 --a------ C:\WINDOWS\system32\drivers\Amusbprt.sys
2008-06-19 17:51 . 2006-04-11 21:56 10,240 --a------ C:\WINDOWS\system32\drivers\Arfumx86.sys
2008-06-19 17:51 . 2007-01-25 01:46 8,704 --a------ C:\WINDOWS\system32\drivers\Amfilter.sys
2008-06-19 17:49 . 2004-08-04 00:44 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-06-19 17:49 . 2004-08-04 00:44 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-06-19 17:48 . 2008-06-19 17:48 <DIR> d-------- C:\Program Files\Common Files\snp2std
2008-06-19 17:48 . 2008-06-19 17:48 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\InstallShield
2008-06-19 10:00 . 2008-06-19 10:00 26,390 --a------ C:\Documents and Settings\artibaj\griffith_backup.zip
2008-06-19 09:52 . 2008-06-19 10:00 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\gtk-2.0
2008-06-19 09:51 . 2008-06-19 10:00 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\griffith
2008-06-18 00:59 . 2008-06-18 00:59 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-18 00:55 . 2008-06-09 12:43 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\MxBoost
2008-06-18 00:54 . 2008-07-14 15:32 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-06-18 00:54 . 2008-06-16 13:32 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-06-18 00:54 . 2008-06-16 11:38 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-06-18 00:54 . 2008-06-09 12:32 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-06-18 00:54 . 2008-06-16 13:32 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-06-18 00:54 . 2008-06-16 13:32 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-06-18 00:54 . 2008-06-09 12:39 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-06-18 00:54 . 2008-06-18 00:54 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-17 23:01 . 2008-06-17 23:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-17 22:51 . 2002-03-01 21:01 8,192 --a------ C:\WINDOWS\system32\kbdpla.dll
2008-06-17 16:05 . 2004-09-09 15:49 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-17 15:48 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-06-17 15:48 . 2004-08-03 23:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-06-17 15:16 . 2008-06-17 15:16 <DIR> d-------- C:\WINDOWS\system32\MTSLog
2008-06-17 15:16 . 2008-06-17 15:16 <DIR> d--h-c--- C:\Documents and Settings\All Users\Dane aplikacji\{ADE0B700-B0DC-4392-9D8F-2B87DA8B402C}
2008-06-17 11:50 . 2008-06-17 11:50 <DIR> d-------- C:\WINDOWS\system32\ShellDD
2008-06-17 11:50 . 2008-06-17 11:51 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\LogSys
2008-06-17 11:50 . 2008-06-17 11:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LogSys
2008-06-17 11:49 . 2008-06-17 11:50 <DIR> d--h-c--- C:\Documents and Settings\All Users\Dane aplikacji\{C63CBBF7-8137-4406-9AA1-7D75EC166ECA}
2008-06-17 10:32 . 2008-06-17 15:25 31 --a------ C:\WINDOWS\system32\bbcap.err
2008-06-17 10:30 . 2008-06-17 15:25 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Blueberry
2008-06-17 10:30 . 2008-06-17 10:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Blueberry
2008-06-17 10:30 . 2008-06-17 10:30 27,776 --a------ C:\WINDOWS\system32\bbcap.dll
2008-06-17 10:30 . 2008-06-17 10:30 4,608 --a------ C:\WINDOWS\system32\bbchlp.dll
2008-06-17 10:30 . 2008-06-17 10:30 2,944 --a------ C:\WINDOWS\system32\drivers\bbcap.sys
2008-06-17 10:29 . 2008-06-17 15:16 <DIR> d-------- C:\Program Files\Common Files\Blueberry Software
2008-06-17 10:29 . 2008-06-17 15:16 <DIR> d-------- C:\Program Files\Blueberry Software
2008-06-17 10:29 . 2008-06-17 10:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{1125ADE1-D617-4AFC-A2BB-E9DE22F436B6}
2008-06-17 10:17 . 2008-06-17 10:17 583 --a------ C:\WINDOWS\QIII.INI
2008-06-17 09:31 . 2008-06-17 09:31 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-17 09:29 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-06-17 09:20 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-17 09:20 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-17 09:18 . 2007-02-28 18:04 2,181,632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-06-17 09:18 . 2007-02-28 18:04 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-06-17 09:18 . 2007-02-28 18:04 2,058,880 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-06-17 09:18 . 2007-02-28 18:04 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-06-17 09:05 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-16 21:29 . 2008-06-16 21:29 <DIR> d-------- C:\WINDOWS\Sun
2008-06-16 21:29 . 2008-06-16 21:29 <DIR> d-------- C:\Program Files\Sun
2008-06-16 21:28 . 2008-06-16 21:28 <DIR> d-------- C:\Program Files\Java
2008-06-16 21:28 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-16 21:25 . 2008-06-16 21:25 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-16 21:21 . 2008-06-16 21:21 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-16 17:24 . 2008-07-13 21:08 <DIR> d-------- C:\Downloads
2008-06-16 17:16 . 2008-06-16 17:17 8 --a------ C:\WINDOWS\system32\nvModes.dat
2008-06-16 16:41 . 2008-06-16 16:41 <DIR> d---s---- C:\Documents and Settings\artibaj\UserData
2008-06-16 14:39 . 2008-06-16 14:39 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-06-16 14:31 . 2008-06-16 14:32 <DIR> d-------- C:\Program Files\Babylon
2008-06-16 14:31 . 2008-05-18 00:30 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Babylon
2008-06-16 14:31 . 2008-06-20 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
2008-06-16 14:24 . 2008-07-02 13:37 <DIR> d-------- C:\Program Files\FontExplorerL.M
2008-06-16 14:22 . 2008-06-16 14:22 <DIR> d-------- C:\Program Files\Common Files\SourceTec
2008-06-16 14:22 . 2008-06-16 14:22 37 --a------ C:\WINDOWS\SWFConverter.INI
2008-06-16 14:21 . 2008-06-16 14:22 <DIR> d-------- C:\Program Files\SourceTec
2008-06-16 14:21 . 2007-02-05 12:00 413,760 --a------ C:\WINDOWS\system32\MPG4c32.dll
2008-06-16 14:21 . 2007-02-05 12:00 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2008-06-16 14:06 . 2008-06-16 14:06 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-06-16 14:04 . 2008-06-16 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2008-06-16 12:59 . 2008-06-16 12:59 <DIR> d-------- C:\Documents and Settings\artibaj\Dane aplikacji\Nero
2008-06-16 12:58 . 2006-03-17 02:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-14 10:09 --------- d-----w C:\Documents and Settings\artibaj\Dane aplikacji\Desktop Sidebar
2008-07-02 15:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-16 16:44 --------- d-----w C:\Program Files\The KMPlayer
2008-06-16 12:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-16 11:52 --------- d-----w C:\Program Files\Bonjour
2008-06-16 11:44 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-16 11:26 --------- d-----w C:\Program Files\Desktop Sidebar
2008-06-16 11:24 --------- d-----w C:\Program Files\TextPad 5
2008-06-16 11:24 --------- d-----w C:\Documents and Settings\artibaj\Dane aplikacji\Helios
2008-06-16 11:22 --------- d-----w C:\Program Files\QuickTime
2008-06-16 11:22 --------- d-----w C:\Program Files\DVD Region+CSS Free
2008-06-16 11:21 --------- d-----w C:\Program Files\Apple Software Update
2008-06-16 11:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-06-16 11:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-06-16 11:18 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-16 11:10 --------- d-----w C:\Program Files\Creative
2008-06-16 10:25 72,748 ----a-w C:\WINDOWS\unins000.exe
2008-06-16 09:54 --------- d-----w C:\Program Files\PowerISO
2008-06-16 09:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-06-16 09:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-16 09:41 --------- d-----w C:\Program Files\Usługi online
2008-06-11 16:52 --------- d-----w C:\Program Files\SubEdit-Player
2008-06-11 15:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-11 15:34 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-11 15:27 691,545 ----a-w C:\WINDOWS\unins001.exe
2008-06-11 14:12 --------- d-----w C:\Program Files\PS Tray Factory
2008-06-09 10:47 3,544 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2005-09-15 16:43 1712128]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-01-20 09:05 217088]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-05 20:22 26248]
"TrayFactory"="C:\Program Files\PS Tray Factory\PSTrayFactory.exe" [2007-04-04 22:50 360960]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-01-28 11:43 5146448]
"iKeyWorks"="C:\Program Files\A4Tech\Keyboard\Ikeymain.exe" [2007-06-25 23:32 65536]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-07-20 09:15 241664]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 02:04 84640]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51 57344]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"TrayFactory"="C:\Program Files\PS Tray Factory\PSTrayFactory.exe" [2007-04-04 22:50 360960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 15:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\nqt35.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2008-06-17 10:30]
R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15:00]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-13 15:54]
R3 Arfumdev;A4Tech USB Port RF-Mouse filter driver;C:\WINDOWS\system32\DRIVERS\Arfumx86.sys [2006-04-11 21:56]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-05-22 10:55]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-07-11 18:00:09 C:\WINDOWS\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - artibaj.job"

[huber2t]

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\efiaiscc.zva
C:\WINDOWS\system32\nlhxwjsl.dll
C:\WINDOWS\BM0f41ff1b.xml
C:\WINDOWS\system32\lstceyqw.dll
C:\WINDOWS\system32\wgumdlxj.dll
C:\WINDOWS\system32\yjdjaoan.dll
C:\WINDOWS\system32\wvvgmuux.dll


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklejto.pl a w poście dajesz tylko link

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

[artibaj]

log z ComboFix

http://www.wklejto.pl/6018

[huber2t]

otwórz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMeEvuR]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\nqt35.sys]

Z menu Notatnika Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg

Uruchom ten plik, uruchom ponownie komputer

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!