proszę o sprawdzenie loga

przez **ora007** » 14 Kwi 2008, 10:06

Zgodnie z podpowiedzią podaję loga z HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01, on 2008-04-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\UMonit.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: OneCard - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

W pliku z ComboFix'a miałam coś takiego:

ComboFix 08-04-06.1 - Ola 2008-04-07 17:22:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.96 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38

/wow section not completed

przez **huber2t** » 14 Kwi 2008, 16:09

fix w hijackthis

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\amvo.exe

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

przez **ora007** » 14 Kwi 2008, 18:34

Log z ComboFix'a:

ComboFix 08-04-06.1 - Ola 2008-04-14 18:20:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.123 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ola\Pulpit\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\amvo.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 10:01 . 2008-04-14 10:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 21:50 . 2008-04-10 21:50 <DIR> d---s---- C:\Documents and Settings\Ola\UserData
2008-04-09 21:10 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-06 10:42 . 2008-04-05 20:01 103,463 -r-hs---- C:\m9j.com
2008-04-05 19:58 . 2008-04-05 19:58 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:29 1,709,600 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-05 19:58 . 2008-04-05 19:58 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-05 19:58 . 2008-04-05 19:58 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-05 19:58 . 2008-04-14 18:29 37,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-05 19:58 . 2008-04-14 10:20 27,188 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-05 19:58 . 2008-04-14 10:20 4,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-05 19:55 . 2008-04-05 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-05 14:08 . 2008-04-05 14:08 <DIR> d-------- C:\Program Files\PITy
2008-03-25 13:21 . 2008-03-25 13:21 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Image Zone Express
2008-03-25 13:15 . 2008-03-25 14:18 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-25 12:45 . 2008-03-25 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-03-25 12:44 . 2005-04-08 20:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-25 12:43 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\HP
2008-03-25 12:42 . 2008-03-25 12:42 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\HP
2008-03-25 12:42 . 2008-03-25 12:47 79,631 --a------ C:\WINDOWS\hpfins05.dat
2008-03-25 12:42 . 2005-05-24 03:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-25 11:57 . 2008-03-25 13:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Program Files\PDFCreator
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\PDFCreator
2008-03-24 21:51 . 2004-03-22 16:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-24 21:50 . 2008-03-24 21:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-24 21:49 . 2008-03-24 21:50 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-24 21:49 . 2008-03-24 21:49 <DIR> d-------- C:\Program Files\Microsoft Works
2008-03-24 13:05 . 2008-03-24 13:05 <DIR> d-------- C:\WINDOWS\Sun
2008-03-24 13:05 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-24 13:04 . 2008-03-24 13:05 <DIR> d-------- C:\Program Files\Java
2008-03-24 13:01 . 2008-03-24 13:01 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-23 22:13 . 2008-03-23 22:13 2,486,272 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-23 22:13 . 2008-03-23 22:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll
2008-03-23 22:13 . 2008-03-23 22:13 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-23 22:13 . 2008-03-23 22:13 348,160 --a------ C:\WINDOWS\system32\CoreVorbis.ax
2008-03-23 22:13 . 2008-03-23 22:13 319,488 --a------ C:\WINDOWS\system32\CoreAAC.ax
2008-03-23 22:13 . 2008-03-23 22:13 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm
2008-03-23 22:12 . 2008-03-23 22:12 3,138,560 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-23 22:12 . 2008-03-23 22:12 405,504 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-23 22:12 . 2008-03-23 22:12 126,976 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-23 22:12 . 2008-03-23 22:12 547 --a------ C:\WINDOWS\system32\ffdshow.ax.manifest
2008-03-23 22:10 . 2008-03-23 22:10 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll
2008-03-23 22:10 . 2008-03-23 22:10 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-23 22:10 . 2008-03-23 22:10 413,696 --a------ C:\WINDOWS\system32\FLVSplitter.ax
2008-03-23 22:10 . 2008-03-23 22:10 391,168 --a------ C:\WINDOWS\system32\i263_32.drv
2008-03-23 22:10 . 2008-03-23 22:10 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll
2008-03-23 22:10 . 2008-03-23 22:10 188,416 --a------ C:\WINDOWS\system32\vorbis.dll
2008-03-23 22:10 . 2008-03-23 22:10 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax
2008-03-23 22:10 . 2008-03-23 22:10 94,208 --a------ C:\WINDOWS\system32\lmpgvd.ax
2008-03-23 22:10 . 2008-03-23 22:10 86,528 --a------ C:\WINDOWS\system32\DVDVideo.ax
2008-03-23 22:10 . 2008-03-23 22:10 45,056 --a------ C:\WINDOWS\system32\ogg.dll
2008-03-23 22:10 . 2008-03-23 22:10 9,216 --a------ C:\WINDOWS\system32\cpuinf32.dll
2008-03-23 22:08 . 2008-03-23 22:08 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-23 22:08 . 2008-03-23 22:08 185,436 --a------ C:\WINDOWS\system32\CoreAVCDecoder.ax
2008-03-23 22:08 . 2008-03-23 22:08 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll
2008-03-23 22:08 . 2008-03-23 22:08 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Program Files\QT Lite
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-23 22:07 . 2008-01-10 16:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-23 22:07 . 2008-01-10 16:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-23 21:58 . 2008-03-24 22:43 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-23 17:31 . 2008-04-08 19:00 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-03-23 17:31 . 2008-03-23 17:31 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 17:30 . 2008-04-12 15:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 17:05 . 2008-03-23 17:05 <DIR> d-------- C:\Program Files\BearShare Applications
2008-03-23 17:05 . 2008-03-30 22:46 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-03-23 17:05 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-03-23 16:57 . 2008-03-23 16:57 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu
2008-03-23 16:56 . 2008-03-30 15:00 <DIR> d-------- C:\Documents and Settings\Ola\Gadu-Gadu
2008-03-23 16:55 . 2008-03-23 16:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-03-23 16:50 . 2008-03-23 16:50 <DIR> d-------- C:\Program Files\MarBit
2008-03-23 16:45 . 2008-03-23 16:58 <DIR> d-------- C:\Program Files\Winamp
2008-03-23 16:45 . 2008-03-23 17:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Winamp
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Ahead
2008-03-23 14:53 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-03-23 14:53 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-03-23 14:53 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-03-23 14:53 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-23 14:53 . 2004-03-03 21:30 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2008-03-23 14:53 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-03-23 14:53 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-03-23 14:53 . 2004-03-03 21:30 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-03-23 14:05 . 2008-03-23 14:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-23 12:27 . 2008-03-23 12:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-23 12:11 . 2008-03-24 21:51 526 --a------ C:\WINDOWS\ODBC.INI
2008-03-23 12:10 . 2008-04-05 19:56 <DIR> d-------- C:\Program Files\Avast4
2008-03-23 12:10 . 2002-01-05 14:48 974,848 --a------ C:\WINDOWS\system32\MFC70.dll
2008-03-23 12:10 . 2002-01-05 13:40 487,424 --a------ C:\WINDOWS\system32\MSVCP70.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 20:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2008-03-23 20:11 56,832 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2008-03-23 20:11 54,784 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2008-03-23 20:11 397,312 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2008-03-23 20:11 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2008-03-23 20:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2008-03-23 20:11 188,416 ----a-w C:\WINDOWS\system32\ff_theora.dll
2008-03-23 20:11 172,032 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2008-03-23 20:11 143,360 ----a-w C:\WINDOWS\system32\ff_libmad.dll
2008-03-23 20:11 135,168 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
2008-03-23 20:11 118,784 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2008-03-23 20:11 102,912 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2008-03-23 20:09 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-03-23 20:09 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-23 20:09 163,840 ----a-w C:\WINDOWS\system32\ts.dll
2008-03-23 20:09 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
2008-03-23 20:09 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
2008-03-23 20:09 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
2008-03-23 20:09 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
2008-03-23 20:09 108,032 ----a-w C:\WINDOWS\system32\avi.dll
2008-03-22 13:00 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-22 12:59 --------- d-----w C:\Program Files\Usługi online
2008-02-08 16:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@={666C7836-A9B6-4AB4-94ED-DC238C81E925}

[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"ashMaiSv"="C:\PROGRA~1\Avast4\ashmaisv.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 14:06 40048]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll 2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b7d-fffb-11dc-9b1e-0018de1019ed}]
\Shell\AutoRun\command - I:\m9j.com
\Shell\explore\Command - I:\m9j.com
\Shell\open\Command - I:\m9j.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f04431f0-ffca-11dc-9b1c-0018de1019ed}]
\Shell\AutoRun\command - I:\xp19.com
\Shell\explore\Command - I:\xp19.com
\Shell\open\Command - I:\xp19.com

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 18:29:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UMonit = C:\WINDOWS\system32\UMonit.exe??f??|????????????????????????????????????????????????LQ??????????????????????pP????'?0??????|p??|????m??|d??w???????????????w????????????????LQ??????????????\Q???????Q?????w??????????'???'??????S???>'???'???'?TJ(??????S??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-14 18:31:08
ComboFix-quarantined-files.txt 2008-04-14 16:30:57
Pre-Run: 4,392,087,552 bajtów wolnych
Post-Run: 4,410,482,688 bajtów wolnych

przez **ora007** » 14 Kwi 2008, 18:35

Log z ComboFix'a:

ComboFix 08-04-06.1 - Ola 2008-04-14 18:20:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.123 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ola\Pulpit\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\amvo.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 10:01 . 2008-04-14 10:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 21:50 . 2008-04-10 21:50 <DIR> d---s---- C:\Documents and Settings\Ola\UserData
2008-04-09 21:10 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-06 10:42 . 2008-04-05 20:01 103,463 -r-hs---- C:\m9j.com
2008-04-05 19:58 . 2008-04-05 19:58 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:29 1,709,600 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-05 19:58 . 2008-04-05 19:58 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-05 19:58 . 2008-04-05 19:58 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-05 19:58 . 2008-04-14 18:29 37,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-05 19:58 . 2008-04-14 10:20 27,188 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-05 19:58 . 2008-04-14 10:20 4,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-05 19:55 . 2008-04-05 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-05 14:08 . 2008-04-05 14:08 <DIR> d-------- C:\Program Files\PITy
2008-03-25 13:21 . 2008-03-25 13:21 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Image Zone Express
2008-03-25 13:15 . 2008-03-25 14:18 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-25 12:45 . 2008-03-25 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-03-25 12:44 . 2005-04-08 20:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-25 12:43 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\HP
2008-03-25 12:42 . 2008-03-25 12:42 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\HP
2008-03-25 12:42 . 2008-03-25 12:47 79,631 --a------ C:\WINDOWS\hpfins05.dat
2008-03-25 12:42 . 2005-05-24 03:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-25 11:57 . 2008-03-25 13:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Program Files\PDFCreator
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\PDFCreator
2008-03-24 21:51 . 2004-03-22 16:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-24 21:50 . 2008-03-24 21:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-24 21:49 . 2008-03-24 21:50 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-24 21:49 . 2008-03-24 21:49 <DIR> d-------- C:\Program Files\Microsoft Works
2008-03-24 13:05 . 2008-03-24 13:05 <DIR> d-------- C:\WINDOWS\Sun
2008-03-24 13:05 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-24 13:04 . 2008-03-24 13:05 <DIR> d-------- C:\Program Files\Java
2008-03-24 13:01 . 2008-03-24 13:01 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-23 22:13 . 2008-03-23 22:13 2,486,272 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-23 22:13 . 2008-03-23 22:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll
2008-03-23 22:13 . 2008-03-23 22:13 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-23 22:13 . 2008-03-23 22:13 348,160 --a------ C:\WINDOWS\system32\CoreVorbis.ax
2008-03-23 22:13 . 2008-03-23 22:13 319,488 --a------ C:\WINDOWS\system32\CoreAAC.ax
2008-03-23 22:13 . 2008-03-23 22:13 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm
2008-03-23 22:12 . 2008-03-23 22:12 3,138,560 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-23 22:12 . 2008-03-23 22:12 405,504 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-23 22:12 . 2008-03-23 22:12 126,976 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-23 22:12 . 2008-03-23 22:12 547 --a------ C:\WINDOWS\system32\ffdshow.ax.manifest
2008-03-23 22:10 . 2008-03-23 22:10 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll
2008-03-23 22:10 . 2008-03-23 22:10 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-23 22:10 . 2008-03-23 22:10 413,696 --a------ C:\WINDOWS\system32\FLVSplitter.ax
2008-03-23 22:10 . 2008-03-23 22:10 391,168 --a------ C:\WINDOWS\system32\i263_32.drv
2008-03-23 22:10 . 2008-03-23 22:10 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll
2008-03-23 22:10 . 2008-03-23 22:10 188,416 --a------ C:\WINDOWS\system32\vorbis.dll
2008-03-23 22:10 . 2008-03-23 22:10 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax
2008-03-23 22:10 . 2008-03-23 22:10 94,208 --a------ C:\WINDOWS\system32\lmpgvd.ax
2008-03-23 22:10 . 2008-03-23 22:10 86,528 --a------ C:\WINDOWS\system32\DVDVideo.ax
2008-03-23 22:10 . 2008-03-23 22:10 45,056 --a------ C:\WINDOWS\system32\ogg.dll
2008-03-23 22:10 . 2008-03-23 22:10 9,216 --a------ C:\WINDOWS\system32\cpuinf32.dll
2008-03-23 22:08 . 2008-03-23 22:08 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-23 22:08 . 2008-03-23 22:08 185,436 --a------ C:\WINDOWS\system32\CoreAVCDecoder.ax
2008-03-23 22:08 . 2008-03-23 22:08 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll
2008-03-23 22:08 . 2008-03-23 22:08 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Program Files\QT Lite
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-23 22:07 . 2008-01-10 16:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-23 22:07 . 2008-01-10 16:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-23 21:58 . 2008-03-24 22:43 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-23 17:31 . 2008-04-08 19:00 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-03-23 17:31 . 2008-03-23 17:31 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 17:30 . 2008-04-12 15:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 17:05 . 2008-03-23 17:05 <DIR> d-------- C:\Program Files\BearShare Applications
2008-03-23 17:05 . 2008-03-30 22:46 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-03-23 17:05 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-03-23 16:57 . 2008-03-23 16:57 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu
2008-03-23 16:56 . 2008-03-30 15:00 <DIR> d-------- C:\Documents and Settings\Ola\Gadu-Gadu
2008-03-23 16:55 . 2008-03-23 16:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-03-23 16:50 . 2008-03-23 16:50 <DIR> d-------- C:\Program Files\MarBit
2008-03-23 16:45 . 2008-03-23 16:58 <DIR> d-------- C:\Program Files\Winamp
2008-03-23 16:45 . 2008-03-23 17:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Winamp
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Ahead
2008-03-23 14:53 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-03-23 14:53 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-03-23 14:53 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-03-23 14:53 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-23 14:53 . 2004-03-03 21:30 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2008-03-23 14:53 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-03-23 14:53 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-03-23 14:53 . 2004-03-03 21:30 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-03-23 14:05 . 2008-03-23 14:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-23 12:27 . 2008-03-23 12:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-23 12:11 . 2008-03-24 21:51 526 --a------ C:\WINDOWS\ODBC.INI
2008-03-23 12:10 . 2008-04-05 19:56 <DIR> d-------- C:\Program Files\Avast4
2008-03-23 12:10 . 2002-01-05 14:48 974,848 --a------ C:\WINDOWS\system32\MFC70.dll
2008-03-23 12:10 . 2002-01-05 13:40 487,424 --a------ C:\WINDOWS\system32\MSVCP70.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 20:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2008-03-23 20:11 56,832 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2008-03-23 20:11 54,784 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2008-03-23 20:11 397,312 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2008-03-23 20:11 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2008-03-23 20:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2008-03-23 20:11 188,416 ----a-w C:\WINDOWS\system32\ff_theora.dll
2008-03-23 20:11 172,032 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2008-03-23 20:11 143,360 ----a-w C:\WINDOWS\system32\ff_libmad.dll
2008-03-23 20:11 135,168 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
2008-03-23 20:11 118,784 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2008-03-23 20:11 102,912 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2008-03-23 20:09 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-03-23 20:09 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-23 20:09 163,840 ----a-w C:\WINDOWS\system32\ts.dll
2008-03-23 20:09 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
2008-03-23 20:09 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
2008-03-23 20:09 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
2008-03-23 20:09 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
2008-03-23 20:09 108,032 ----a-w C:\WINDOWS\system32\avi.dll
2008-03-22 13:00 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-22 12:59 --------- d-----w C:\Program Files\Usługi online
2008-02-08 16:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@={666C7836-A9B6-4AB4-94ED-DC238C81E925}

[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"ashMaiSv"="C:\PROGRA~1\Avast4\ashmaisv.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 14:06 40048]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll 2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b7d-fffb-11dc-9b1e-0018de1019ed}]
\Shell\AutoRun\command - I:\m9j.com
\Shell\explore\Command - I:\m9j.com
\Shell\open\Command - I:\m9j.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f04431f0-ffca-11dc-9b1c-0018de1019ed}]
\Shell\AutoRun\command - I:\xp19.com
\Shell\explore\Command - I:\xp19.com
\Shell\open\Command - I:\xp19.com

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 18:29:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UMonit = C:\WINDOWS\system32\UMonit.exe??f??|????????????????????????????????????????????????LQ??????????????????????pP????'?0??????|p??|????m??|d??w???????????????w????????????????LQ??????????????\Q???????Q?????w??????????'???'??????S???>'???'???'?TJ(??????S??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-14 18:31:08
ComboFix-quarantined-files.txt 2008-04-14 16:30:57
Pre-Run: 4,392,087,552 bajtów wolnych
Post-Run: 4,410,482,688 bajtów wolnych

przez **ora007** » 14 Kwi 2008, 18:39

Log z ComboFix'a:

ComboFix 08-04-06.1 - Ola 2008-04-14 18:20:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.123 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ola\Pulpit\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\amvo.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 10:01 . 2008-04-14 10:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 21:50 . 2008-04-10 21:50 <DIR> d---s---- C:\Documents and Settings\Ola\UserData
2008-04-09 21:10 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-06 10:42 . 2008-04-05 20:01 103,463 -r-hs---- C:\m9j.com
2008-04-05 19:58 . 2008-04-05 19:58 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:29 1,709,600 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-05 19:58 . 2008-04-05 19:58 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-05 19:58 . 2008-04-05 19:58 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-05 19:58 . 2008-04-14 18:29 37,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-05 19:58 . 2008-04-14 10:20 27,188 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-05 19:58 . 2008-04-14 10:20 4,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-05 19:55 . 2008-04-05 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-05 14:08 . 2008-04-05 14:08 <DIR> d-------- C:\Program Files\PITy
2008-03-25 13:21 . 2008-03-25 13:21 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Image Zone Express
2008-03-25 13:15 . 2008-03-25 14:18 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-25 12:45 . 2008-03-25 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-03-25 12:44 . 2005-04-08 20:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-25 12:43 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\HP
2008-03-25 12:42 . 2008-03-25 12:42 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\HP
2008-03-25 12:42 . 2008-03-25 12:47 79,631 --a------ C:\WINDOWS\hpfins05.dat
2008-03-25 12:42 . 2005-05-24 03:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-25 11:57 . 2008-03-25 13:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Program Files\PDFCreator
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\PDFCreator
2008-03-24 21:51 . 2004-03-22 16:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-24 21:50 . 2008-03-24 21:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-24 21:49 . 2008-03-24 21:50 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-24 21:49 . 2008-03-24 21:49 <DIR> d-------- C:\Program Files\Microsoft Works
2008-03-24 13:05 . 2008-03-24 13:05 <DIR> d-------- C:\WINDOWS\Sun
2008-03-24 13:05 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-24 13:04 . 2008-03-24 13:05 <DIR> d-------- C:\Program Files\Java
2008-03-24 13:01 . 2008-03-24 13:01 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-23 22:13 . 2008-03-23 22:13 2,486,272 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-23 22:13 . 2008-03-23 22:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll
2008-03-23 22:13 . 2008-03-23 22:13 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-23 22:13 . 2008-03-23 22:13 348,160 --a------ C:\WINDOWS\system32\CoreVorbis.ax
2008-03-23 22:13 . 2008-03-23 22:13 319,488 --a------ C:\WINDOWS\system32\CoreAAC.ax
2008-03-23 22:13 . 2008-03-23 22:13 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm
2008-03-23 22:12 . 2008-03-23 22:12 3,138,560 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-23 22:12 . 2008-03-23 22:12 405,504 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-23 22:12 . 2008-03-23 22:12 126,976 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-23 22:12 . 2008-03-23 22:12 547 --a------ C:\WINDOWS\system32\ffdshow.ax.manifest
2008-03-23 22:10 . 2008-03-23 22:10 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll
2008-03-23 22:10 . 2008-03-23 22:10 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-23 22:10 . 2008-03-23 22:10 413,696 --a------ C:\WINDOWS\system32\FLVSplitter.ax
2008-03-23 22:10 . 2008-03-23 22:10 391,168 --a------ C:\WINDOWS\system32\i263_32.drv
2008-03-23 22:10 . 2008-03-23 22:10 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll
2008-03-23 22:10 . 2008-03-23 22:10 188,416 --a------ C:\WINDOWS\system32\vorbis.dll
2008-03-23 22:10 . 2008-03-23 22:10 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax
2008-03-23 22:10 . 2008-03-23 22:10 94,208 --a------ C:\WINDOWS\system32\lmpgvd.ax
2008-03-23 22:10 . 2008-03-23 22:10 86,528 --a------ C:\WINDOWS\system32\DVDVideo.ax
2008-03-23 22:10 . 2008-03-23 22:10 45,056 --a------ C:\WINDOWS\system32\ogg.dll
2008-03-23 22:10 . 2008-03-23 22:10 9,216 --a------ C:\WINDOWS\system32\cpuinf32.dll
2008-03-23 22:08 . 2008-03-23 22:08 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-23 22:08 . 2008-03-23 22:08 185,436 --a------ C:\WINDOWS\system32\CoreAVCDecoder.ax
2008-03-23 22:08 . 2008-03-23 22:08 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll
2008-03-23 22:08 . 2008-03-23 22:08 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Program Files\QT Lite
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-23 22:07 . 2008-01-10 16:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-23 22:07 . 2008-01-10 16:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-23 21:58 . 2008-03-24 22:43 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-23 17:31 . 2008-04-08 19:00 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-03-23 17:31 . 2008-03-23 17:31 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 17:30 . 2008-04-12 15:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 17:05 . 2008-03-23 17:05 <DIR> d-------- C:\Program Files\BearShare Applications
2008-03-23 17:05 . 2008-03-30 22:46 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-03-23 17:05 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-03-23 16:57 . 2008-03-23 16:57 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu
2008-03-23 16:56 . 2008-03-30 15:00 <DIR> d-------- C:\Documents and Settings\Ola\Gadu-Gadu
2008-03-23 16:55 . 2008-03-23 16:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-03-23 16:50 . 2008-03-23 16:50 <DIR> d-------- C:\Program Files\MarBit
2008-03-23 16:45 . 2008-03-23 16:58 <DIR> d-------- C:\Program Files\Winamp
2008-03-23 16:45 . 2008-03-23 17:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Winamp
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Ahead
2008-03-23 14:53 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-03-23 14:53 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-03-23 14:53 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-03-23 14:53 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-23 14:53 . 2004-03-03 21:30 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2008-03-23 14:53 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-03-23 14:53 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-03-23 14:53 . 2004-03-03 21:30 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-03-23 14:05 . 2008-03-23 14:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-23 12:27 . 2008-03-23 12:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-23 12:11 . 2008-03-24 21:51 526 --a------ C:\WINDOWS\ODBC.INI
2008-03-23 12:10 . 2008-04-05 19:56 <DIR> d-------- C:\Program Files\Avast4
2008-03-23 12:10 . 2002-01-05 14:48 974,848 --a------ C:\WINDOWS\system32\MFC70.dll
2008-03-23 12:10 . 2002-01-05 13:40 487,424 --a------ C:\WINDOWS\system32\MSVCP70.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 20:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2008-03-23 20:11 56,832 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2008-03-23 20:11 54,784 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2008-03-23 20:11 397,312 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2008-03-23 20:11 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2008-03-23 20:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2008-03-23 20:11 188,416 ----a-w C:\WINDOWS\system32\ff_theora.dll
2008-03-23 20:11 172,032 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2008-03-23 20:11 143,360 ----a-w C:\WINDOWS\system32\ff_libmad.dll
2008-03-23 20:11 135,168 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
2008-03-23 20:11 118,784 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2008-03-23 20:11 102,912 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2008-03-23 20:09 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-03-23 20:09 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-23 20:09 163,840 ----a-w C:\WINDOWS\system32\ts.dll
2008-03-23 20:09 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
2008-03-23 20:09 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
2008-03-23 20:09 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
2008-03-23 20:09 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
2008-03-23 20:09 108,032 ----a-w C:\WINDOWS\system32\avi.dll
2008-03-22 13:00 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-22 12:59 --------- d-----w C:\Program Files\Usługi online
2008-02-08 16:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@={666C7836-A9B6-4AB4-94ED-DC238C81E925}

[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"ashMaiSv"="C:\PROGRA~1\Avast4\ashmaisv.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 14:06 40048]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll 2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa0c0b7d-fffb-11dc-9b1e-0018de1019ed}]
\Shell\AutoRun\command - I:\m9j.com
\Shell\explore\Command - I:\m9j.com
\Shell\open\Command - I:\m9j.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f04431f0-ffca-11dc-9b1c-0018de1019ed}]
\Shell\AutoRun\command - I:\xp19.com
\Shell\explore\Command - I:\xp19.com
\Shell\open\Command - I:\xp19.com

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 18:29:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UMonit = C:\WINDOWS\system32\UMonit.exe??f??|????????????????????????????????????????????????LQ??????????????????????pP????'?0??????|p??|????m??|d??w???????????????w????????????????LQ??????????????\Q???????Q?????w??????????'???'??????S???>'???'???'?TJ(??????S??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-14 18:31:08
ComboFix-quarantined-files.txt 2008-04-14 16:30:57
Pre-Run: 4,392,087,552 bajtów wolnych
Post-Run: 4,410,482,688 bajtów wolnych

przez **huber2t** » 14 Kwi 2008, 18:46

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\m9j.com Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

przez **ora007** » 14 Kwi 2008, 18:59

ComboFix 08-04-06.1 - Ola 2008-04-14 18:49:49.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.111 [GMT 2:00]
Running from: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ola\Pulpit\CFScript.txt.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\m9j.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\m9j.com

.
((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 10:01 . 2008-04-14 10:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 21:50 . 2008-04-10 21:50 <DIR> d---s---- C:\Documents and Settings\Ola\UserData
2008-04-09 21:10 . 2001-10-26 17:29 177,152 --a------ C:\WINDOWS\system32\LXACSUI.DLL
2008-04-05 19:58 . 2008-04-05 19:58 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-05 19:58 . 2008-04-14 18:56 1,885,216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-05 19:58 . 2008-04-05 19:58 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-05 19:58 . 2008-04-05 19:58 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-05 19:58 . 2008-04-14 18:55 40,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-05 19:58 . 2008-04-14 10:20 27,188 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-05 19:58 . 2008-04-14 10:20 4,340 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-05 19:55 . 2008-04-05 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-05 14:08 . 2008-04-05 14:08 <DIR> d-------- C:\Program Files\PITy
2008-03-25 13:21 . 2008-03-25 13:21 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Image Zone Express
2008-03-25 13:15 . 2008-03-25 14:18 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-25 12:46 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-25 12:45 . 2008-03-25 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-03-25 12:44 . 2005-04-08 20:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-25 12:44 . 2004-08-04 00:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-25 12:43 . 2008-03-25 12:46 <DIR> d-------- C:\Program Files\HP
2008-03-25 12:42 . 2008-03-25 12:42 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\HP
2008-03-25 12:42 . 2008-03-25 12:47 79,631 --a------ C:\WINDOWS\hpfins05.dat
2008-03-25 12:42 . 2005-05-24 03:19 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-25 12:41 . 2004-08-04 00:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-25 11:57 . 2008-03-25 13:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Program Files\PDFCreator
2008-03-25 11:54 . 2008-03-25 11:54 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\PDFCreator
2008-03-24 21:51 . 2004-03-22 16:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-24 21:50 . 2008-03-24 21:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-24 21:49 . 2008-03-24 21:50 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-24 21:49 . 2008-03-24 21:49 <DIR> d-------- C:\Program Files\Microsoft Works
2008-03-24 13:05 . 2008-03-24 13:05 <DIR> d-------- C:\WINDOWS\Sun
2008-03-24 13:05 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-24 13:04 . 2008-03-24 13:05 <DIR> d-------- C:\Program Files\Java
2008-03-24 13:01 . 2008-03-24 13:01 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-23 22:13 . 2008-03-23 22:13 2,486,272 --a------ C:\WINDOWS\system32\ffdshow.ax
2008-03-23 22:13 . 2008-03-23 22:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll
2008-03-23 22:13 . 2008-03-23 22:13 577,536 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-23 22:13 . 2008-03-23 22:13 348,160 --a------ C:\WINDOWS\system32\CoreVorbis.ax
2008-03-23 22:13 . 2008-03-23 22:13 319,488 --a------ C:\WINDOWS\system32\CoreAAC.ax
2008-03-23 22:13 . 2008-03-23 22:13 301,568 --a------ C:\WINDOWS\system32\l3codecp.acm
2008-03-23 22:12 . 2008-03-23 22:12 3,138,560 --a------ C:\WINDOWS\system32\libavcodec.dll
2008-03-23 22:12 . 2008-03-23 22:12 405,504 --a------ C:\WINDOWS\system32\libmplayer.dll
2008-03-23 22:12 . 2008-03-23 22:12 126,976 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2008-03-23 22:12 . 2008-03-23 22:12 547 --a------ C:\WINDOWS\system32\ffdshow.ax.manifest
2008-03-23 22:10 . 2008-03-23 22:10 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll
2008-03-23 22:10 . 2008-03-23 22:10 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-23 22:10 . 2008-03-23 22:10 413,696 --a------ C:\WINDOWS\system32\FLVSplitter.ax
2008-03-23 22:10 . 2008-03-23 22:10 391,168 --a------ C:\WINDOWS\system32\i263_32.drv
2008-03-23 22:10 . 2008-03-23 22:10 245,760 --a------ C:\WINDOWS\system32\mplvpx.dll
2008-03-23 22:10 . 2008-03-23 22:10 188,416 --a------ C:\WINDOWS\system32\vorbis.dll
2008-03-23 22:10 . 2008-03-23 22:10 106,496 --a------ C:\WINDOWS\system32\lmpgspl.ax
2008-03-23 22:10 . 2008-03-23 22:10 94,208 --a------ C:\WINDOWS\system32\lmpgvd.ax
2008-03-23 22:10 . 2008-03-23 22:10 86,528 --a------ C:\WINDOWS\system32\DVDVideo.ax
2008-03-23 22:10 . 2008-03-23 22:10 45,056 --a------ C:\WINDOWS\system32\ogg.dll
2008-03-23 22:10 . 2008-03-23 22:10 9,216 --a------ C:\WINDOWS\system32\cpuinf32.dll
2008-03-23 22:08 . 2008-03-23 22:08 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-23 22:08 . 2008-03-23 22:08 185,436 --a------ C:\WINDOWS\system32\CoreAVCDecoder.ax
2008-03-23 22:08 . 2008-03-23 22:08 79,360 --a------ C:\WINDOWS\system32\mkzlib.dll
2008-03-23 22:08 . 2008-03-23 22:08 23,552 --a------ C:\WINDOWS\system32\mkunicode.dll
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Program Files\QT Lite
2008-03-23 22:07 . 2008-03-23 22:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-03-23 22:07 . 2008-01-10 16:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-23 22:07 . 2008-01-10 16:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-23 21:58 . 2008-03-24 22:43 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-23 17:31 . 2008-04-08 19:00 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\skypePM
2008-03-23 17:31 . 2008-03-23 17:31 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-23 17:30 . 2008-04-12 15:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-23 17:29 . 2008-03-23 17:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-23 17:05 . 2008-03-23 17:05 <DIR> d-------- C:\Program Files\BearShare Applications
2008-03-23 17:05 . 2008-03-30 22:46 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\BearShare
2008-03-23 17:05 . 2006-11-12 12:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-03-23 16:57 . 2008-03-23 16:57 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu
2008-03-23 16:56 . 2008-03-30 15:00 <DIR> d-------- C:\Documents and Settings\Ola\Gadu-Gadu
2008-03-23 16:55 . 2008-03-23 16:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-03-23 16:50 . 2008-03-23 16:50 <DIR> d-------- C:\Program Files\MarBit
2008-03-23 16:45 . 2008-03-23 16:58 <DIR> d-------- C:\Program Files\Winamp
2008-03-23 16:45 . 2008-03-23 17:03 <DIR> d-------- C:\Documents and Settings\Ola\Dane aplikacji\Winamp
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-03-23 14:53 . 2008-03-23 14:53 <DIR> d-------- C:\Program Files\Ahead
2008-03-23 14:53 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-03-23 14:53 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-03-23 14:53 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-03-23 14:53 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-23 14:53 . 2004-03-03 21:30 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2008-03-23 14:53 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-03-23 14:53 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-03-23 14:53 . 2004-03-03 21:30 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-03-23 14:05 . 2008-03-23 14:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-23 12:27 . 2008-03-23 12:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-23 12:11 . 2008-03-24 21:51 526 --a------ C:\WINDOWS\ODBC.INI
2008-03-23 12:10 . 2008-04-05 19:56 <DIR> d-------- C:\Program Files\Avast4
2008-03-23 12:10 . 2002-01-05 14:48 974,848 --a------ C:\WINDOWS\system32\MFC70.dll
2008-03-23 12:10 . 2002-01-05 13:40 487,424 --a------ C:\WINDOWS\system32\MSVCP70.dll
2008-03-23 12:10 . 2002-12-25 10:44 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 20:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2008-03-23 20:11 56,832 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2008-03-23 20:11 54,784 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2008-03-23 20:11 397,312 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2008-03-23 20:11 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2008-03-23 20:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2008-03-23 20:11 188,416 ----a-w C:\WINDOWS\system32\ff_theora.dll
2008-03-23 20:11 172,032 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2008-03-23 20:11 143,360 ----a-w C:\WINDOWS\system32\ff_libmad.dll
2008-03-23 20:11 135,168 ----a-w C:\WINDOWS\system32\ff_samplerate.dll
2008-03-23 20:11 118,784 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2008-03-23 20:11 102,912 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2008-03-23 20:09 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll
2008-03-23 20:09 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-23 20:09 163,840 ----a-w C:\WINDOWS\system32\ts.dll
2008-03-23 20:09 159,744 ----a-w C:\WINDOWS\system32\mmfinfo.dll
2008-03-23 20:09 148,480 ----a-w C:\WINDOWS\system32\mkx.dll
2008-03-23 20:09 141,312 ----a-w C:\WINDOWS\system32\mp4.dll
2008-03-23 20:09 120,832 ----a-w C:\WINDOWS\system32\ogm.dll
2008-03-23 20:09 108,032 ----a-w C:\WINDOWS\system32\avi.dll
2008-03-22 13:00 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-22 12:59 --------- d-----w C:\Program Files\Usługi online
2008-02-08 16:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]
@={666C7836-A9B6-4AB4-94ED-DC238C81E925}

[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]
2006-04-03 02:08 381952 -ra------ C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 11:24 110592]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 02:39 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 02:36 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 02:40 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26 761945]
"UMonit"="C:\WINDOWS\system32\UMonit.exe" [2006-06-09 12:47 200704]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 14:12 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-11-03 14:58 28160 C:\WINDOWS\KHALMNPR.Exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 10:45 877568]
"ashMaiSv"="C:\PROGRA~1\Avast4\ashmaisv.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 14:06 40048]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-03-22 22:18:57 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll 2006-05-03 07:23 40448 C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ItSDisk;ItSDisk;C:\WINDOWS\system32\Drivers\ItSDisk.sys [2006-05-16 20:14]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
R3 FIXUSTOR;FIXUSTOR;C:\WINDOWS\system32\DRIVERS\fixustor.sys [2006-01-26 05:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 18:56:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UMonit = C:\WINDOWS\system32\UMonit.exe??f??|????????????????????????????????????????????????LQ??????????????????????pP????'?0??????|p??|????m??|d??w???????????????w????????????????LQ??????????????\Q???????Q?????w??????????'???'??????S???>'???'???'?TJ(??????S??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-14 18:57:31
ComboFix-quarantined-files.txt 2008-04-14 16:57:19
ComboFix2.txt 2008-04-14 16:31:12
Pre-Run: 4,501,565,440 bajtów wolnych
Post-Run: 4,515,184,640 bajtów wolnych

przez **huber2t** » 14 Kwi 2008, 19:02

Log jest czysty

Przeskanuj komputer tym http://www.kaspersky.pl/virusscanner.html Daj log z niego na forum

Usuń ręcznie folder C: \Qoobox
usuń instalkę Combofix z dysku.

przez **ora007** » 14 Kwi 2008, 19:20

A czy mogę przeskanować kompa Kasperskim zainstalowanym na kompie? Czy musi to być koniecznie skaner on-line?

przez **huber2t** » 14 Kwi 2008, 19:27

Tak możesz ale log ze skanowania daj na forum

przez **ora007** » 14 Kwi 2008, 21:45

A gdzie mam szukać tego loga? Czy będzie on w zakładce "statystyki"? Sorry, że tak zawracam głowę, ale nie mam o tym pojęcia.

przez **huber2t** » 15 Kwi 2008, 03:18

Ze skanu onnline bedziesz mniał okienko że ukończono skanowanie będzie też mozliwy wtedy zapis loga

przez **ora007** » 16 Kwi 2008, 22:54

zeskanowałam kompa Kasperskim zainstalowanym na kompie i nic mi nie wykryło, nie wiem tylko gdzie jest ten log. Co teraz mam zrobić?

przez **huber2t** » 17 Kwi 2008, 03:17

Ale czy ja ci nie kazałem zeskanowac skanerem onnline

przez **ora007** » 17 Kwi 2008, 09:54

Tak, kazałeś, ale powiedziałeś także, że skanerem zainstalowanym na kompie też mogę. Wczoraj odinstalowałam jednak Kasperskiego z kompa i próbowałam przeskanować on-line. Niestety się nie udało i nie wiem dlaczego, jak zdążę to dzisiaj jeszcze przeskanuję jak nie to dopiero po weekendzie.