Proszę o sprawdzenie loga

[Vurba]

ComboFix 08-06-06.6 - Yodas 2008-06-07 19:24:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.113 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\00BBBB15
C:\Program Files\myglobalsearch\bar\Cache\00BBC507
C:\Program Files\myglobalsearch\bar\Cache\00BBD023.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD459.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD69B.bin
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm

.
((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.

2008-06-04 18:57 . 2008-06-07 08:52 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\ESET
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:35 . 2008-05-22 08:35 <DIR> d-------- C:\Program Files\Sun
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-05-20 16:07 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 07:49 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-06-05 18:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 19:25:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-07 19:26:50
ComboFix-quarantined-files.txt 2008-06-07 17:26:46

Pre-Run: 6,445,002,752 bajtów wolnych
Post-Run: 6,445,809,664 bajtów wolnych

133 --- E O F --- 2008-05-18 15:35:49

[huber2t]

log ok

Czy sa jakieś problemy?

[Vurba]

Mój problem polega na tym że internet pada co ok. 10 min ;/

[huber2t]

daj log z HijackThis

[Vurba]

Ok, tutaj daję loga z hijack~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:46:20, on 2008-06-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Gadu-Gadu\gg.exe
E:\counterstrike\steam.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
D:\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Aimp\AIMP2.exe
C:\Program Files\Tibia\Tibia.exe
D:\xDDDD\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Steam] "e:\counterstrike\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus ... nicode.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: McAfee Application Installer Cleanup (0175331211142666) (0175331211142666mcinstcleanup) - Unknown owner - C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - D:\Ares\chatServer.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4816 bytes





Wczoraj także skanowałem kasperskym online, też dać loga?

[huber2t]

fix w hijackthis

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

Driver::
McAfee Application Installer Cleanup


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

[Vurba]

Log z ComboFix



ComboFix 08-06-06.6 - Yodas 2008-06-08 12:33:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.44 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Yodas\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.

2008-06-08 11:30 . 2008-06-08 12:27 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-08 11:10 . 2008-06-08 11:12 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Program Files\AVG
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\AVGTOOLBAR
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8
2008-06-08 11:10 . 2008-06-08 11:10 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-08 11:10 . 2008-06-08 11:10 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-08 11:10 . 2008-06-08 11:10 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-08 11:08 . 2008-06-08 11:08 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-07 22:42 . 2008-06-07 23:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-07 20:59 . 2008-06-07 21:01 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-07 20:59 . 2008-06-07 21:00 <DIR> d-------- C:\Program Files\CCleaner
2008-06-04 18:57 . 2008-06-08 08:24 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-06-08 11:58 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 08:51 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-06-07 20:02 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-07_19.26.39,35 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-07 14:28:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 05:10:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-03-13 14:43:42 40,456 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\eamon.sys
+ 2008-03-13 14:44:36 29,704 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\easdrv.sys
+ 2008-03-13 14:52:18 33,800 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\epfwtdir.sys
+ 2008-06-08 09:10:48 26,184 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys
+ 2005-05-24 10:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 13:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 13:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2006-12-01 20:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 20:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 20:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 20:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 22:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 22:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 22:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 22:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 22:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 22:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 22:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 22:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 22:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
2008-06-08 11:10 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-08 11:10 2050816]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]
"SpybotSD TeaTimer"="D:\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-08 11:10 1177368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:10]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-08 11:10]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:10]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:10]
R4 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys []
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []

*Newly Created Service* - AVG8EMC
*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - AVGTDIX
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 12:35:29
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-08 12:36:47
ComboFix-quarantined-files.txt 2008-06-08 10:36:39
ComboFix2.txt 2008-06-07 17:26:51

Pre-Run: 6,480,965,632 bajtów wolnych
Post-Run: 6,497,296,384 bajtów wolnych

170 --- E O F --- 2008-05-18 15:35:49

[huber2t]

log ok
Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

Włącz przywracanie systemu.