Prosze o sprawdzenie loga

[dog07]

to wynik z cmbofixa:


ComboFix 08-07-21.2 - ganst 2008-07-22 17:51:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.129 [GMT 2:00]
Running from: F:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.

2008-07-22 14:03 . 2008-07-22 14:03 <DIR> d-------- C:\Program Files\Shortcut
2008-07-22 13:57 . 2008-07-22 13:57 18,944 --a------ C:\WINDOWS\system32\iexfilter.dll
2008-07-22 13:44 . 2008-07-22 13:44 <DIR> d-------- C:\Program Files\PhotoZoom Pro 2
2008-07-17 19:17 . 2008-07-17 19:17 <DIR> d-------- C:\WINDOWS\system32\Tools
2008-07-16 22:17 . 2001-03-06 18:05 4,358,144 -ra------ C:\WINDOWS\uncsetup.exe
2008-07-16 22:17 . 2008-07-16 22:17 53,248 --a------ C:\WINDOWS\system32\unrar.dll
2008-07-10 17:37 . 2008-07-10 18:11 <DIR> d-------- C:\Documents and Settings\ganst\Dane aplikacji\SecondLife
2008-07-07 14:05 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-07 14:05 . 2001-10-26 16:57 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-07 14:05 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-07 14:05 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-07 13:18 . 2008-07-10 12:35 604 --a------ C:\WINDOWS\Thps3.INI
2008-07-03 16:20 . 2008-07-07 16:59 <DIR> d-------- C:\Documents and Settings\ganst\Dane aplikacji\Hamachi
2008-07-03 16:19 . 2008-07-07 14:49 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-02 14:57 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-06-22 14:45 . 2008-06-22 14:45 1,070,502 --a------ C:\WINDOWS\My 'Me To You' Screensaver.exe
2008-06-22 14:45 . 2008-06-22 14:45 399,072 --a------ C:\WINDOWS\My 'Me To You' Screensaver.scr
2008-06-22 14:45 . 2008-06-22 14:45 40,960 --a------ C:\WINDOWS\My 'Me To You' Screensaver.dll
2008-06-22 14:45 . 2008-06-22 14:45 18,192 --a------ C:\WINDOWS\My 'Me To You' Screensaver.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 14:11 --------- d-----w C:\Documents and Settings\ganst\Dane aplikacji\skypePM
2008-07-22 14:11 --------- d-----w C:\Documents and Settings\ganst\Dane aplikacji\Skype
2008-07-09 20:26 --------- d-----w C:\Documents and Settings\ganst\Dane aplikacji\GanymedeNet
2008-07-04 18:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-23 10:01 4,000 ----a-w C:\ao.dat
2008-06-12 14:16 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-09 15:43 98,512 ----a-w C:\WINDOWS\GREUninstall.exe
2008-06-09 15:43 --------- d-----w C:\Program Files\mozilla.org
2008-06-09 15:43 --------- d-----w C:\Program Files\Common Files\mozilla.org
2008-06-08 10:20 --------- d-----w C:\Documents and Settings\ganst\Dane aplikacji\Ahead
2008-06-08 10:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-06-08 10:18 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-06-08 10:16 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-08 10:15 --------- d-----w C:\Program Files\Nero
2008-06-08 10:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-06-08 10:12 --------- d-----w C:\Program Files\AskTBar
2008-05-28 14:48 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll
2008-05-24 19:34 --------- d-----w C:\Program Files\directx
2008-05-24 08:08 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-12 09:06 151,552 ------w C:\WINDOWS\system32\pxwma.dll
2008-05-12 09:06 108,544 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-05-12 09:06 104,960 ------w C:\WINDOWS\system32\pxinsi64.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2008-06-08 12:12 57344]

[HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{401F4B6B-3C36-4E8D-BC07-F46FC6D67D9A}]
2008-07-22 13:57 18944 --a------ C:\WINDOWS\system32\IEXFIL~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2003-07-29 07:19 49152]
"BitComet"="F:\programy\BitComet\BitComet.exe" [2008-05-05 11:02 2334520]
"Gadu-Gadu"="E:\1.Programy\Gadu-Gadu\gg.exe" [2008-06-03 18:10 2127296]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 12:49 451872]
"NVIEW"="nview.dll" [2003-07-29 07:19 852038 C:\WINDOWS\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-29 07:19 4841472]
"avast!"="E:\14AF6~1.PRO\Avast\ashDisp.exe" [2008-05-16 01:19 79224]
"WinampAgent"="E:\1.Programy\Winamp\winampa.exe" [2003-12-13 02:50 33792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-27 20:43 81920]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="F:\programy\quick\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"WireLessKeyboard"="C:\Program Files\Multimedia Keyboard Driver\StartAutorun.exe" [2005-11-30 12:48 94208]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SsAAD.exe"="E:\14AF6~1.PRO\SONYST~1\SsAAD.exe" [2005-01-24 19:58 81920]
"nwiz"="nwiz.exe" [2003-07-29 07:19 323584 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2002-09-27 08:44 47104 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-24 10:08:31 113664]
Microsoft Office.lnk - E:\1.Programy\Word\Office\OSA9.EXE [2000-01-21 08:15:54 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\1.Programy\\DC++\\DCPlusPlus.exe"=
"E:\\1.Programy\\Gadu-Gadu\\gg.exe"=
"F:\\gry\\q3\\quake3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"F:\\programy\\quick\\iTunes.exe"=
"D:\\programy\\eMule\\emule.exe"=
"F:\\programy\\BitComet\\BitComet.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Documents and Settings\\ganst\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"F:\\programy\\hamachi\\hamachi.exe"=
"F:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"D:\\programy\\tlen\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24595:TCP"= 24595:TCP:BitComet 24595 TCP
"24595:UDP"= 24595:UDP:BitComet 24595 UDP

R0 d344bus;d344bus;C:\WINDOWS\system32\DRIVERS\d344bus.sys [2003-12-27 20:42]
R0 d344prt;d344prt;C:\WINDOWS\system32\Drivers\d344prt.sys [2003-12-27 02:38]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 16:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 16:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 16:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 16:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 16:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39dab67f-21bb-11dd-b042-000ae670a6bf}]
\Shell\AutoRun\command - I:\jfvkcsy.bat
\Shell\explore\Command - I:\jfvkcsy.bat
\Shell\open\Command - I:\jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39dab680-21bb-11dd-b042-000ae670a6bf}]
\Shell\AutoRun\command - J:\jfvkcsy.bat
\Shell\explore\Command - J:\jfvkcsy.bat
\Shell\open\Command - J:\jfvkcsy.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{409e784e-24fc-11dd-b055-000ae670a6bf}]
\Shell\AutoRun\command - jfvkcsy.bat
\Shell\explore\Command - jfvkcsy.bat
\Shell\open\Command - jfvkcsy.bat

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-06-18 08:02:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://google.atcomet.com/b/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: &D&ownload &with BitComet - F:\programy\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - F:\programy\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - F:\programy\BitComet\BitComet.exe/AddAllLink.htm
O9 -: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\programy\BitComet\tools\BitCometBHO_1.2.2.28.dll/206


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 17:54:10
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-07-22 17:57:09
ComboFix-quarantined-files.txt 2008-07-22 15:56:02

Pre-Run: 1,524,109,312 bajtów wolnych
Post-Run: 1,760,788,480 bajtów wolnych

163

[huber2t]

Do wyleczenia pendrive z wirusów użyj
Perlovga Removal Tool
Flash Disinfector
lub format

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\iexfilter.dll

Folder::
C:\Program Files\AskTBar

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"=-
[-HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{401F4B6B-3C36-4E8D-BC07-F46FC6D67D9A}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39dab67f-21bb-11dd-b042-000ae670a6bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39dab680-21bb-11dd-b042-000ae670a6bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{409e784e-24fc-11dd-b055-000ae670a6bf}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Podaj log z HijackThis

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link

[dog07]

log z combofix http://www.wklejto.pl/6417

log z Hijack http://www.wklejto.pl/6418

[huber2t]

fix w hijackthis

O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\programy\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

otwórz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b619672-2003-11dd-b037-000ae670a6bf}]

Z menu Notatnika Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg

Uruchom ten plik, uruchom ponownie komputer

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!