Proszę o sprawdzenie loga

[Skoku9]

ComboFix 08-08-19.06 - Neghan 2008-08-21 15:12:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.674 [GMT 2:00]
Running from: H:\INSTALKI\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.

2008-08-21 13:56 . 2008-08-21 13:56 <DIR> d-------- C:\WINDOWS\LastGood
2008-08-21 13:51 . 2008-08-21 13:51 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-08-21 13:51 . 2008-08-21 13:51 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-08-19 20:41 . 2008-08-19 20:41 <DIR> d-------- C:\Program Files\EA GAMES
2008-08-19 20:39 . 2008-08-19 20:39 <DIR> d-------- C:\Program Files\Common Files\EasyInfo
2008-08-19 19:41 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-08-19 19:39 . 2008-08-19 19:39 <DIR> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-08-19 19:39 . 2008-08-19 19:39 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-08-19 19:37 . 2008-08-19 19:37 <DIR> d-------- C:\Documents and Settings\Neghan\Dane aplikacji\DAEMON Tools
2008-08-19 19:37 . 2008-08-19 19:37 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-08-17 23:51 . 2008-08-17 23:51 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-08-17 20:11 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-17 20:11 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-15 08:35 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-08-15 08:35 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-14 12:21 . 2008-08-17 23:53 <DIR> d--h----- C:\WINDOWS\$hf_mig$

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 11:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-01 20:21 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 22:51 1266992]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]
"hohohhaha"="C:\WINDOWS\system32\drive\calling.com" [2008-05-21 15:06 754176]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 11:22 86016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 01:02 36352]
"msennger"="C:\WINDOWS\system32\drive\calling.com" [2008-05-21 15:06 754176]
"nwiz"="nwiz.exe" [2006-06-01 11:22 1519616 C:\WINDOWS\system32\nwiz.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 08:27 16207872 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\drive\\calling.com"=

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Neghan\Dane aplikacji\Mozilla\Firefox\Profiles\sl1dxvtf.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.daemon-search.com/default
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 15:13:03
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-21 15:13:26
ComboFix-quarantined-files.txt 2008-08-21 13:13:24

Pre-Run: 7,214,022,656 bajtów wolnych
Post-Run: 8,114,225,152 bajtów wolnych

94 --- E O F --- 2008-08-17 21:53:17


PROSZĘ O SPRAWDZENIE

[huber2t]

Czy są jakieś problemy?
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\drive\calling.com
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Orb"=-
"hohohhaha"=-
"DAEMON Tools Lite"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=-
"msennger"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

Logi dajesz na http://www.wklej.eu/ a w poście dajesz tylko link