Prosze o sprawdzenie logów z Combofixa i Hijackthisa

Dzisiaj na kompa wgrał mi się denerwujący wirus, nie pokazywał mi ukrytych plików folderów, otwierał każdy folder osobno, mulił kompa itp. To był olhrwef.exe, i.com, o.exe i jakieś .dll ( nie wiem czy to jeden czy więcej ). Avast coś tam usuwał, dr. web też, ad-aware tylko cookie, bo na pełnym nie chce coś skanować. Otóż Hijakcthiem usunąłem ten wpis olhrwef, ale cały czas się pojawiał. Combofix te wszystkie wpisy co napisałem usunął, ale wolałbym wiedzieć czy mam system czysty.

Kod:

ComboFix 09-03-06.02 - Kosmo 2009-03-09 20:23:53.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.2047.1479 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Kosmo\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090305-1] *On-access scanning disabled* (Updated)
AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated)
 * Resident AV is active

.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
D:\Autorun.inf

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-02-09 do 2009-03-09  )))))))))))))))))))))))))))))))
.

2009-03-09 18:13 . 2009-03-05 15:07   100,472   --a------   c:\windows\system32\drivers\dwprot.sys
2009-03-09 18:12 . 2009-03-09 18:12   <DIR>   d--------   c:\program files\Common Files\Doctor Web
2009-03-09 16:44 . 2009-03-09 16:44   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Doctor Web
2009-03-09 16:06 . 2009-03-09 16:05   109,308   -r-hs----   C:\u.com
2009-03-08 16:21 . 2009-03-08 16:21   221   --a------   c:\windows\NCLogConfig.ini
2009-03-05 17:10 . 2009-03-05 17:10   <DIR>   d--------   c:\program files\MSBuild
2009-03-05 17:08 . 2009-03-05 17:08   <DIR>   d--------   c:\windows\system32\XPSViewer
2009-03-05 17:08 . 2009-03-05 17:08   <DIR>   d--------   c:\program files\Reference Assemblies
2009-03-05 17:07 . 2006-06-29 13:07   14,048   ---------   c:\windows\system32\spmsg2.dll
2009-03-04 16:27 . 2009-03-04 16:36   81,984   --a------   c:\windows\system32\bdod.bin
2009-03-04 16:24 . 2009-03-04 16:36   <DIR>   d--------   c:\program files\Common Files\Softwin
2009-02-28 18:47 . 2009-02-28 18:47   <DIR>   d--------   c:\documents and settings\Kosmo\Dane aplikacji\Any Video Converter
2009-02-21 15:52 . 2009-02-10 12:02   787,672   --a------   c:\windows\system32\drivers\cfosspeed.sys
2009-02-21 15:52 . 2009-02-10 12:02   290,008   --a------   c:\windows\system32\cfosspeed.dll
2009-02-19 18:08 . 2009-02-19 18:31   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\NexonEU
2009-02-19 16:12 . 2009-02-19 16:12   <DIR>   d--------   c:\windows\nview
2009-02-19 16:12 . 2009-02-09 13:18   453,152   --a------   c:\windows\system32\nvudisp.exe
2009-02-19 16:12 . 2009-03-09 20:21   216,597   --a------   c:\windows\system32\nvapps.xml
2009-02-19 16:12 . 2009-02-09 13:18   18,795   --a------   c:\windows\system32\nvdisp.nvu
2009-02-19 16:11 . 2009-02-05 10:54   453,152   --a------   c:\windows\system32\NVUNINST.EXE
2009-02-19 15:18 . 2009-02-19 15:18   <DIR>   d--------   C:\Nexon
2009-02-19 15:18 . 2009-02-19 18:09   <DIR>   d--------   C:\download
2009-02-19 15:18 . 2009-02-19 16:16   421,888   --a------   c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-02-16 15:17 . 2009-02-27 19:36   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Hagel Technologies
2009-02-15 11:32 . 2005-02-12 15:43   245,760   --a------   c:\windows\system32\vbalColumnTreeView6.ocx
2009-02-15 11:32 . 1999-08-02 16:11   57,344   --a------   c:\windows\system32\CGZipLibrary.DLL
2009-02-15 11:32 . 2003-01-26 13:41   40,960   --a------   c:\windows\system32\SSubTmr6.dll
2009-02-15 11:32 . 1999-03-12 01:20   18,728   --a------   c:\windows\system32\ISHF_Ex.tlb
2009-02-15 11:32 . 1998-03-18 16:45   8,096   --a------   c:\windows\system32\OLEGUIDS.TLB
2009-02-11 14:24 . 2009-02-11 14:24   249,856   ---------   c:\windows\Setup1.exe
2009-02-11 14:24 . 2009-02-11 14:24   73,216   --a------   c:\windows\ST6UNST.EXE

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-08 18:17   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\Skype
2009-03-08 16:47   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\skypePM
2009-03-08 15:21   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\HP
2009-03-05 15:21   ---------   d-----w   c:\program files\Common Files\Wise Installation Wizard
2009-02-19 15:12   ---------   d-----w   c:\program files\AGEIA Technologies
2009-02-18 12:03   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\Image Zone Express
2009-02-12 21:05   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\gtk-2.0
2009-02-06 11:26   ---------   d-----w   c:\program files\Common Files\Labtec
2009-02-06 11:23   ---------   d-----w   c:\program files\Common Files\LogiShrd
2009-02-04 23:02   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-02-04 23:02   ---------   d-----w   c:\program files\ROBOT Structural Office
2009-02-04 23:02   ---------   d-----w   c:\program files\Common Files\RoboBAT
2009-01-31 11:20   ---------   d-----w   c:\program files\Labtec
2009-01-27 17:02   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\TMP
2009-01-27 17:01   ---------   d-----w   c:\program files\Marvell
2009-01-22 15:10   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-17 12:37   ---------   d-----w   c:\program files\HP
2009-01-17 12:36   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-01-16 17:24   70,936   ----a-w   c:\windows\system32\PhysXLoader.dll
2009-01-15 12:53   ---------   d-----w   c:\program files\Skype
2009-01-15 12:53   ---------   d-----w   c:\program files\Common Files\Skype
2009-01-15 12:53   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Skype
2008-12-13 16:23   410,984   ----a-w   c:\windows\system32\deploytk.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-13 136600]
"HP Software Update"="d:\hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LogitechVideoRepair"="d:\labtec\ISStart.exe" [2004-02-12 188416]
"LogitechVideoTray"="d:\labtec\LogiTray.exe" [2004-02-12 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"cFosSpeed"="d:\cfosspeed\cFosSpeed.exe" [2009-02-10 876760]
"avast!"="d:\avast\ashDisp.exe" [2009-02-05 81000]
"SpIDerAgent"="d:\drweb\SpIDerAgent.exe" [2009-02-19 423152]
"SpIDerMail"="d:\drweb\spiderml.exe" [2009-03-05 640240]
"SpIDerNT"="d:\drweb\spiderui.exe" [2008-12-09 197896]
"nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-08 1205840]
HP Digital Imaging Monitor.lnk - d:\hp\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      autocheck autochk *\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Tlen\\tlen.exe"=
"d:\\Metin 2\\metin2.bin"=
"d:\\Call of Duty - World at War\\CoDWaWmp.exe"=
"d:\\Call of Duty - World at War\\CoDWaW.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Gadu-Gadu\\gg.exe"=
"d:\\FIFA 08\\FIFA08.exe"=
"d:\\Dance Party\\Program\\DanceParty.exe"=
"d:\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\Steam\\hl.exe"=
"c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"=
"d:\combat arms eu\CombatArms.exe"= d:\combat arms eu\CombatArms.exe:*Enabled:CombatArms.exe
"d:\combat arms eu\Engine.exe"= d:\combat arms eu\Engine.exe:*Enabled:Engine.exe
"d:\\Combat Arms EU\\NMService.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [2009-03-09 100472]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-05 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-05 20560]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [2008-10-17 886072]
R2 SPIDER;SpIDer Guard File System Monitor;d:\drweb\spider.sys [2008-12-09 268328]
R2 SPIDERNT;SpIDer Guard for Windows;d:\drweb\spidernt.exe [2008-12-09 197896]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2008-12-08 104344]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2008-12-08 69656]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0db7d919-0663-11de-b2fb-4d6564696130}]
\Shell\AutoRun\command - H:\iqe68o.bat
\Shell\explore\Command - H:\iqe68o.bat
\Shell\open\Command - H:\iqe68o.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec917e64-d71a-11dd-b21e-4d6564696130}]
\Shell\AutoRun\command - H:\o.exe
\Shell\open\Command - H:\o.exe
.
Zawartość folderu 'Zaplanowane zadania'

2009-03-09 c:\windows\Tasks\Dr.Web Update.job
- d:\drweb\ [2009-03-09 20:15]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe


.
------- Skan uzupełniający -------
.
IE: E&ksportuj do programu Microsoft Excel - d:\micros~1\Office12\EXCEL.EXE/3000
LSP: d:\drweb\drwebsp.dll
TCP: {514D1C80-D8E5-4FB5-8E48-9394AE0B0A9F} = 83.238.255.76 213.241.79.37
FF - ProfilePath - c:\documents and settings\Kosmo\Dane aplikacji\Mozilla\Firefox\Profiles\90qefse8.default\
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll
FF - plugin: d:\acrobat reader\Reader\browser\nppdf32.dll
FF - plugin: d:\mozilla firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-09 20:27:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'lsass.exe'(768)
d:\drweb\drwebsp.dll
.
Czas ukończenia: 2009-03-09 20:28:35
ComboFix-quarantined-files.txt  2009-03-09 19:28:33

Przed: 28,449,337,344 bajtów wolnych
Po: 28,837,175,296 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

196


Kod:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:42:16, on 2009-03-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Lavasoft\aawservice.exe
D:\Avast\aswUpdSv.exe
D:\Avast\ashServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\HP\HP Software Update\HPWuSchd2.exe
D:\Labtec\LogiTray.exe
D:\cFosSpeed\cFosSpeed.exe
D:\Avast\ashDisp.exe
D:\DrWeb\SpIDerAgent.exe
D:\DrWeb\spiderml.exe
D:\DrWeb\spiderui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\spoolsv.exe
D:\cFosSpeed\spd.exe
D:\Diskeeper\DkService.exe
C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\DrWeb\spidernt.exe
C:\WINDOWS\system32\svchost.exe
D:\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
D:\Mozilla Firefox\firefox.exe
D:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Labtec\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Labtec\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [cFosSpeed] D:\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [avast!] D:\Avast\ashDisp.exe
O4 - HKLM\..\Run: [SpIDerAgent] "D:\DrWeb\SpIDerAgent.exe"
O4 - HKLM\..\Run: [SpIDerMail] "D:\DrWeb\spiderml.exe"
O4 - HKLM\..\Run: [SpIDerNT] D:\DrWeb\spiderui.exe /agent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{514D1C80-D8E5-4FB5-8E48-9394AE0B0A9F}: NameServer = 83.238.255.76 213.241.79.37
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Lavasoft\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Avast\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Avast\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Avast\ashWebSv.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\cFosSpeed\spd.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Diskeeper\DkService.exe
O23 - Service: Dr.Web ® Scanning Engine (DrWebEngine) (DrWebEngine) - Doctor Web, Ltd. - C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Doctor Web, Ltd. - D:\DrWeb\spidernt.exe

--
End of file - 5715 bytes


Do sprawdzanie logów z hijachtisa jest pewna stronka, czy istnieje również takie coś do Combofixa ? Oraz jak usunąć te ścierwa z pena, aby systemu nie zarazić, bo to na nim znalazłem jeden z tych plików i możliwe, że to jego [pendrive'a] wina ...

automaty są zawodne więc nie polecam sprawdzania samemu na tego typu stronach

Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
lub format

Pobierz ComboFix, ale nie uruchamiaj
Zaznacz, wklej do notatnika, i zapisz plik jako CFScript.txt najlepiej aby ikonka tego pliku znajdowała się obok ikonki ComboFix.exe

Kod:

File::
C:\u.com
c:\windows\Setup1.exe
c:\windows\system32\olhrwef.exe
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]


Dzięki wielkie, ten plik .txt wkleiłem do Combofixa, usunął te wpisy, mam nadzieję, że teraz będzie dobrze

Jakby co wkleję najświeższe logi.

Kod:

ComboFix 09-03-06.02 - Kosmo 2009-03-09 21:24:41.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.2047.1652 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Kosmo\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Kosmo\Pulpit\CFScript.txt.txt
AV: avast! antivirus 4.8.1335 [VPS 090305-1] *On-access scanning disabled* (Updated)
AV: Doctor Web Anti-Virus *On-access scanning disabled* (Updated)
 * Utworzono nowy punkt przywracania

FILE ::
C:\u.com
c:\windows\Setup1.exe
c:\windows\system32\olhrwef.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\u.com
c:\windows\Setup1.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-02-09 do 2009-03-09  )))))))))))))))))))))))))))))))
.

2009-03-09 16:44 . 2009-03-09 16:44   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Doctor Web
2009-03-08 16:21 . 2009-03-08 16:21   221   --a------   c:\windows\NCLogConfig.ini
2009-03-05 17:10 . 2009-03-05 17:10   <DIR>   d--------   c:\program files\MSBuild
2009-03-05 17:08 . 2009-03-05 17:08   <DIR>   d--------   c:\windows\system32\XPSViewer
2009-03-05 17:08 . 2009-03-05 17:08   <DIR>   d--------   c:\program files\Reference Assemblies
2009-03-05 17:07 . 2006-06-29 13:07   14,048   ---------   c:\windows\system32\spmsg2.dll
2009-03-04 16:27 . 2009-03-04 16:36   81,984   --a------   c:\windows\system32\bdod.bin
2009-03-04 16:24 . 2009-03-04 16:36   <DIR>   d--------   c:\program files\Common Files\Softwin
2009-02-28 18:47 . 2009-02-28 18:47   <DIR>   d--------   c:\documents and settings\Kosmo\Dane aplikacji\Any Video Converter
2009-02-21 15:52 . 2009-02-10 12:02   787,672   --a------   c:\windows\system32\drivers\cfosspeed.sys
2009-02-21 15:52 . 2009-02-10 12:02   290,008   --a------   c:\windows\system32\cfosspeed.dll
2009-02-19 18:08 . 2009-02-19 18:31   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\NexonEU
2009-02-19 16:12 . 2009-02-19 16:12   <DIR>   d--------   c:\windows\nview
2009-02-19 16:12 . 2009-02-09 13:18   453,152   --a------   c:\windows\system32\nvudisp.exe
2009-02-19 16:12 . 2009-03-09 21:17   216,597   --a------   c:\windows\system32\nvapps.xml
2009-02-19 16:12 . 2009-02-09 13:18   18,795   --a------   c:\windows\system32\nvdisp.nvu
2009-02-19 16:11 . 2009-02-05 10:54   453,152   --a------   c:\windows\system32\NVUNINST.EXE
2009-02-19 15:18 . 2009-02-19 15:18   <DIR>   d--------   C:\Nexon
2009-02-19 15:18 . 2009-02-19 18:09   <DIR>   d--------   C:\download
2009-02-19 15:18 . 2009-02-19 16:16   421,888   --a------   c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-02-16 15:17 . 2009-02-27 19:36   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Hagel Technologies
2009-02-15 11:32 . 2005-02-12 15:43   245,760   --a------   c:\windows\system32\vbalColumnTreeView6.ocx
2009-02-15 11:32 . 1999-08-02 16:11   57,344   --a------   c:\windows\system32\CGZipLibrary.DLL
2009-02-15 11:32 . 2003-01-26 13:41   40,960   --a------   c:\windows\system32\SSubTmr6.dll
2009-02-15 11:32 . 1999-03-12 01:20   18,728   --a------   c:\windows\system32\ISHF_Ex.tlb
2009-02-15 11:32 . 1998-03-18 16:45   8,096   --a------   c:\windows\system32\OLEGUIDS.TLB
2009-02-11 14:24 . 2009-02-11 14:24   73,216   --a------   c:\windows\ST6UNST.EXE

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-08 18:17   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\Skype
2009-03-08 16:47   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\skypePM
2009-03-08 15:21   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\HP
2009-03-05 15:21   ---------   d-----w   c:\program files\Common Files\Wise Installation Wizard
2009-02-19 15:12   ---------   d-----w   c:\program files\AGEIA Technologies
2009-02-18 12:03   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\Image Zone Express
2009-02-12 21:05   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\gtk-2.0
2009-02-06 11:26   ---------   d-----w   c:\program files\Common Files\Labtec
2009-02-06 11:23   ---------   d-----w   c:\program files\Common Files\LogiShrd
2009-02-04 23:02   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-02-04 23:02   ---------   d-----w   c:\program files\ROBOT Structural Office
2009-02-04 23:02   ---------   d-----w   c:\program files\Common Files\RoboBAT
2009-01-31 11:20   ---------   d-----w   c:\program files\Labtec
2009-01-27 17:02   ---------   d-----w   c:\documents and settings\Kosmo\Dane aplikacji\TMP
2009-01-27 17:01   ---------   d-----w   c:\program files\Marvell
2009-01-22 15:10   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-17 12:37   ---------   d-----w   c:\program files\HP
2009-01-17 12:36   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-01-16 17:24   70,936   ----a-w   c:\windows\system32\PhysXLoader.dll
2009-01-15 12:53   ---------   d-----w   c:\program files\Skype
2009-01-15 12:53   ---------   d-----w   c:\program files\Common Files\Skype
2009-01-15 12:53   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Skype
2008-12-13 16:23   410,984   ----a-w   c:\windows\system32\deploytk.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-03-09_20.28.07.67   )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-03 22:43:54   66,560   ----a-w   c:\windows\system32\cdm.dll
+ 2008-10-16 13:09:44   92,696   ----a-w   c:\windows\system32\cdm.dll
- 2004-08-03 22:43:54   66,560   -c--a-w   c:\windows\system32\dllcache\cdm.dll
+ 2008-10-16 13:09:44   92,696   -c--a-w   c:\windows\system32\dllcache\cdm.dll
- 2004-08-03 22:44:16   431,616   -c--a-w   c:\windows\system32\dllcache\wuapi.dll
+ 2008-10-16 13:12:20   561,688   -c--a-w   c:\windows\system32\dllcache\wuapi.dll
- 2004-08-03 22:44:30   112,128   -c--a-w   c:\windows\system32\dllcache\wuauclt.exe
+ 2008-10-16 13:09:44   51,224   -c--a-w   c:\windows\system32\dllcache\wuauclt.exe
- 2004-08-03 22:44:16   1,134,592   -c--a-w   c:\windows\system32\dllcache\wuaueng.dll
+ 2008-10-16 13:13:40   1,809,944   -c--a-w   c:\windows\system32\dllcache\wuaueng.dll
- 2004-08-03 22:44:16   113,664   -c--a-w   c:\windows\system32\dllcache\wucltui.dll
+ 2008-10-16 13:12:22   323,608   -c--a-w   c:\windows\system32\dllcache\wucltui.dll
- 2004-08-03 22:44:16   120,320   -c--a-w   c:\windows\system32\dllcache\wuweb.dll
+ 2008-10-16 13:13:40   202,776   -c--a-w   c:\windows\system32\dllcache\wuweb.dll
+ 2008-10-16 13:08:58   34,328   ----a-w   c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
- 2004-08-03 22:44:16   431,616   ----a-w   c:\windows\system32\wuapi.dll
+ 2008-10-16 13:12:20   561,688   ----a-w   c:\windows\system32\wuapi.dll
- 2004-08-03 22:44:30   112,128   ----a-w   c:\windows\system32\wuauclt.exe
+ 2008-10-16 13:09:44   51,224   ----a-w   c:\windows\system32\wuauclt.exe
- 2004-08-03 22:44:16   1,134,592   ----a-w   c:\windows\system32\wuaueng.dll
+ 2008-10-16 13:13:40   1,809,944   ----a-w   c:\windows\system32\wuaueng.dll
- 2004-08-03 22:44:16   113,664   ----a-w   c:\windows\system32\wucltui.dll
+ 2008-10-16 13:12:22   323,608   ----a-w   c:\windows\system32\wucltui.dll
+ 2008-10-16 13:09:44   43,544   ----a-w   c:\windows\system32\wups2.dll
- 2004-08-03 22:44:16   120,320   ----a-w   c:\windows\system32\wuweb.dll
+ 2008-10-16 13:13:40   202,776   ----a-w   c:\windows\system32\wuweb.dll
+ 2009-03-09 20:16:59   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_5c8.dat
+ 2009-03-09 19:51:42   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_720.dat
+ 2009-03-09 20:17:03   16,384   ----atw   c:\windows\Temp\Perflib_Perfdata_77c.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-13 136600]
"HP Software Update"="d:\hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LogitechVideoRepair"="d:\labtec\ISStart.exe" [2004-02-12 188416]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"cFosSpeed"="d:\cfosspeed\cFosSpeed.exe" [2009-02-10 876760]
"avast!"="d:\avast\ashDisp.exe" [2009-02-05 81000]
"nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-08 1205840]
HP Digital Imaging Monitor.lnk - d:\hp\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      autocheck autochk *\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete\[u]0[/u]autocheck lsdelete

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
--a------ 2004-02-12 16:59 77824 d:\labtec\LogiTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Tlen\\tlen.exe"=
"d:\\Metin 2\\metin2.bin"=
"d:\\Call of Duty - World at War\\CoDWaWmp.exe"=
"d:\\Call of Duty - World at War\\CoDWaW.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"d:\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Gadu-Gadu\\gg.exe"=
"d:\\FIFA 08\\FIFA08.exe"=
"d:\\Dance Party\\Program\\DanceParty.exe"=
"d:\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\Steam\\hl.exe"=
"c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"=
"d:\combat arms eu\CombatArms.exe"= d:\combat arms eu\CombatArms.exe:*Enabled:CombatArms.exe
"d:\combat arms eu\Engine.exe"= d:\combat arms eu\Engine.exe:*Enabled:Engine.exe
"d:\\Combat Arms EU\\NMService.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-05 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-05 20560]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2008-12-08 104344]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2008-12-08 69656]
.
.
------- Skan uzupełniający -------
.
IE: E&ksportuj do programu Microsoft Excel - d:\micros~1\Office12\EXCEL.EXE/3000
TCP: {514D1C80-D8E5-4FB5-8E48-9394AE0B0A9F} = 83.238.255.76 213.241.79.37
FF - ProfilePath - c:\documents and settings\Kosmo\Dane aplikacji\Mozilla\Firefox\Profiles\90qefse8.default\
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll
FF - plugin: d:\acrobat reader\Reader\browser\nppdf32.dll
FF - plugin: d:\mozilla firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-09 21:25:29
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2009-03-09 21:26:02
ComboFix-quarantined-files.txt  2009-03-09 20:26:00
ComboFix2.txt  2009-03-09 19:49:15
ComboFix3.txt  2009-03-09 19:28:36

Przed: 28 803 059 712 bajtów wolnych
Po: 28,789,751,808 bajtów wolnych

197


usuń ręcznie folder C:\Qoobox oraz instalkę Combofix z dysku.

Wyłącz I włącz przywracanie systemu na wszystkich dyskach.Instrukcja

przeskanuj komputer Kaspersky
gdy będą wirusy pokaż raport lub Dr.WEB CureIt!

otwórz notatnik i wklej
[code]
Windows Registry Editor Version 5.00