Po wczorajszym przeinstalowaniu XP było wszystko ok. Nagrałem antywirusa Eset Nod 32.. Po chwili pojawił sie taki komunikat (na dole po prawej stronie) http://img183.imageshack.us/img183/9549/beztytuuct1.jpg . Prubowałem skanować Spyware Doctor i innymi programami.. Jednak to nadal sie pojawiało;/ Co zrobić aby usunąć to doszczętnie itp. Oto log z Combofixa [quote] ComboFix 09-01-21.04 - Maniek 2009-01-22 23:01:07.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.226 [GMT 1:00] Uruchomiony z: e:\documents and settings\Maniek\Pulpit\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-22 do 2009-01-22 ))))))))))))))))))))))))))))))) . 2009-01-22 22:47 . 2009-01-22 22:54 d-------- e:\program files\a-squared Anti-Malware 2009-01-22 22:42 . 2009-01-22 22:43 d-------- e:\program files\Anti-Trojan-55 2009-01-22 22:39 . 2009-01-22 22:39 d-------- e:\documents and settings\Maniek\Dane aplikacji\Simply Super Software 2009-01-22 22:39 . 2009-01-22 22:39 d-------- e:\documents and settings\All Users\Dane aplikacji\Simply Super Software 2009-01-22 22:39 . 2006-05-25 14:52 162,304 --a------ e:\windows\system32\ztvunrar36.dll 2009-01-22 22:39 . 2003-02-02 19:06 153,088 --a------ e:\windows\system32\unrar3.dll 2009-01-22 22:39 . 2005-08-26 00:50 77,312 --a------ e:\windows\system32\ztvunace26.dll 2009-01-22 22:39 . 2002-03-06 00:00 75,264 --a------ e:\windows\system32\unacev2.dll 2009-01-22 22:39 . 2006-06-19 12:01 69,632 --a------ e:\windows\system32\ztvcabinet.dll 2009-01-22 22:25 . 2009-01-22 22:25 98,304 --a------ e:\windows\system32\qttask.exe 2009-01-22 22:22 . 2003-08-18 05:10 122,880 --a------ e:\windows\system32\directx.cpl 2009-01-22 22:22 . 2003-03-25 05:49 106,544 --a------ e:\windows\system32\tweakui.cpl 2009-01-22 22:22 . 2003-03-25 05:49 98,304 --a------ e:\windows\system32\startup.cpl 2009-01-22 22:22 . 2004-02-17 10:11 53,248 --a------ e:\windows\system32\vp6dec_settings.cpl 2009-01-22 22:22 . 2003-03-25 05:49 51,238 --a------ e:\windows\system32\tweakui.hlp 2009-01-22 22:21 . 2004-09-23 18:57 6,676,480 --a------ e:\windows\system32\quicktime.qts 2009-01-22 22:21 . 2004-11-08 20:01 360,504 --a------ e:\windows\system32\qtplugin.ocx 2009-01-22 22:21 . 2004-09-23 18:57 323,072 --a------ e:\windows\system32\quicktime.cpl 2009-01-22 22:21 . 2009-01-22 22:25 9,006 --a------ e:\windows\system32\quicktime.qtp 2009-01-22 22:19 . 2009-01-22 22:22 d-------- e:\program files\ACE Mega CoDecS Pack 2009-01-22 22:19 . 2004-05-25 16:06 417,792 --a------ e:\windows\system32\ac3filter.cpl 2009-01-22 22:07 . 2009-01-22 22:07 d-------- e:\documents and settings\Maniek\Dane aplikacji\DivX 2009-01-22 22:05 . 2009-01-22 22:21 d-------- e:\windows\system32\QuickTime 2009-01-22 22:05 . 2004-08-03 23:15 82,944 --a------ e:\windows\system32\drivers\wdmaud.sys 2009-01-22 22:05 . 2004-08-03 23:15 82,944 --a--c--- e:\windows\system32\dllcache\wdmaud.sys 2009-01-22 22:05 . 2001-08-17 22:00 54,272 --a------ e:\windows\system32\drivers\swmidi.sys 2009-01-22 22:05 . 2001-08-17 22:00 54,272 --a--c--- e:\windows\system32\dllcache\swmidi.sys 2009-01-22 22:05 . 2004-08-03 23:07 52,864 --a------ e:\windows\system32\drivers\DMusic.sys 2009-01-22 22:05 . 2004-08-03 23:07 52,864 --a--c--- e:\windows\system32\dllcache\dmusic.sys 2009-01-22 22:05 . 2006-08-01 15:02 49,152 --a------ e:\windows\system32\ChCfg.exe 2009-01-22 22:05 . 2004-08-03 23:07 6,400 --a------ e:\windows\system32\drivers\splitter.sys 2009-01-22 22:05 . 2004-08-03 23:07 6,400 --a--c--- e:\windows\system32\dllcache\splitter.sys 2009-01-22 22:03 . 2009-01-22 22:03 d-------- e:\program files\Realtek AC97 2009-01-22 22:03 . 2009-01-22 22:03 d--h----- e:\program files\InstallShield Installation Information 2009-01-22 22:03 . 2006-11-17 05:40 18,804,736 --a------ e:\windows\system32\alsndmgr.cpl 2009-01-22 22:03 . 2006-12-08 15:20 10,528,768 --a------ e:\windows\system32\RTLCPL.exe 2009-01-22 22:03 . 2007-04-16 15:28 577,536 --a------ e:\windows\soundman.exe 2009-01-22 22:03 . 2006-07-31 11:19 315,392 --a------ e:\windows\alcupd.exe 2009-01-22 22:03 . 2006-07-31 11:27 217,088 --a------ e:\windows\Alcrmv.exe 2009-01-22 22:03 . 2006-10-18 02:53 147,456 --a------ e:\windows\system32\RtlCPAPI.dll 2009-01-22 22:03 . 2002-02-05 13:54 141,016 --a------ e:\windows\system32\alsndmgr.wav 2009-01-22 22:03 . 2004-08-04 00:44 130,048 --a------ e:\windows\system32\ksproxy.ax 2009-01-22 22:03 . 2004-08-04 00:44 130,048 --a--c--- e:\windows\system32\dllcache\ksproxy.ax 2009-01-22 22:03 . 2004-08-03 23:08 60,288 --a------ e:\windows\system32\drivers\drmk.sys 2009-01-22 22:03 . 2004-08-03 23:08 60,288 --a--c--- e:\windows\system32\dllcache\drmk.sys 2009-01-22 21:48 . 2009-01-09 11:46 39,776 --a------ e:\windows\system32\DfSdkBt64.exe 2009-01-22 21:48 . 2009-01-09 11:46 33,632 --a------ e:\windows\system32\DfSdkBt.exe 2009-01-22 21:43 . 2009-01-22 21:43 d-------- e:\program files\MarBit 2009-01-22 21:41 . 2009-01-22 21:41 d-------- e:\program files\Ashampoo 2009-01-22 21:38 . 2009-01-22 21:38 0 --a------ e:\windows\nsreg.dat 2009-01-22 21:32 . 2009-01-22 21:33 d-------- e:\program files\MP3 Remix 2009-01-22 21:32 . 2009-01-22 21:32 d-------- e:\documents and settings\All Users\Dane aplikacji\MP3 Remix 2009-01-22 21:31 . 2009-01-22 21:31 d-------- e:\program files\Winamp Toolbar 2009-01-22 21:31 . 2009-01-22 21:31 d-------- e:\program files\Winamp Remote 2009-01-22 21:31 . 2009-01-22 21:31 d-------- e:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar 2009-01-22 21:31 . 2009-01-22 21:31 d-------- e:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2009-01-22 21:26 . 2009-01-22 21:32 d-------- e:\program files\Winamp 2009-01-22 21:26 . 2009-01-22 21:36 d-------- e:\documents and settings\Maniek\Dane aplikacji\Winamp 2009-01-22 21:25 . 2009-01-22 21:25 159,578 --a------ e:\windows\Marsu-Fix 2.5 Uninstaller.exe 2009-01-22 21:23 . 2009-01-22 21:23 d-------- e:\program files\ESET 2009-01-22 21:23 . 2009-01-22 21:23 d-------- e:\documents and settings\All Users\Dane aplikacji\ESET 2009-01-22 21:12 . 2009-01-22 21:12 d-------- e:\program files\Lavalys 2009-01-22 21:10 . 2009-01-22 21:10 d-------- e:\program files\MGI 2009-01-22 21:10 . 2009-01-22 21:10 d-------- e:\program files\Common Files\MGI Shared 2009-01-22 21:08 . 2009-01-22 21:08 192 --a------ e:\windows\maxlink.ini 2009-01-22 21:08 . 2009-01-22 21:08 96 --a------ e:\windows\Tb98.ini 2009-01-22 21:07 . 2009-01-22 21:09 d-------- e:\program files\TextBridge Pro 8.0 2009-01-22 21:07 . 2009-01-22 21:07 d-------- e:\program files\Common Files\Xerox Shared 2009-01-22 21:07 . 2009-01-22 21:07 d-------- e:\documents and settings\Maniek\WINDOWS 2009-01-22 21:02 . 2009-01-22 21:02 d-------- e:\program files\uTorrent 2009-01-22 21:02 . 2009-01-22 21:44 d-------- e:\documents and settings\Maniek\Dane aplikacji\uTorrent . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-22 21:33 95,744 --sh--r e:\windows\system32\nmdfgds0.dll 2009-01-22 20:56 --------- d-----w e:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-01-22 20:00 --------- d-----w e:\documents and settings\Maniek\Dane aplikacji\HP 2009-01-22 19:59 --------- d-----w e:\program files\HP 2009-01-22 19:59 --------- d-----w e:\documents and settings\All Users\Dane aplikacji\HP 2009-01-22 19:57 --------- d-----w e:\program files\Common Files\HP 2009-01-22 19:56 --------- d-----w e:\program files\Spybot - Search & Destroy 2009-01-22 19:56 --------- d-----w e:\program files\Hewlett-Packard 2009-01-22 19:43 107,882 --sh--r e:\windows\system32\olhrwef.exe 2009-01-22 19:43 107,882 --sh--r E:\w98.com 2009-01-22 19:39 --------- d-----w e:\program files\Common Files\InstallShield 2009-01-22 19:33 --------- d-----w e:\program files\RegCleaner 2009-01-22 19:29 --------- d-----w e:\program files\Gadu-Gadu 2009-01-22 19:11 --------- d-----w e:\program files\microsoft frontpage 2009-01-22 19:09 --------- d-----w e:\program files\Usługi online 2008-04-07 09:21 67,696 ----a-w e:\program files\mozilla firefox\components\jar50.dll 2008-04-07 09:21 54,376 ----a-w e:\program files\mozilla firefox\components\jsd3250.dll 2008-04-07 09:21 34,952 ----a-w e:\program files\mozilla firefox\components\myspell.dll 2008-04-07 09:21 46,720 ----a-w e:\program files\mozilla firefox\components\spellchk.dll 2008-04-07 09:21 172,144 ----a-w e:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "e:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="e:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="e:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "cdoosoft"="e:\windows\system32\olhrwef.exe" [2009-01-22 107882] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2008-05-03 13529088] "NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2008-05-03 86016] "HP Software Update"="e:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "InstantAccess"="e:\progra~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" [1998-12-10 37376] "RegisterDropHandler"="e:\progra~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [1998-12-10 23040] "egui"="e:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168] "TrialReset"="e:\windows\regx32.exe" [2008-07-03 285327] "QuickTime Task"="e:\windows\system32\qttask.exe" [2009-01-22 98304] "AT-Watch"="e:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "a-squared"="e:\program files\A-SQUARED ANTI-MALWARE\a2guard.exe" [2008-12-14 2782352] "nwiz"="nwiz.exe" [2008-05-03 e:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 e:\windows\soundman.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "RegisterDropHandler"="e:\progra~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [1998-12-10 23040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= e:\progra~1\ACEMEG~1\SystemS\Intel\iac25_32.ax "msacm.sl_anet"= e:\progra~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.yv12"= e:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= e:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll "vidc.iyuv"= e:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= e:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= e:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= e:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= e:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "msacm.msaudio1"= e:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\uTorrent\\uTorrent.exe"= "e:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "e:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "e:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "e:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe"= R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [2008-08-18 34312] R4 ekrn;Eset Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224] S3 DfSdkS;Defragmentation-Service;e:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [2009-01-22 410976] S3 WEBNTACCESS;WEBNTACCESS;e:\windows\system32\Ntaccess.sys [2008-04-13 17920] S4 NOD32FiXTemDono;Eset Nod32 Boot;e:\windows\system32\regedt32.exe [2001-10-26 3584] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - A2ANTIMALWARE *NewlyCreated* - UMWDF . . ------- Skan uzupełniający ------- . IE: &Winamp Search - e:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html Trusted Zone: com.tw\asia.msi Trusted Zone: com.tw\global.msi Trusted Zone: com.tw\www.msi DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab FF - ProfilePath - e:\documents and settings\Maniek\Dane aplikacji\Mozilla\Firefox\Profiles\rbcrsfar.defaultFF - component: e:\program files\Mozilla Firefox\components\xpinstal.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: browser.blink_allowed - true FF - user.js: network.prefetch-next - true FF - user.js: nglayout.initialpaint.delay - 50 FF - user.js: layout.spellcheckDefault - 1 FF - user.js: browser.urlbar.autoFill - false FF - user.js: browser.search.openintab - false FF - user.js: browser.tabs.closeButtons - 1 FF - user.js: browser.tabs.opentabfor.middleclick - true FF - user.js: browser.tabs.tabMinWidth - 100 FF - user.js: browser.urlbar.hideGoButton - true . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-22 23:02:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-22 23:02:55 ComboFix-quarantined-files.txt 2009-01-22 22:02:53 Przed: 16 477 925 376 bajtów wolnych Po: 16,572,801,024 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 210[/quote] Mam nadzieje ze pomożecie mi rozwiązać ten problem..