Witam proszę o sprawdzenie niżej podanych logów czy wszystko jest na swoim miejscu. [color=blue]ComboFix[/color] [code]ComboFix 08-12-06.06 - SbQ 2008-12-07 12:32:21.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.3066 [GMT 1:00] Uruchomiony z: c:\documents and settings\SbQ\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\e.cmd c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\History\search C:\rcukd.cmd c:\windows\system32\gasretyw0.dll c:\windows\system32\gasretyw1.dll c:\windows\system32\kamsoft.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-07 do 2008-12-07 ))))))))))))))))))))))))))))))) . 2008-12-07 12:19 . 2008-12-07 12:19 d-------- c:\program files\Trend Micro 2008-12-06 21:26 . 2008-12-07 12:27 2,615,328 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-06 21:26 . 2008-07-08 13:54 148,496 --a------ c:\windows\system32\drivers\26102207.sys 2008-12-06 21:26 . 2008-12-07 11:32 20,492 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-12-05 20:10 . 2008-12-05 20:11 d-------- c:\program files\RivaTuner v2.20 2008-12-05 11:25 . 2008-12-06 19:07 104,421 -r-hs---- C:\2u.com 2008-12-04 20:10 . 2008-12-06 21:29 664 --a------ c:\windows\system32\d3d9caps.dat 2008-12-03 22:08 . 2008-12-03 22:08 dr-h----- c:\documents and settings\SbQ\Dane aplikacji\SecuROM 2008-12-03 20:38 . 2008-12-03 20:39 d-------- c:\windows\system32\drivers\umdf 2008-12-03 20:38 . 2008-12-03 22:23 d-------- c:\program files\Microsoft Games for Windows - LIVE 2008-12-02 18:53 . 2008-12-06 21:27 d-------- c:\documents and settings\SbQ\Dane aplikacji\mIRC 2008-12-02 16:11 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-02 16:09 . 2008-12-02 16:09 d-------- c:\windows\system32\XPSViewer 2008-12-02 16:09 . 2008-12-02 16:09 d-------- c:\program files\Reference Assemblies 2008-12-02 16:09 . 2008-12-02 16:09 d-------- c:\program files\MSBuild 2008-12-02 16:08 . 2008-12-02 16:09 d-------- C:\731a8c6a5795c77a6306c6a2 2008-12-02 16:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2008-12-02 16:08 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2008-12-02 16:08 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2008-12-02 16:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2008-12-02 16:08 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2008-12-02 16:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2008-12-02 16:08 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2008-12-01 13:19 . 2008-12-01 13:19 d-------- c:\windows\system32\xlive 2008-12-01 13:14 . 2008-12-01 13:15 d--h----- c:\windows\msdownld.tmp 2008-12-01 13:14 . 2008-12-01 13:14 d-------- c:\windows\Logs 2008-11-30 17:28 . 2008-11-30 17:31 d-------- c:\program files\Photo Resize Magic 2008-11-30 13:06 . 2008-11-25 20:35 225,280 --a------ c:\program files\Uninstall My Global Search Bar.dll 2008-11-29 18:44 . 2008-11-29 18:44 d-------- c:\program files\HD Tune 2008-11-29 16:12 . 2008-11-29 16:12 d-------- c:\program files\Common Files\Apple 2008-11-29 16:12 . 2008-11-29 16:12 d-------- c:\program files\Apple Software Update 2008-11-29 16:12 . 2008-11-29 16:12 d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-29 16:12 . 2008-11-29 16:12 d-------- c:\documents and settings\All Users\Dane aplikacji\Apple 2008-11-29 14:20 . 2008-11-29 14:42 d-------- c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited 2008-11-29 14:18 . 2008-12-03 20:40 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-11-29 13:26 . 2008-11-29 13:26 d-------- c:\windows\system32\svcdll 2008-11-29 11:07 . 2008-11-29 11:07 d-------- c:\windows\Sun 2008-11-29 11:06 . 2008-12-04 20:12 d-------- c:\program files\Java 2008-11-29 11:06 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll 2008-11-29 11:06 . 2008-11-10 03:39 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-28 22:09 . 2008-11-28 22:09 d-------- c:\windows\system32\Adobe 2008-11-28 22:09 . 2008-11-04 09:35 499,712 --a------ c:\windows\system32\msvcp71.dll 2008-11-27 18:03 . 2008-11-27 18:03 d-------- c:\documents and settings\SbQ\Dane aplikacji\Media Player Classic 2008-11-27 10:35 . 2008-09-10 02:15 1,307,648 --------- c:\windows\system32\msxml6.dll 2008-11-27 10:35 . 2008-09-10 02:15 1,307,648 -----c--- c:\windows\system32\dllcache\msxml6.dll 2008-11-27 10:35 . 2007-03-14 15:36 693,932 -----c--- c:\windows\system32\dllcache\wmplayer.chm 2008-11-27 10:35 . 2008-04-14 21:52 89,600 --------- c:\windows\system32\msxml6r.dll 2008-11-27 10:35 . 2008-04-14 21:52 89,600 -----c--- c:\windows\system32\dllcache\msxml6r.dll 2008-11-27 10:35 . 2007-03-14 16:58 71,460 -----c--- c:\windows\system32\dllcache\wmplayer.adm 2008-11-27 10:35 . 2007-03-14 16:02 27,965 -----c--- c:\windows\system32\dllcache\wmplay.chm 2008-11-27 10:35 . 2007-06-26 11:30 10,457 -----c--- c:\windows\system32\dllcache\wmptour.hta 2008-11-27 10:35 . 2007-06-26 11:30 1,771 -----c--- c:\windows\system32\dllcache\wmptour.css 2008-11-27 10:35 . 2008-04-14 22:05 1,714 -----c--- c:\windows\system32\dllcache\wmpocm.inf 2008-11-27 10:35 . 2007-06-26 11:30 420 -----c--- c:\windows\system32\dllcache\wmploc.js 2008-11-27 10:32 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]02862_.tmp 2008-11-27 10:04 . 2008-11-27 10:04 d-------- c:\documents and settings\SbQ\Dane aplikacji\Leadertech 2008-11-27 09:51 . 2008-11-27 09:51 d-------- c:\program files\DAEMON Tools Toolbar 2008-11-27 09:45 . 2008-11-27 09:45 d-------- c:\documents and settings\SbQ\Dane aplikacji\DAEMON Tools 2008-11-27 09:45 . 2008-11-27 09:45 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2008-11-26 21:49 . 2008-11-26 22:27 d-------- c:\documents and settings\SbQ\Dane aplikacji\Xfire 2008-11-26 09:48 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-11-26 09:48 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-26 09:47 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-26 09:47 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-26 09:47 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-26 09:47 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-26 09:47 . 2008-09-15 16:27 1,846,656 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-11-26 09:47 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2008-11-26 09:47 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-26 09:47 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-11-26 09:47 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-11-26 09:47 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2008-11-26 09:46 . 2008-11-28 10:08 d--h----- c:\windows\$hf_mig$ 2008-11-26 09:45 . 2008-05-07 06:12 1,291,776 -----c--- c:\windows\system32\dllcache\quartz.dll 2008-11-25 20:35 . 2008-12-05 15:22 d-------- C:\My Downloads 2008-11-25 19:58 . 2008-11-25 19:58 d-------- c:\program files\K-Lite Codec Pack 2008-11-25 19:57 . 2008-11-25 19:57 d-------- c:\documents and settings\SbQ\Dane aplikacji\BESTplayer 2008-11-25 19:49 . 2008-11-25 19:50 d-------- c:\documents and settings\SbQ\Dane aplikacji\Winamp 2008-11-25 19:49 . 2007-03-08 00:51 129,784 --------- c:\windows\system32\pxafs.dll 2008-11-25 19:49 . 2007-03-08 00:51 43,528 --------- c:\windows\system32\drivers\PxHelp20.sys 2008-11-25 19:49 . 2007-03-08 00:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys 2008-11-25 19:49 . 2007-03-08 00:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys 2008-11-25 19:38 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-25 19:38 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-25 19:38 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-25 19:30 . 2008-12-06 14:08 d-------- C:\Downloads 2008-11-25 19:22 . 2008-11-25 19:23 d-------- c:\documents and settings\SbQ\Dane aplikacji\Ventrilo 2008-11-25 19:07 . 2008-11-25 19:07 22,328 --a------ c:\documents and settings\SbQ\Dane aplikacji\PnkBstrK.sys 2008-11-25 19:06 . 2008-12-03 20:39 d-------- c:\windows\system32\LogFiles 2008-11-25 19:06 . 2008-11-30 13:14 202,040 --a------ c:\windows\system32\PnkBstrB.exe 2008-11-25 19:06 . 2008-11-27 17:16 66,872 --a------ c:\windows\system32\PnkBstrA.exe 2008-11-25 19:06 . 2008-11-25 19:06 271 --a------ c:\windows\game.ini . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-03 19:05 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-30 12:14 137,688 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-25 18:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-25 17:40 --------- d-----w c:\program files\AGEIA Technologies 2008-11-25 17:39 --------- d-----w c:\documents and settings\SbQ\Dane aplikacji\Nowe Gadu-Gadu 2008-11-25 17:21 20,747 ----a-w c:\windows\system32\drivers\AegisP.sys 2008-11-25 17:21 --------- d-----w c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor 2008-11-25 17:13 --------- d-----w c:\program files\DVD-RAM 2008-11-25 17:12 --------- d-----w c:\program files\SteelSeries Ikari Optical 2008-11-25 17:12 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-25 17:07 --------- d-----w c:\program files\Steel Sound 5H USB 2008-11-25 17:02 --------- d-----w c:\program files\Realtek 2008-11-25 17:02 --------- d-----w c:\program files\Marvell 2008-11-25 17:01 14,656 ----a-w c:\windows\gdrv.sys 2008-11-25 17:00 --------- d-----w c:\program files\Intel 2008-11-25 16:54 --------- d-----w c:\program files\microsoft frontpage 2008-11-25 16:53 --------- d-----w c:\program files\Usługi online 2008-11-25 08:45 2,283,027 ----a-w c:\windows\system32\x264vfw.dll 2008-11-24 14:32 57,344 ----a-w c:\windows\system32\ff_vfw.dll 2008-11-20 20:45 42,320 ----a-w c:\windows\system32\xfcodec.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\divx.dll 2008-10-28 16:41 14,303,392 ----a-w c:\windows\system32\xlive.dll 2008-10-28 16:41 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll 2008-10-27 09:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll 2008-10-27 09:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll 2008-10-27 09:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll 2008-10-27 09:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-10 03:52 452,440 ----a-w c:\windows\system32\d3dx10_40.dll 2008-10-10 03:52 4,379,984 ----a-w c:\windows\system32\D3DX9_40.dll 2008-10-10 03:52 2,036,576 ----a-w c:\windows\system32\D3DCompiler_40.dll 2008-10-02 09:07 453,152 ----a-w c:\windows\system32\NVUNINST.EXE 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Steam"="c:\gry\steam\steam.exe" [2008-11-25 1410296] "Nowe Gadu-Gadu"="c:\programy\Nowe Gadu-Gadu\gg.exe" [2008-11-21 6890088] "DAEMON Tools Lite"="c:\programy\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "RGSC"="c:\gry\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-03 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-31 36864] "36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-17 1953792] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "WinampAgent"="c:\programy\Winamp\winampa.exe" [2008-09-12 36352] "QuickTime Task"="c:\programy\Qck Time\QTTask.exe" [2008-09-06 413696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.20\RivaTuner.exe" [2008-11-19 2727936] "RivaTuner"="c:\program files\RivaTuner v2.20\RivaTuner.exe" [2008-11-19 2727936] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\SbQ\Menu Start\Programy\Autostartis-H24LU.lnk - c:\programy\Virus Removal Tool\is-H24LU\startup.exe [2008-12-06 65536] c:\documents and settings\All Users\Menu Start\Programy\AutostartRAMASST.lnk - c:\windows\system32\RAMASST.exe [2008-11-25 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\GRY\\COD4\\iw3mp.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\GRY\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"= "c:\\GRY\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "27454:TCP"= 27454:TCP:BitComet 27454 TCP "27454:UDP"= 27454:UDP:BitComet 27454 UDP R1 is-H24LUdrv;is-H24LUdrv;c:\windows\system32\DRIVERS\26102207.sys [2008-12-06 148496] R3 cmudaxu;C-Media USB Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [2008-11-25 1391296] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c049f715-bb1e-11dd-94c4-001d7e0f1d96}] \Shell\AutoRun\command - F:\ij.bat \Shell\explore\Command - F:\ij.bat \Shell\open\Command - F:\ij.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c049f716-bb1e-11dd-94c4-001d7e0f1d96}] \Shell\AutoRun\command - G:\o1.com \Shell\explore\Command - G:\o1.com \Shell\open\Command - G:\o1.com *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - USUNIĘTO PUSTE WPISY - - - - Toolbar-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) HKLM-Run-CmUsbSound - cmcnfgu.cpl . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.nasza-klasa.pl/ IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\programy\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\programy\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\programy\BitComet\BitComet.exe/AddLink.htm FireFox -: Profile - c:\documents and settings\SbQ\Dane aplikacji\Mozilla\Firefox\Profiles\9ag8sceg.defaultFireFox -: prefs.js - STARTUP.HOMEPAGE - www.nasza-klasa.pl FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npBitCometAgent.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin2.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin3.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin4.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin5.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin6.dll FF -: plugin - c:\programy\Mozilla Firefox\plugins\npqtplugin7.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin2.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin3.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin4.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin5.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin6.dll FF -: plugin - c:\programy\Qck Time\Plugins\npqtplugin7.dll FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-07 12:33:18 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(716) c:\windows\system32\GTGina.dll . Czas ukończenia: 2008-12-07 12:33:42 ComboFix-quarantined-files.txt 2008-12-07 11:33:38 Przed: 251,476,279,296 bajtów wolnych Po: 251,469,557,760 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 286 --- E O F --- 2008-12-04 16:15:15 [/code] [color=blue]HijackThis[/color] [code]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:34:53, on 2008-12-07 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\RTHDCPL.EXE C:\Programy\Winamp\winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programy\Nowe Gadu-Gadu\gg.exe C:\Programy\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\RAMASST.exe C:\GRY\GTA IV\Rockstar Games Social Club\1_1_1_0\RGSC.exe C:\WINDOWS\System32\svchost.exe C:\GRY\Steam\Steam.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\msiexec.exe C:\Programy\VT\Ventrilo.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nasza-klasa.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programy\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Programy\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programy\Qck Time\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.20\RivaTuner.exe" /S O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.20\RivaTuner.exe" /T O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\gry\steam\steam.exe" -silent O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Programy\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programy\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [RGSC] C:\GRY\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: is-H24LU.lnk = C:\Programy\Virus Removal Tool\is-H24LU\startup.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Programy\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Programy\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Programy\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Programy\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 5806 bytes[/code] Pozdrawiam i czekam na odpowiedź :-)