Logi - Nie można wyłączyć niektórych zadań

Proszę o pomoc. W Menadżerze Zadań są zadania, których nie mogę wyłączyć. Włączają się ponownie. Boję się, że to wirus. Dodaję loga z HijackThis.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:52:55, on 2008-03-25
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\System32\drivers\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\<a href="http://www.download.net.pl/1/Winamp/">Winamp</a>\winamp.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/intl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [CursorXP] D:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\System32\drivers\svchost.exe
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{60442047-07CB-1045-0701-030309170030}] "C:\Program Files\Common Files\{60442047-07CB-1045-0701-030309170030}\Update.exe" mc-110-12-0000137 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{60442047-07CB-1045-0701-030309170030}] "C:\Program Files\Common Files\{60442047-07CB-1045-0701-030309170030}\Update.exe" mc-110-12-0000137 (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1162632391640
O17 - HKLM\System\CS2\Services\Tcpip\..\{51D66B9F-7444-4EF3-AA99-2A52B677AC3F}: NameServer = 192.168.0.2,158.43.240.4,149.174.211.5
O17 - HKLM\System\CS3\Services\Tcpip\..\{4784BEA8-2043-4297-8074-6139E0110D8B}: NameServer = 192.168.0.2,158.43.240.4
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - E:\Program Files\Spik\url_wpmsg.dll
O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O21 - SSODL: CDRecorder025 - {A3BC5E20-0235-1ABF-9CE1-00AA00512025} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\windows\System32\msasvc.exe (file missing)
O23 - Service: Windows Logon Process Service (MSWinLogonProcService) - Unknown owner - C:\windows\winlogon.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6986 bytes

Z góry dzięki.

nie wyglada to najlepiej


usun to

O23 - Service: Windows Logon Process Service (MSWinLogonProcService) - Unknown owner - C:\windows\winlogon.exe (file missing)
 O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\windows\System32\msasvc.exe (file missing)
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe (file missing)
 O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
 O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{60442047-07CB-1045-0701-030309170030}] "C:\Program Files\Common Files\{60442047-07CB-1045-0701-030309170030}\Update.exe" mc-110-12-0000137 (User 'Default user')
 O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{60442047-07CB-1045-0701-030309170030}] "C:\Program Files\Common Files\{60442047-07CB-1045-0701-030309170030}\Update.exe" mc-110-12-0000137 (User 'SYSTEM')
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\System32\drivers\svchost.exe
 	R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
C:\WINDOWS\System32\drivers\svchost.exe

a niewiem co z tymi

C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\
O21 - SSODL: CDRecorder025 - {A3BC5E20-0235-1ABF-9CE1-00AA00512025} - (no file)
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: Harmonogram zada? (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe

i no tyle.
nastepnym razem jak cchesz sparwdzic log to TUTAJ wysylasz tam plik z logiem i tam co jezst zanznaczone czerwonym krzyzykiem usuwasz

nastepnym razem jak cchesz sparwdzic log to TUTAJ wysylasz tam plik z logiem i tam co jezst zanznaczone czerwonym krzyzykiem usuwasz

Tego sposobu nie polecam, gdyż te logi nie są dokładnie pokazywane, często źle pokazuje np. u mnie wykrywa program Alcohol jako czerwony X, a przecież to jest normalny program do wypalania itp. , więc trzeba na to uważać żeby czasem czego "dobrego" nie skasować.

Dziękuję za obie wiadomości, może ktoś jeszcze sprawdzić?

Daj loga z combofixa

C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Zuza\Local Settings\Application Data\cftmon.exe
O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\
O21 - SSODL: CDRecorder025 - {A3BC5E20-0235-1ABF-9CE1-00AA00512025} - (no file)
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: Harmonogram zada? (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe

Jeśli chodzi o te logi to:
spools.exe - trojan (nie mylić z spoolsv.exe)
cftmon.exe - wirus czyli do wywalenia
WLCtrl32.dll - Robak do wywalenia

Natomiast jeśli chodzi o:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

To nie jest to wcale złe, to tylko strona Bearshare, która się ustawia jako główna po instalacji programu Bearshare, ale zaleca się zmienić strone główną na inną np. Google.pl

O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing

Ale to trzeba usuwać specjalnym narzędziem!
Ściągnij LSP-Fix zaznacz "I know what I'm doing",
następnie w okienku Keep zaznacz plik newdotnet6_38.dll (innych plikow NIE ruszaj, bo internet przestanie działać)
i za pomocą strzałki (>>) przenieś go do okienka Remover i kliknij Finish i restart kompa.

Oczywiście, zgodnie z zaleceniem @wncvirus'a, log z ComboFixa jest potrzebny, bo możesz mieć więcej "kwiatków", niewidocznych w Hijacku.

ordynat.

log z ComboFix, jak zalecaliście.

ComboFix 08-03-24.2 - Zuza 2008-03-25 12:32:00.1 - [color=red][b]FAT32[/b][/color]x86
Running from: C:\Documents and Settings\Zuza\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Zuza\Dane aplikacji\install.dat
C:\Documents and Settings\Zuza\Menu Start\Programy\Outerinfo
C:\Documents and Settings\Zuza\Menu Start\Programy\Outerinfo\Terms.lnk
C:\Documents and Settings\Zuza\Moje dokumenty\MBOLS~1
C:\Documents and Settings\Zuza\Moje dokumenty\SCURIT~1
C:\Program Files\Common Files\{30442~1
C:\Program Files\Common Files\{60442~1
C:\Program Files\Common Files\{60442~2
C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll
C:\Program Files\Common Files\scurit~1
C:\Program Files\Common Files\scurit~1\F?nts\
C:\Program Files\Common Files\scurit~1\spool32.exe
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\newdotnet
C:\Program Files\newdotnet\readme.html
C:\Program Files\newdotnet\uninstall6_38.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\outerinfo\Thumbs.db
C:\Program Files\outlook
C:\temp\tn3
C:\WINDOWS\drsmartload.dat
C:\WINDOWS\drsmartloadb.dat
C:\WINDOWS\drsmartloadb1.dat
C:\WINDOWS\enewsletterpro1.dat
C:\WINDOWS\hosts
C:\WINDOWS\icroso~1.net
C:\WINDOWS\system32\1.txt
C:\WINDOWS\system32\2.txt
C:\WINDOWS\system32\app.exe
C:\WINDOWS\system32\asks~1
C:\WINDOWS\system32\asks~1\?asks\
C:\WINDOWS\system32\bund1
C:\WINDOWS\system32\dlh9jkdq8.exe
C:\WINDOWS\system32\drivers\Bgl51.sys
C:\WINDOWS\system32\drivers\Fkp40.sys
C:\WINDOWS\system32\drivers\Ins05.sys
C:\WINDOWS\system32\drivers\Lqv05.sys
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\mcroso~1.net
C:\WINDOWS\system32\mcroso~1.net\M?crosoft.NET\
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\racle~1\?racle\
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\unsvchosts.exe
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm
C:\WINDOWS\ymbols~1
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
C:\WINDOWS\system32\drivers\core.sys . . . . failed to delete

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLIENT_IP-IPX
-------\Legacy_CORE
-------\Service_Client IP-IPX
-------\Service_core
-------\Legacy_Fkp40
-------\Legacy_Ins05
-------\Legacy_Lqv05
-------\Fkp40
-------\Ins05
-------\Lqv05


(((((((((((((((((((((((((   Files Created from 2008-02-25 to 2008-03-25  )))))))))))))))))))))))))))))))
.

2008-03-25 12:37 . 2008-03-25 12:38	<DIR>	d--------	C:\temp\tn3
2008-03-25 12:23 . 2008-03-25 12:24	26,496	--a------	C:\WINDOWS\system32\drivers\Oty16.sys
2008-03-25 12:23 . 2008-03-25 12:24	11,776	--a------	C:\WINDOWS\system32\WLCtrl32.dll
2008-03-25 12:03 . 2008-03-25 06:29	<DIR>	d--------	C:\SDFix
2008-03-25 08:15 . 2008-03-25 08:15	3,869	--a------	C:\ZB20080325081407001.xml
2008-03-20 13:39 . 2008-03-20 13:39	34,688	--a------	C:\WINDOWS\system32\drivers\ntio922.sys
2008-03-20 13:39 . 2008-03-20 13:39	10,880	--a------	C:\WINDOWS\system32\drivers\ndisaluo.sys
2008-03-20 13:39 . 2008-03-20 13:39	10,610	---hs----	C:\WINDOWS\system32\drivers\spools.exe
2008-03-20 13:31 . 2008-03-20 13:31	<DIR>	d--hs----	C:\FOUND.005
2008-03-09 12:26 . 2008-03-09 12:26	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-03-09 12:13 . 2008-03-09 12:13	<DIR>	d--------	C:\Program Files\Common Files\Adobe Systems Shared

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 08:59	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitLgx701_cfdg.exe
2008-01-13 13:16	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitSmL1Vc_cfdg.exe
2008-01-13 12:55	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitAhE6Gj_cfdg.exe
2007-03-01 15:53	142	----a-w	C:\Program Files\page.html
2006-11-25 08:57	482	----a-w	C:\Program Files\Del.js
2006-10-05 14:04	766	----a-w	C:\Program Files\Common Files\sms.ico
2006-10-05 14:04	70	----a-w	C:\Program Files\Common Files\moje.js
2006-03-12 13:11	16,066	----a-w	C:\Program Files\INSTALL.LOG
1998-04-30 13:56	129,024	----a-w	C:\Program Files\UNWISE.EXE
2006-03-17 19:54	3,350	--sha-w	C:\WINDOWS\system32\KGyGaAvL.sys
2006-03-17 19:54	88	--sh--r	C:\WINDOWS\system32\F2B1403595.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="D:\Program Files\CursorXP\CursorXP.exe" [2003-03-01 16:40 125440]
"SVCHOST.EXE"="C:\WINDOWS\System32\drivers\svchost.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 22:18 443968]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]
"{60442047-07CA-1045-0701-030309170030}"= "C:\Program Files\Common Files\{60442047-07CA-1045-0701-030309170030}\Update.exe" mc-110-12-0000137

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\partnershipreg]
C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll 2008-03-20 13:39 13587 C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2005-07-04 12:58]
R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\System32\DRIVERS\bsstor.sys [2002-06-06 00:07]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2006-02-23 18:17]
R1 core;core;C:\WINDOWS\System32\drivers\core.sys [2007-05-15 17:35]
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\System32\drivers\BsUDF.sys [2002-09-13 13:35]
S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\System32\Drivers\Ca533av.sys []
S2 MsaSvc;Microsoft authenticate service;C:\windows\System32\msasvc.exe []
S2 MSWinLogonProcService;Windows Logon Process Service;"C:\windows\winlogon.exe" -service []
S3 Oty16;Oty16;C:\WINDOWS\System32\drivers\Oty16.sys [2008-03-25 12:24]
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\System32\Drivers\Bulk533.sys []
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys [2006-11-07 09:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys [2006-11-07 09:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\w200mgmt.sys [2006-11-07 09:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\w200obex.sys [2006-11-07 09:42]

*Newly Created Service* - CORE
.
Contents of the 'Scheduled Tasks' folder
"2008-01-01 13:01:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-25 12:38:02
Windows 5.1.2600 Dodatek Service Pack. 1 FAT NTAPI

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Client IP-IPX]
"ImagePath"="\"C:\WINDOWS\System32\svchosts.exe\" -e mc-110-12-0000137"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Fkp40]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Fkp40.sys"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Ins05]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Ins05.sys"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Lqv05]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Lqv05.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
.
Completion time: 2008-03-25 12:39:31
ComboFix-quarantined-files.txt  2008-03-25 11:39:28

Wklej do Notatnika:

File::
C:\WINDOWS\system32\drivers\Oty16.sys
C:\WINDOWS\system32\WLCtrl32.dll
C:\WINDOWS\system32\drivers\ntio922.sys
C:\WINDOWS\system32\drivers\ndisaluo.sys
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Common Files\{60442047-07CA-1045-0701-030309170030}\Update.exe
C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
C:\WINDOWS\System32\drivers\core.sys
C:\windows\System32\msasvc.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\System32\drivers\Ins05.sys
C:\WINDOWS\System32\drivers\Fkp40.sys
C:\WINDOWS\System32\drivers\Lqv05.sys

Folder::
C:\temp\tn3
C:\FOUND.005
C:\Program Files\Common Files\{60442047-07CA-1045-0701-030309170030}
C:\Documents and Settings\All Users\Dokumenty\Settings

Driver::
core
Ca533av
MsaSvc
MSWinLogonProcService
Oty16
Fkp40

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SVCHOST.EXE"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]
"{60442047-07CA-1045-0701-030309170030}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\partnershipreg]
[-HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Fkp40]
[-HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Client IP-IPX]
[-HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Ins05]
[-HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Lqv05]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log). Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.


poniższe pliki sprawdź na http://virusscan.jotti.org/

2008-03-25 08:15 . 2008-03-25 08:15 3,869 --a------ C:\ZB20080325081407001.xml
2008-01-25 08:59 1,599,488 --sh--w C:\Documents and Settings\Zuza\PulpitLgx701_cfdg.exe
2008-01-13 13:16 1,599,488 --sh--w C:\Documents and Settings\Zuza\PulpitSmL1Vc_cfdg.exe
2008-01-13 12:55 1,599,488 --sh--w C:\Documents and Settings\Zuza\PulpitAhE6Gj_cfdg.exe

Po wykonaniu tego daj nowego loga.