Logi - Profilaktyczna kontrola

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:01, on 2008-10-28
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\slownik\Watch.exe
C:\Program Files\Launch Manager\WisLMSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [1 mags 16 more] C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags\Date Dent.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Aktywacja Testera.lnk = D:\slownik\Watch.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab
O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1201879035093
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1201879019984
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows...ggPublisher.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

--
End of file - 9801 bytes

File::
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll
C:\WINDOWS\system32\_zykzujdwupesaelm.dll
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll-uninst.exe
C:\WINDOWS\system32\g78.exe
C:\WINDOWS\system32\ceqeelbxovvvstx.exe
C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags\Date Dent.exe
C:\WINDOWS\Tasks\AC40099A9193BC12.job
c:\docume~1\[beeep]eczka\daneap~1\proxyc~1\Nurb Store Gpl.exe

Folder::
C:\Program Files\Proxy Cake
C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake
C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1 mags 16 more"=-

ComboFix 08-10-28.01 - [beeep]eczka 2008-10-28 21:53:08.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1286 [GMT 0:00]
Uruchomiony z: C:\Documents and Settings\[beeep]eczka\Pulpit\ComboFix.exe
Użyto następujących komend :: C:\Documents and Settings\[beeep]eczka\Pulpit\CFScript.txt
* Utworzono nowy punkt przywracania

FILE ::
c:\docume~1\[beeep]eczka\daneap~1\proxyc~1\Nurb Store Gpl.exe
C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags\Date Dent.exe
C:\WINDOWS\system32\_zykzujdwupesaelm.dll
C:\WINDOWS\system32\ceqeelbxovvvstx.exe
C:\WINDOWS\system32\g78.exe
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll-uninst.exe
C:\WINDOWS\Tasks\AC40099A9193BC12.job
.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags
C:\Documents and Settings\All Users\Dane aplikacji\Admin Inter 1 Mags\Date Dent.exe
C:\Program Files\Proxy Cake
C:\WINDOWS\system32\_zykzujdwupesaelm.dll
C:\WINDOWS\system32\ceqeelbxovvvstx.exe
C:\WINDOWS\system32\g78.exe
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll-uninst.exe
C:\WINDOWS\system32\nepwhxqjwblyxhbve.dll
C:\WINDOWS\Tasks\AC40099A9193BC12.job

.
((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-28 )))))))))))))))))))))))))))))))
.

2008-10-25 21:54 . 2008-10-25 21:54 <DIR> d-------- C:\Program Files\Yahoo!
2008-10-25 21:54 . 2008-10-25 21:55 <DIR> d-------- C:\Program Files\CCleaner
2008-10-25 18:39 . 2008-10-25 18:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-24 20:42 . 2001-08-17 20:53 3,328 --a------ C:\WINDOWS\system32\drivers\qv2kux.sys
2008-10-24 20:42 . 2001-08-17 20:53 3,328 --a--c--- C:\WINDOWS\system32\dllcache\qv2kux.sys
2008-10-24 10:09 . 2008-10-15 16:36 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-23 21:11 . 2008-10-23 21:11 <DIR> d-------- C:\Program Files\Opera
2008-10-20 21:28 . 2008-10-20 21:28 <DIR> d-------- C:\Program Files\iTunes
2008-10-20 21:28 . 2008-10-20 21:28 <DIR> d-------- C:\Program Files\iPod
2008-10-20 21:28 . 2008-10-20 21:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-20 10:48 . 2008-10-20 10:49 <DIR> d-------- C:\Mgla
2008-10-20 10:47 . 2008-10-20 10:48 <DIR> d-------- C:\Mesko damska rzecz pl.up.by.myta
2008-10-20 10:46 . 2008-10-20 10:47 <DIR> d-------- C:\Lars_and_the_Real_Girl
2008-10-20 10:44 . 2008-10-20 10:45 <DIR> d-------- C:\Knocked Up - wpadka
2008-10-20 10:43 . 2008-10-20 10:44 <DIR> d-------- C:\Katyń
2008-10-20 10:42 . 2008-10-20 10:43 <DIR> d-------- C:\I.Think.I.Love.My.Wife
2008-10-20 10:41 . 2008-10-20 10:42 <DIR> d-------- C:\I.Now.Pronounce.You.Chuck.And.Larry[2007]DvDrip[Eng]-aXXo
2008-10-20 10:41 . 2008-10-20 10:41 <DIR> d-------- C:\I Am Legend
2008-10-20 10:40 . 2008-10-20 10:41 <DIR> d-------- C:\No.Country.for.Old.Men.DVDRip
2008-10-20 10:39 . 2008-10-20 10:40 <DIR> d-------- C:\New Folder
2008-10-20 10:38 . 2008-10-20 10:39 <DIR> d-------- C:\Music.And.Lyrics
2008-10-20 10:38 . 2008-10-20 10:38 <DIR> d-------- C:\Mr.Woodcock.2007.DVDRip.XviD-FA
2008-10-20 10:37 . 2008-10-20 10:37 <DIR> d-------- C:\filmy
2008-10-17 00:33 . 2008-10-17 00:33 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-10-16 17:18 . 2008-10-16 17:27 <DIR> d-------- C:\Program Files\SRS Labs
2008-10-16 17:18 . 2008-10-16 17:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SRS Labs
2008-10-16 17:18 . 2007-07-26 07:25 47,360 -ra------ C:\WINDOWS\system32\drivers\Surroundhp_kern_i386.sys
2008-10-16 17:18 . 2007-07-26 07:25 47,104 -ra------ C:\WINDOWS\system32\drivers\tshd4_kern_i386.sys
2008-10-16 17:18 . 2007-07-26 07:25 42,112 -ra------ C:\WINDOWS\system32\drivers\csiidecoder_kern_i386.sys
2008-10-16 17:18 . 2007-07-26 07:25 39,808 -ra------ C:\WINDOWS\system32\drivers\SRS_SSCFilter_i386.sys
2008-10-16 17:18 . 2007-07-26 07:25 32,000 -ra------ C:\WINDOWS\system32\drivers\wowhd_kern_i386.sys
2008-10-16 15:41 . 2008-09-08 10:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-16 15:40 . 2008-08-14 13:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-16 15:40 . 2008-08-14 13:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-16 15:40 . 2008-08-14 13:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-16 15:40 . 2008-08-14 13:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-16 15:40 . 2008-09-15 15:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 00:59 . 2008-10-15 01:03 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-15 00:59 . 2008-10-15 01:03 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-15 00:33 . 2008-10-15 21:20 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-10-15 00:32 . 2008-10-15 01:03 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-15 00:32 . 2008-10-15 01:03 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-15 00:31 . 2008-10-15 01:03 <DIR> d-------- C:\Program Files\Symantec
2008-10-15 00:31 . 2008-10-28 21:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-10-15 00:30 . 2008-10-28 16:26 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-10-15 00:01 . 2008-10-15 00:02 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-10-14 23:51 . 2008-10-14 23:51 <DIR> d-------- C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Thinstall
2008-10-14 22:56 . 2008-10-14 22:56 <DIR> d-------- C:\Program Files\Techland
2008-10-14 22:55 . 2008-10-14 22:55 <DIR> d-------- C:\Internet Transtalor 3 pliki instalacyjne
2008-10-06 19:54 . 2008-10-06 19:54 <DIR> d-------- C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Ashampoo
2008-10-06 19:43 . 2008-10-06 19:43 <DIR> d-------- C:\Program Files\Ashampoo
2008-10-05 13:48 . 2008-10-05 13:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NortonInstaller
2008-10-05 13:48 . 2008-10-15 00:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Norton
2008-10-03 12:34 . 2008-10-03 12:34 625,032 --a------ C:\WINDOWS\system32\SymNeti.dll
2008-10-03 12:34 . 2008-10-03 12:34 242,056 --a------ C:\WINDOWS\system32\SymRedir.dll
2008-10-03 12:14 . 2008-10-03 12:14 187,952 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
2008-10-03 12:14 . 2008-10-03 12:14 146,096 --a------ C:\WINDOWS\system32\drivers\symfw.sys
2008-10-03 12:14 . 2008-10-03 12:14 39,984 --a------ C:\WINDOWS\system32\drivers\symids.sys
2008-10-03 12:14 . 2008-10-03 12:14 37,936 --a------ C:\WINDOWS\system32\drivers\symndisv.sys
2008-10-03 12:14 . 2008-10-03 12:14 35,120 --a------ C:\WINDOWS\system32\drivers\symndis.sys
2008-10-03 12:14 . 2008-10-03 12:14 27,696 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
2008-10-03 12:14 . 2008-10-03 12:14 12,848 --a------ C:\WINDOWS\system32\drivers\symdns.sys
2008-10-03 12:14 . 2008-10-03 12:14 10,804 --a------ C:\WINDOWS\system32\drivers\SymRedir.cat
2008-10-03 12:14 . 2008-10-03 12:14 1,358 --a------ C:\WINDOWS\system32\drivers\SymRedir.inf
2008-10-01 18:15 . 2008-10-10 19:18 <DIR> d-------- C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake
2008-10-01 18:14 . 2008-10-10 19:18 <DIR> d-------- C:\Program Files\BitTorrent Fastest Tool

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 20:41 --------- d-----w C:\Program Files\Steam
2008-10-16 18:10 --------- d-----w C:\Program Files\Gadu-Gadu
2008-10-06 20:13 --------- d-----w C:\Program Files\Ahead
2008-10-04 21:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-10-04 13:06 --------- d-----w C:\Program Files\eMule
2008-09-16 05:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kodak
2008-09-15 22:09 --------- d-----w C:\Program Files\Kodak
2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-12 18:13 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-09-12 18:13 --------- d-----w C:\Program Files\ACD Systems
2008-09-12 18:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-09-11 11:30 --------- d-----w C:\Program Files\Apple Software Update
2008-09-11 11:26 --------- d-----w C:\Program Files\QuickTime
2008-09-11 11:26 --------- d-----w C:\Program Files\Common Files\Apple
2008-09-11 11:26 --------- d-----w C:\Program Files\Bonjour
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-02 17:33 --------- d-----w C:\Documents and Settings\[beeep]eczka\Dane aplikacji\ACD Systems
2008-08-30 16:54 --------- d-----w C:\Program Files\Winamp
2008-08-30 16:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-08-30 15:14 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-29 08:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-02-11 12:24 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-26_11.11.23.54 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-26 10:13:38 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-28 20:45:24 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-10-26 10:13:38 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-10-28 20:45:24 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-10-26 10:13:38 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-28 20:45:24 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-10-26 10:13:38 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-10-28 20:45:24 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-10-11 1410296]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-04 68856]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-10-16 2131392]
"SRS Audio Sandbox"="C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2008-06-09 3215360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2008-08-03 36352]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2006-12-14 192512]
"LMgrVolOSD"="C:\Program Files\Launch Manager\OSD.exe" [2006-12-26 180224]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2006-08-29 241664]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2006-11-09 86016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 84640]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-05 26248]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [BU]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 C:\WINDOWS\RTHDCPL.exe]
"AtiPTA"="atiptaxx.exe" [2006-02-22 C:\WINDOWS\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Aktywacja Testera.lnk - D:\slownik\Watch.exe [2008-02-06 352768]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.ACDV"= ACDV.dll
"VIDC.mjpg"= mcmjpg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 9867]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-13 198336]
R3 WisLMSvc;WisLMSvc;C:\Program Files\Launch Manager\WisLMSvc.exe [2006-11-17 118784]

*Newly Created Service* - COMHOST
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2008-10-24 C:\WINDOWS\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - [beeep]eczka.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 23:38]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 21:54:58
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?(???0???\???????0??????????????|???|???????|????????L???????8'????F?????????????h?????????????B????????|@??|????=??|[?A?????????z?A???????7~??????F?4^@???????????????A??$K?????z?A???@?('??6u@?('????????@?8'?????

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-10-28 21:56:35
ComboFix-quarantined-files.txt 2008-10-28 21:56:18
ComboFix2.txt 2008-10-27 11:35:12
ComboFix3.txt 2008-10-26 11:12:13

Przed: 126 250 287 104 bajtów wolnych
Po: 126,230,310,912 bajtów wolnych

223 --- E O F --- 2008-10-24 11:35:21

File::
C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake\Nurb Store Gpl.exe

Folder::
C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake

File::
C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake\Nurb Store Gpl.exe

Folder::
C:\Documents and Settings\[beeep]eczka\Dane aplikacji\Proxy Cake