Logi - Zainfekowany system

Czym najlepiej przeskanowac kompa? Ale zeby to mialo odrazu funkcje "Usun" - zeby usuwalo te wiruski... Bo sprawdzalem mks'em i na poczatku bylo troche a teraz juz nic , a jak sprawdzam (sciagnalem na "test") programem XP antivirus 2008 to pisalo ze mam 100 a teraz 101

1. Sprawdź system skanerem Online. Skaner Online
2. Użyj programów antyszpiegowskiego SpyBot Search & Destroy Pobierz
3. Przeskanuj komputer programem Avast (freeware) Pobierz

Dobra ale moze ktos spojrzec w moje logi?

ComboFix 08-02.01.1 - user 2008-01-31 19:52:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.2887 [GMT 1:00]
Running from: E:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\user\Pulpit\Error Cleaner.url
C:\Documents and Settings\user\Pulpit\Privacy Protector.url
C:\Documents and Settings\user\Pulpit\Spyware&Malware Protection.url
C:\Documents and Settings\user\Ulubione\Error Cleaner.url
C:\Documents and Settings\user\Ulubione\Privacy Protector.url
C:\Documents and Settings\user\Ulubione\Spyware&Malware Protection.url
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\003C35F0
C:\Program Files\myglobalsearch\bar\Cache\003C3832
C:\Program Files\myglobalsearch\bar\Cache\003C394C.bin
C:\Program Files\myglobalsearch\bar\Cache\003C3B5F.bin
C:\Program Files\myglobalsearch\bar\Cache\003C4801.bin
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
C:\WINDOWS\dat.txt
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt

----- BITS: Possible infected sites -----

hxxp://216.40.219.141
hxxp://onsafepro.com
hxxp://softworldnetwork.com
.
((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02.01 )))))))))))))))))))))))))))))))
.

2008-01-31 19:34 . 2008-01-31 19:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-01-31 19:20 . 2008-01-31 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-01-31 19:19 . 2008-01-31 19:19 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-31 19:19 . 2008-01-31 19:19 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-31 15:50 . 2008-01-31 15:51 13,588 --a------ C:\WINDOWS\system32\wpa.dbl
2008-01-30 21:37 . 2008-01-31 18:03 <DIR> d-------- C:\Program Files\SkanerOnline
2008-01-30 21:23 . 2008-01-30 21:23 <DIR> d-------- C:\Program Files\XP Antivirus
2008-01-29 21:23 . 2008-01-29 18:15 303,104 --a------ C:\WINDOWS\dntpkwowkv.dll
2008-01-29 21:23 . 2008-01-29 18:15 229,376 --a------ C:\WINDOWS\bgrlsmn.dll
2008-01-29 21:23 . 2008-01-29 18:15 217,088 --a------ C:\WINDOWS\adsoowf.dll
2008-01-29 21:23 . 2008-01-29 18:15 176,128 --a------ C:\WINDOWS\ekxdvft.dll
2008-01-29 21:23 . 2008-01-29 18:15 81,920 --a------ C:\WINDOWS\ffvrdgt.exe
2008-01-29 20:31 . 2008-01-29 20:31 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-01-29 20:31 . 2004-04-30 09:37 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2008-01-29 20:31 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2008-01-27 12:06 . 2008-01-27 12:06 <DIR> d-------- C:\Documents and Settings\user\iceytina_lightningGIMP
2008-01-26 13:44 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-25 18:38 . 2008-01-25 18:39 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\SecondLife
2008-01-24 21:26 . 2008-01-24 21:26 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-01-24 21:25 . 2008-01-24 21:25 <DIR> d-------- C:\WINDOWS\Kudos 2-in-1
2008-01-24 19:27 . 2008-01-24 19:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-01-24 18:24 . 2008-01-24 18:24 147,080 --a------ C:\WINDOWS\1 Cool Button Tool - Flash Uninstaller.exe
2008-01-23 22:34 . 2008-01-23 22:36 980 --a------ C:\WINDOWS\ARCHPR.INI
2008-01-23 22:11 . 2008-01-23 22:34 <DIR> d-------- C:\Program Files\ARCHPR
2008-01-23 12:58 . 2008-01-23 12:58 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-01-22 17:35 . 2008-01-28 20:59 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\gtk-2.0
2008-01-22 17:35 . 2008-01-22 17:35 <DIR> d-------- C:\Documents and Settings\user\.thumbnails
2008-01-22 17:32 . 2008-01-30 21:16 <DIR> d-------- C:\Documents and Settings\user\.gimp-2.4
2008-01-21 22:11 . 2008-01-21 22:11 <DIR> d-------- C:\Documents and Settings\user\world_machine - island
2008-01-21 16:50 . 2008-01-21 16:50 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-21 16:46 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-01-21 16:42 . 2008-01-21 16:42 10 --a------ C:\WINDOWS\WININIT.INI
2008-01-21 16:19 . 2008-01-21 16:19 <DIR> d-------- C:\Documents and Settings\user\Fraps_2.9.3
2008-01-21 16:19 . 2008-01-28 21:51 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-21 13:55 . 2008-01-21 13:55 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\BearShare
2008-01-21 13:35 . 2008-01-21 13:35 <DIR> d-------- C:\Documents and Settings\user\Darmowe_konto_premium__nalezy_otworzyc_plik_WORDA_
2008-01-21 13:21 . 2008-01-21 13:21 1,517 --a------ C:\WINDOWS\system32\msexcr.ini
2008-01-18 14:41 . 2008-01-18 14:41 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\LEGO Company
2008-01-17 17:35 . 2003-07-20 10:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-01-17 17:35 . 2005-01-04 01:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-01-16 17:24 . 2008-01-24 21:21 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-01-16 17:14 . 2008-01-16 17:14 <DIR> d-------- C:\Program Files\Disney
2008-01-16 13:10 . 2008-01-16 13:10 <DIR> d-------- C:\Program Files\Common Files\EZB Systems
2008-01-16 12:59 . 2008-01-16 12:59 <DIR> d-------- C:\Documents and Settings\user\Vodna_delikatesa
2008-01-14 09:30 . 2008-01-14 09:30 <DIR> d-------- C:\Program Files\Skype
2008-01-14 09:30 . 2008-01-26 19:45 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-01-14 09:30 . 2008-01-26 19:52 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Skype
2008-01-14 09:30 . 2008-01-14 09:30 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-14 09:29 . 2008-01-14 09:30 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-14 09:29 . 2008-01-14 09:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-11 18:03 . 2008-01-11 18:03 <DIR> d-------- C:\Program Files\GameSpy
2008-01-11 18:02 . 2008-01-11 18:02 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-01-11 18:02 . 2008-01-11 18:02 <DIR> dr-h----- C:\Documents and Settings\user\Dane aplikacji\SecuROM
2008-01-11 17:58 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-01-11 17:58 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-01-11 17:58 . 2008-01-28 19:01 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-01-11 17:58 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-01-11 17:58 . 2008-01-28 19:01 22,328 --a------ C:\Documents and Settings\user\Dane aplikacji\PnkBstrK.sys
2008-01-10 21:07 . 2008-01-10 21:08 <DIR> d-------- C:\Documents and Settings\user\15593_phx
2008-01-10 17:13 . 2008-01-10 17:13 <DIR> d-------- C:\Documents and Settings\user\9567_new_winrar_zip_archive_(24)
2008-01-08 21:07 . 2008-01-08 21:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI
2008-01-07 18:48 . 2008-01-07 18:48 <DIR> d-------- C:\Documents and Settings\user\terraingenerator304
2008-01-04 21:46 . 2008-01-04 21:46 <DIR> d-------- C:\Program Files\Google
2008-01-02 22:20 . 2008-01-02 22:20 <DIR> d-------- C:\WINDOWS\setupmp3
2008-01-02 22:20 . 2005-06-30 03:45 20,576 --------- C:\WINDOWS\system32\drivers\spmmd2k.sys
2008-01-01 21:22 . 2008-01-01 21:22 <DIR> d---s---- C:\Documents and Settings\user\UserData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 19:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-28 18:01 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-28 18:01 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-24 17:26 155,995 ----a-w C:\WINDOWS\java\Packages\XZ3L3DNJ.ZIP
2008-01-22 18:28 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-01-21 15:47 --------- d-----w C:\Program Files\ATI Technologies
2008-01-08 20:32 102,400 ----a-w C:\WINDOWS\DUMP91a1.tmp
2007-12-31 19:32 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Media Player Classic
2007-12-31 16:19 --------- d-----w C:\Program Files\SpeedFan
2007-12-31 10:59 --------- d-----w C:\Program Files\Futuremark
2007-12-29 18:12 --------- d-----w C:\Program Files\Save Flash
2007-12-28 17:17 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu
2007-12-26 18:31 --------- d-----w C:\Program Files\Lavalys
2007-12-26 14:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Earthsim
2007-12-26 12:59 --------- d-----w C:\Program Files\DIFX
2007-12-26 12:34 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-26 12:20 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-25 20:36 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-24 23:38 --------- d-----w C:\Program Files\PowerQuest
2007-12-24 17:51 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-24 17:35 --------- d-----w C:\Program Files\Activision
2007-12-24 17:27 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Ahead
2007-12-24 16:11 --------- d-----w C:\Program Files\Electronic Arts
2007-12-24 16:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-24 16:10 --------- d-----w C:\Program Files\AGEIA Technologies
2007-12-24 15:51 --------- d-----w C:\Program Files\ADSL
2007-12-24 15:16 --------- d-----w C:\Program Files\ASUS
2007-12-24 14:36 --------- d-----w C:\Program Files\C-Media 6501 Sound
2007-12-23 12:28 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-23 12:26 --------- d-----w C:\Program Files\Nero
2007-12-23 12:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-12-23 12:19 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-23 12:19 --------- d-----w C:\Program Files\Microsoft Works
2007-12-23 12:18 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-12-23 12:17 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-12-23 12:17 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-23 12:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-12-23 12:16 --------- d-----w C:\Program Files\Real Alternative
2007-12-23 12:16 --------- d-----w C:\Program Files\Media Player Classic
2007-12-23 12:16 --------- d-----w C:\Program Files\MarBit
2007-12-23 12:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-12-23 12:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-12-23 12:15 --------- d-----w C:\Program Files\Winamp
2007-12-21 23:00 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\ATI
2007-12-21 22:58 --------- d-----w C:\Program Files\My Company Name
2007-12-21 22:56 --------- d-----w C:\Program Files\Common Files\ATI Technologies
2007-12-21 22:53 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 22:44 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-21 22:40 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 22:39 --------- d-----w C:\Program Files\Usługi online
2007-12-21 02:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2007-12-13 12:05 531,248 ----a-w C:\WINDOWS\system32\es.scr
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-21 18:47 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECA6E136-A0B1-4D9B-AB52-C20229DAC5E3}]
2008-01-29 18:15 303104 --a------ C:\WINDOWS\dntpkwowkv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4064EA35-578D-4073-A834-C96D82CBCF40}
{1BF97F11-E184-42BD-8E57-EDBA3CFB4F7A}

[HKEY_CLASSES_ROOT\clsid\{1bf97f11-e184-42bd-8e57-edba3cfb4f7a}]
[HKEY_CLASSES_ROOT\ekxdvft.1]
[HKEY_CLASSES_ROOT\TypeLib\{19A9FCCD-A724-4407-BA70-411F4F700538}]
[HKEY_CLASSES_ROOT\ekxdvft]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"Gadu-Gadu"="E:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"XP Antivirus"="C:\Program Files\XP Antivirus\xpa2008pro.exe" [2008-01-30 21:23 498832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C6501Sound"="c6501.cpl" []
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-23 13:17 949376]
"WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2007-12-20 16:16 37376]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\ADSL\ADSL USB MODEM\dslmon.exe [2008-01-22 19:28:30 929861]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"adsoowf"= {3D39DFFB-6237-4809-9507-B3FCC8689BC1} - C:\WINDOWS\adsoowf.dll [2008-01-29 18:15 217088]
"bgrlsmn"= {AD7713E0-D010-48E9-9A9D-E01A977228F8} - C:\WINDOWS\bgrlsmn.dll [2008-01-29 18:15 229376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
--a------ 2008-01-02 11:14 7820728 E:\Program Files\BearShare\BearShare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-03-22 08:49 149040 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch PC Probe II]
--a------ 2007-05-09 10:38 2130432 C:\Program Files\ASUS\PC Probe II\Probe2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-15 20:02 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-01-26 10:19 1266936 E:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-09-26 15:49 35328 C:\Program Files\Winamp\winampa.exe

R3 adiusbae;ADSL USB MODEM LAN ADAPTER;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-05-22 15:21]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\c6501.sys [2007-07-10 02:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f33ca4c-cea1-11dc-ad4b-000723ff2aad}]
\Shell\AutoRun\command - G:\autorun.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 19:53:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-01 19:53:27
ComboFix-quarantined-files.txt 2008-02-01 18:53:26
.
2008-01-26 12:44:42 --- E O F ---

Wklej do Notatnika:

File::
C:\WINDOWS\dntpkwowkv.dll
C:\WINDOWS\bgrlsmn.dll
C:\WINDOWS\adsoowf.dll
C:\WINDOWS\ekxdvft.dll
C:\WINDOWS\ffvrdgt.exe

Folder::
C:\Program Files\XP Antivirus

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECA6E136-A0B1-4D9B-AB52-C20229DAC5E3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1BF97F11-E184-42BD-8E57-EDBA3CFB4F7A}"=-
[-HKEY_CLASSES_ROOT\clsid\{1bf97f11-e184-42bd-8e57-edba3cfb4f7a}]
[-HKEY_CLASSES_ROOT\ekxdvft.1]
[-HKEY_CLASSES_ROOT\TypeLib\{19A9FCCD-A724-4407-BA70-411F4F700538}]
[-HKEY_CLASSES_ROOT\ekxdvft]
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\*0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"adsoowf"=-
"bgrlsmn"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f33ca4c-cea1-11dc-ad4b-000723ff2aad}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"

Po wklejeniu do Notatnika musisz usunąć z tekstu *gwiazdkę!
>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
? podobnie jak na tym obrazku -->
Ma się rozpocząć usuwanie. (i powstanie log).
Po restarcie usuń ręcznie folder C: \Qoobox.

Daj ten log, który powstanie w trakcie usuwania.
ordynat

ComboFix 08-02.01.1 - user 2008-02-02 18:49:25.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.2860 [GMT 1:00]
Running from: E:\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED

FILE
C:\WINDOWS\adsoowf.dll
C:\WINDOWS\bgrlsmn.dll
C:\WINDOWS\dntpkwowkv.dll
C:\WINDOWS\ekxdvft.dll
C:\WINDOWS\ffvrdgt.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\XP Antivirus
C:\Program Files\XP Antivirus\xpa2008pro.exe
C:\WINDOWS\adsoowf.dll
C:\WINDOWS\bgrlsmn.dll
C:\WINDOWS\dntpkwowkv.dll
C:\WINDOWS\ekxdvft.dll
C:\WINDOWS\ffvrdgt.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-02 to 2008-02-02 )))))))))))))))))))))))))))))))
.

2008-02-01 20:46 . 2008-02-01 20:46 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-31 19:34 . 2008-01-31 19:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-01-31 19:20 . 2008-01-31 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-01-31 19:19 . 2008-01-31 19:19 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-31 15:50 . 2008-02-01 19:55 13,646 --a------ C:\WINDOWS\system32\wpa.dbl
2008-01-30 21:37 . 2008-01-31 18:03 <DIR> d-------- C:\Program Files\SkanerOnline
2008-01-29 20:31 . 2008-01-29 20:31 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-01-29 20:31 . 2004-04-30 09:37 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2008-01-29 20:31 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2008-01-27 12:06 . 2008-01-27 12:06 <DIR> d-------- C:\Documents and Settings\user\iceytina_lightningGIMP
2008-01-26 13:44 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-25 18:38 . 2008-01-25 18:39 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\SecondLife
2008-01-24 21:26 . 2008-01-24 21:26 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-01-24 21:25 . 2008-01-24 21:25 <DIR> d-------- C:\WINDOWS\Kudos 2-in-1
2008-01-24 19:27 . 2008-01-24 19:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-01-24 18:24 . 2008-01-24 18:24 147,080 --a------ C:\WINDOWS\1 Cool Button Tool - Flash Uninstaller.exe
2008-01-23 22:34 . 2008-01-23 22:36 980 --a------ C:\WINDOWS\ARCHPR.INI
2008-01-23 22:11 . 2008-01-23 22:34 <DIR> d-------- C:\Program Files\ARCHPR
2008-01-23 12:58 . 2008-01-23 12:58 <DIR> d-------- C:\Program Files\Common Files\NSV
2008-01-22 17:35 . 2008-01-28 20:59 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\gtk-2.0
2008-01-22 17:35 . 2008-01-22 17:35 <DIR> d-------- C:\Documents and Settings\user\.thumbnails
2008-01-22 17:32 . 2008-01-30 21:16 <DIR> d-------- C:\Documents and Settings\user\.gimp-2.4
2008-01-21 22:11 . 2008-01-21 22:11 <DIR> d-------- C:\Documents and Settings\user\world_machine - island
2008-01-21 16:50 . 2008-01-21 16:50 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-21 16:46 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-01-21 16:42 . 2008-01-21 16:42 10 --a------ C:\WINDOWS\WININIT.INI
2008-01-21 16:19 . 2008-01-21 16:19 <DIR> d-------- C:\Documents and Settings\user\Fraps_2.9.3
2008-01-21 16:19 . 2008-01-28 21:51 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-21 13:55 . 2008-01-21 13:55 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\BearShare
2008-01-21 13:35 . 2008-01-21 13:35 <DIR> d-------- C:\Documents and Settings\user\Darmowe_konto_premium__nalezy_otworzyc_plik_WORDA_
2008-01-21 13:21 . 2008-01-21 13:21 1,517 --a------ C:\WINDOWS\system32\msexcr.ini
2008-01-18 14:41 . 2008-01-18 14:41 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\LEGO Company
2008-01-17 17:35 . 2003-07-20 10:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-01-17 17:35 . 2005-01-04 01:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-01-16 17:24 . 2008-01-24 21:21 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-01-16 17:14 . 2008-01-16 17:14 <DIR> d-------- C:\Program Files\Disney
2008-01-16 13:10 . 2008-01-16 13:10 <DIR> d-------- C:\Program Files\Common Files\EZB Systems
2008-01-16 12:59 . 2008-01-16 12:59 <DIR> d-------- C:\Documents and Settings\user\Vodna_delikatesa
2008-01-14 09:30 . 2008-01-14 09:30 <DIR> d-------- C:\Program Files\Skype
2008-01-14 09:30 . 2008-01-26 19:45 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\skypePM
2008-01-14 09:30 . 2008-01-26 19:52 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Skype
2008-01-14 09:30 . 2008-01-14 09:30 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-14 09:29 . 2008-01-14 09:30 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-14 09:29 . 2008-01-14 09:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-11 18:03 . 2008-01-11 18:03 <DIR> d-------- C:\Program Files\GameSpy
2008-01-11 18:02 . 2008-01-11 18:02 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-01-11 18:02 . 2008-01-11 18:02 <DIR> dr-h----- C:\Documents and Settings\user\Dane aplikacji\SecuROM
2008-01-11 17:58 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-01-11 17:58 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-01-11 17:58 . 2008-02-01 20:30 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-01-11 17:58 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-01-11 17:58 . 2008-02-01 20:31 22,328 --a------ C:\Documents and Settings\user\Dane aplikacji\PnkBstrK.sys
2008-01-10 21:07 . 2008-01-10 21:08 <DIR> d-------- C:\Documents and Settings\user\15593_phx
2008-01-10 17:13 . 2008-01-10 17:13 <DIR> d-------- C:\Documents and Settings\user\9567_new_winrar_zip_archive_(24)
2008-01-08 21:07 . 2008-01-08 21:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI
2008-01-07 18:48 . 2008-01-07 18:48 <DIR> d-------- C:\Documents and Settings\user\terraingenerator304
2008-01-04 21:46 . 2008-01-04 21:46 <DIR> d-------- C:\Program Files\Google
2008-01-02 22:20 . 2008-01-02 22:20 <DIR> d-------- C:\WINDOWS\setupmp3
2008-01-02 22:20 . 2005-06-30 03:45 20,576 --------- C:\WINDOWS\system32\drivers\spmmd2k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 19:31 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-01 19:31 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-29 19:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-24 17:26 155,995 ----a-w C:\WINDOWS\java\Packages\XZ3L3DNJ.ZIP
2008-01-22 18:28 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-01-21 15:47 --------- d-----w C:\Program Files\ATI Technologies
2008-01-08 20:32 102,400 ----a-w C:\WINDOWS\DUMP91a1.tmp
2007-12-31 19:32 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Media Player Classic
2007-12-31 16:19 --------- d-----w C:\Program Files\SpeedFan
2007-12-31 10:59 --------- d-----w C:\Program Files\Futuremark
2007-12-29 18:12 --------- d-----w C:\Program Files\Save Flash
2007-12-28 17:17 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu
2007-12-26 18:31 --------- d-----w C:\Program Files\Lavalys
2007-12-26 14:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Earthsim
2007-12-26 12:59 --------- d-----w C:\Program Files\DIFX
2007-12-26 12:34 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-26 12:20 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-25 20:36 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-24 23:38 --------- d-----w C:\Program Files\PowerQuest
2007-12-24 17:51 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-24 17:35 --------- d-----w C:\Program Files\Activision
2007-12-24 17:27 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Ahead
2007-12-24 16:11 --------- d-----w C:\Program Files\Electronic Arts
2007-12-24 16:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-24 16:10 --------- d-----w C:\Program Files\AGEIA Technologies
2007-12-24 15:51 --------- d-----w C:\Program Files\ADSL
2007-12-24 15:16 --------- d-----w C:\Program Files\ASUS
2007-12-24 14:36 --------- d-----w C:\Program Files\C-Media 6501 Sound
2007-12-23 12:28 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-23 12:26 --------- d-----w C:\Program Files\Nero
2007-12-23 12:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-12-23 12:19 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-23 12:19 --------- d-----w C:\Program Files\Microsoft Works
2007-12-23 12:18 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-12-23 12:17 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-12-23 12:17 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-23 12:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-12-23 12:16 --------- d-----w C:\Program Files\Real Alternative
2007-12-23 12:16 --------- d-----w C:\Program Files\Media Player Classic
2007-12-23 12:16 --------- d-----w C:\Program Files\MarBit
2007-12-23 12:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-12-23 12:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-12-23 12:15 --------- d-----w C:\Program Files\Winamp
2007-12-21 23:00 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\ATI
2007-12-21 22:58 --------- d-----w C:\Program Files\My Company Name
2007-12-21 22:56 --------- d-----w C:\Program Files\Common Files\ATI Technologies
2007-12-21 22:53 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 22:44 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-21 22:40 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 22:39 --------- d-----w C:\Program Files\Usługi online
2007-12-21 02:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2007-12-13 12:05 531,248 ----a-w C:\WINDOWS\system32\es.scr
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-21 18:47 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"Gadu-Gadu"="E:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"XP Antivirus"="C:\Program Files\XP Antivirus\xpa2008pro.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C6501Sound"="c6501.cpl" []
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-23 13:17 949376]
"WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2007-12-20 16:16 37376]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\ADSL\ADSL USB MODEM\dslmon.exe [2008-01-22 19:28:30 929861]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
--a------ 2008-01-02 11:14 7820728 E:\Program Files\BearShare\BearShare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-03-22 08:49 149040 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch PC Probe II]
--a------ 2007-05-09 10:38 2130432 C:\Program Files\ASUS\PC Probe II\Probe2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-15 20:02 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-01-26 10:19 1266936 E:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-09-26 15:49 35328 C:\Program Files\Winamp\winampa.exe

R3 adiusbae;ADSL USB MODEM LAN ADAPTER;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-05-22 15:21]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\c6501.sys [2007-07-10 02:42]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 18:50:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-02 18:50:33
ComboFix-quarantined-files.txt 2008-02-02 17:50:32
ComboFix2.txt 2008-02-02 17:28:40
ComboFix3.txt 2008-02-01 18:53:28
.
2008-01-26 12:44:42 --- E O F ---

czysto