Prosze o sprawdzenie logów:
ComboFix 09-03-06.02 - Ala 2009-03-10 9:38:09.13 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.383.127 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Ala\Pulpit\ComboFix.exe
U?yto nast?puj?cych komend :: c:\documents and settings\Ala\Pulpit\CFScript.txt
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((( Pliki utworzone od 2009-02-10 do 2009-03-10 )))))))))))))))))))))))))))))))
.
2009-03-10 07:50 . 2009-03-10 07:50 & lt; DIR & gt; d----c--- c:\windows\ERUNT
2009-03-10 07:42 . 2009-03-10 08:30 & lt; DIR & gt; d----c--- C:\SDFix
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-10 06:43 --------- dc----w c:\documents and settings\Ala\Dane aplikacji\uTorrent
2009-03-09 14:06 96,256 -c--a-w c:\windows\system32\atmf.dll
2009-03-09 14:06 23,424 -c--a-w c:\windows\system32\drivers\nthiruqi.sys
2009-02-04 08:02 --------- dc----w c:\program files\LucasArts
2009-01-15 19:14 --------- dc----w c:\documents and settings\All Users\Dane aplikacji\hps
.
((((((((((((((((((((((((((((( SnapShot@2009-03-09_11.26.40.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04 163,328 -c--a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-03-10 07:15:00 7,663,616 -c--a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2009-03-10 07:15:01 204,800 -c--a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 -c--a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-03-10 06:50:34 7,663,616 -c--a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2009-03-10 06:50:34 204,800 -c--a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2009-03-09 08:22:55 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-10 07:21:57 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-09 08:22:55 32,768 -c--a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2009-03-10 07:21:57 32,768 -c--a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2009-03-09 08:22:55 32,768 -c--a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-10 07:21:57 32,768 -c--a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domylne, prawid?owe wpisy nie s? pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53332D9B-8A0A-4DFA-8C3A-2833D4CE8469}]
2009-03-09 15:06 96256 --a--c--- c:\windows\System32\atmf.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
" Gadu-Gadu " = " c:\program files\Gadu-Gadu\gg.exe " [2007-11-14 2131392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
" NvCplDaemon " = " c:\windows\System32\NvCpl.dll " [2005-12-10 7311360]
" NvMediaCenter " = " c:\windows\System32\NvMcTray.dll " [2005-12-10 86016]
" SunJavaUpdateSched " = " c:\program files\Java\jre1.6.0_05\bin\jusched.exe " [2008-02-22 144784]
" TweakMASTER " = " c:\program files\TweakMASTER\TMTray.exe " [2006-11-27 284712]
" DU Meter " = " c:\program files\DU Meter\DUMeter.exe " [2006-11-27 1582616]
" nwiz " = " nwiz.exe " [2005-12-10 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
" CTFMON.EXE " = " c:\windows\System32\CTFMON.EXE " [2002-09-20 13312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
" vidc.ffds " = ffdshow.ax
" msacm.ac3filter " = ac3filter.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 11:54 2131392 c:\program files\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 2002-08-20 15:08 1511453 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe
R0 ojurssiu;ojurssiu;c:\windows\system32\drivers\ojurssiu.sys [2001-08-17 23424]
S3 SER120;OTI Serial port driver;c:\windows\system32\drivers\ser120.sys [2007-05-23 32910]
--- Inne Us?ugi/Sterowniki w Pami?ci ---
*NewlyCreated* - AUJASNKJ
*Deregistered* - aujasnkj
.
.
------- Skan uzupe?niaj?cy -------
.
uStart Page = hxxp://karo.umk.pl/K_2.00/karo.php?lang=pl & rr=0.38193034172135753 & uid=Liadain & al=u
IE: Add to & LinkFox - c:\progra~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
IE: E & ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Ala\Dane aplikacji\Mozilla\Firefox\Profiles\zofw483f.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: f:\acrobat\Reader\browser\nppdf32.dll
---- FIREFOX - SPOSÓB POST?POWANIA ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: keyword.enabled - true
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-10 09:40:39
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
c:\windows\system32\_963a5fe4a87afae59e172fd886aad950.sys_.vir 39936 bytes executable
c:\windows\system32\963a5fe4a87afae59e172fd886aad950.sys 39936 bytes executable
skanowanie pomylnie uko?czone
ukryte pliki: 2
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\963a5fe4a87afae59e172fd886aad950]
" ImagePath " = " System32\963a5fe4a87afae59e172fd886aad950.sys "
.
--------------------- Pliki DLL ?adowane pod uruchomionymi procesami ---------------------
- - - - - - - & gt; 'winlogon.exe'(580)
c:\windows\System32\ODBC32.dll
- - - - - - - & gt; 'lsass.exe'(636)
c:\windows\System32\dssenh.dll
.
Czas uko?czenia: 2009-03-10 9:45:33
ComboFix-quarantined-files.txt 2009-03-10 08:44:46
ComboFix2.txt 2009-03-09 19:02:39
ComboFix3.txt 2009-03-09 14:53:45
ComboFix4.txt 2009-03-09 14:35:49
ComboFix5.txt 2009-03-10 08:37:13
Przed: 1 697 062 912 bajtów wolnych
Po: 1,701,556,224 bajtów wolnych
149