Czysty czy Zarażony ? - Prosze o sprawdzenie loga.

[Driner]

Daje loga z Combofix prosze o sprawdzenie czy mam Keyloger albo inny syf.

ComboFix 08-05-12.1 - Bartek 2008-05-14 13:49:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.231 [GMT 2:00]
Running from: C:\Documents and Settings\Bartek\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 )))))))))))))))))))))))))))))))
.

2008-05-13 21:13 . 2008-05-13 21:29 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-13 21:13 . 2008-05-13 21:29 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-13 21:12 . 2008-05-13 21:12 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-05-13 21:12 . 2008-05-14 13:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-13 21:12 . 2008-05-14 14:01 992,800 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-13 21:12 . 2008-05-14 06:38 13,484 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-13 21:12 . 2008-05-14 14:00 8,736 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-13 21:12 . 2008-05-14 06:38 1,604 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-13 21:11 . 2008-05-13 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-13 21:10 . 2008-05-14 13:49 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-05-12 16:48 . 2008-05-12 16:57 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\gtk-2.0
2008-05-12 16:48 . 2008-05-12 16:48 <DIR> d-------- C:\Documents and Settings\Bartek\.thumbnails
2008-05-12 16:47 . 2008-05-12 16:59 <DIR> d-------- C:\Documents and Settings\Bartek\.gimp-2.4
2008-05-12 16:46 . 2008-05-12 16:46 <DIR> d-------- C:\Program Files\GIMP-2.0
2008-05-10 21:52 . 2008-05-10 21:52 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-05-08 07:55 . 2008-05-08 08:02 <DIR> d-------- C:\Program Files\Winamp
2008-05-08 07:55 . 2008-05-08 08:04 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\Winamp
2008-05-08 07:24 . 2008-05-08 07:24 <DIR> d-------- C:\WINDOWS\Sun
2008-05-07 22:23 . 2008-05-07 22:34 <DIR> d-------- C:\Program Files\PhotoFiltre Studio
2008-05-07 22:23 . 2008-05-07 22:23 45 ---h----- C:\WINDOWS\dsez6884.dat
2008-05-07 19:48 . 2008-05-07 19:58 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\Hide IP NG
2008-05-06 18:33 . 2008-05-06 18:33 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2008-05-06 18:33 . 2008-05-06 18:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-06 18:33 . 2008-05-06 18:33 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\TuneUp Software
2008-05-06 18:33 . 2008-05-06 18:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2008-05-06 18:33 . 2007-05-16 08:41 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-05 12:06 . 2008-05-05 12:06 1,160 --a------ C:\WINDOWS\mozver.dat
2008-05-04 17:10 . 2008-05-04 17:11 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-04 15:51 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-04 15:51 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-04 15:51 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-04 15:50 . 2008-05-04 15:50 <DIR> d-------- C:\Program Files\Alwil Software
2008-05-04 15:24 . 2008-05-04 15:24 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-04 15:14 . 2008-05-04 15:14 <DIR> d---s---- C:\Documents and Settings\Bartek\UserData
2008-05-04 15:12 . 2005-12-29 14:07 282,624 -ra------ C:\WINDOWS\system32\drivers\Mrvw125.sys
2008-05-04 15:11 . 2008-05-04 15:11 <DIR> d-------- C:\Program Files\Customer
2008-05-04 15:11 . 2008-05-04 15:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-05-04 15:11 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-05-04 15:09 . 2001-09-19 15:47 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll
2008-05-04 15:09 . 2005-08-11 15:49 393,088 -ra------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-05-04 15:09 . 2005-10-05 19:21 141,312 -ra------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-05-04 15:09 . 2005-03-04 22:53 127,872 -ra------ C:\WINDOWS\system32\drivers\aeaudio.sys
2008-05-04 15:09 . 2003-08-19 21:36 65,536 --a--c--- C:\WINDOWS\system32\dllcache\a3d.dll
2008-05-04 15:09 . 2003-08-19 21:36 65,536 -ra------ C:\WINDOWS\system32\a3d.dll
2008-05-04 15:09 . 2005-06-22 12:11 23,552 -ra------ C:\WINDOWS\system32\PostProc.dll
2008-05-04 15:08 . 2008-05-04 15:08 <DIR> d-------- C:\Program Files\Analog Devices
2008-05-04 15:06 . 2008-05-04 15:06 21,768 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-05-04 15:06 . 2004-04-27 17:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-05-04 15:02 . 2008-05-04 15:02 <DIR> d-------- C:\Program Files\ASUSTeK
2008-05-04 15:01 . 2008-05-04 17:10 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-05-04 15:00 . 2008-05-04 15:11 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-04 15:00 . 2006-02-08 10:26 11,264 -ra------ C:\WINDOWS\system32\drivers\EIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-04 15:14 --------- d-----w C:\Program Files\RPG Tsukuru XP
2008-05-04 14:37 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\Gadu-Gadu
2008-05-04 13:11 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll
2008-05-04 12:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-04 12:49 --------- d-----w C:\Program Files\Java
2008-05-04 12:49 --------- d-----w C:\Program Files\Common Files\Java
2008-05-04 12:46 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 02:56 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 09:29 7561216]
"nwiz"="nwiz.exe" [2006-03-09 09:29 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-03-09 09:29 86016]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 11:11 925696]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-04 17:11:33 113664]
Wireless PCI_CardBus utility V1.01.exe.lnk - C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe [2008-05-04 15:11:14 913408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 14:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-09 15:16:02 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-14 14:00:59
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-14 14:02:48
ComboFix-quarantined-files.txt 2008-05-14 12:02:41

Pre-Run: 155,858,997,248 bajtów wolnych
Post-Run: 155,824,091,136 bajtów wolnych

126

[huber2t]

Log wyglada na czysty

Usuń instalkę Combofix z dysku

Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

Włącz przywracanie systemu.