Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
Log Hijackthis
12 Maj 2008, 15:25
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.o2.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 7885 bytes
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.o2.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 7885 bytes
12 Maj 2008, 16:26
Występują jakieś problemy że podajesz log?
W logu czysto
W logu czysto
12 Maj 2008, 16:49
tak,cos dlugo sie wylancza komputer,nie wiem z jakich przyczyn 
12 Maj 2008, 16:55
Daj loga z Combofix
pytanie
12 Maj 2008, 16:57
tak sobie czytałem opisy pp3088
http://forum.instalki.pl/viewtopic.php?t=6762
czy to jest złe?? co myślisz o tym huber2t. dodam że nie ma zielonego pojęcia ale tak z ciekawości. Przeczytaj jak możesz odpisz zanim kolega wykona log z combofix. Dziękuje.
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
http://forum.instalki.pl/viewtopic.php?t=6762
czy to jest złe?? co myślisz o tym huber2t. dodam że nie ma zielonego pojęcia ale tak z ciekawości. Przeczytaj jak możesz odpisz zanim kolega wykona log z combofix. Dziękuje.
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
12 Maj 2008, 17:14
to z ważniejszych to tylko to:
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
usuń za pomocą: LspFix
http://www.cexx.org/lspfix.htm
Odpal LSP-Fix zaznacz "I know what I'm doing" następnie w okienku Keep zaznacz plik nwprovau.dll
i za pomocą strzałki (>>) przenieś go do okienka Remover i kliknij Finish
a reszta to są zbedniki i nie ma sensu w ich usuwaniu bo i tak częśc z nich powruci
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
usuń za pomocą: LspFix
http://www.cexx.org/lspfix.htm
Odpal LSP-Fix zaznacz "I know what I'm doing" następnie w okienku Keep zaznacz plik nwprovau.dll
i za pomocą strzałki (>>) przenieś go do okienka Remover i kliknij Finish
a reszta to są zbedniki i nie ma sensu w ich usuwaniu bo i tak częśc z nich powruci
super
12 Maj 2008, 17:18
Super tylko ze u mnie jest ok. JA tylko przeglądałem sobie ten log i log pp3088 i to wszystko. Dzięki za informację. Więc kolega "smoczatko" sobie to usunie. Pozdrawiam i nie przeszkadzam 
12 Maj 2008, 18:39
to mam dac logo z combofixem ?
12 Maj 2008, 19:07
Usuń to co ci ostatnio usunołem i zrób nowy log z combofixa i daj an forum
12 Maj 2008, 20:33
ComboFix 08-05-11.1 - Kamila 2008-05-12 20:26:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.717 [GMT 2:00]
Running from: C:\Documents and Settings\Kamila\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.
2008-05-12 15:18 . 2008-05-12 15:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-12 11:53 . 2008-05-12 11:53 <DIR> d-------- C:\Documents and Settings\Kamila\.idlerc
2008-05-12 09:52 . 2008-05-12 09:52 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nokia Multimedia Player
2008-05-12 09:52 . 2004-08-04 02:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-11 16:49 . 2008-05-11 16:49 <DIR> d-------- C:\Program Files\FDRLab
2008-05-11 15:19 . 2008-05-11 15:19 <DIR> d-------- C:\Documents and Settings\Kamila\Phone Browser
2008-05-11 14:32 . 2008-05-11 14:32 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\AdobeUM
2008-05-11 10:41 . 2008-05-11 10:41 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Paludour
2008-05-10 14:23 . 2004-08-04 00:43 82,432 --a------ C:\WINDOWS\system32\CNBJMON2.DLL
2008-05-10 14:23 . 2001-10-26 15:42 55,761 --a------ C:\WINDOWS\system32\CNBJHLP2.HLP
2008-05-10 14:23 . 2001-10-26 15:42 1,187 --a------ C:\WINDOWS\system32\CNBJHLP2.CNT
2008-05-10 00:12 . 2008-05-10 00:12 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Yahoo!
2008-05-09 22:03 . 2008-05-09 22:03 <DIR> d-------- C:\Documents and Settings\Kamila\Bluetooth Software
2008-05-06 10:50 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-05-06 10:50 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-05-06 10:50 . 2008-05-06 10:50 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-06 10:50 . 2008-05-06 10:50 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-05-06 10:49 . 2008-05-06 10:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-06 10:48 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-05-06 10:48 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-05-06 10:48 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-05-06 10:48 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-05-06 10:48 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-05-06 10:48 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-05-06 07:58 . 2008-05-06 07:58 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\ACD Systems
2008-05-05 11:10 . 2008-05-05 11:10 <DIR> d-------- C:\Program Files\WIDCOMM
2008-05-04 22:25 . 2008-05-04 22:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-04 15:25 . 2008-05-06 08:57 <DIR> d-------- C:\Program Files\SignSIS-GUI
2008-05-04 13:08 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-04 13:06 . 2008-05-11 14:41 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nokia
2008-05-04 13:06 . 2008-05-04 13:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-05-04 13:05 . 2008-05-04 13:05 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-05-04 13:05 . 2008-05-06 10:48 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-05-04 13:04 . 2008-05-04 13:04 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-04 12:47 . 2008-05-04 12:47 115,920 --a------ C:\WINDOWS\system32\msinet.ocx
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\ssd.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\sisx.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\sis.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\pkg.ico
2008-05-04 12:15 . 2008-05-11 19:27 <DIR> d-------- C:\Program Files\Barak's SignME
2008-05-04 12:15 . 2008-05-04 15:34 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Barak's SignMe!
2008-05-03 21:59 . 2008-05-03 21:59 <DIR> d-------- C:\Program Files\DIFX
2008-05-03 21:53 . 2008-05-04 18:21 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\PC Suite
2008-05-03 21:52 . 2008-05-06 10:49 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-05-03 21:52 . 2008-05-06 10:49 <DIR> d-------- C:\Program Files\Nokia
2008-05-03 21:52 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-05-03 21:51 . 2008-05-04 13:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-02 14:24 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-05-02 14:24 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-05-02 14:24 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-05-02 14:24 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-05-02 13:02 . 2008-05-02 13:02 <DIR> d-------- C:\WINDOWS\Sun
2008-05-02 05:57 . 2008-05-02 05:57 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Gadu-Gadu
2008-05-02 05:56 . 2008-05-02 05:56 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-05-02 05:56 . 2008-05-02 12:51 <DIR> d-------- C:\Documents and Settings\Kamila\Gadu-Gadu
2008-05-01 18:17 . 2008-05-01 18:17 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-05-01 18:17 . 2008-05-12 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-01 18:17 . 2008-05-12 20:30 7,284,512 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-01 18:17 . 2008-05-12 20:30 183,072 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-01 18:17 . 2008-05-12 20:29 116,288 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-01 18:17 . 2008-05-01 18:28 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-01 18:17 . 2008-05-01 18:28 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-01 18:17 . 2008-05-12 20:29 23,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-01 18:16 . 2008-05-01 18:16 <DIR> d-------- C:\KAV
2008-05-01 18:01 . 2008-05-12 08:48 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\skypePM
2008-05-01 18:01 . 2008-05-01 18:01 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-05-01 18:00 . 2008-05-12 20:31 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Skype
2008-05-01 17:59 . 2008-05-01 18:00 <DIR> d-------- C:\Program Files\Skype
2008-05-01 17:59 . 2008-05-01 17:59 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-05-01 17:59 . 2008-05-01 17:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-01 17:37 . 2008-05-01 17:37 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Talkback
2008-05-01 17:29 . 2008-05-12 08:48 <DIR> d-------- C:\Program Files\Odkurzacz
2008-05-01 17:15 . 2008-05-01 17:15 <DIR> d-------- C:\Program Files\uTorrent
2008-05-01 17:15 . 2008-05-12 08:48 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\uTorrent
2008-05-01 17:10 . 2008-05-01 17:10 1,160 --a------ C:\WINDOWS\mozver.dat
2008-05-01 17:05 . 2008-05-01 17:05 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-01 16:54 . 2008-05-01 17:36 <DIR> d-------- C:\Program Files\Winamp
2008-05-01 16:54 . 2008-05-01 16:57 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Winamp
2008-05-01 16:27 . 2008-05-01 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\Yahoo!
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\ACD Systems
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-05-01 16:10 . 2008-05-01 16:10 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-05-01 16:10 . 2007-09-28 17:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-01 16:09 . 2008-05-05 10:28 <DIR> d-------- C:\totalcmd
2008-05-01 16:09 . 2008-05-01 16:10 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\UC.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\RAR.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\LHA.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\ARJ.PIF
2008-05-01 16:09 . 2008-05-01 16:09 312 --a------ C:\WINDOWS\wincmd.ini
2008-05-01 15:56 . 2008-05-01 15:59 <DIR> d-------- C:\Program Files\Real Alternative
2008-05-01 15:34 . 2008-05-01 15:34 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nero
2008-05-01 15:32 . 2008-05-01 15:32 <DIR> d-------- C:\Program Files\Nero
2008-05-01 15:32 . 2008-05-01 15:34 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-05-01 15:32 . 2008-05-01 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-05-01 15:25 . 2008-05-01 15:25 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-01 15:17 . 2008-05-01 15:18 <DIR> d-------- C:\Program Files\Logitech
2008-05-01 15:17 . 2008-05-01 15:17 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-05-01 15:17 . 2002-03-29 11:27 322,832 --a------ C:\WINDOWS\system32\MFC30.DLL
2008-05-01 15:17 . 2002-03-22 11:50 40,124 --------- C:\WINDOWS\system32\drivers\Lhidusb.sys
2008-05-01 15:17 . 2002-03-22 11:50 13,052 --------- C:\WINDOWS\system32\drivers\LCCFLTR.SYS
2008-05-01 15:17 . 2002-03-22 11:50 10,560 --a------ C:\WINDOWS\system32\drivers\itchfltr.sys
2008-05-01 15:13 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-01 14:42 . 2008-05-01 14:42 427 --a------ C:\WINDOWS\ODBC.INI
2008-05-01 14:41 . 2008-05-01 14:42 <DIR> d-------- C:\WINDOWS\ShellNew
2008-05-01 14:37 . 2008-05-01 15:13 <DIR> d-------- C:\Program Files\Java
2008-05-01 14:37 . 2008-05-01 14:37 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-01 13:52 . 2008-05-01 13:52 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-05-01 10:58 . 2008-05-05 23:58 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-05-01 10:58 . 2008-05-06 00:14 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-01 10:52 . 2008-05-01 10:52 <DIR> d--hs---- C:\Documents and Settings\Kamila\UserData
2008-05-01 10:48 . 2008-05-01 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-05-01 10:46 . 2008-05-01 10:46 <DIR> d-------- C:\Program Files\Google
2008-05-01 10:09 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-05-01 10:08 . 2008-05-01 10:58 <DIR> d-------- C:\Program Files\CyberLink
2008-05-01 10:08 . 2003-03-18 20:14 499,712 --------- C:\WINDOWS\system32\msvcp71.dll
2008-05-01 10:08 . 2003-02-21 04:42 348,160 --------- C:\WINDOWS\system32\msvcr71.dll
2008-05-01 10:05 . 2008-05-01 10:05 <DIR> d-------- C:\Program Files\C-Media 3D Audio
2008-05-01 10:05 . 2003-10-14 05:52 2,301,952 --a------ C:\WINDOWS\system\cmicnfg.cpl
2008-05-01 10:04 . 2008-05-01 10:04 <DIR> d-------- C:\Program Files\SiSLan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-01 09:21 --------- d-----w C:\Program Files\ATI Technologies
2008-05-01 07:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-01 07:37 --------- d-----w C:\Program Files\Usługi online
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 14:18 202024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 18:21 21898024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09 49152]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 21:00 315392]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-03-29 01:59 294912]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51 1836328]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 23:02 200768]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-09-16 15:02:14 610365]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"E:\\INTERNET\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 20:30:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
?:\WINDOWS\system32\SETUPAPI.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-05-12 20:32:31 - machine was rebooted [Kamila]
ComboFix-quarantined-files.txt 2008-05-12 18:32:25
Pre-Run: 2,878,312,448 bajtów wolnych
Post-Run: 2,942,861,312 bajt˘w wolnych
227 --- E O F --- 2008-05-07 16:29:48
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.717 [GMT 2:00]
Running from: C:\Documents and Settings\Kamila\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.
2008-05-12 15:18 . 2008-05-12 15:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-12 11:53 . 2008-05-12 11:53 <DIR> d-------- C:\Documents and Settings\Kamila\.idlerc
2008-05-12 09:52 . 2008-05-12 09:52 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nokia Multimedia Player
2008-05-12 09:52 . 2004-08-04 02:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-11 16:49 . 2008-05-11 16:49 <DIR> d-------- C:\Program Files\FDRLab
2008-05-11 15:19 . 2008-05-11 15:19 <DIR> d-------- C:\Documents and Settings\Kamila\Phone Browser
2008-05-11 14:32 . 2008-05-11 14:32 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\AdobeUM
2008-05-11 10:41 . 2008-05-11 10:41 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Paludour
2008-05-10 14:23 . 2004-08-04 00:43 82,432 --a------ C:\WINDOWS\system32\CNBJMON2.DLL
2008-05-10 14:23 . 2001-10-26 15:42 55,761 --a------ C:\WINDOWS\system32\CNBJHLP2.HLP
2008-05-10 14:23 . 2001-10-26 15:42 1,187 --a------ C:\WINDOWS\system32\CNBJHLP2.CNT
2008-05-10 00:12 . 2008-05-10 00:12 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Yahoo!
2008-05-09 22:03 . 2008-05-09 22:03 <DIR> d-------- C:\Documents and Settings\Kamila\Bluetooth Software
2008-05-06 10:50 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-05-06 10:50 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-05-06 10:50 . 2008-05-06 10:50 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-06 10:50 . 2008-05-06 10:50 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-05-06 10:49 . 2008-05-06 10:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia
2008-05-06 10:48 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-05-06 10:48 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-05-06 10:48 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-05-06 10:48 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-05-06 10:48 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-05-06 10:48 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-05-06 07:58 . 2008-05-06 07:58 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\ACD Systems
2008-05-05 11:10 . 2008-05-05 11:10 <DIR> d-------- C:\Program Files\WIDCOMM
2008-05-04 22:25 . 2008-05-04 22:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-04 15:25 . 2008-05-06 08:57 <DIR> d-------- C:\Program Files\SignSIS-GUI
2008-05-04 13:08 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-04 13:06 . 2008-05-11 14:41 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nokia
2008-05-04 13:06 . 2008-05-04 13:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-05-04 13:05 . 2008-05-04 13:05 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-05-04 13:05 . 2008-05-06 10:48 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-05-04 13:04 . 2008-05-04 13:04 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-04 12:47 . 2008-05-04 12:47 115,920 --a------ C:\WINDOWS\system32\msinet.ocx
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\ssd.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\sisx.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\sis.ico
2008-05-04 12:47 . 2008-05-04 15:35 22,486 --a------ C:\WINDOWS\pkg.ico
2008-05-04 12:15 . 2008-05-11 19:27 <DIR> d-------- C:\Program Files\Barak's SignME
2008-05-04 12:15 . 2008-05-04 15:34 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Barak's SignMe!
2008-05-03 21:59 . 2008-05-03 21:59 <DIR> d-------- C:\Program Files\DIFX
2008-05-03 21:53 . 2008-05-04 18:21 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\PC Suite
2008-05-03 21:52 . 2008-05-06 10:49 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-05-03 21:52 . 2008-05-06 10:49 <DIR> d-------- C:\Program Files\Nokia
2008-05-03 21:52 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-05-03 21:51 . 2008-05-04 13:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-02 14:24 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-05-02 14:24 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-05-02 14:24 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-05-02 14:24 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-05-02 13:02 . 2008-05-02 13:02 <DIR> d-------- C:\WINDOWS\Sun
2008-05-02 05:57 . 2008-05-02 05:57 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Gadu-Gadu
2008-05-02 05:56 . 2008-05-02 05:56 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-05-02 05:56 . 2008-05-02 12:51 <DIR> d-------- C:\Documents and Settings\Kamila\Gadu-Gadu
2008-05-01 18:17 . 2008-05-01 18:17 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-05-01 18:17 . 2008-05-12 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-01 18:17 . 2008-05-12 20:30 7,284,512 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-01 18:17 . 2008-05-12 20:30 183,072 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-01 18:17 . 2008-05-12 20:29 116,288 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-01 18:17 . 2008-05-01 18:28 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-01 18:17 . 2008-05-01 18:28 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-01 18:17 . 2008-05-12 20:29 23,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-01 18:16 . 2008-05-01 18:16 <DIR> d-------- C:\KAV
2008-05-01 18:01 . 2008-05-12 08:48 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\skypePM
2008-05-01 18:01 . 2008-05-01 18:01 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-05-01 18:00 . 2008-05-12 20:31 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Skype
2008-05-01 17:59 . 2008-05-01 18:00 <DIR> d-------- C:\Program Files\Skype
2008-05-01 17:59 . 2008-05-01 17:59 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-05-01 17:59 . 2008-05-01 17:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-01 17:37 . 2008-05-01 17:37 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Talkback
2008-05-01 17:29 . 2008-05-12 08:48 <DIR> d-------- C:\Program Files\Odkurzacz
2008-05-01 17:15 . 2008-05-01 17:15 <DIR> d-------- C:\Program Files\uTorrent
2008-05-01 17:15 . 2008-05-12 08:48 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\uTorrent
2008-05-01 17:10 . 2008-05-01 17:10 1,160 --a------ C:\WINDOWS\mozver.dat
2008-05-01 17:05 . 2008-05-01 17:05 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-01 16:54 . 2008-05-01 17:36 <DIR> d-------- C:\Program Files\Winamp
2008-05-01 16:54 . 2008-05-01 16:57 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Winamp
2008-05-01 16:27 . 2008-05-01 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\Yahoo!
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Program Files\ACD Systems
2008-05-01 16:25 . 2008-05-01 16:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-05-01 16:10 . 2008-05-01 16:10 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-05-01 16:10 . 2007-09-28 17:07 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-01 16:09 . 2008-05-05 10:28 <DIR> d-------- C:\totalcmd
2008-05-01 16:09 . 2008-05-01 16:10 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\UC.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\RAR.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\LHA.PIF
2008-05-01 16:09 . 2005-02-02 06:51 545 --a------ C:\WINDOWS\ARJ.PIF
2008-05-01 16:09 . 2008-05-01 16:09 312 --a------ C:\WINDOWS\wincmd.ini
2008-05-01 15:56 . 2008-05-01 15:59 <DIR> d-------- C:\Program Files\Real Alternative
2008-05-01 15:34 . 2008-05-01 15:34 <DIR> d-------- C:\Documents and Settings\Kamila\Dane aplikacji\Nero
2008-05-01 15:32 . 2008-05-01 15:32 <DIR> d-------- C:\Program Files\Nero
2008-05-01 15:32 . 2008-05-01 15:34 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-05-01 15:32 . 2008-05-01 15:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-05-01 15:25 . 2008-05-01 15:25 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-01 15:17 . 2008-05-01 15:18 <DIR> d-------- C:\Program Files\Logitech
2008-05-01 15:17 . 2008-05-01 15:17 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-05-01 15:17 . 2002-03-29 11:27 322,832 --a------ C:\WINDOWS\system32\MFC30.DLL
2008-05-01 15:17 . 2002-03-22 11:50 40,124 --------- C:\WINDOWS\system32\drivers\Lhidusb.sys
2008-05-01 15:17 . 2002-03-22 11:50 13,052 --------- C:\WINDOWS\system32\drivers\LCCFLTR.SYS
2008-05-01 15:17 . 2002-03-22 11:50 10,560 --a------ C:\WINDOWS\system32\drivers\itchfltr.sys
2008-05-01 15:13 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-01 14:42 . 2008-05-01 14:42 427 --a------ C:\WINDOWS\ODBC.INI
2008-05-01 14:41 . 2008-05-01 14:42 <DIR> d-------- C:\WINDOWS\ShellNew
2008-05-01 14:37 . 2008-05-01 15:13 <DIR> d-------- C:\Program Files\Java
2008-05-01 14:37 . 2008-05-01 14:37 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-01 13:52 . 2008-05-01 13:52 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-05-01 10:58 . 2008-05-05 23:58 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-05-01 10:58 . 2008-05-06 00:14 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-01 10:52 . 2008-05-01 10:52 <DIR> d--hs---- C:\Documents and Settings\Kamila\UserData
2008-05-01 10:48 . 2008-05-01 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-05-01 10:46 . 2008-05-01 10:46 <DIR> d-------- C:\Program Files\Google
2008-05-01 10:09 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-05-01 10:08 . 2008-05-01 10:58 <DIR> d-------- C:\Program Files\CyberLink
2008-05-01 10:08 . 2003-03-18 20:14 499,712 --------- C:\WINDOWS\system32\msvcp71.dll
2008-05-01 10:08 . 2003-02-21 04:42 348,160 --------- C:\WINDOWS\system32\msvcr71.dll
2008-05-01 10:05 . 2008-05-01 10:05 <DIR> d-------- C:\Program Files\C-Media 3D Audio
2008-05-01 10:05 . 2003-10-14 05:52 2,301,952 --a------ C:\WINDOWS\system\cmicnfg.cpl
2008-05-01 10:04 . 2008-05-01 10:04 <DIR> d-------- C:\Program Files\SiSLan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-01 09:21 --------- d-----w C:\Program Files\ATI Technologies
2008-05-01 07:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-01 07:37 --------- d-----w C:\Program Files\Usługi online
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 14:18 202024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 18:21 21898024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09 49152]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 21:00 315392]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-03-29 01:59 294912]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51 1836328]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 23:02 200768]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-09-16 15:02:14 610365]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"E:\\INTERNET\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 20:30:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
?:\WINDOWS\system32\SETUPAPI.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-05-12 20:32:31 - machine was rebooted [Kamila]
ComboFix-quarantined-files.txt 2008-05-12 18:32:25
Pre-Run: 2,878,312,448 bajtów wolnych
Post-Run: 2,942,861,312 bajt˘w wolnych
227 --- E O F --- 2008-05-07 16:29:48
12 Maj 2008, 20:40
W logu nic nie widzę
Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum
Włącz przywracanie systemu.
Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum
Włącz przywracanie systemu.
12 Maj 2008, 20:54
to jeszcze raz mam to zrobic combofixem i puzniej zeskanowac,i mam wszystkie dyski zeskanowac i ktory skaner wybrac ?
12 Maj 2008, 20:56
Combofiem już nie tylko ostatecznie Kasperskim wszsytkie dyski
12 Maj 2008, 21:18
nie moge wlaczysc skanowania,pod strzalka pokazuje sie zulta gwaztka..
moge tylko wlaczyc skanowanie folderow....
moge tylko wlaczyc skanowanie folderow....
12 Maj 2008, 21:29
To zrób to