Bardzo prosze o sprawdzenie loga combofix mojego komputera. Po wygenerowaniu loga przestał działać internet i nie moge wejść do konfiguracji karty żeby sprawdzić czy nie zmienił sie adres ip. Nie mogę wejśćdo ustawień połączeń sieciowych.
- Kod: Zaznacz wszystko
ComboFix 09-08-22.04 - Romka 2009-08-22 23:23.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.48.1045.18.2046.1129 [GMT 2:00]
Uruchomiony z: c:\users\Romka\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090527-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: F-Secure Internet Security 2008 8.00 *On-access scanning enabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: F-Secure Internet Security 2008 8.00 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
SP: avast! antivirus 4.8.1335 [VPS 090527-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: BitDefender Antispyware *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: F-Secure Internet Security 2008 8.00 *enabled* (Updated) {0651C4B0-1D7E-4682-B965-2E9523C483A5}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Pliki utworzone od 2009-07-22 do 2009-08-22 )))))))))))))))))))))))))))))))
.
2009-08-22 21:35 . 2009-08-22 21:35 -------- d-----w- c:\users\Romka\AppData\Local\temp
2009-08-22 21:35 . 2009-08-22 21:35 -------- d-----w- c:\users\rafal1\AppData\Local\temp
2009-08-22 21:35 . 2009-08-22 21:35 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-08-22 21:35 . 2009-08-22 21:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-08-22 19:44 . 2009-08-22 19:44 -------- d-----w- c:\users\rafal1\AppData\Local\Toshiba
2009-08-22 19:44 . 2009-08-22 19:44 -------- d-----w- c:\users\rafal1\AppData\Roaming\ATI
2009-08-22 19:44 . 2009-08-22 19:44 -------- d-----w- c:\users\rafal1\AppData\Local\ATI
2009-08-22 19:28 . 2009-08-22 19:28 -------- d-----w- c:\programdata\Sunbelt
2009-08-03 16:10 . 2009-08-03 16:10 -------- d-----w- c:\program files\Alcohol Soft
2009-08-03 16:04 . 2009-08-03 16:04 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-29 07:03 . 2009-07-18 16:06 827904 ----a-w- c:\windows\system32\wininet.dll
2009-07-29 07:02 . 2009-07-18 09:46 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-29 07:02 . 2009-07-18 16:01 78336 ----a-w- c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 20:55 . 2006-12-05 05:22 673898 ----a-w- c:\windows\system32\perfh015.dat
2009-08-22 20:55 . 2006-12-05 05:22 133278 ----a-w- c:\windows\system32\perfc015.dat
2009-08-22 19:44 . 2009-08-22 19:44 107184 ----a-w- c:\users\rafal1\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-30 07:05 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-02 22:37 . 2008-01-12 18:16 -------- d-----w- c:\programdata\Microsoft Help
2009-06-15 15:24 . 2009-07-20 06:20 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-20 06:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-20 06:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-20 06:20 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-05-28 18:15 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-05-28 18:00 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-05-28 18:00 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-22_20.28.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-02 13:05 . 2009-08-22 20:52 90758 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-01-12 17:26 . 2009-08-22 20:52 11756 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-215878830-2496798263-996412810-1000_UserData.bin
- 2009-06-30 06:56 . 2009-06-30 06:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-30 06:56 . 2009-08-22 21:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-06-30 06:56 . 2009-06-30 06:56 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-30 06:56 . 2009-08-22 21:00 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-30 06:56 . 2009-08-22 21:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-06-30 06:56 . 2009-06-30 06:56 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-08-22 05:27 . 2009-08-22 17:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-08-22 05:27 . 2009-08-22 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-08-22 05:27 . 2009-08-22 17:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-08-22 05:27 . 2009-08-22 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-08-22 20:55 598122 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-22 19:50 598122 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-08-22 20:55 106154 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-08-22 19:50 106154 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 411192]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-05-23 509496]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 438272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 413696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 571024]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPO\Toshiba.Tempo.UI.TrayApplication.exe" [2007-10-29 103824]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-13 4489216]
"NDSTray.exe"="NDSTray.exe" [BU]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-05-28 1826816]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Romka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\users\Romka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E255C810-C290-4C53-B909-BE4781A20F40}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7B9E4666-8346-4546-A7B2-5FC4ABA25502}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C8AA8728-BCB8-496F-9DE8-C78D15D085AC}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{53CA4037-180C-4C34-9684-2E40967F6362}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{843FC464-ADF7-4179-95CF-71014D31F412}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7E1251E9-8431-41E3-BA41-FA990990135F}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{F5776AD2-3080-4937-9180-7E9BE4419784}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 7.0.1.325\\polish\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\polish\setup.exe:Kaspersky Anti-Virus 7.0 Setup
"UDP Query User{0139D406-09FF-4A07-A2E1-CBD8F9A37675}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 7.0.1.325\\polish\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\polish\setup.exe:Kaspersky Anti-Virus 7.0 Setup
R0 CplIR;Embedded IR Driver;c:\windows\System32\drivers\CplIR.sys [2007-03-06 14848]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [2009-01-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [2009-01-10 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [2009-01-10 51792]
R2 SG_Service;SoftGuard Service;c:\program files\Common Files\RbtProt\sgsrv.exe [2003-10-25 155648]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPO\TempoSVC.exe [2007-10-29 95624]
.
Zawartość folderu 'Zaplanowane zadania'
2009-08-22 c:\windows\Tasks\User_Feed_Synchronization-{8AE900D1-C356-4C89-A02C-76977A54ECE4}.job
- c:\windows\system32\msfeedssync.exe [2008-06-08 07:33]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL
TCP: {10CD2532-93FB-4081-8F68-0FCA1BFE113A} = 150.254.5.4,150.254.5.11
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 23:35
Windows 6.0.6001 Service Pack 1 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000008a
.
Czas ukończenia: 2009-08-22 23:42
ComboFix-quarantined-files.txt 2009-08-22 21:42
ComboFix2.txt 2009-08-22 20:39
Przed: 42 316 976 128 bajtów wolnych
Po: 42 223 087 616 bajtów wolnych
162 --- E O F --- 2009-07-29 22:37
Bardzo proszę o pomoc w rozwiązaniu problemu
Zapisz jako