Proszę o sprawdzenie loga z ComboFix.
Przeskanowałem kompa (system Vista) online Kaspersym i znalazł dużo zaifekowanych plików ale raportu nie udał mi się zapisać ani wysłać do analizy. Proszę o pomoc czy coś złego widać w logu
ComboFix 08-04-20.1 - Beatka 2008-04-20 20:15:49.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.251 [GMT 2:00]
Running from: C:\Users\Beatka\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\driver
C:\Windows\system32\driver\34api.dll
C:\Windows\system32\driver\34COM.dll
C:\Windows\system32\driver\cap7134.cat
C:\Windows\system32\driver\cap7134.sys
C:\Windows\system32\driver\E500_33.INF
C:\Windows\system32\driver\E500_34.INF
C:\Windows\system32\driver\E501_33.inf
C:\Windows\system32\driver\E501_34.inf
C:\Windows\system32\driver\E501_JP.inf
C:\Windows\system32\driver\EZMaker.inf
C:\Windows\system32\driver\InstallDriver.exe
C:\Windows\system32\driver\PhTvTune.cat
C:\Windows\system32\driver\PhTVTune.inf
C:\Windows\system32\driver\PhTvTune.sys
C:\Windows\system32\driver\Prop7134.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-20 to 2008-04-20 )))))))))))))))))))))))))))))))
.
2008-04-20 18:19 . 2008-04-20 18:19 <DIR> d-------- C:\Windows\System32\Kaspersky Lab
2008-04-19 22:56 . 2008-04-19 22:56 <DIR> d-------- C:\Program Files\mks_vir_9
2008-04-19 22:53 . 2008-04-20 17:46 <DIR> d-------- C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
2008-04-19 22:53 . 2008-04-19 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 22:38 . 2006-04-27 16:17 <DIR> d-------- C:\Users\Beatka\BibliotekiWindows
2008-04-19 22:11 . 2005-10-19 18:19 1,327,189 --a------ C:\Windows\System32\odSupp_M.dll
2008-04-19 22:11 . 2005-11-22 20:56 630,784 --a------ C:\Windows\System32\ANIWZCS2.dll
2008-04-19 22:11 . 2005-10-19 18:19 204,800 --a------ C:\Windows\System32\aIPH.dll
2008-04-19 22:11 . 2005-11-23 10:10 163,840 --a------ C:\Windows\System32\WlanApp.dll
2008-04-19 22:11 . 2005-10-19 18:19 57,407 --a------ C:\Windows\System32\ANICtl.dll
2008-04-19 22:11 . 2005-10-27 08:55 49,152 --a------ C:\Windows\System32\JJAKEn.dll
2008-04-19 22:11 . 2005-10-19 18:19 49,152 --a------ C:\Windows\System32\AQCKGen.dll
2008-04-19 22:10 . 2008-04-19 22:10 <DIR> d-------- C:\Program Files\D-Link
2008-04-19 22:10 . 2008-04-19 22:11 <DIR> d-------- C:\Program Files\ANI
2008-04-19 22:10 . 2005-11-10 07:13 50,176 --a------ C:\Windows\System32\ANIO64.sys
2008-04-19 22:10 . 2005-10-21 15:56 36,864 --a------ C:\Windows\System32\ANIOApi.dll
2008-04-19 22:10 . 2005-11-09 15:44 24,288 --a------ C:\Windows\System32\ANIO.sys
2008-04-19 22:10 . 2004-10-14 10:29 16,997 --a------ C:\Windows\System32\ANIO.VXD
2008-04-19 22:10 . 2004-10-14 10:29 11,904 --a------ C:\Windows\System32\anio4.sys
2008-04-19 21:36 . 2008-04-19 21:36 <DIR> d-------- C:\PerfLogs
2008-04-19 19:17 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-19 19:16 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-04-19 19:15 . 2008-01-19 09:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 19:14 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-19 19:13 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-19 19:13 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-04-19 19:13 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-19 19:12 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-19 19:12 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-19 19:10 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-19 19:10 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-19 19:10 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-19 19:10 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-16 12:01 . 2008-04-16 12:02 <DIR> d-------- C:\Program Files\PITy2007
2008-04-12 15:49 . 2008-04-12 15:49 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2008-04-12 15:24 . 2008-04-12 15:24 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-12 14:09 . 2008-04-12 14:10 <DIR> d-------- C:\Users\Beatka\AppData\Roaming\RegClean
2008-04-10 20:20 . 2008-02-29 06:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-10 20:20 . 2008-02-22 04:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-10 20:20 . 2008-02-22 07:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\Windows\System32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\Windows\System32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\Windows\System32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a------ C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\Windows\System32\divxdec.ax
2008-03-21 22:30 . 2008-03-21 22:30 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-03-21 22:30 . 2008-03-21 22:30 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-03-21 22:30 . 2008-03-21 22:30 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 4,816 --a------ C:\Windows\System32\divxsm.tlb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 16:24 --------- d-----w C:\Users\Beatka\AppData\Roaming\Skype
2008-04-19 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-19 19:52 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 17:58 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-19 17:58 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 17:45 --------- d-----w C:\Users\Beatka\AppData\Roaming\uTorrent
2008-04-17 11:43 --------- d-----w C:\Users\Beatka\AppData\Roaming\Winamp
2008-04-15 14:18 --------- d-----w C:\Program Files\PITy
2008-04-15 12:24 --------- d-----w C:\Program Files\Winamp
2008-04-13 11:11 --------- d-----w C:\Program Files\DivX
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-12 22:41 --------- d-----w C:\Program Files\Ascentive
2008-03-09 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-03-06 20:03 892,928 ----a-w C:\Windows\System32\iconv.dll
2008-03-06 20:03 405,504 ----a-w C:\Windows\System32\libmplayer.dll
2008-03-06 20:03 3,108,864 ----a-w C:\Windows\System32\libavcodec.dll
2008-03-06 20:03 126,976 ----a-w C:\Windows\System32\libmpeg2_ff.dll
2008-03-06 20:02 56,320 ----a-w C:\Windows\System32\ff_unrar.dll
2008-03-06 20:02 54,784 ----a-w C:\Windows\System32\ff_liba52.dll
2008-03-06 20:02 397,312 ----a-w C:\Windows\System32\ff_libfaad2.dll
2008-03-06 20:02 26,624 ----a-w C:\Windows\System32\ff_wmv9.dll
2008-03-06 20:02 188,416 ----a-w C:\Windows\System32\ff_theora.dll
2008-03-06 20:02 167,936 ----a-w C:\Windows\System32\ff_libdts.dll
2008-03-06 20:02 143,360 ----a-w C:\Windows\System32\ff_libmad.dll
2008-03-06 20:02 135,168 ----a-w C:\Windows\System32\ff_samplerate.dll
2008-03-06 20:02 118,784 ----a-w C:\Windows\System32\ff_realaac.dll
2008-03-06 20:02 102,912 ----a-w C:\Windows\System32\ff_tremor.dll
2008-03-06 20:02 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll
2008-03-06 20:01 79,360 ----a-w C:\Windows\System32\mkzlib.dll
2008-03-06 20:01 23,552 ----a-w C:\Windows\System32\mkunicode.dll
2008-03-06 20:01 163,840 ----a-w C:\Windows\System32\ts.dll
2008-03-06 20:01 159,744 ----a-w C:\Windows\System32\mmfinfo.dll
2008-03-06 20:01 148,480 ----a-w C:\Windows\System32\mkx.dll
2008-03-06 20:01 141,312 ----a-w C:\Windows\System32\mp4.dll
2008-03-06 20:01 120,832 ----a-w C:\Windows\System32\ogm.dll
2008-03-06 20:01 108,032 ----a-w C:\Windows\System32\avi.dll
2008-03-06 20:01 --------- d-----w C:\Program Files\Real Alternative
2008-03-03 19:36 --------- d-----w C:\Program Files\uTorrent
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-24 10:56 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-24 10:56 --------- d-----w C:\Program Files\Winamp Remote
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2007-07-13 19:41 991 ----a-w C:\Program Files\INSTALL.LOG
2007-05-01 17:47 1,049,719 ----a-w C:\Users\Beatka\wrar361pl.exe
2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-02 23:11 117,535,476 ----a-r C:\Users\Beatka\Nero7.exe
2006-11-06 14:09 111,132,138 ----a-r C:\Users\Beatka\nero-7 0 1 4.exe
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-17 14:17 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"TOSCDSPD"="TOSCDSPD.EXE" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-19 17:27 26164776]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-03 15:44 77824]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 13:14 409264]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 17:02 493112]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]
"TOSHIBA Volume Indicator"="C:\Program Files\Toshiba\Utilities\VolControl.exe" [2006-12-13 11:33 94208]
"NDSTray.exe"="NDSTray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-04 08:35 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [2008-02-08 20:06 3276800]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DFBA3EE2-B8A8-4B44-B757-BE86F9E4125E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FCF0BE58-D08D-4E31-9A4D-A5100E76A2D2}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C387C43D-ABC3-47B2-86BB-DF14F1BAEB12}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AFFF25F8-1AC1-48BA-AEFE-53FC5F121CDA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{5A8B6332-6782-4F62-BD22-D315D6F0AAB7}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{62897443-69B9-4B84-A920-EDE9564C416D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 05:10]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 06:34]
R3 BoiHwsetup;Access 32bits INT15 routine;C:\Windows\system32\drivers\BoiHwSetup.sys [2006-10-12 10:18]
R3 qkbfiltr;Keyboard Filter Driver;C:\Windows\system32\DRIVERS\qkbfiltr.sys [2006-11-20 19:14]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-24 22:46]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
S3 Cap7134;Cap7134 Capture;C:\Windows\system32\DRIVERS\Cap7134.sys [2005-12-19 12:23]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 21:57:30 C:\Windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Beatka.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
"2008-04-19 01:30:00 C:\Windows\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean.Beatka)Runs RegClean to optimize your registry.
"2008-04-20 17:50:22 C:\Windows\Tasks\User_Feed_Synchronization-{319A2F54-116C-4C58-9E79-18900B99F6AA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 20:21:45
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-20 20:23:31
ComboFix-quarantined-files.txt 2008-04-20 18:23:05
Pre-Run: 29,292,900,352 bajtów wolnych
Post-Run: 30,039,535,616 bajtów wolnych
251 --- E O F --- 2008-04-19 18:04:26
Proszę o sprawdzenie loga
Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.
2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
1. Każdy temat powinien odzwierciedlać treść wątku.
2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
6 posty(ów)
• Strona 1 z 1
przez huber2t » 21 Kwi 2008, 16:14
UA:
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
Plik
zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu
Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Wklej do notatnika:
- Kod: Zaznacz wszystko
File::
C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ANIWZCS2Service"=-
Plik
zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu
Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
-
huber2t - Zasłużony działacz forum
- Posty: 2798
- Dołączenie: 21 Mar 2008, 10:07
- Pochwały: 42
nowy log
przez drucik11 » 21 Kwi 2008, 18:13
UA:
Zrobiłem jak pisałeś, oto log
Pozdrawiam
ComboFix 08-04-20.5 - Beatka 2008-04-21 17:56:02.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.236 [GMT 2:00]
Running from: C:\Users\Beatka\Desktop\ComboFix.exe
Command switches used :: C:\Users\Beatka\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\driver
C:\Windows\system32\driver\34api.dll
C:\Windows\system32\driver\34COM.dll
C:\Windows\system32\driver\cap7134.cat
C:\Windows\system32\driver\cap7134.sys
C:\Windows\system32\driver\E500_33.INF
C:\Windows\system32\driver\E500_34.INF
C:\Windows\system32\driver\E501_33.inf
C:\Windows\system32\driver\E501_34.inf
C:\Windows\system32\driver\E501_JP.inf
C:\Windows\system32\driver\EZMaker.inf
C:\Windows\system32\driver\InstallDriver.exe
C:\Windows\system32\driver\PhTvTune.cat
C:\Windows\system32\driver\PhTVTune.inf
C:\Windows\system32\driver\PhTvTune.sys
C:\Windows\system32\driver\Prop7134.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.
2008-04-19 22:56 . 2008-04-19 22:56 <DIR> d-------- C:\Program Files\mks_vir_9
2008-04-19 22:53 . 2008-04-20 17:46 <DIR> d-------- C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
2008-04-19 22:53 . 2008-04-19 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 22:38 . 2006-04-27 16:17 <DIR> d-------- C:\Users\Beatka\BibliotekiWindows
2008-04-19 22:11 . 2005-10-19 18:19 1,327,189 --a------ C:\Windows\System32\odSupp_M.dll
2008-04-19 22:11 . 2005-11-22 20:56 630,784 --a------ C:\Windows\System32\ANIWZCS2.dll
2008-04-19 22:11 . 2005-10-19 18:19 204,800 --a------ C:\Windows\System32\aIPH.dll
2008-04-19 22:11 . 2005-11-23 10:10 163,840 --a------ C:\Windows\System32\WlanApp.dll
2008-04-19 22:11 . 2005-10-19 18:19 57,407 --a------ C:\Windows\System32\ANICtl.dll
2008-04-19 22:11 . 2005-10-27 08:55 49,152 --a------ C:\Windows\System32\JJAKEn.dll
2008-04-19 22:11 . 2005-10-19 18:19 49,152 --a------ C:\Windows\System32\AQCKGen.dll
2008-04-19 22:10 . 2008-04-19 22:10 <DIR> d-------- C:\Program Files\D-Link
2008-04-19 22:10 . 2008-04-21 17:35 <DIR> d-------- C:\Program Files\ANI
2008-04-19 22:10 . 2005-11-10 07:13 50,176 --a------ C:\Windows\System32\ANIO64.sys
2008-04-19 22:10 . 2005-10-21 15:56 36,864 --a------ C:\Windows\System32\ANIOApi.dll
2008-04-19 22:10 . 2005-11-09 15:44 24,288 --a------ C:\Windows\System32\ANIO.sys
2008-04-19 22:10 . 2004-10-14 10:29 16,997 --a------ C:\Windows\System32\ANIO.VXD
2008-04-19 22:10 . 2004-10-14 10:29 11,904 --a------ C:\Windows\System32\anio4.sys
2008-04-19 21:36 . 2008-04-19 21:36 <DIR> d-------- C:\PerfLogs
2008-04-19 19:17 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-19 19:16 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-04-19 19:15 . 2008-01-19 09:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 19:14 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-19 19:13 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-19 19:13 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-04-19 19:13 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-19 19:12 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-19 19:12 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-19 19:10 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-19 19:10 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-19 19:10 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-19 19:10 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-16 12:01 . 2008-04-16 12:02 <DIR> d-------- C:\Program Files\PITy2007
2008-04-12 15:49 . 2008-04-12 15:49 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2008-04-12 15:24 . 2008-04-12 15:24 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-12 14:09 . 2008-04-12 14:10 <DIR> d-------- C:\Users\Beatka\AppData\Roaming\RegClean
2008-04-10 20:20 . 2008-02-29 06:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-10 20:20 . 2008-02-22 04:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-10 20:20 . 2008-02-22 07:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\Windows\System32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\Windows\System32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\Windows\System32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a------ C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\Windows\System32\divxdec.ax
2008-03-21 22:30 . 2008-03-21 22:30 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-03-21 22:30 . 2008-03-21 22:30 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-03-21 22:30 . 2008-03-21 22:30 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 4,816 --a------ C:\Windows\System32\divxsm.tlb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 15:51 --------- d-----w C:\Users\Beatka\AppData\Roaming\Skype
2008-04-21 15:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 15:35 --------- d-----w C:\Program Files\Soulseek-Test
2008-04-21 15:35 --------- d-----w C:\Program Files\DivX
2008-04-21 15:35 --------- d-----w C:\Program Files\AVIcodec
2008-04-21 15:35 --------- d-----w C:\Program Files\Atheros
2008-04-19 19:52 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 17:58 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-19 17:58 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 17:45 --------- d-----w C:\Users\Beatka\AppData\Roaming\uTorrent
2008-04-17 11:43 --------- d-----w C:\Users\Beatka\AppData\Roaming\Winamp
2008-04-15 14:18 --------- d-----w C:\Program Files\PITy
2008-04-15 12:24 --------- d-----w C:\Program Files\Winamp
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-12 22:41 --------- d-----w C:\Program Files\Ascentive
2008-03-09 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-03-06 20:03 892,928 ----a-w C:\Windows\System32\iconv.dll
2008-03-06 20:03 405,504 ----a-w C:\Windows\System32\libmplayer.dll
2008-03-06 20:03 3,108,864 ----a-w C:\Windows\System32\libavcodec.dll
2008-03-06 20:03 126,976 ----a-w C:\Windows\System32\libmpeg2_ff.dll
2008-03-06 20:02 56,320 ----a-w C:\Windows\System32\ff_unrar.dll
2008-03-06 20:02 54,784 ----a-w C:\Windows\System32\ff_liba52.dll
2008-03-06 20:02 397,312 ----a-w C:\Windows\System32\ff_libfaad2.dll
2008-03-06 20:02 26,624 ----a-w C:\Windows\System32\ff_wmv9.dll
2008-03-06 20:02 188,416 ----a-w C:\Windows\System32\ff_theora.dll
2008-03-06 20:02 167,936 ----a-w C:\Windows\System32\ff_libdts.dll
2008-03-06 20:02 143,360 ----a-w C:\Windows\System32\ff_libmad.dll
2008-03-06 20:02 135,168 ----a-w C:\Windows\System32\ff_samplerate.dll
2008-03-06 20:02 118,784 ----a-w C:\Windows\System32\ff_realaac.dll
2008-03-06 20:02 102,912 ----a-w C:\Windows\System32\ff_tremor.dll
2008-03-06 20:02 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll
2008-03-06 20:01 79,360 ----a-w C:\Windows\System32\mkzlib.dll
2008-03-06 20:01 23,552 ----a-w C:\Windows\System32\mkunicode.dll
2008-03-06 20:01 163,840 ----a-w C:\Windows\System32\ts.dll
2008-03-06 20:01 159,744 ----a-w C:\Windows\System32\mmfinfo.dll
2008-03-06 20:01 148,480 ----a-w C:\Windows\System32\mkx.dll
2008-03-06 20:01 141,312 ----a-w C:\Windows\System32\mp4.dll
2008-03-06 20:01 120,832 ----a-w C:\Windows\System32\ogm.dll
2008-03-06 20:01 108,032 ----a-w C:\Windows\System32\avi.dll
2008-03-06 20:01 --------- d-----w C:\Program Files\Real Alternative
2008-03-03 19:36 --------- d-----w C:\Program Files\uTorrent
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-24 10:56 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-24 10:56 --------- d-----w C:\Program Files\Winamp Remote
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2007-07-13 19:41 991 ----a-w C:\Program Files\INSTALL.LOG
2007-05-01 17:47 1,049,719 ----a-w C:\Users\Beatka\wrar361pl.exe
2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-02 23:11 117,535,476 ----a-r C:\Users\Beatka\Nero7.exe
2006-11-06 14:09 111,132,138 ----a-r C:\Users\Beatka\nero-7 0 1 4.exe
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-17 14:17 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"TOSCDSPD"="TOSCDSPD.EXE" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-19 17:27 26164776]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-03 15:44 77824]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 13:14 409264]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 17:02 493112]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]
"TOSHIBA Volume Indicator"="C:\Program Files\Toshiba\Utilities\VolControl.exe" [2006-12-13 11:33 94208]
"NDSTray.exe"="NDSTray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-04 08:35 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [2008-02-08 20:06 3276800]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DFBA3EE2-B8A8-4B44-B757-BE86F9E4125E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FCF0BE58-D08D-4E31-9A4D-A5100E76A2D2}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C387C43D-ABC3-47B2-86BB-DF14F1BAEB12}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AFFF25F8-1AC1-48BA-AEFE-53FC5F121CDA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{5A8B6332-6782-4F62-BD22-D315D6F0AAB7}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{62897443-69B9-4B84-A920-EDE9564C416D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 05:10]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 06:34]
R3 BoiHwsetup;Access 32bits INT15 routine;C:\Windows\system32\drivers\BoiHwSetup.sys [2006-10-12 10:18]
R3 qkbfiltr;Keyboard Filter Driver;C:\Windows\system32\DRIVERS\qkbfiltr.sys [2006-11-20 19:14]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-24 22:46]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
S3 Cap7134;Cap7134 Capture;C:\Windows\system32\DRIVERS\Cap7134.sys [2005-12-19 12:23]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83418536-cda5-11db-8ced-806e6f6e6963}]
\shell\AutoRun\command - E:\AUTORUN.EXE
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 21:57:30 C:\Windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Beatka.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
"2008-04-19 01:30:00 C:\Windows\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean.Beatka)Runs RegClean to optimize your registry.
"2008-04-21 15:40:25 C:\Windows\Tasks\User_Feed_Synchronization-{319A2F54-116C-4C58-9E79-18900B99F6AA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 18:02:23
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-04-21 18:07:05
ComboFix-quarantined-files.txt 2008-04-21 16:05:59
ComboFix2.txt 2008-04-20 18:23:33
Pre-Run: 26,081,243,136 bajtów wolnych
Post-Run: 26,157,793,280 bajtów wolnych
256 --- E O F --- 2008-04-19 18:04:26
Pozdrawiam
ComboFix 08-04-20.5 - Beatka 2008-04-21 17:56:02.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.236 [GMT 2:00]
Running from: C:\Users\Beatka\Desktop\ComboFix.exe
Command switches used :: C:\Users\Beatka\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\driver
C:\Windows\system32\driver\34api.dll
C:\Windows\system32\driver\34COM.dll
C:\Windows\system32\driver\cap7134.cat
C:\Windows\system32\driver\cap7134.sys
C:\Windows\system32\driver\E500_33.INF
C:\Windows\system32\driver\E500_34.INF
C:\Windows\system32\driver\E501_33.inf
C:\Windows\system32\driver\E501_34.inf
C:\Windows\system32\driver\E501_JP.inf
C:\Windows\system32\driver\EZMaker.inf
C:\Windows\system32\driver\InstallDriver.exe
C:\Windows\system32\driver\PhTvTune.cat
C:\Windows\system32\driver\PhTVTune.inf
C:\Windows\system32\driver\PhTvTune.sys
C:\Windows\system32\driver\Prop7134.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.
2008-04-19 22:56 . 2008-04-19 22:56 <DIR> d-------- C:\Program Files\mks_vir_9
2008-04-19 22:53 . 2008-04-20 17:46 <DIR> d-------- C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
2008-04-19 22:53 . 2008-04-19 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 22:38 . 2006-04-27 16:17 <DIR> d-------- C:\Users\Beatka\BibliotekiWindows
2008-04-19 22:11 . 2005-10-19 18:19 1,327,189 --a------ C:\Windows\System32\odSupp_M.dll
2008-04-19 22:11 . 2005-11-22 20:56 630,784 --a------ C:\Windows\System32\ANIWZCS2.dll
2008-04-19 22:11 . 2005-10-19 18:19 204,800 --a------ C:\Windows\System32\aIPH.dll
2008-04-19 22:11 . 2005-11-23 10:10 163,840 --a------ C:\Windows\System32\WlanApp.dll
2008-04-19 22:11 . 2005-10-19 18:19 57,407 --a------ C:\Windows\System32\ANICtl.dll
2008-04-19 22:11 . 2005-10-27 08:55 49,152 --a------ C:\Windows\System32\JJAKEn.dll
2008-04-19 22:11 . 2005-10-19 18:19 49,152 --a------ C:\Windows\System32\AQCKGen.dll
2008-04-19 22:10 . 2008-04-19 22:10 <DIR> d-------- C:\Program Files\D-Link
2008-04-19 22:10 . 2008-04-21 17:35 <DIR> d-------- C:\Program Files\ANI
2008-04-19 22:10 . 2005-11-10 07:13 50,176 --a------ C:\Windows\System32\ANIO64.sys
2008-04-19 22:10 . 2005-10-21 15:56 36,864 --a------ C:\Windows\System32\ANIOApi.dll
2008-04-19 22:10 . 2005-11-09 15:44 24,288 --a------ C:\Windows\System32\ANIO.sys
2008-04-19 22:10 . 2004-10-14 10:29 16,997 --a------ C:\Windows\System32\ANIO.VXD
2008-04-19 22:10 . 2004-10-14 10:29 11,904 --a------ C:\Windows\System32\anio4.sys
2008-04-19 21:36 . 2008-04-19 21:36 <DIR> d-------- C:\PerfLogs
2008-04-19 19:17 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-19 19:16 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-04-19 19:15 . 2008-01-19 09:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 19:14 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-19 19:13 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-19 19:13 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-04-19 19:13 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-19 19:12 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-19 19:12 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-19 19:10 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-19 19:10 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-19 19:10 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-19 19:10 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-16 12:01 . 2008-04-16 12:02 <DIR> d-------- C:\Program Files\PITy2007
2008-04-12 15:49 . 2008-04-12 15:49 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2008-04-12 15:24 . 2008-04-12 15:24 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-12 14:09 . 2008-04-12 14:10 <DIR> d-------- C:\Users\Beatka\AppData\Roaming\RegClean
2008-04-10 20:20 . 2008-02-29 06:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-10 20:20 . 2008-02-22 04:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-10 20:20 . 2008-02-22 07:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\Windows\System32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\Windows\System32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\Windows\System32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a------ C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\Windows\System32\divxdec.ax
2008-03-21 22:30 . 2008-03-21 22:30 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-03-21 22:30 . 2008-03-21 22:30 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-03-21 22:30 . 2008-03-21 22:30 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 4,816 --a------ C:\Windows\System32\divxsm.tlb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 15:51 --------- d-----w C:\Users\Beatka\AppData\Roaming\Skype
2008-04-21 15:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 15:35 --------- d-----w C:\Program Files\Soulseek-Test
2008-04-21 15:35 --------- d-----w C:\Program Files\DivX
2008-04-21 15:35 --------- d-----w C:\Program Files\AVIcodec
2008-04-21 15:35 --------- d-----w C:\Program Files\Atheros
2008-04-19 19:52 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 17:58 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-19 17:58 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 17:45 --------- d-----w C:\Users\Beatka\AppData\Roaming\uTorrent
2008-04-17 11:43 --------- d-----w C:\Users\Beatka\AppData\Roaming\Winamp
2008-04-15 14:18 --------- d-----w C:\Program Files\PITy
2008-04-15 12:24 --------- d-----w C:\Program Files\Winamp
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-12 22:41 --------- d-----w C:\Program Files\Ascentive
2008-03-09 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-03-06 20:03 892,928 ----a-w C:\Windows\System32\iconv.dll
2008-03-06 20:03 405,504 ----a-w C:\Windows\System32\libmplayer.dll
2008-03-06 20:03 3,108,864 ----a-w C:\Windows\System32\libavcodec.dll
2008-03-06 20:03 126,976 ----a-w C:\Windows\System32\libmpeg2_ff.dll
2008-03-06 20:02 56,320 ----a-w C:\Windows\System32\ff_unrar.dll
2008-03-06 20:02 54,784 ----a-w C:\Windows\System32\ff_liba52.dll
2008-03-06 20:02 397,312 ----a-w C:\Windows\System32\ff_libfaad2.dll
2008-03-06 20:02 26,624 ----a-w C:\Windows\System32\ff_wmv9.dll
2008-03-06 20:02 188,416 ----a-w C:\Windows\System32\ff_theora.dll
2008-03-06 20:02 167,936 ----a-w C:\Windows\System32\ff_libdts.dll
2008-03-06 20:02 143,360 ----a-w C:\Windows\System32\ff_libmad.dll
2008-03-06 20:02 135,168 ----a-w C:\Windows\System32\ff_samplerate.dll
2008-03-06 20:02 118,784 ----a-w C:\Windows\System32\ff_realaac.dll
2008-03-06 20:02 102,912 ----a-w C:\Windows\System32\ff_tremor.dll
2008-03-06 20:02 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll
2008-03-06 20:01 79,360 ----a-w C:\Windows\System32\mkzlib.dll
2008-03-06 20:01 23,552 ----a-w C:\Windows\System32\mkunicode.dll
2008-03-06 20:01 163,840 ----a-w C:\Windows\System32\ts.dll
2008-03-06 20:01 159,744 ----a-w C:\Windows\System32\mmfinfo.dll
2008-03-06 20:01 148,480 ----a-w C:\Windows\System32\mkx.dll
2008-03-06 20:01 141,312 ----a-w C:\Windows\System32\mp4.dll
2008-03-06 20:01 120,832 ----a-w C:\Windows\System32\ogm.dll
2008-03-06 20:01 108,032 ----a-w C:\Windows\System32\avi.dll
2008-03-06 20:01 --------- d-----w C:\Program Files\Real Alternative
2008-03-03 19:36 --------- d-----w C:\Program Files\uTorrent
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-24 10:56 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-24 10:56 --------- d-----w C:\Program Files\Winamp Remote
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2007-07-13 19:41 991 ----a-w C:\Program Files\INSTALL.LOG
2007-05-01 17:47 1,049,719 ----a-w C:\Users\Beatka\wrar361pl.exe
2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-02 23:11 117,535,476 ----a-r C:\Users\Beatka\Nero7.exe
2006-11-06 14:09 111,132,138 ----a-r C:\Users\Beatka\nero-7 0 1 4.exe
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-17 14:17 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"TOSCDSPD"="TOSCDSPD.EXE" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-19 17:27 26164776]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-03 15:44 77824]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 13:14 409264]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 17:02 493112]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]
"TOSHIBA Volume Indicator"="C:\Program Files\Toshiba\Utilities\VolControl.exe" [2006-12-13 11:33 94208]
"NDSTray.exe"="NDSTray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-04 08:35 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [2008-02-08 20:06 3276800]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DFBA3EE2-B8A8-4B44-B757-BE86F9E4125E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FCF0BE58-D08D-4E31-9A4D-A5100E76A2D2}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C387C43D-ABC3-47B2-86BB-DF14F1BAEB12}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AFFF25F8-1AC1-48BA-AEFE-53FC5F121CDA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{5A8B6332-6782-4F62-BD22-D315D6F0AAB7}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{62897443-69B9-4B84-A920-EDE9564C416D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 05:10]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 06:34]
R3 BoiHwsetup;Access 32bits INT15 routine;C:\Windows\system32\drivers\BoiHwSetup.sys [2006-10-12 10:18]
R3 qkbfiltr;Keyboard Filter Driver;C:\Windows\system32\DRIVERS\qkbfiltr.sys [2006-11-20 19:14]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-24 22:46]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
S3 Cap7134;Cap7134 Capture;C:\Windows\system32\DRIVERS\Cap7134.sys [2005-12-19 12:23]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83418536-cda5-11db-8ced-806e6f6e6963}]
\shell\AutoRun\command - E:\AUTORUN.EXE
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 21:57:30 C:\Windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Beatka.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
"2008-04-19 01:30:00 C:\Windows\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean.Beatka)Runs RegClean to optimize your registry.
"2008-04-21 15:40:25 C:\Windows\Tasks\User_Feed_Synchronization-{319A2F54-116C-4C58-9E79-18900B99F6AA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 18:02:23
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-04-21 18:07:05
ComboFix-quarantined-files.txt 2008-04-21 16:05:59
ComboFix2.txt 2008-04-20 18:23:33
Pre-Run: 26,081,243,136 bajtów wolnych
Post-Run: 26,157,793,280 bajtów wolnych
256 --- E O F --- 2008-04-19 18:04:26
- drucik11
- Forumowicz
- Posty: 8
- Dołączenie: 20 Kwi 2008, 20:03
przez huber2t » 21 Kwi 2008, 18:27
UA:
otwórz notatnik i wklej
zapisz jako typ wszystkie pliki i pod nazwą plik.reg
Uruchom ten plik, uruchom ponownie komputer
Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
zapisz jako typ wszystkie pliki i pod nazwą plik.reg
Uruchom ten plik, uruchom ponownie komputer
Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum
-
huber2t - Zasłużony działacz forum
- Posty: 2798
- Dołączenie: 21 Mar 2008, 10:07
- Pochwały: 42
przez huber2t » 21 Kwi 2008, 20:42
UA:
Z menu plik wybierasz zapisz jako
nazwa pliku: plik.reg
zapisz jako typ: wszystkie pliki
klikasz zapisz
uruchamisz powstaly plik
restartujesz komputer
nazwa pliku: plik.reg
zapisz jako typ: wszystkie pliki
klikasz zapisz
uruchamisz powstaly plik
restartujesz komputer
-
huber2t - Zasłużony działacz forum
- Posty: 2798
- Dołączenie: 21 Mar 2008, 10:07
- Pochwały: 42
6 posty(ów)
• Strona 1 z 1
Kto jest na forum
Zarejestrowani użytkownicy: Illidan