Proszę o sprawdzenie loga

INSTALKI.pl - programy, gry, sterowniki

Logi, zabezpieczenie komputera, danych. Programy antywirusowe antyspyware, firewall itp.

Regulamin forum

1. Każdy temat powinien odzwierciedlać treść wątku.
2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
Wyślij odpowiedź
 
drucik11
  • drucik11
  • Posty: 8
  • Dołączenie: 20 Kwi 2008, 20:03

Proszę o sprawdzenie loga

20 Kwi 2008, 20:36

Proszę o sprawdzenie loga z ComboFix.
Przeskanowałem kompa (system Vista) online Kaspersym i znalazł dużo zaifekowanych plików ale raportu nie udał mi się zapisać ani wysłać do analizy. Proszę o pomoc czy coś złego widać w logu


ComboFix 08-04-20.1 - Beatka 2008-04-20 20:15:49.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.251 [GMT 2:00]
Running from: C:\Users\Beatka\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\driver
C:\Windows\system32\driver\34api.dll
C:\Windows\system32\driver\34COM.dll
C:\Windows\system32\driver\cap7134.cat
C:\Windows\system32\driver\cap7134.sys
C:\Windows\system32\driver\E500_33.INF
C:\Windows\system32\driver\E500_34.INF
C:\Windows\system32\driver\E501_33.inf
C:\Windows\system32\driver\E501_34.inf
C:\Windows\system32\driver\E501_JP.inf
C:\Windows\system32\driver\EZMaker.inf
C:\Windows\system32\driver\InstallDriver.exe
C:\Windows\system32\driver\PhTvTune.cat
C:\Windows\system32\driver\PhTVTune.inf
C:\Windows\system32\driver\PhTvTune.sys
C:\Windows\system32\driver\Prop7134.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-20 to 2008-04-20 )))))))))))))))))))))))))))))))
.

2008-04-20 18:19 . 2008-04-20 18:19 <DIR> d-------- C:\Windows\System32\Kaspersky Lab
2008-04-19 22:56 . 2008-04-19 22:56 <DIR> d-------- C:\Program Files\mks_vir_9
2008-04-19 22:53 . 2008-04-20 17:46 <DIR> d-------- C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
2008-04-19 22:53 . 2008-04-19 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 22:38 . 2006-04-27 16:17 <DIR> d-------- C:\Users\Beatka\BibliotekiWindows
2008-04-19 22:11 . 2005-10-19 18:19 1,327,189 --a------ C:\Windows\System32\odSupp_M.dll
2008-04-19 22:11 . 2005-11-22 20:56 630,784 --a------ C:\Windows\System32\ANIWZCS2.dll
2008-04-19 22:11 . 2005-10-19 18:19 204,800 --a------ C:\Windows\System32\aIPH.dll
2008-04-19 22:11 . 2005-11-23 10:10 163,840 --a------ C:\Windows\System32\WlanApp.dll
2008-04-19 22:11 . 2005-10-19 18:19 57,407 --a------ C:\Windows\System32\ANICtl.dll
2008-04-19 22:11 . 2005-10-27 08:55 49,152 --a------ C:\Windows\System32\JJAKEn.dll
2008-04-19 22:11 . 2005-10-19 18:19 49,152 --a------ C:\Windows\System32\AQCKGen.dll
2008-04-19 22:10 . 2008-04-19 22:10 <DIR> d-------- C:\Program Files\D-Link
2008-04-19 22:10 . 2008-04-19 22:11 <DIR> d-------- C:\Program Files\ANI
2008-04-19 22:10 . 2005-11-10 07:13 50,176 --a------ C:\Windows\System32\ANIO64.sys
2008-04-19 22:10 . 2005-10-21 15:56 36,864 --a------ C:\Windows\System32\ANIOApi.dll
2008-04-19 22:10 . 2005-11-09 15:44 24,288 --a------ C:\Windows\System32\ANIO.sys
2008-04-19 22:10 . 2004-10-14 10:29 16,997 --a------ C:\Windows\System32\ANIO.VXD
2008-04-19 22:10 . 2004-10-14 10:29 11,904 --a------ C:\Windows\System32\anio4.sys
2008-04-19 21:36 . 2008-04-19 21:36 <DIR> d-------- C:\PerfLogs
2008-04-19 19:17 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-19 19:16 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-04-19 19:15 . 2008-01-19 09:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 19:14 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-19 19:13 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-19 19:13 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-04-19 19:13 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-19 19:12 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-19 19:12 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-19 19:10 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-19 19:10 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-19 19:10 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-19 19:10 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-16 12:01 . 2008-04-16 12:02 <DIR> d-------- C:\Program Files\PITy2007
2008-04-12 15:49 . 2008-04-12 15:49 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2008-04-12 15:24 . 2008-04-12 15:24 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-12 14:09 . 2008-04-12 14:10 <DIR> d-------- C:\Users\Beatka\AppData\Roaming\RegClean
2008-04-10 20:20 . 2008-02-29 06:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-10 20:20 . 2008-02-22 04:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-10 20:20 . 2008-02-22 07:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\Windows\System32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\Windows\System32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\Windows\System32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a------ C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\Windows\System32\divxdec.ax
2008-03-21 22:30 . 2008-03-21 22:30 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-03-21 22:30 . 2008-03-21 22:30 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-03-21 22:30 . 2008-03-21 22:30 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 4,816 --a------ C:\Windows\System32\divxsm.tlb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 16:24 --------- d-----w C:\Users\Beatka\AppData\Roaming\Skype
2008-04-19 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-19 19:52 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 17:58 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-19 17:58 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 17:45 --------- d-----w C:\Users\Beatka\AppData\Roaming\uTorrent
2008-04-17 11:43 --------- d-----w C:\Users\Beatka\AppData\Roaming\Winamp
2008-04-15 14:18 --------- d-----w C:\Program Files\PITy
2008-04-15 12:24 --------- d-----w C:\Program Files\Winamp
2008-04-13 11:11 --------- d-----w C:\Program Files\DivX
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-12 22:41 --------- d-----w C:\Program Files\Ascentive
2008-03-09 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-03-06 20:03 892,928 ----a-w C:\Windows\System32\iconv.dll
2008-03-06 20:03 405,504 ----a-w C:\Windows\System32\libmplayer.dll
2008-03-06 20:03 3,108,864 ----a-w C:\Windows\System32\libavcodec.dll
2008-03-06 20:03 126,976 ----a-w C:\Windows\System32\libmpeg2_ff.dll
2008-03-06 20:02 56,320 ----a-w C:\Windows\System32\ff_unrar.dll
2008-03-06 20:02 54,784 ----a-w C:\Windows\System32\ff_liba52.dll
2008-03-06 20:02 397,312 ----a-w C:\Windows\System32\ff_libfaad2.dll
2008-03-06 20:02 26,624 ----a-w C:\Windows\System32\ff_wmv9.dll
2008-03-06 20:02 188,416 ----a-w C:\Windows\System32\ff_theora.dll
2008-03-06 20:02 167,936 ----a-w C:\Windows\System32\ff_libdts.dll
2008-03-06 20:02 143,360 ----a-w C:\Windows\System32\ff_libmad.dll
2008-03-06 20:02 135,168 ----a-w C:\Windows\System32\ff_samplerate.dll
2008-03-06 20:02 118,784 ----a-w C:\Windows\System32\ff_realaac.dll
2008-03-06 20:02 102,912 ----a-w C:\Windows\System32\ff_tremor.dll
2008-03-06 20:02 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll
2008-03-06 20:01 79,360 ----a-w C:\Windows\System32\mkzlib.dll
2008-03-06 20:01 23,552 ----a-w C:\Windows\System32\mkunicode.dll
2008-03-06 20:01 163,840 ----a-w C:\Windows\System32\ts.dll
2008-03-06 20:01 159,744 ----a-w C:\Windows\System32\mmfinfo.dll
2008-03-06 20:01 148,480 ----a-w C:\Windows\System32\mkx.dll
2008-03-06 20:01 141,312 ----a-w C:\Windows\System32\mp4.dll
2008-03-06 20:01 120,832 ----a-w C:\Windows\System32\ogm.dll
2008-03-06 20:01 108,032 ----a-w C:\Windows\System32\avi.dll
2008-03-06 20:01 --------- d-----w C:\Program Files\Real Alternative
2008-03-03 19:36 --------- d-----w C:\Program Files\uTorrent
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-24 10:56 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-24 10:56 --------- d-----w C:\Program Files\Winamp Remote
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2007-07-13 19:41 991 ----a-w C:\Program Files\INSTALL.LOG
2007-05-01 17:47 1,049,719 ----a-w C:\Users\Beatka\wrar361pl.exe
2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-02 23:11 117,535,476 ----a-r C:\Users\Beatka\Nero7.exe
2006-11-06 14:09 111,132,138 ----a-r C:\Users\Beatka\nero-7 0 1 4.exe
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-17 14:17 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"TOSCDSPD"="TOSCDSPD.EXE" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-19 17:27 26164776]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-03 15:44 77824]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 13:14 409264]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 17:02 493112]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]
"TOSHIBA Volume Indicator"="C:\Program Files\Toshiba\Utilities\VolControl.exe" [2006-12-13 11:33 94208]
"NDSTray.exe"="NDSTray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-04 08:35 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [2008-02-08 20:06 3276800]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DFBA3EE2-B8A8-4B44-B757-BE86F9E4125E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FCF0BE58-D08D-4E31-9A4D-A5100E76A2D2}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C387C43D-ABC3-47B2-86BB-DF14F1BAEB12}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AFFF25F8-1AC1-48BA-AEFE-53FC5F121CDA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{5A8B6332-6782-4F62-BD22-D315D6F0AAB7}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{62897443-69B9-4B84-A920-EDE9564C416D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 05:10]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 06:34]
R3 BoiHwsetup;Access 32bits INT15 routine;C:\Windows\system32\drivers\BoiHwSetup.sys [2006-10-12 10:18]
R3 qkbfiltr;Keyboard Filter Driver;C:\Windows\system32\DRIVERS\qkbfiltr.sys [2006-11-20 19:14]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-24 22:46]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
S3 Cap7134;Cap7134 Capture;C:\Windows\system32\DRIVERS\Cap7134.sys [2005-12-19 12:23]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 21:57:30 C:\Windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Beatka.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
"2008-04-19 01:30:00 C:\Windows\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean.Beatka)Runs RegClean to optimize your registry.
"2008-04-20 17:50:22 C:\Windows\Tasks\User_Feed_Synchronization-{319A2F54-116C-4C58-9E79-18900B99F6AA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 20:21:45
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-20 20:23:31
ComboFix-quarantined-files.txt 2008-04-20 18:23:05

Pre-Run: 29,292,900,352 bajtów wolnych
Post-Run: 30,039,535,616 bajtów wolnych

251 --- E O F --- 2008-04-19 18:04:26
 
huber2t
  • huber2t
  • Posty: 2798
  • Dołączenie: 21 Mar 2008, 10:07

21 Kwi 2008, 16:14

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
Kod:
File::
C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ANIWZCS2Service"=-

Plik -> zapisz jako -> CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->
Image
Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
 
drucik11
  • drucik11
  • Posty: 8
  • Dołączenie: 20 Kwi 2008, 20:03

nowy log

21 Kwi 2008, 18:13

Zrobiłem jak pisałeś, oto log

Pozdrawiam

ComboFix 08-04-20.5 - Beatka 2008-04-21 17:56:02.1 - NTFSx86
Microsoft&reg; Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.236 [GMT 2:00]
Running from: C:\Users\Beatka\Desktop\ComboFix.exe
Command switches used :: C:\Users\Beatka\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\driver
C:\Windows\system32\driver\34api.dll
C:\Windows\system32\driver\34COM.dll
C:\Windows\system32\driver\cap7134.cat
C:\Windows\system32\driver\cap7134.sys
C:\Windows\system32\driver\E500_33.INF
C:\Windows\system32\driver\E500_34.INF
C:\Windows\system32\driver\E501_33.inf
C:\Windows\system32\driver\E501_34.inf
C:\Windows\system32\driver\E501_JP.inf
C:\Windows\system32\driver\EZMaker.inf
C:\Windows\system32\driver\InstallDriver.exe
C:\Windows\system32\driver\PhTvTune.cat
C:\Windows\system32\driver\PhTVTune.inf
C:\Windows\system32\driver\PhTvTune.sys
C:\Windows\system32\driver\Prop7134.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.

2008-04-19 22:56 . 2008-04-19 22:56 <DIR> d-------- C:\Program Files\mks_vir_9
2008-04-19 22:53 . 2008-04-20 17:46 <DIR> d-------- C:\Windows\7F1484A92B194ACEBAA32D7992D4FB63.TMP
2008-04-19 22:53 . 2008-04-19 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 22:38 . 2006-04-27 16:17 <DIR> d-------- C:\Users\Beatka\BibliotekiWindows
2008-04-19 22:11 . 2005-10-19 18:19 1,327,189 --a------ C:\Windows\System32\odSupp_M.dll
2008-04-19 22:11 . 2005-11-22 20:56 630,784 --a------ C:\Windows\System32\ANIWZCS2.dll
2008-04-19 22:11 . 2005-10-19 18:19 204,800 --a------ C:\Windows\System32\aIPH.dll
2008-04-19 22:11 . 2005-11-23 10:10 163,840 --a------ C:\Windows\System32\WlanApp.dll
2008-04-19 22:11 . 2005-10-19 18:19 57,407 --a------ C:\Windows\System32\ANICtl.dll
2008-04-19 22:11 . 2005-10-27 08:55 49,152 --a------ C:\Windows\System32\JJAKEn.dll
2008-04-19 22:11 . 2005-10-19 18:19 49,152 --a------ C:\Windows\System32\AQCKGen.dll
2008-04-19 22:10 . 2008-04-19 22:10 <DIR> d-------- C:\Program Files\D-Link
2008-04-19 22:10 . 2008-04-21 17:35 <DIR> d-------- C:\Program Files\ANI
2008-04-19 22:10 . 2005-11-10 07:13 50,176 --a------ C:\Windows\System32\ANIO64.sys
2008-04-19 22:10 . 2005-10-21 15:56 36,864 --a------ C:\Windows\System32\ANIOApi.dll
2008-04-19 22:10 . 2005-11-09 15:44 24,288 --a------ C:\Windows\System32\ANIO.sys
2008-04-19 22:10 . 2004-10-14 10:29 16,997 --a------ C:\Windows\System32\ANIO.VXD
2008-04-19 22:10 . 2004-10-14 10:29 11,904 --a------ C:\Windows\System32\anio4.sys
2008-04-19 21:36 . 2008-04-19 21:36 <DIR> d-------- C:\PerfLogs
2008-04-19 19:17 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-19 19:16 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-04-19 19:15 . 2008-01-19 09:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 19:14 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-19 19:13 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-19 19:13 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-04-19 19:13 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-19 19:12 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-19 19:12 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-19 19:10 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-19 19:10 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-19 19:10 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-19 19:10 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-16 12:01 . 2008-04-16 12:02 <DIR> d-------- C:\Program Files\PITy2007
2008-04-12 15:49 . 2008-04-12 15:49 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2008-04-12 15:24 . 2008-04-12 15:24 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-12 14:09 . 2008-04-12 14:10 <DIR> d-------- C:\Users\Beatka\AppData\Roaming\RegClean
2008-04-10 20:20 . 2008-02-29 06:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-10 20:20 . 2008-02-22 04:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-10 20:20 . 2008-02-22 07:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\Windows\System32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\Windows\System32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\Windows\System32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\Windows\System32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a------ C:\Windows\System32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\Windows\System32\divxdec.ax
2008-03-21 22:30 . 2008-03-21 22:30 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-03-21 22:30 . 2008-03-21 22:30 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-03-21 22:30 . 2008-03-21 22:30 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-03-21 22:30 . 2008-03-21 22:30 4,816 --a------ C:\Windows\System32\divxsm.tlb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 15:51 --------- d-----w C:\Users\Beatka\AppData\Roaming\Skype
2008-04-21 15:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 15:35 --------- d-----w C:\Program Files\Soulseek-Test
2008-04-21 15:35 --------- d-----w C:\Program Files\DivX
2008-04-21 15:35 --------- d-----w C:\Program Files\AVIcodec
2008-04-21 15:35 --------- d-----w C:\Program Files\Atheros
2008-04-19 19:52 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-19 19:40 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 17:58 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-19 17:58 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 17:45 --------- d-----w C:\Users\Beatka\AppData\Roaming\uTorrent
2008-04-17 11:43 --------- d-----w C:\Users\Beatka\AppData\Roaming\Winamp
2008-04-15 14:18 --------- d-----w C:\Program Files\PITy
2008-04-15 12:24 --------- d-----w C:\Program Files\Winamp
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-03-12 22:41 --------- d-----w C:\Program Files\Ascentive
2008-03-09 13:22 --------- d-----w C:\Program Files\Microsoft Games
2008-03-06 20:03 892,928 ----a-w C:\Windows\System32\iconv.dll
2008-03-06 20:03 405,504 ----a-w C:\Windows\System32\libmplayer.dll
2008-03-06 20:03 3,108,864 ----a-w C:\Windows\System32\libavcodec.dll
2008-03-06 20:03 126,976 ----a-w C:\Windows\System32\libmpeg2_ff.dll
2008-03-06 20:02 56,320 ----a-w C:\Windows\System32\ff_unrar.dll
2008-03-06 20:02 54,784 ----a-w C:\Windows\System32\ff_liba52.dll
2008-03-06 20:02 397,312 ----a-w C:\Windows\System32\ff_libfaad2.dll
2008-03-06 20:02 26,624 ----a-w C:\Windows\System32\ff_wmv9.dll
2008-03-06 20:02 188,416 ----a-w C:\Windows\System32\ff_theora.dll
2008-03-06 20:02 167,936 ----a-w C:\Windows\System32\ff_libdts.dll
2008-03-06 20:02 143,360 ----a-w C:\Windows\System32\ff_libmad.dll
2008-03-06 20:02 135,168 ----a-w C:\Windows\System32\ff_samplerate.dll
2008-03-06 20:02 118,784 ----a-w C:\Windows\System32\ff_realaac.dll
2008-03-06 20:02 102,912 ----a-w C:\Windows\System32\ff_tremor.dll
2008-03-06 20:02 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll
2008-03-06 20:01 79,360 ----a-w C:\Windows\System32\mkzlib.dll
2008-03-06 20:01 23,552 ----a-w C:\Windows\System32\mkunicode.dll
2008-03-06 20:01 163,840 ----a-w C:\Windows\System32\ts.dll
2008-03-06 20:01 159,744 ----a-w C:\Windows\System32\mmfinfo.dll
2008-03-06 20:01 148,480 ----a-w C:\Windows\System32\mkx.dll
2008-03-06 20:01 141,312 ----a-w C:\Windows\System32\mp4.dll
2008-03-06 20:01 120,832 ----a-w C:\Windows\System32\ogm.dll
2008-03-06 20:01 108,032 ----a-w C:\Windows\System32\avi.dll
2008-03-06 20:01 --------- d-----w C:\Program Files\Real Alternative
2008-03-03 19:36 --------- d-----w C:\Program Files\uTorrent
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-24 10:56 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-24 10:56 --------- d-----w C:\Program Files\Winamp Remote
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2007-07-13 19:41 991 ----a-w C:\Program Files\INSTALL.LOG
2007-05-01 17:47 1,049,719 ----a-w C:\Users\Beatka\wrar361pl.exe
2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-02 23:11 117,535,476 ----a-r C:\Users\Beatka\Nero7.exe
2006-11-06 14:09 111,132,138 ----a-r C:\Users\Beatka\nero-7 0 1 4.exe
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-17 14:17 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-17 14:17 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"TOSCDSPD"="TOSCDSPD.EXE" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-19 17:27 26164776]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-03 15:44 77824]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 13:14 409264]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 17:02 493112]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]
"TOSHIBA Volume Indicator"="C:\Program Files\Toshiba\Utilities\VolControl.exe" [2006-12-13 11:33 94208]
"NDSTray.exe"="NDSTray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-04 08:35 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [2008-02-08 20:06 3276800]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DFBA3EE2-B8A8-4B44-B757-BE86F9E4125E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FCF0BE58-D08D-4E31-9A4D-A5100E76A2D2}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C387C43D-ABC3-47B2-86BB-DF14F1BAEB12}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AFFF25F8-1AC1-48BA-AEFE-53FC5F121CDA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{5A8B6332-6782-4F62-BD22-D315D6F0AAB7}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{62897443-69B9-4B84-A920-EDE9564C416D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 05:10]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 06:34]
R3 BoiHwsetup;Access 32bits INT15 routine;C:\Windows\system32\drivers\BoiHwSetup.sys [2006-10-12 10:18]
R3 qkbfiltr;Keyboard Filter Driver;C:\Windows\system32\DRIVERS\qkbfiltr.sys [2006-11-20 19:14]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-24 22:46]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]
S3 Cap7134;Cap7134 Capture;C:\Windows\system32\DRIVERS\Cap7134.sys [2005-12-19 12:23]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83418536-cda5-11db-8ced-806e6f6e6963}]
\shell\AutoRun\command - E:\AUTORUN.EXE

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 21:57:30 C:\Windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Beatka.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
"2008-04-19 01:30:00 C:\Windows\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean.Beatka)Runs RegClean to optimize your registry.
"2008-04-21 15:40:25 C:\Windows\Tasks\User_Feed_Synchronization-{319A2F54-116C-4C58-9E79-18900B99F6AA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 18:02:23
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-04-21 18:07:05
ComboFix-quarantined-files.txt 2008-04-21 16:05:59
ComboFix2.txt 2008-04-20 18:23:33

Pre-Run: 26,081,243,136 bajtów wolnych
Post-Run: 26,157,793,280 bajtów wolnych

256 --- E O F --- 2008-04-19 18:04:26
 
huber2t
  • huber2t
  • Posty: 2798
  • Dołączenie: 21 Mar 2008, 10:07

21 Kwi 2008, 18:27

otwórz notatnik i wklej
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]


zapisz jako typ wszystkie pliki i pod nazwą plik.reg

Uruchom ten plik, uruchom ponownie komputer

Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum
 
drucik11
  • drucik11
  • Posty: 8
  • Dołączenie: 20 Kwi 2008, 20:03

pytanie

21 Kwi 2008, 19:28

Witam,

Nie zabardzo rozumiem co ma zrobić

zapisz jako typ wszystkie pliki i pod nazwą plik.reg

co znaczy zapisać jako typ, proszę o więcej informacji
 
huber2t
  • huber2t
  • Posty: 2798
  • Dołączenie: 21 Mar 2008, 10:07

21 Kwi 2008, 20:42

Z menu plik wybierasz zapisz jako
nazwa pliku: plik.reg
zapisz jako typ: wszystkie pliki

klikasz zapisz

uruchamisz powstaly plik

restartujesz komputer
Wyślij odpowiedź
Switch to full style

Powered by phpBB © phpBB Group.

phpBB Mobile / SEO by Artodia.

Strona główna