Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
Proszę o sprawdzenie loga
07 Cze 2008, 19:30
ComboFix 08-06-06.6 - Yodas 2008-06-07 19:24:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.113 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\00BBBB15
C:\Program Files\myglobalsearch\bar\Cache\00BBC507
C:\Program Files\myglobalsearch\bar\Cache\00BBD023.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD459.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD69B.bin
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
.
((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.
2008-06-04 18:57 . 2008-06-07 08:52 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\ESET
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:35 . 2008-05-22 08:35 <DIR> d-------- C:\Program Files\Sun
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-05-20 16:07 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 07:49 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-06-05 18:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [ ]
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 19:25:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 19:26:50
ComboFix-quarantined-files.txt 2008-06-07 17:26:46
Pre-Run: 6,445,002,752 bajtów wolnych
Post-Run: 6,445,809,664 bajtów wolnych
133 --- E O F --- 2008-05-18 15:35:49
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.113 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\00BBBB15
C:\Program Files\myglobalsearch\bar\Cache\00BBC507
C:\Program Files\myglobalsearch\bar\Cache\00BBD023.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD459.bin
C:\Program Files\myglobalsearch\bar\Cache\00BBD69B.bin
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
.
((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.
2008-06-04 18:57 . 2008-06-07 08:52 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\ESET
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:35 . 2008-05-22 08:35 <DIR> d-------- C:\Program Files\Sun
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-05-20 16:07 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 07:49 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-06-05 18:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [ ]
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 19:25:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 19:26:50
ComboFix-quarantined-files.txt 2008-06-07 17:26:46
Pre-Run: 6,445,002,752 bajtów wolnych
Post-Run: 6,445,809,664 bajtów wolnych
133 --- E O F --- 2008-05-18 15:35:49
07 Cze 2008, 20:14
log ok
Czy sa jakieś problemy?
Czy sa jakieś problemy?
07 Cze 2008, 20:19
Mój problem polega na tym że internet pada co ok. 10 min ;/
08 Cze 2008, 10:48
Ok, tutaj daję loga z hijack~
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:46:20, on 2008-06-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Gadu-Gadu\gg.exe
E:\counterstrike\steam.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
D:\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Aimp\AIMP2.exe
C:\Program Files\Tibia\Tibia.exe
D:\xDDDD\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Steam] "e:\counterstrike\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus ... nicode.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: McAfee Application Installer Cleanup (0175331211142666) (0175331211142666mcinstcleanup) - Unknown owner - C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - D:\Ares\chatServer.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4816 bytes
Wczoraj także skanowałem kasperskym online, też dać loga?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:46:20, on 2008-06-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Gadu-Gadu\gg.exe
E:\counterstrike\steam.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
D:\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Aimp\AIMP2.exe
C:\Program Files\Tibia\Tibia.exe
D:\xDDDD\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Steam] "e:\counterstrike\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus ... nicode.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: McAfee Application Installer Cleanup (0175331211142666) (0175331211142666mcinstcleanup) - Unknown owner - C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - D:\Ares\chatServer.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4816 bytes
Wczoraj także skanowałem kasperskym online, też dać loga?
08 Cze 2008, 11:45
fix w hijackthis
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
Plik
zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu
Rozpocznie się usuwanie i powstanie log, daj ten log na forum.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
- Kod:
Driver::
McAfee Application Installer Cleanup
Plik
zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu
Rozpocznie się usuwanie i powstanie log, daj ten log na forum.
08 Cze 2008, 12:40
Log z ComboFix
ComboFix 08-06-06.6 - Yodas 2008-06-08 12:33:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.44 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Yodas\Pulpit\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-08 11:30 . 2008-06-08 12:27 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-08 11:10 . 2008-06-08 11:12 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Program Files\AVG
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\AVGTOOLBAR
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8
2008-06-08 11:10 . 2008-06-08 11:10 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-08 11:10 . 2008-06-08 11:10 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-08 11:10 . 2008-06-08 11:10 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-08 11:08 . 2008-06-08 11:08 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-07 22:42 . 2008-06-07 23:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-07 20:59 . 2008-06-07 21:01 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-07 20:59 . 2008-06-07 21:00 <DIR> d-------- C:\Program Files\CCleaner
2008-06-04 18:57 . 2008-06-08 08:24 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-06-08 11:58 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 08:51 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-06-07 20:02 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-07_19.26.39,35 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-07 14:28:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 05:10:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-03-13 14:43:42 40,456 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\eamon.sys
+ 2008-03-13 14:44:36 29,704 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\easdrv.sys
+ 2008-03-13 14:52:18 33,800 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\epfwtdir.sys
+ 2008-06-08 09:10:48 26,184 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys
+ 2005-05-24 10:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 13:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 13:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2006-12-01 20:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 20:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 20:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 20:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 22:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 22:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 22:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 22:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 22:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 22:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 22:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 22:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 22:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
2008-06-08 11:10 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-08 11:10 2050816]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]
"SpybotSD TeaTimer"="D:\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-08 11:10 1177368]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:10]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-08 11:10]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:10]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:10]
R4 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys []
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
*Newly Created Service* - AVG8EMC
*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - AVGTDIX
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 12:35:29
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 12:36:47
ComboFix-quarantined-files.txt 2008-06-08 10:36:39
ComboFix2.txt 2008-06-07 17:26:51
Pre-Run: 6,480,965,632 bajtów wolnych
Post-Run: 6,497,296,384 bajtów wolnych
170 --- E O F --- 2008-05-18 15:35:49
ComboFix 08-06-06.6 - Yodas 2008-06-08 12:33:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.44 [GMT 2:00]
Running from: C:\Documents and Settings\Yodas\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Yodas\Pulpit\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-08 11:30 . 2008-06-08 12:27 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-08 11:10 . 2008-06-08 11:12 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Program Files\AVG
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\AVGTOOLBAR
2008-06-08 11:10 . 2008-06-08 11:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8
2008-06-08 11:10 . 2008-06-08 11:10 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-08 11:10 . 2008-06-08 11:10 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-08 11:10 . 2008-06-08 11:10 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-08 11:08 . 2008-06-08 11:08 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-07 22:42 . 2008-06-07 23:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-07 21:52 . 2008-06-07 21:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-07 20:59 . 2008-06-07 21:01 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-07 20:59 . 2008-06-07 21:00 <DIR> d-------- C:\Program Files\CCleaner
2008-06-04 18:57 . 2008-06-08 08:24 <DIR> d-------- C:\ss
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-05-22 08:34 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-22 08:33 . 2008-05-22 08:34 <DIR> d-------- C:\Program Files\Java
2008-05-22 08:33 . 2008-05-22 08:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-05-21 22:31 . 2008-05-21 22:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-05-19 22:02 . 2008-05-19 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-05-19 21:41 . 2008-06-08 11:58 <DIR> d-------- C:\Program Files\OneStepSearch
2008-05-18 17:35 . 2008-05-18 20:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-18 13:40 . 2008-05-18 13:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
2008-05-17 23:34 . 2008-05-23 14:11 <DIR> d-------- C:\Documents and Settings\Yodas\Dane aplikacji\foobar2000
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-10 22:19 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-10 22:19 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-10 22:19 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-09 22:22 . 2008-05-09 22:22 <DIR> d-------- C:\WINDOWS\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 08:51 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tibia
2008-06-07 20:02 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-07 07:36 --------- d-----w C:\Program Files\Tibia
2008-06-06 18:38 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\teamspeak2
2008-05-27 20:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:32 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\skypePM
2008-05-24 13:41 --------- d-----w C:\Program Files\DivX
2008-05-06 17:24 12,528 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-05-05 19:55 --------- d-----w C:\Program Files\TibiaBot NG
2008-05-05 19:36 55,318 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-05-05 19:36 4,584 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-05-04 16:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-04 16:54 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-03 20:12 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\HateML
2008-05-03 17:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-22 17:40 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\INTERIAPL
2008-04-20 09:24 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\AgerWebEdytor
2008-04-18 17:36 --------- d-----w C:\Documents and Settings\Yodas\Dane aplikacji\Tlen.pl
2008-04-12 17:02 451,072 ----a-w C:\WINDOWS\WypasOTS Client uninstall.exe
2008-02-06 18:38 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-07_19.26.39,35 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-07 14:28:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 05:10:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-03-13 14:43:42 40,456 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\eamon.sys
+ 2008-03-13 14:44:36 29,704 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\easdrv.sys
+ 2008-03-13 14:52:18 33,800 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\epfwtdir.sys
+ 2008-06-08 09:10:48 26,184 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys
+ 2005-05-24 10:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 13:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 13:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2006-12-01 20:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 20:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 20:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 20:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 22:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 22:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 22:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 22:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 22:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 22:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 22:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 22:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 22:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
2008-06-08 11:10 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-08 11:10 2050816]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Steam"="e:\counterstrike\steam.exe" [2008-04-10 15:10 1271032]
"SpybotSD TeaTimer"="D:\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 22:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43 86016]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2006-09-05 19:28 540672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-08 11:10 1177368]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\counter-strike\\hl.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\condition zero\\hl.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"E:\\CounterStrike\\SteamApps\\JODZIO\\day of defeat\\hl.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"=
"E:\\CounterStrike\\SteamApps\\jodzio\\dedicated server\\hlds.exe"=
"C:\\Documents and Settings\\Yodas\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:10]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-08 11:10]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:10]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:10]
R4 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys []
S2 0175331211142666mcinstcleanup;McAfee Application Installer Cleanup (0175331211142666);C:\DOCUME~1\Yodas\USTAWI~1\Temp\017533~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 18:27]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []
*Newly Created Service* - AVG8EMC
*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - AVGTDIX
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 12:35:29
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1???\ ?|????C:\Documents and???|???|?????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 12:36:47
ComboFix-quarantined-files.txt 2008-06-08 10:36:39
ComboFix2.txt 2008-06-07 17:26:51
Pre-Run: 6,480,965,632 bajtów wolnych
Post-Run: 6,497,296,384 bajtów wolnych
170 --- E O F --- 2008-05-18 15:35:49
08 Cze 2008, 13:39
log ok
Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum
Włącz przywracanie systemu.
Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum
Włącz przywracanie systemu.