Szalejący komp-logi

[mateusz x man]

Witam. Coś dziwnego zaczęło mi się dziać z komputerem. Pierwszy objaw to dziwne reakcje systemu na próbę uruchomienia jakiegoś programu. Po naciśnięciu na ikonkę pojawia się komunikat że element docelowy został usunięty, a po kilku sekundach komunikat znika i pojawia uruchamia się program. Kolejnym objawem jest wyłączenie się gry i to bez pojawienia się żadnego raporty o błędach. Zauważyłem że po naciśnięciu G gra się wyłącza.

Kod: Zaznacz wszystko

ComboFix 08-05-09.1 - Mateusz P 2008-05-10 21:18:07.30 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1538 [GMT 2:00]
Running from: C:\Documents and Settings\Mateusz P\Moje dokumenty\ComboFix.exe
 * Created a new restore point
 * Resident AV is active


[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-04-10 to 2008-05-10  )))))))))))))))))))))))))))))))
.

2008-05-10 20:45 . 2008-05-10 20:45   <DIR>   d--------   C:\Program Files\WapSter
2008-05-10 13:48 . 2008-05-10 13:48   306,432   --a------   C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-10 13:48 . 2007-12-20 11:41   29,440   --a------   C:\WINDOWS\system32\uxtuneup.dll
2008-05-07 23:35 . 2008-05-07 23:35   <DIR>   d--------   C:\Program Files\Eidos
2008-05-07 21:02 . 2008-05-07 21:02   <DIR>   d--------   C:\Program Files\MyPhoneExplorer
2008-05-07 21:02 . 2008-05-10 13:15   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\MyPhoneExplorer
2008-05-07 20:57 . 2008-05-07 20:57   <DIR>   d--------   C:\Program Files\FotkaPRO
2008-05-07 20:57 . 2008-05-07 20:57   <DIR>   d--------   C:\Program Files\AVG(2)
2008-05-07 20:57 . 2008-05-07 20:57   <DIR>   d--------   C:\Program Files\Avanquest update
2008-05-07 20:57 . 2008-05-07 20:57   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software
2008-05-07 20:56 . 2008-05-07 20:56   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\Sony Ericsson
2008-05-07 20:56 . 2008-05-07 20:56   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\PC Suite
2008-05-07 20:56 . 2008-05-07 20:56   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\Nokia
2008-05-07 20:53 . 2008-05-07 20:53   <DIR>   d--------   C:\Program Files\Sony Setup
2008-05-07 18:32 . 2008-05-07 19:00   <DIR>   d--------   C:\Nowy folder(2)
2008-05-07 18:28 . 2008-05-07 20:56   <DIR>   d--------   C:\Program Files\MyPhoneExplorer(2)
2008-05-07 14:58 . 2008-05-07 20:56   <DIR>   d--------   C:\Program Files\Avanquest update(2)
2008-05-07 14:57 . 2008-05-07 20:56   <DIR>   d--------   C:\Program Files\Sony Ericsson(2)
2008-05-07 14:18 . 2008-05-07 20:56   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson(2)
2008-05-04 19:15 . 2008-05-04 19:23   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\avg8(2)
2008-05-04 17:25 . 2008-05-04 19:24   <DIR>   d--hs----   C:\RECYCLER(2)
2008-05-02 23:56 . 2008-05-02 23:56   <DIR>   d--------   C:\Program Files\Windows Media Components
2008-05-02 23:55 . 2000-05-01 23:02   97,280   --a------   C:\WINDOWS\system32\ccrpbds5.dll
2008-05-02 23:54 . 2008-05-02 23:54   <DIR>   d--------   C:\WINDOWS\speech
2008-05-02 23:54 . 2008-05-02 23:54   754   --a------   C:\WINDOWS\WORDPAD.INI
2008-04-30 00:20 . 2008-04-30 00:20   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2008-04-30 00:20 . 2008-04-30 00:20   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-29 19:53 . 2008-04-29 19:53   <DIR>   d--------   C:\Program Files\ToniArts
2008-04-28 18:43 . 2008-04-28 18:43   <DIR>   d--------   C:\Program Files\Techland
2008-04-28 07:09 . 2008-04-28 07:09   <DIR>   d--------   C:\Program Files\Real Alternative
2008-04-26 00:13 . 2008-04-26 00:13   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\DAEMON Tools
2008-04-25 23:13 . 2008-04-25 23:13   <DIR>   d--------   C:\WINDOWS\system32\QuickTime
2008-04-25 23:13 . 2008-03-12 02:37   107,864   --a------   C:\WINDOWS\system32\tsccvid.dll
2008-04-22 19:14 . 2008-04-22 19:43   415   --a------   C:\WINDOWS\wcx_ftp.ini
2008-04-22 19:12 . 2008-04-22 19:43   <DIR>   d--------   C:\Program Files\totalcmd
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\UC.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\RAR.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\PKZIP.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\PKUNZIP.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\NOCLOSE.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\LHA.PIF
2008-04-22 19:12 . 2007-09-14 07:02   545   --a------   C:\WINDOWS\ARJ.PIF
2008-04-22 19:12 . 2008-04-22 19:43   501   --a------   C:\WINDOWS\wincmd.ini
2008-04-22 00:47 . 2008-01-07 14:29   352   --ah-----   C:\WINDOWS\nod32fixtemdono.reg
2008-04-22 00:44 . 2008-04-22 00:44   <DIR>   d--------   C:\Documents and Settings\Mateusz P\Dane aplikacji\Grisoft
2008-04-22 00:44 . 2007-05-30 14:10   10,872   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-18 21:42 . 2004-08-03 23:08   25,600   --a------   C:\WINDOWS\system32\drivers\usbser.sys
2008-04-18 21:42 . 2004-08-03 23:08   25,600   --a--c---   C:\WINDOWS\system32\dllcache\usbser.sys
2008-04-18 21:42 . 2008-04-18 21:42   0   --ah-----   C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-04-18 21:42 . 2008-04-18 21:42   0   --ah-----   C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-04-18 21:37 . 2008-04-18 21:37   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-04-18 21:36 . 2008-04-18 21:36   <DIR>   d--------   C:\Program Files\DIFX
2008-04-18 21:36 . 2007-11-29 10:33   1,419,232   --a------   C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-04-18 21:36 . 2007-11-29 10:39   95,744   --a------   C:\WINDOWS\system32\nmwcdcocls.dll
2008-04-18 21:36 . 2007-11-29 10:32   48,128   --a------   C:\WINDOWS\system32\nmwcdcls.dll
2008-04-18 21:36 . 2007-09-17 15:53   21,632   --a------   C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-04-18 21:36 . 2007-11-29 10:39   19,328   --a------   C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-04-18 21:36 . 2007-11-29 10:39   16,896   --a------   C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-04-18 21:36 . 2007-11-29 10:39   8,064   --a------   C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-04-18 21:35 . 2008-04-18 21:35   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-13 10:45 . 2008-04-13 10:45   <DIR>   d--------   C:\Program Files\Alcohol Soft
2008-04-13 10:45 . 2004-04-30 09:37   160,640   --a------   C:\WINDOWS\system32\drivers\a347bus.sys
2008-04-13 10:45 . 2004-04-30 09:33   5,248   --a------   C:\WINDOWS\system32\drivers\a347scsi.sys
2008-04-13 02:19 . 2008-04-19 18:50   <DIR>   d--------   C:\Program Files\SHOUTcast
2008-04-10 18:57 . 2008-04-10 18:57   <DIR>   d--------   C:\Program Files\Common Files\Adobe Systems Shared
2008-04-10 15:54 . 2008-05-10 21:18   1,024   --ah-----   C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-10 19:19   ---------   d-----w   C:\Program Files\Mozilla Firefox 3 Beta 4
2008-05-10 14:51   ---------   d-----w   C:\Program Files\Winamp
2008-05-10 14:39   ---------   d-----w   C:\Program Files\Microsoft.NET
2008-05-10 11:48   ---------   d-----w   C:\Program Files\TuneUp Utilities 2008
2008-05-07 19:37   ---------   d-----w   C:\Program Files\Gadu-Gadu
2008-05-07 19:15   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-05-04 17:24   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Avg7
2008-04-25 22:13   716,272   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2008-04-21 22:39   ---------   d-----w   C:\Program Files\ESET
2008-04-21 22:33   ---------   d-----w   C:\Program Files\BitComet
2008-04-21 19:55   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2008-04-18 14:11   ---------   d-----w   C:\Documents and Settings\Mateusz P\Dane aplikacji\Ahead
2008-04-15 14:42   ---------   d-----w   C:\Program Files\Deluxe Ski Jump 3
2008-04-10 16:57   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-04-10 16:53   ---------   d-----w   C:\Program Files\Realtek
2008-04-09 21:25   ---------   d-----w   C:\Program Files\Unlocker
2008-04-09 21:17   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-04-09 21:06   ---------   d-----w   C:\Documents and Settings\Mateusz P\Dane aplikacji\Cool Record Edit Pro
2008-04-09 19:12   ---------   d-----w   C:\Program Files\QuickTime
2008-04-09 19:12   ---------   d-----w   C:\Program Files\ImTOO
2008-04-08 22:31   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-04-08 11:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2008-04-03 22:58   ---------   d-----w   C:\Documents and Settings\Mateusz P\Dane aplikacji\Desktopicon
2008-04-02 03:34   315,392   ----a-w   C:\WINDOWS\HideWin.exe
2008-03-28 23:47   ---------   d-----w   C:\Documents and Settings\Mateusz P\Dane aplikacji\Media Player Classic
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-13 14:52   71,176   ----a-w   C:\WINDOWS\system32\drivers\epfw.sys
2008-03-13 14:52   54,280   ----a-w   C:\WINDOWS\system32\drivers\epfwtdi.sys
2008-03-13 14:52   30,728   ----a-w   C:\WINDOWS\system32\drivers\epfwndis.sys
2008-03-13 14:44   29,704   ----a-w   C:\WINDOWS\system32\drivers\easdrv.sys
2008-03-13 14:43   40,456   ----a-w   C:\WINDOWS\system32\drivers\eamon.sys
2008-02-20 06:51   282,624   ----a-w   C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38   45,568   ----a-w   C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:05   662,016   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-02-13 12:31   16,857,600   ----a-w   C:\WINDOWS\RTHDCPL.exe
2008-01-22 11:54   32   ----a-w   C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-03-13 16:48 1443072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)
"MDM"=2 (0x2)
"LightScribeService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Winamp\\WapSter\\AQQ\\AQQ.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18712:TCP"= 18712:TCP:BitComet 18712 TCP
"18712:UDP"= 18712:UDP:BitComet 18712 UDP
"80:TCP"= 80:TCP:BitComet 80 TCP
"80:UDP"= 80:UDP:BitComet 80 UDP
"9039:TCP"= 9039:TCP:BitComet 9039 TCP
"9039:UDP"= 9039:UDP:BitComet 9039 UDP

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2007-12-20 22:47]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14:00]
S3 GDMnIcpt;GDMnIcpt;C:\WINDOWS\system32\drivers\MiniIcpt.sys [2007-12-20 22:47]
S3 HookCentre;HookCentre;C:\WINDOWS\system32\drivers\HookCentre.sys [2007-12-20 22:47]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 12:33]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 12:33]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 12:33]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 12:33]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 12:33]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-10 13:48]
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42]
S4 Windows Firewall;Windows Firewall;C:\WINDOWS\system32\SVCH0ST.EXE []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-05-09 15:32:38 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-05-06 12:31:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-10 21:19:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\DOCUME~1\MATEUS~1\USTAWI~1\Temp\ASFWHide"
.
Completion time: 2008-05-10 21:19:50
ComboFix-quarantined-files.txt  2008-05-10 19:19:46

Pre-Run: 43,860,553,728 bajtów wolnych
Post-Run: 43,848,409,088 bajtów wolnych

192   --- E O F ---   2008-04-09 14:16:53


[huber2t]

W logu czysto

Pokaż log z Combofix