Skan z Dr. Web CureIt wrzuce jutro.
Log z ComboFix.
ComboFix 08-11-14.01 - user 2008-11-17 21:39:37.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.660 [GMT 1:00]
Running from: c:\documents and settings\user\Pulpit\ComboFix.exe
Command switches used :: c:\documents and settings\user\Pulpit\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:\documents and settings\All Users\Menu Start\Programy\Autostart\scvhost.exe
c:\windows\firefox.exe
c:\windows\system32\vip.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Menu Start\Programy\Autostart\scvhost.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_REVOLUTION1
-------\Legacy_XDVA062
-------\Service_Revolution1
-------\Service_XDva062
-------\Service_Xii78
((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))
.
2008-11-17 19:58 . 2008-11-17 19:58 96,976 --a------ c:\windows\system32\drivers\klin.dat
2008-11-17 19:58 . 2008-11-17 19:58 87,855 --a------ c:\windows\system32\drivers\klick.dat
2008-11-17 19:57 . 2008-11-17 21:31 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-17 19:57 . 2008-11-17 21:42 2,770,464 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-11-17 19:57 . 2008-11-17 21:43 229,408 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2008-11-17 19:57 . 2008-11-17 21:42 25,868 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-11-17 19:57 . 2008-11-17 21:42 2,884 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2008-11-17 19:50 . 2008-11-17 19:50 <DIR> d-------- c:\program files\Kaspersky Lab
2008-11-17 19:47 . 2008-11-17 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-11-17 13:37 . 2008-11-17 15:35 <DIR> d-------- C:\WoW
2008-11-16 20:49 . 2008-11-16 20:49 <DIR> d-------- c:\windows\Sun
2008-11-16 20:48 . 2008-11-16 20:48 <DIR> d-------- c:\program files\Common Files\Java
2008-11-16 20:48 . 2008-05-28 03:03 49,265 --a------ c:\windows\system32\jpicpl32.cpl
2008-11-16 15:57 . 2008-11-16 15:57 56 --a------ c:\windows\wininit.ini
2008-11-16 15:52 . 2008-11-16 15:52 <DIR> d-------- c:\program files\World of Warcraft
2008-11-15 15:13 . 2008-11-15 15:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Blizzard
2008-11-12 22:54 . 2008-11-12 22:54 <DIR> d-------- c:\program files\FAST Defrag
2008-10-28 22:09 . 2008-10-28 22:17 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Microsoft Games
2008-10-27 15:11 . 2004-04-09 18:12 1,040,384 --a------ c:\windows\system32\GnucDNA.dll
2008-10-22 19:17 . 2008-10-22 19:17 50 --a------ c:\windows\MegaManager.INI
2008-10-22 18:22 . 2008-10-22 18:22 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Megaupload
2008-10-22 18:22 . 2008-10-22 18:22 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\EmailNotifier
2008-10-22 18:22 . 2008-10-22 18:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Megaupload
2008-10-22 18:22 . 2008-10-22 18:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\EmailNotifier
2008-10-20 18:23 . 2008-10-20 18:23 319 --a------ c:\windows\game.ini
2008-10-20 15:07 . 2008-10-20 15:07 2,560 --a------ c:\windows\_MSRSTRT.EXE
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 20:43 --------- d-----w c:\program files\neostrada tp
2008-11-17 20:41 --------- d-----w c:\documents and settings\user\Dane aplikacji\DNA
2008-11-17 20:34 --------- d-----w c:\program files\eMule
2008-11-17 18:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-11-16 20:51 --------- d-----w c:\documents and settings\user\Dane aplikacji\BitTorrent
2008-11-16 19:48 --------- d-----w c:\program files\Java
2008-11-15 14:29 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-01 15:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-30 15:40 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-10-28 21:08 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-28 15:39 --------- d-----w c:\program files\Free Audio Pack
2008-10-23 13:23 --------- d-----w c:\program files\CyberLink
2008-10-20 14:08 --------- d-----w c:\program files\Mp3 To Wave Converter
2008-10-01 14:39 --------- d-----w c:\program files\NifTools
2008-09-25 15:38 729,088 ----a-w c:\windows\iun6002.exe
2008-09-25 15:38 --------- d-----w c:\program files\AceGain
2008-09-25 15:31 --------- d-----w c:\program files\EA GAMES
2008-09-23 07:05 --------- d-----w c:\program files\DVDVideoSoft
2008-09-21 19:01 --------- d-----w c:\documents and settings\user\Dane aplikacji\GanymedeNet
2008-03-17 20:48 251,392 ----a-w c:\program files\opera\program\plugins\dapop.dll
.
((((((((((((((((((((((((((((( snapshot@2008-11-16_20.07.03.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-21 16:34:36 121,872 ----a-w c:\windows\system32\drivers\kl1.sys
+ 2008-01-29 16:29:38 32,784 ----a-w c:\windows\system32\drivers\klbg.sys
+ 2008-11-17 18:57:30 213,008 ----a-w c:\windows\system32\drivers\klif.sys
+ 2008-04-30 16:06:48 24,592 ----a-w c:\windows\system32\drivers\klim5.sys
+ 2008-07-29 18:20:00 24,774 ----a-w c:\windows\system32\drivers\klopp.dat
- 2002-11-01 19:15:54 24,670 ------w c:\windows\system32\java.exe
+ 2008-05-28 00:20:14 49,248 ----a-w c:\windows\system32\java.exe
- 2002-11-01 19:15:54 24,672 ------w c:\windows\system32\javaw.exe
+ 2008-05-28 00:20:24 53,346 ----a-w c:\windows\system32\javaw.exe
+ 2008-05-28 02:03:38 131,174 ----a-w c:\windows\system32\javaws.exe
+ 2008-07-29 18:21:42 218,376 ----a-w c:\windows\system32\klogon.dll
- 2008-11-16 16:55:01 68,608 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-17 20:35:50 68,608 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-16 16:55:01 60,224 ----a-w c:\windows\system32\perfc015.dat
+ 2008-11-17 20:35:50 60,224 ----a-w c:\windows\system32\perfc015.dat
- 2008-11-16 16:55:01 436,090 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-17 20:35:50 436,090 ----a-w c:\windows\system32\perfh009.dat
- 2008-11-16 16:55:01 423,478 ----a-w c:\windows\system32\perfh015.dat
+ 2008-11-17 20:35:50 423,478 ----a-w c:\windows\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{F4F10C1D-87C7-404A-B4B3-000000000000}"= "c:\progra~1\DAP\SBSearch.dll" [2007-12-21 32768]
[HKEY_CLASSES_ROOT\clsid\{f4f10c1d-87c7-404a-b4b3-000000000000}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{95EFB171-F3DF-4BEC-9EF7-829A800203E6}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2007-12-22 290112]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-03-21 15360]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 1957888]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_16\bin\jusched.exe" [2008-05-28 75256]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
--a------ 2008-03-17 21:48 3057152 c:\program files\DAP\DAP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-07-05 09:08 16380416 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-r------- 2007-06-15 09:45 1826816 c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ZZZsvc_lich"=2 (0x2)
"FTRTSVC"=2 (0x2)
"PnkBstrA"=2 (0x2)
"CcEvtSvc"=2 (0x2)
"BlueSoleil Hid Service"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\DAP\\DAP.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\xampp\\mysql\\bin\\mysqld.exe"=
"c:\\xampp\\apache\\bin\\apache.exe"=
"g:\\Program Files\\Little Fighter 2.5 - v2.0\\lf2.5\\lf2.5.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe"=
"f:\\Program Files\\World of Warcraft\\Repair.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 ddsxeiservice;ddsxeiservice2;\??\e:\program files\CS\SXE\sXe Injected\ddsxei.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5052a39d-afdc-11dc-a003-001d7d3c480e}]
\Shell\AutoRun\command - J:\USBNB.exe
.
Contents of the 'Scheduled Tasks' folder
2008-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-17 21:43:40
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\NEOSTR~1\TaskBarIcon.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-11-17 21:45:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-17 20:45:28
ComboFix2.txt 2008-11-16 19:07:21
Pre-Run: 52 379 074 560 bytes free
Post-Run: 52,445,413,376 bytes free
206
