Otóż od pewnego czasu mam problem ze skanem(?) nieotwartych portów. Podaje tu przykładowy log z firewala (Sunbelt Profesional Firewall - dawne Kerio).
Jak widać na załączonym obrazku w ciągu sekundy nawiązywanych jest nawet 60000 odwołań do lokalnego punktu 91.145.136.0:13476. Zdalnym punktem może być ip z mojej sieci lub coś innego. Podczas takiego zdarzenia komputer nie odpowiada lub odpowiada bardzo wolno na polecenia(laguje myszka itp.). Proces trwa 30s czasami więcej, kilka razy dziennie.
Na drugim obrazku widać wraz z tym skanem nieotwartych portów pokrywa się inne zdarzenie :icmp destination unreachable network unreachable.
System był skanowany i pozbawiony jest raczej wszelkich śmieci. Daje logi z HijacThis i ComboFix.
» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "Hijack"
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:33:02, on 2009-10-07
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files\AVerTV\QuickTV.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Totalcmd\TOTALCMD.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\AVerTV\AVerTV.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV\QuickTV.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{609EA36B-DFFC-4F48-9B94-729B19FAA26C}: NameServer = 193.19.122.18,193.19.122.42
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
--
End of file - 2763 bytes
» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "ComboFix"
ComboFix 09-10-04.01 - Cezary 2009-10-05 15:27.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1665 [GMT 2:00]
Uruchomiony z: d:\!azureus ciagnie\ComboFix.exe
FW: Kerio Personal Firewall *disabled* {A990EAA7-8941-4621-BC27-4F16261D3180}
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Dane aplikacji\Microsoft\id.txt
c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat
c:\recycler\S-1-5-21-9630407163-7319655151-837582323-7883
c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\libfn.dll
c:\windows\system32\Drivers\otrgvhlxgacb.sys
c:\windows\system32\Drivers\rulemddmlxiu.sys
c:\windows\system32\Drivers\shumfgebblbe.sys
c:\windows\system32\Drivers\vutjdanrnkhc.sys
c:\windows\system32\ieuinit.inf
c:\windows\UA000088.DLL
----- BITS: Możliwe zainfekowane strony -----
hxxp://shefo5.fileave.com
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_COM+_MESSAGES
-------\Legacy_fci
-------\Legacy_OREANS32
-------\Legacy_POWERMANAGER
-------\Service_FCI
-------\Service_oreans32
-------\Service_PowerManager
-------\Legacy_otrgvhlxgacb
-------\Legacy_rulemddmlxiu
-------\Legacy_shumfgebblbe
-------\Legacy_vutjdanrnkhc
-------\Service_otrgvhlxgacb
-------\Service_rulemddmlxiu
-------\Service_shumfgebblbe
-------\Service_vutjdanrnkhc
((((((((((((((((((((((((( Pliki utworzone od 2009-09-05 do 2009-10-05 )))))))))))))))))))))))))))))))
.
2009-09-26 11:17 . 2009-09-26 11:17 164352 --sh--w- c:\windows\system32\SC.dll
2009-09-23 12:12 . 2009-09-23 12:12 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\id Software
2009-09-22 19:25 . 2009-09-22 19:25 361344 -c--a-w- c:\windows\system32\dllcache\TCPIP.SYS
2009-09-22 07:15 . 2009-09-22 07:15 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\id Software
2009-09-21 15:10 . 2009-09-21 15:10 -------- d-----w- c:\windows\6833245EDD86479A882A8360D62C8194.TMP
2009-09-18 08:27 . 2009-09-18 08:27 -------- d-----w- c:\documents and settings\Cezary\Ustawienia lokalne\Dane aplikacji\ATI
2009-09-18 08:27 . 2009-09-18 08:27 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ATI
2009-09-18 08:24 . 2009-07-21 08:40 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-09-18 08:24 . 2009-09-18 08:25 -------- d-----w- c:\program files\ATI Technologies
2009-09-18 08:23 . 2009-09-18 08:23 -------- d-----w- c:\program files\9-8_legacy_xp32-64_dd_ccc
2009-09-17 09:33 . 2009-09-17 09:33 -------- d-----w- c:\windows\Zuma's Revenge!
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-05 13:16 . 2009-03-24 18:50 138944 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-05 13:16 . 2009-03-24 18:49 189784 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-05 09:40 . 2006-12-22 15:08 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-05 08:34 . 2009-03-24 18:49 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-10-05 08:13 . 2006-12-22 20:20 -------- d-----w- c:\program files\Easy RealMedia Tools
2009-10-04 20:47 . 2008-12-02 09:42 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\uTorrent
2009-10-04 17:20 . 2009-05-09 08:03 -------- d-----w- c:\program files\Steam
2009-10-04 09:49 . 2007-06-18 07:50 -------- d-----w- c:\program files\DC++
2009-10-02 12:15 . 2006-12-22 12:46 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\XnView
2009-09-30 19:10 . 2006-12-22 15:55 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-09-26 07:05 . 2007-04-27 19:43 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\Skype
2009-09-23 12:12 . 2009-03-24 18:49 2373712 ----a-w- c:\windows\system32\pbsvc.exe
2009-09-22 19:25 . 2009-09-22 19:25 361344 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-09-22 19:25 . 2004-08-03 21:14 361344 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-09-21 15:25 . 2001-10-26 18:15 80924 ----a-w- c:\windows\system32\perfc015.dat
2009-09-21 15:25 . 2001-10-26 18:15 484252 ----a-w- c:\windows\system32\perfh015.dat
2009-09-21 15:18 . 2008-09-28 16:30 36504 ----a-w- c:\documents and settings\Cezary\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-09-21 15:10 . 2009-07-06 12:07 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-21 15:00 . 2006-12-22 08:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-21 13:28 . 2009-08-13 09:33 -------- d-----w- c:\program files\DVDPean Pro 5.6.0
2009-09-19 07:06 . 2006-12-22 18:16 -------- d-----w- c:\program files\SpeedFan
2009-09-18 08:01 . 2007-01-06 15:26 328002 ----a-w- c:\windows\system32\drivers\fwdrv.err
2009-09-18 07:19 . 2009-07-06 12:07 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-11 17:43 . 2006-12-22 13:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-10 14:59 . 2007-12-23 11:28 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-09-10 14:59 . 2007-12-23 11:28 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-08-22 16:30 . 2009-08-22 16:29 -------- d-----w- c:\program files\mp3DirectCut
2009-08-22 08:49 . 2009-08-21 17:10 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Installations
2009-08-22 08:33 . 2009-08-22 08:33 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-08-22 08:32 . 2009-08-22 08:32 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-08-22 08:32 . 2009-08-22 08:32 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-22 08:32 . 2009-08-22 08:32 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-21 18:53 . 2009-08-21 18:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\PC Suite
2009-08-21 18:53 . 2009-08-21 18:53 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2009-08-21 18:51 . 2009-08-21 18:51 -------- d-----w- c:\program files\DIFX
2009-08-13 09:33 . 2009-08-13 09:33 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\DVDPeanSoftware
2009-08-13 08:29 . 2009-08-13 08:29 -------- d-----w- c:\program files\Real Alternative
2009-08-13 08:22 . 2009-08-13 07:57 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-08-11 08:18 . 2007-09-28 15:01 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\InstallShield
2009-08-11 07:24 . 2009-08-11 07:24 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Office Genuine Advantage
2009-08-08 10:49 . 2009-08-08 09:29 -------- d-----w- c:\program files\Common Files\Logishrd
2009-08-08 10:41 . 2009-08-08 09:31 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd
2009-08-08 10:16 . 2009-08-08 10:16 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-08-08 10:16 . 2009-08-08 10:16 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-08-08 10:16 . 2009-08-08 10:16 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-08-08 10:16 . 2009-08-08 10:16 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-08-08 09:31 . 2009-08-08 09:31 -------- d-----w- c:\documents and settings\Cezary\Dane aplikacji\Logitech
2009-07-21 16:30 . 2005-11-13 22:43 3565056 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-07-21 15:55 . 2009-07-21 15:55 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-07-21 15:54 . 2006-09-08 13:47 325120 ----a-w- c:\windows\system32\ati2dvag.dll
2009-07-21 15:44 . 2009-07-21 15:44 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-07-21 15:44 . 2009-07-21 15:44 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-07-21 15:43 . 2009-07-21 15:43 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-07-21 15:43 . 2009-07-21 15:43 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-07-21 15:43 . 2009-07-21 15:43 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-07-21 15:42 . 2009-07-21 15:42 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-07-21 15:40 . 2009-07-21 15:40 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-07-21 15:35 . 2009-07-21 15:35 307200 ----a-w- c:\windows\system32\atiiiexx.dll
2009-07-21 15:32 . 2009-07-21 15:32 11845632 ----a-w- c:\windows\system32\atioglxx.dll
2009-07-21 15:32 . 2006-09-08 13:33 3818272 ----a-w- c:\windows\system32\ati3duag.dll
2009-07-21 15:17 . 2006-09-08 13:28 2670720 ----a-w- c:\windows\system32\ativvaxx.dll
2009-07-21 15:17 . 2009-07-21 15:17 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-07-21 15:17 . 2009-07-21 15:17 3107788 ----a-w- c:\windows\system32\ativva5x.dat
2009-07-21 15:01 . 2009-07-21 15:01 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-07-21 14:57 . 2009-07-21 14:57 475136 ----a-w- c:\windows\system32\atikvmag.dll
2009-07-21 14:55 . 2009-07-21 14:55 126976 ----a-w- c:\windows\system32\atiadlxx.dll
2009-07-21 14:54 . 2009-07-21 14:54 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-07-21 14:54 . 2009-07-21 14:54 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-07-21 14:53 . 2009-07-21 14:53 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-07-21 14:53 . 2009-07-21 14:53 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-07-21 14:52 . 2009-07-21 14:52 290816 ----a-w- c:\windows\system32\atiok3x2.dll
2009-07-21 14:52 . 2009-07-21 14:52 3227648 ----a-w- c:\windows\system32\aticaldd.dll
2009-07-21 14:48 . 2006-09-08 13:10 626688 ----a-w- c:\windows\system32\ati2cqag.dll
2009-07-20 07:34 . 2009-07-20 07:34 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-07-14 15:17 . 2009-07-14 15:17 15308440 ----a-w- c:\windows\system32\xlive.dll
2009-07-14 15:17 . 2009-07-14 15:17 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
.
------- Sigcheck -------
[-] 2009-09-22 . 8E036EEC565910417EA020CE0962AA24 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2009-09-22 . 8E036EEC565910417EA020CE0962AA24 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
QuickTV.lnk - c:\program files\AVerTV\QuickTV.exe [2010-10-5 266240]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk]
backup=c:\windows\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Cezary^Menu Start^Programy^Autostart^Logitech . Rejestracja produktu.lnk]
path=c:\documents and settings\Cezary\Menu Start\Programy\Autostart\Logitech . Rejestracja produktu.lnk
backup=c:\windows\pss\Logitech . Rejestracja produktu.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-07-04 28544]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2005-12-15 274432]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2005-12-15 81920]
R1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [2003-07-11 14912]
R3 PhTVTune;Cap7134 TVTuner;c:\windows\system32\drivers\PhTVTune.sys [2006-12-22 46976]
R3 Tetris;Tetris driver;c:\windows\system32\drivers\Tetris.sys [2007-05-10 48928]
S4 BBDemon;Backbone Service;"e:\program files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" -service --> e:\program files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe [?]
S4 UfgtyElfmuy;UfgtyElfmuy;c:\windows\System32\svchost.exe -k netsvcs [2004-08-04 14336]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.onet.pl/
TCP: {26DBA36B-E1FA-4B56-B16A-71669CC81AD9} = 193.19.122.18,193.19.122.42
FF - ProfilePath - c:\documents and settings\Cezary\Dane aplikacji\Mozilla\Firefox\Profiles\eq384at7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSignPlugin.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Notify-WgaLogon - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 15:34
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1214440339-362288127-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2e,a6,1d,28,3f,55,41,55,bc,c7,09,8d,c4,44,23,7c,87,e6,fc,c6,2b,d5,5d,
8e,de,6e,16,30,e6,67,90,16,0e,62,d8,10,2a,aa,7d,03,e2,d7,25,9a,5b,70,a4,0b,\
"??"=hex:66,93,4f,42,21,d0,8c,ee,3a,6b,45,64,32,b6,14,2b
[HKEY_USERS\S-1-5-21-1214440339-362288127-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:e9,47,14,22,78,c6,85,e2,6a,94,f5,58,c2,a0,39,7d,9b,dd,9c,de,32,
00,87,43,4b,34,5d,6b,3e,7b,03,18,5e,bf,72,88,2b,b1,2d,5f,03,ea,cc,63,3c,1d,\
"rkeysecu"=hex:45,68,47,87,23,6a,b1,37,85,2a,fa,01,7c,8c,46,06
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(524)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(332)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
c:\program files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
c:\program files\Totalcmd\TOTALCMD.EXE
.
**************************************************************************
.
Czas ukończenia: 2009-10-05 15:37 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-10-05 13:37
Przed: 1 393 336 320 bajtów wolnych
Po: 1 304 354 816 bajtów wolnych
242
Czekam na jakieś propozycje co z tym zrobić.