Prosba O Sprawdzenie Loga

[hef44]

Witam,

prosze o sprawdzenie kolejnego loga, tym razem z innego komputera niz poprzednio:

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "ComboFix

"

ComboFix 09-01-21.04 - Administrator 2009-01-26 14:45:33.1 - NTFSx86 MINIMAL

Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.3071.2826 [GMT 1:00]

Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)

FW: Kaspersky Internet Security *enabled*

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\2u.com

C:\autorun.inf

c:\windows\system32\gasretyw0.dll

c:\windows\system32\kamsoft.exe

D:\2u.com

D:\Autorun.inf

 

.

((((((((((((((((((((((((( Pliki utworzone od 2008-12-26 do 2009-01-26 )))))))))))))))))))))))))))))))

.

 

2009-01-09 20:42 . 2009-01-09 20:42 <DIR> d-------- c:\program files\Cool CD Burner

2009-01-09 20:42 . 2003-12-17 15:00 1,208,320 --a------ c:\windows\system32\PTxSCP.ocx

2009-01-09 20:42 . 2007-07-31 11:57 1,164,728 --a------ c:\windows\system32\NMSDVDXU.dll

2009-01-09 20:42 . 2000-05-22 21:58 608,448 --a------ c:\windows\system32\comctl32.ocx

2009-01-09 20:42 . 2002-10-16 20:03 208,896 --a------ c:\windows\system32\RICHTX32.OCX

2009-01-09 20:42 . 2002-10-26 13:35 140,288 --a------ c:\windows\system32\COMDLG32.OCX

2009-01-09 20:42 . 1998-06-17 23:00 89,360 --a------ c:\windows\system32\VB5DB.DLL

2009-01-08 15:18 . 2009-01-12 17:45 279 --a------ c:\windows\game.ini

2009-01-08 14:44 . 2009-01-08 14:48 <DIR> d-------- c:\program files\DAEMON Tools

2009-01-08 14:42 . 2009-01-08 14:42 685,816 --a------ c:\windows\system32\drivers\sptd.sys

2009-01-06 17:56 . 2009-01-06 17:56 <DIR> d-------- c:\program files\uTorrent

2009-01-06 17:56 . 2009-01-09 00:27 <DIR> d-------- c:\documents and settings\Bober\Dane aplikacji\uTorrent

2009-01-06 17:39 . 2009-01-12 17:45 22,328 --a------ c:\documents and settings\Bober\Dane aplikacji\PnkBstrK.sys

2009-01-06 14:35 . 2009-01-06 14:35 <DIR> d-------- c:\program files\Unlocker

2009-01-06 14:35 . 2009-01-06 14:35 <DIR> d-------- c:\documents and settings\Bober\Dane aplikacji\Desktopicon

2009-01-05 20:56 . 2009-01-05 20:56 <DIR> d-------- c:\documents and settings\Bober\Dane aplikacji\AdobeUM

2009-01-04 21:31 . 2009-01-04 21:31 <DIR> d-------- c:\program files\AMD

2009-01-04 21:31 . 2007-06-29 14:47 34,304 --a------ c:\windows\system32\drivers\AmdLLD.sys

2009-01-02 15:06 . 2009-01-02 15:06 228,737 --a------ C:\AnalysisLog.sr0

2009-01-02 14:47 . 2009-01-02 14:47 <DIR> d-------- c:\program files\Common Files\Creative Labs Shared

2009-01-02 14:47 . 2008-12-03 15:04 189,440 --a------ c:\windows\system32\KSXPPI32.dll

2009-01-02 14:47 . 2008-12-01 14:14 33,126 --a------ c:\windows\system32\kschimp.ini

2009-01-02 14:47 . 2007-12-11 18:47 23,292 --a------ c:\windows\ksaudENG.reg

2009-01-02 14:47 . 2008-11-06 18:41 7,556 --a------ c:\windows\system32\MixerDefaultXP.reg

2009-01-02 14:47 . 2008-08-28 23:02 3,556 --a------ c:\windows\system32\DeviceDefaultsXP.reg

2009-01-02 14:47 . 2007-07-05 10:27 2,630 --a------ c:\windows\MixerName.reg

2009-01-02 14:38 . 2009-01-02 14:38 <DIR> d-------- c:\program files\Intel Desktop Board

2009-01-01 19:03 . 2009-01-01 19:03 <DIR> d-------- c:\program files\Common Files\Adobe

2008-12-29 20:15 . 1999-12-12 18:01 44,032 --------- c:\windows\system32\CTSVCCDA.EXE

2008-12-29 20:15 . 1999-11-17 18:00 25,088 --------- c:\windows\system32\CTSVCCTL.EXE

2008-12-29 20:14 . 2008-12-29 20:14 <DIR> d-------- c:\program files\Common Files\Creative

2008-12-29 20:14 . 2007-04-20 15:28 3,118 --------- c:\windows\system32\AudioDrv.ini

2008-12-29 20:13 . 2000-12-13 11:21 7,572,224 --------- c:\windows\system32\CT8MGM.SF2

2008-12-29 20:13 . 1999-09-22 16:18 2,167,684 --------- c:\windows\system32\CT2MGM.SF2

2008-12-29 20:09 . 2006-01-06 03:49 <DIR> d-------- c:\windows\nview

2008-12-29 20:09 . 2008-09-16 21:27 453,152 --a------ c:\windows\system32\NVUNINST.EXE

2008-12-29 20:09 . 2008-09-17 09:55 453,152 --a------ c:\windows\system32\nvudisp.exe

2008-12-29 20:09 . 2009-01-26 14:49 195,261 --a------ c:\windows\system32\nvapps.xml

2008-12-29 20:09 . 2008-09-17 09:55 18,394 --a------ c:\windows\system32\nvdisp.nvu

2008-12-29 17:02 . 2008-12-29 17:02 <DIR> d-------- c:\documents and settings\Bober\.jpi_cache

2008-12-29 17:02 . 2008-12-29 17:02 <DIR> d-------- c:\documents and settings\Bober\.java

2008-12-29 15:31 . 2009-01-02 14:47 <DIR> d-------- c:\program files\Creative

2008-12-29 15:31 . 2003-07-24 12:17 4,174,814 --a------ c:\windows\system32\ct4mgm.sf2

2008-12-29 15:31 . 2008-12-29 20:20 413,696 --a------ c:\windows\system32\wrap_oal.dll

2008-12-29 15:31 . 2006-08-07 19:30 162,176 --a------ c:\windows\system32\drivers\ctusfsyn.sys

2008-12-29 15:31 . 2005-12-08 11:54 142,336 --a------ c:\windows\system32\drivers\ctsfm2k.sys

2008-12-29 15:31 . 2005-12-08 11:54 120,832 --a------ c:\windows\system32\sfms32.dll

2008-12-29 15:31 . 2005-12-08 11:54 114,688 --a------ c:\windows\system32\drivers\ctoss2k.sys

2008-12-29 15:31 . 2008-12-29 20:20 102,400 --a------ c:\windows\system32\OpenAL32.dll

2008-12-29 15:31 . 2005-04-22 04:27 73,728 -ra------ c:\windows\MIDIDEF.EXE

2008-12-29 15:31 . 2005-12-08 11:54 21,504 --a------ c:\windows\system32\sfman32.dll

2008-12-29 15:31 . 2003-04-11 10:26 59 --a------ c:\windows\system32\default4.sfm

2008-12-29 15:27 . 2008-12-29 15:27 29 --a------ c:\windows\sfbm.INI

2008-12-28 13:03 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys

2008-12-28 12:59 . 2008-12-28 12:59 <DIR> d-------- c:\program files\Free WMA to MP3 Converter

2008-12-28 12:53 . 2008-12-28 12:54 <DIR> d-------- c:\documents and settings\Bober\dwhelper

2008-12-26 19:47 . 2008-12-27 17:18 <DIR> d-------- c:\program files\RivaTuner v2.08

2008-12-26 18:57 . 2008-12-26 22:42 <DIR> d-------- c:\windows\system32\NtmsData

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-26 13:49 16,884 --sha-w c:\windows\system32\drivers\fidbox.idx

2009-01-26 13:49 1,888,800 --sha-w c:\windows\system32\drivers\fidbox.dat

2009-01-26 13:49 --------- d-----w c:\program files\neostrada tp

2009-01-26 13:49 --------- d-----w c:\program files\Lx_cats

2009-01-26 13:49 --------- d-----w c:\program files\cFosSpeed

2009-01-26 13:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab

2009-01-12 20:35 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\Xfire

2009-01-12 17:40 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2009-01-12 16:45 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-10 14:00 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP

2009-01-08 14:21 --------- d-----w c:\program files\Xfire

2009-01-07 21:14 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\teamspeak2

2009-01-02 18:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Creative

2008-12-25 12:03 --------- d-----w c:\program files\Razer

2008-12-25 12:03 --------- d-----w c:\program files\DIFX

2008-12-25 12:03 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\InstallShield

2008-12-20 15:28 --------- d-----w c:\program files\Aspyr

2008-12-20 15:22 --------- d--h--r c:\documents and settings\Bober\Dane aplikacji\SecuROM

2008-12-20 15:03 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\IObit

2008-12-20 14:55 --------- d-----w c:\program files\IObit

2008-12-20 14:31 --------- d-----w c:\documents and settings\NetworkService\Dane aplikacji\Xfire

2008-12-20 14:21 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\Creative

2008-12-20 14:12 --------- d--h--w c:\program files\Creative Installation Information

2008-12-20 13:51 --------- d-----w c:\program files\Common Files\InstallShield

2008-12-20 13:44 --------- d-----w c:\program files\Lexmark 730 Series

2008-12-20 13:35 --------- d-----w c:\program files\Teamspeak2_RC2

2008-12-20 13:34 --------- d-----w c:\program files\OO Software

2008-12-20 13:33 --------- d-----w c:\program files\K-Lite Codec Pack

2008-12-20 13:33 --------- d-----w c:\program files\Gadu-Gadu

2008-12-20 13:33 --------- d-----w c:\documents and settings\Bober\Dane aplikacji\Gadu-Gadu

2008-12-20 13:32 --------- d-----w c:\program files\foobar2000

2008-12-20 13:27 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-12-20 13:27 --------- d-----w c:\program files\AGEIA Technologies

2008-12-20 13:18 33 ----a-w c:\windows\system32\drivers\adidsl.cfg

2008-12-20 13:18 --------- d-----w c:\program files\SAGEM

2008-12-20 13:18 --------- d-----w c:\program files\Java

2008-12-20 13:12 --------- d-----w c:\program files\microsoft frontpage

2008-12-20 13:11 --------- d-----w c:\program files\Usługi online

2008-08-10 23:08 978,396 ----a-w c:\program files\BDAXP.cab

2006-01-11 03:37 311,328 --sha-w c:\windows\system32\drivers\fidbox2.dat

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2008-11-15 2235920]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-08-16 167368]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]

"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768]

"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]

"LXCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 73728]

"cFosSpeed"="c:\program files\cFosSpeed\cFosSpeed.exe" [2008-06-25 867544]

"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2008-09-05 159744]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]

"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-02-28 180224]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-11-11 206088]

"P17Helper"="SPIRun.dll" [2006-07-03 c:\windows\system32\SPIRUN.DLL]

"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

 

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.X264"= x264vfw.dll

"VIDC.XFR1"= xfcodec.dll

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"d:\\Fearek\\FEARMP.exe"=

"d:\\Fearek\\FEAR.exe"=

"c:\\Program Files\\Gadu-Gadu\\gg.exe"=

"c:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Xfire\\xfire.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Documents and Settings\\Bober\\Pulpit\\utorrent.exe"=

"d:\\nowy cal of duty\\iw3mp.exe"=

 

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [2006-01-11 16640]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]

S3 AVPsys;AVPsys;\??\c:\windows\system32\drivers\cdaudio.sys --> c:\windows\system32\drivers\cdaudio.sys [?]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-01-02 79360]

S3 CyUsb;Cypress Generic USB Driver;c:\windows\system32\drivers\CYUSB.sys [2008-12-20 31104]

S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2008-12-20 22784]

S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2008-12-20 116992]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2006-01-04 22640]

S4 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2008-12-20 64000]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6282651f-df17-11dd-8be4-4d6564696130}]

\Shell\AutoRun\command - G:\2u.com

\Shell\explore\Command - G:\2u.com

\Shell\open\Command - G:\2u.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dfecfba-7ce0-11da-8bf7-df47c62bdaa7}]

\Shell\AutoRun\command - G:\2u.com

\Shell\explore\Command - G:\2u.com

\Shell\open\Command - G:\2u.com

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.neostrada.pl

IE: { - c:\program files\Messenger\msmsgs.exe

FF - ProfilePath - c:\documents and settings\Bober\Dane aplikacji\Mozilla\Firefox\Profiles\dvyrspim.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-26 14:49:48

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCFCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG10.00.00.01WORKSTATION"="DFAC8EF032F2C480269EDA5B037202C9A5768BDB90D327C51A5E8FE63746D4FDA8972064140

6206A443D6F2298202CAC6C251FE2EADB8967AF39947993A26F1E0AF7926F007FBE2A87F524C553AD

543AC0F65A3784BA30E6A311D919D32EE9FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74

CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933

8EDD5E5BE2F6E667A9C6AECB7A5D140787736DB2C2375784177B67DD0969B7761E146627F10013CC0

EFAEC5749356325D7819082C39BDF050056261753991FD43D1AF43A199FE01CABCCFCF65640549C92

014E35028BFB3233E96F8CDA43190A2C2FD5D813D6ABA96E18E732123B813B3C03169A3404D03A3D2

D05192CD76BE423CD3B0DEAADFCFD567CEFDC9E6354E83FE8DD73B318C78314E62A8CFA5EA0E3BCC2

DAD04A409D59C7EA5D41BE09F7BFE8EC9D767F6C8DA58B35ABA99EF3873F7AAFF015023E9CAE8C2D7

D9C5C925D926A19D14D38BD926EDE88D4279247B0E0BC0B3C3D86EC4E234EDA9D9F84F7B7E0D8CE7C

1624588E5DACA4F830749AF264CD9E7EA2ED24C8912064126E69C680E4ADBFA0E1AD9F77A6F6246CE

38746699B56877E10F450E708748CB2A35D21F209C6F4C6B863888D33A3728855B3B4EF0CE7B808C6

7B72CBC925E8DA4BDB3C8F6DE44AFD93F41F4F20FDD0AD8B03662CEF7477E678869CD54D6D666B660

0611B642E6FD3DFB98003BD34543B81A3EC01B4D45C71CF3CF8AD3EEDC1476A8AEB1CF6ABE85F012C

DEB190D96516A56A7199FC43D67B68E8C3BE78AB0F5540E14F60E04B0DB6CB6881A9CF62402A5CCC2

E641BDFA7E1507ECCB8110FB402C40E90F6105D08F98AB242F9E92A77637BE572949BADE4018D8E78

0ECC646DBC483CC8B42997D9477CED8F79FE706D354EF3A01EBA14F73D1851BF75A75B487991BC253

182155643D1276A40E1D55C92135B32BBEA5E20FBD9A3AC6A4F09A630D805E6C8A950A597310BE92C

9DE15077FEA2B1ED4F3C6D29B505E1ACA565C05B4BAD629C5B2D43F0B5EA395DED7D2B61B7F3BC734

5C0C6327D9892BFC1CC21FA0973820F8E70FDFE6BBC953AC179A051589F8855D663E48AFAA787E86F

80A6932838C3C8E7C1FA77D61B52EB3F863ACC70175BDBC701D5A9E81D1C352B25032C307F37B7C4B

031926BC3D3DE3EBB555D817190150C56FC08F7884272A8413F50A0740209332E6D8C15189643CC13

2011836998D4CD080E254B1F7C35CE43341068E05F34788FCEA7311E279129EA22F9E2DFF4306B1F9

306FBB7E3D33779117FECB799ED8A8D48261200A8FE4906B2AC7CD4BD0175046B2E954E25E8B09AD8

34880E14B5954623D1FB8B508B540A00C3A3F19E663188C7299803FED43EBC624C071B4349783BF97

7ABB3EA772982095C217FD641195F"

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\program files\Creative\Shared Files\CTAudSvc.exe

c:\program files\cFosSpeed\spd.exe

c:\windows\system32\CTSVCCDA.EXE

c:\windows\system32\FTRTSVC.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\oodag.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\windows\system32\wscntfy.exe

c:\progra~1\NEOSTR~1\TaskBarIcon.exe

c:\windows\system32\rundll32.exe

c:\program files\Razer\DeathAdder\razerofa.exe

c:\windows\system32\rundll32.exe

.

**************************************************************************

.

Czas ukończenia: 2009-01-26 14:51:29 - komputer został uruchomiony ponownie [bober]

ComboFix-quarantined-files.txt 2009-01-26 13:51:26

 

Przed: 18 983 944 192 bajtów wolnych

Po: 19,345,289,216 bajtów wolnych

 

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4

245 --- E O F --- 2008-12-21 12:03:28

[Kolobos]

Podlacz zainfekowane nosniki, uzyj Flash Disinfector.

 

Wklej do notatnika:

REGEDIT4

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6282651f-df17-11dd-8be4-4d6564696130}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dfecfba-7ce0-11da-8bf7-df47c62bdaa7}]

 

Zapisz jako fix.reg i uruchom.

 

Na koniec zablokuj dostep do klucza mountpoints2, opis na dole strony:

http://www.searchengines.pl/Infekcje-z-pen...ych-t94761.html