Wysypka Windowsa Co 20 Min. ?!

[fumfel]

Witam.

Proszę o pomoc, trzeci dzień męczę się z jakimś syfem. Komputer dokładnie co 20 minut od momentu zalogowania wysypuje mi się do niebieskiego ekranu (fotka poniżej). Zaczęło się od tego że moja kochana żonka wsadziła zawirusowanego pena do USB... Norton wykrył Backdoor.Trojan, niby zlikwidował problem.... ale od tego czasu zwiecha co 20 minut. Żadne skanowanie antywirusem czy SpyDoctorem nie daje rezultatu...

 

Jeżeli mogę prosić rzuccie okiem na moje logi z Hijackthis i Combofix, może ktoś znajdzie problem mam za małe doświadczenie żeby grzebać w procesach:

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "Hijackthis"

Logfile of HijackThis v1.99.1

Scan saved at 21:03:06, on 2009-02-17

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe

C:\WINDOWS\tsnp2std.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\vsnp2std.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\NewFon\NewFon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gateway\EzTune\DTHtml.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Portrait Displays\Pivot Software\floater.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Program Files\HotKey\HotKey.exe

C:\Program Files\Kalendarz XP\Kalendarz.exe

C:\Program Files\TechniSat DVB\bin\Server4PC.exe

C:\Program Files\TechniSat DVB\bin\Server4PC.exe

C:\Downloads\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"

O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -GWY

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\Updreg.exe

O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe

O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [XSC SIP Client] "C:\Program Files\NewFon\NewFon.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Blue eye Calibration.lnk = C:\Program Files\LaCie blue eye Pro\Tools\CLCalibrationLoader.exe

O4 - Global Startup: HotKey Driver.lnk = C:\Program Files\HotKey\HotKey.exe

O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe

O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Konwertuj do istniejącego pliku PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Konwertuj wybrane łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre...ows-i586-jc.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "ComboFix"

ComboFix 09-02-17.02 - artur 2009-02-19 1:09:54.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.3327.2633 [GMT 1:00]

Uruchomiony z: c:\downloads\ComboFix.exe

AV: Norton Internet Security *On-access scanning disabled* (Updated)

FW: Norton Internet Security *enabled*

* Utworzono nowy punkt przywracania

.

 

((((((((((((((((((((((((( Pliki utworzone od 2009-01-19 do 2009-02-19 )))))))))))))))))))))))))))))))

.

 

2009-02-18 12:43 . 2009-02-18 12:48 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\OpenOffice.ux.pl2

2009-02-18 08:30 . 2009-02-18 08:30 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\Ahead

2009-02-16 22:06 . 2009-02-16 22:06 <DIR> d-------- c:\program files\Spybot - Search & Destroy

2009-02-16 22:06 . 2009-02-16 22:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy

2009-02-16 10:04 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll

2009-02-16 10:03 . 2009-02-16 22:50 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\skypePM

2009-02-16 10:03 . 2009-02-16 10:03 32 --a------ c:\documents and settings\All Users\Dane aplikacji\ezsid.dat

2009-02-16 10:02 . 2009-02-16 22:51 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\Skype

2009-02-16 10:01 . 2009-02-16 10:04 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\Winamp

2009-02-13 00:30 . 2009-02-14 00:44 321 --a------ c:\windows\barcode.ini

2009-02-11 02:22 . 2008-04-14 00:11 26,112 --a------ c:\windows\system32\drivers\MemStPCI.SYS

2009-02-11 02:22 . 2008-04-14 00:11 26,112 --a--c--- c:\windows\system32\dllcache\memstpci.sys

2009-02-10 17:28 . 2009-02-19 00:26 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\OpenOffice.ux.pl2

2009-02-08 23:42 . 2009-02-08 23:42 <DIR> d-------- c:\windows\Sun

2009-02-08 23:41 . 2009-02-08 23:41 <DIR> d-------- c:\program files\Java

2009-02-08 23:41 . 2009-02-08 23:41 410,984 --a------ c:\windows\system32\deploytk.dll

2009-02-08 23:41 . 2009-02-08 23:41 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-02-04 21:40 . 2009-02-04 21:40 <DIR> d-------- c:\program files\7-Zip

2009-02-04 20:38 . 2009-02-04 20:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI

2009-02-04 20:27 . 2009-02-04 20:27 <DIR> d-------- c:\program files\DAEMON Tools Lite

2009-02-04 20:27 . 2009-02-06 20:08 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\DAEMON Tools

2009-02-04 20:25 . 2009-02-04 20:25 715,248 --a------ c:\windows\system32\drivers\sptd.sys

2009-02-04 00:17 . 2009-02-04 00:17 <DIR> d-------- c:\program files\directx

2009-02-03 23:55 . 2007-04-18 01:19 1,311,202 -ra------ c:\windows\system32\drivers\ativcaxx.cpa

2009-02-03 23:55 . 2007-09-08 15:37 47,360 -ra------ c:\windows\system32\drivers\ativvpxx.vp

2009-02-03 23:55 . 2007-04-18 01:19 2,096 -ra------ c:\windows\system32\drivers\ativdkxx.vp

2009-02-03 23:55 . 2007-05-30 05:43 2,096 -ra------ c:\windows\system32\drivers\ativckxx.vp

2009-02-03 23:55 . 2007-04-18 01:19 929 -ra------ c:\windows\system32\drivers\ativcaxx.vp

2009-02-03 00:01 . 2009-02-03 00:01 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Ahead

2009-02-02 22:25 . 2009-02-02 22:25 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Sony Corporation

2009-02-02 22:16 . 2006-11-02 16:57 118,520 --a------ c:\windows\system32\PxInsI64.exe

2009-02-02 22:16 . 2006-10-18 19:43 115,960 --a------ c:\windows\system32\PxCpyI64.exe

2009-02-02 22:11 . 2009-02-02 22:18 <DIR> d-------- c:\program files\Sony

2009-02-02 19:40 . 2009-02-02 19:40 <DIR> d-------- c:\program files\LaCie blue eye Pro

2009-02-02 19:40 . 2006-06-13 14:53 65,536 --a------ c:\windows\system32\NDSPCIIO.dll

2009-02-02 19:40 . 2002-07-03 07:58 44,344 --a------ c:\windows\system32\drivers\Seqcal.sys

2009-02-02 19:40 . 2007-03-28 14:32 44,344 --a------ c:\windows\system32\drivers\i1display.sys

2009-02-02 19:40 . 2006-10-03 10:18 33,024 --a------ c:\windows\system32\drivers\cvspydr2.sys

2009-02-02 19:40 . 2006-06-13 14:53 32,768 --a------ c:\windows\system32\Monapi.dll

2009-02-02 19:40 . 2005-01-11 16:06 15,040 --a------ c:\windows\system32\drivers\XrUsb.sys

2009-02-02 17:13 . 2009-02-02 17:13 2,422 --a------ c:\windows\system32\wpa.bak

2009-02-02 17:09 . 2009-02-02 17:09 4,444 --a------ c:\windows\system32\pid.PNF

2009-02-01 19:50 . 2009-02-01 19:50 <DIR> d-------- c:\program files\Audacity

2009-02-01 17:39 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys

2009-02-01 17:30 . 2009-02-01 17:30 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\AdobeUM

2009-02-01 10:13 . 2009-02-01 10:13 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\IEPro

2009-02-01 10:12 . 2009-02-01 10:12 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\Symantec

2009-02-01 10:12 . 2009-02-01 10:12 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\DisplayTune

2009-02-01 10:12 . 2009-02-01 10:12 <DIR> d-------- c:\documents and settings\ania\Dane aplikacji\ATI

2009-02-01 10:11 . 2009-02-19 01:10 <DIR> d--h----- c:\documents and settings\ania\Ustawienia lokalne

2009-02-01 10:11 . 2009-02-16 13:26 <DIR> dr------- c:\documents and settings\ania\Ulubione

2009-02-01 10:11 . 2009-01-31 21:44 <DIR> d--h----- c:\documents and settings\ania\Szablony

2009-02-01 10:11 . 2009-02-16 10:42 <DIR> d-------- c:\documents and settings\ania\Pulpit

2009-02-01 10:11 . 2009-02-01 14:46 <DIR> dr------- c:\documents and settings\ania\Moje dokumenty

2009-02-01 10:11 . 2009-01-31 22:40 <DIR> dr------- c:\documents and settings\ania\Menu Start

2009-02-01 10:11 . 2009-02-18 12:43 <DIR> dr-h----- c:\documents and settings\ania\Dane aplikacji

2009-02-01 10:11 . 2009-02-18 12:48 <DIR> d-------- c:\documents and settings\ania

2009-02-01 03:11 . 2009-02-01 03:12 <DIR> d-------- c:\program files\TechniSat DVB

2009-02-01 03:11 . 2009-02-01 03:11 <DIR> d-------- c:\program files\MainConcept

2009-02-01 03:11 . 2009-02-01 03:11 <DIR> d-------- c:\program files\DVBViewerTE

2009-02-01 03:11 . 2009-02-01 03:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Technisat

2009-02-01 03:11 . 2009-02-01 03:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CMUV

2009-02-01 02:53 . 2009-02-01 02:53 <DIR> d-------- c:\windows\system32\Adobe

2009-02-01 02:53 . 2004-08-17 02:40 16,384 --a------ c:\windows\system32\FileOps.exe

2009-02-01 02:48 . 2009-02-01 02:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Adobe Systems

2009-02-01 02:46 . 2009-02-01 02:46 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared

2009-02-01 02:46 . 2009-02-01 18:32 <DIR> d-------- c:\program files\Common Files\Adobe

2009-02-01 02:42 . 2009-02-19 00:58 <DIR> d-------- C:\Downloads

2009-02-01 02:29 . 2009-02-01 02:30 <DIR> d-------- C:\WFDB

2009-02-01 02:29 . 2009-02-11 18:15 <DIR> d-------- c:\program files\WinFast

2009-02-01 02:25 . 2009-02-01 02:25 <DIR> d-------- c:\windows\system32\WinFox

2009-02-01 02:25 . 2009-02-01 02:25 <DIR> d-------- c:\windows\system32\WinFast

2009-02-01 02:25 . 2006-10-18 11:37 162,944 --a------ c:\windows\system32\drivers\cx88vid.sys

2009-02-01 02:25 . 2006-10-18 11:37 50,816 --a------ c:\windows\system32\drivers\cx88tune.sys

2009-02-01 02:25 . 2006-10-18 11:38 9,728 --a------ c:\windows\system32\drivers\cxavxbar.sys

2009-02-01 02:25 . 2003-09-05 09:57 9,469 --a------ c:\windows\system32\drivers\WINFOXIO.sys

2009-02-01 02:20 . 2009-02-01 02:20 <DIR> d-------- c:\program files\MadOnion.com

2009-02-01 02:17 . 2009-02-01 02:17 <DIR> d-------- c:\program files\Common Files\Ulead Systems

2009-02-01 02:16 . 2009-02-01 02:16 <DIR> d-------- c:\program files\Crystal FTP Free

2009-02-01 02:16 . 2009-02-01 02:16 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Crystal FTP

2009-02-01 02:16 . 2009-02-01 02:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ulead Systems

2009-02-01 02:11 . 2009-02-01 02:11 196 --a------ c:\windows\_delis32.ini

2009-02-01 02:00 . 2009-02-19 01:02 104 --a------ c:\windows\Mycomputer.lnk

2009-02-01 01:58 . 2009-02-01 01:58 <DIR> d-------- c:\program files\HotKey

2009-02-01 01:58 . 2009-02-01 01:58 <DIR> d-------- c:\documents and settings\artur\WINDOWS

2009-02-01 01:57 . 2009-02-01 01:57 <DIR> d-------- c:\program files\VID_0C12&PID_0005

2009-02-01 01:50 . 2009-02-01 01:50 <DIR> d-------- c:\program files\Microsoft IntelliPoint 5.2

2009-02-01 01:50 . 2009-02-01 01:50 <DIR> d-------- c:\program files\Microsoft IntelliPoint

2009-02-01 01:44 . 2009-02-19 01:00 <DIR> d-------- c:\program files\Kalendarz XP

2009-02-01 01:42 . 2009-02-01 01:42 <DIR> d-------- c:\program files\ABBYY

2009-02-01 01:37 . 2009-02-01 01:37 <DIR> d-------- c:\program files\Common Files\Ahead

2009-02-01 01:37 . 2009-02-01 01:37 <DIR> d-------- c:\program files\Ahead

2009-02-01 01:37 . 2001-07-07 06:41 569,344 -ra------ c:\windows\system32\imagr5.dll

2009-02-01 01:37 . 2001-07-07 04:44 544,768 -ra------ c:\windows\system32\imagx5.dll

2009-02-01 01:37 . 2001-07-07 19:24 283,920 -ra------ c:\windows\system32\ImagXpr5.dll

2009-02-01 01:37 . 2001-07-10 03:50 155,648 -ra------ c:\windows\system32\NeroCheck.exe

2009-02-01 01:37 . 2001-06-27 00:15 38,912 -ra------ c:\windows\system32\picn20.dll

2009-02-01 01:21 . 2009-02-01 01:21 <DIR> d-------- c:\program files\OpenOffice.ux.pl 2.2.0

2009-02-01 01:17 . 2009-02-01 01:17 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Corel

2009-02-01 01:16 . 2009-02-01 01:16 <DIR> d-------- c:\windows\Corel

2009-02-01 01:15 . 2009-02-01 01:15 <DIR> d-------- c:\program files\Corel

2009-02-01 01:15 . 2009-02-01 01:15 <DIR> d-------- c:\program files\Common Files\Corel

2009-02-01 01:02 . 2009-02-01 01:02 <DIR> d-------- c:\program files\NewFon

2009-02-01 01:01 . 2009-02-01 01:02 <DIR> d-------- c:\program files\Winamp

2009-02-01 01:01 . 2009-02-01 01:02 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Winamp

2009-02-01 00:51 . 2009-02-19 00:22 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\Skype

2009-02-01 00:50 . 2009-02-01 00:50 <DIR> d-------- c:\program files\Skype

2009-02-01 00:50 . 2009-02-01 00:50 <DIR> d-------- c:\program files\Common Files\Skype

2009-02-01 00:39 . 2008-04-14 00:16 85,248 --a------ c:\windows\system32\drivers\NABTSFEC.sys

2009-02-01 00:38 . 2008-04-14 22:51 91,648 --a------ c:\windows\system32\kswdmcap.ax

2009-02-01 00:38 . 2008-04-14 22:51 91,648 --a--c--- c:\windows\system32\dllcache\kswdmcap.ax

2009-02-01 00:38 . 2008-04-14 22:51 61,952 --a------ c:\windows\system32\kstvtune.ax

2009-02-01 00:38 . 2008-04-14 22:51 61,952 --a--c--- c:\windows\system32\dllcache\kstvtune.ax

2009-02-01 00:38 . 2008-04-14 22:50 54,784 --a------ c:\windows\system32\vfwwdm32.dll

2009-02-01 00:38 . 2008-04-14 22:50 54,784 --a--c--- c:\windows\system32\dllcache\vfwwdm32.dll

2009-02-01 00:38 . 2008-04-14 22:51 43,008 --a------ c:\windows\system32\ksxbar.ax

2009-02-01 00:38 . 2008-04-14 22:51 43,008 --a--c--- c:\windows\system32\dllcache\ksxbar.ax

2009-02-01 00:35 . 2009-02-01 00:35 <DIR> d-------- c:\program files\Common Files\snp2std

2009-02-01 00:22 . 2009-02-19 01:00 <DIR> d-------- c:\program files\FlashGet

2009-02-01 00:22 . 2009-02-01 00:50 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype

2009-02-01 00:12 . 2009-02-01 00:12 0 --a------ c:\windows\nsreg.dat

2009-02-01 00:09 . 2009-02-01 00:11 <DIR> d-------- c:\program files\RegCleaner

2009-02-01 00:07 . 2009-02-01 00:08 <DIR> d-------- c:\documents and settings\artur\Dane aplikacji\MiniDm

2009-01-31 23:59 . 2009-02-11 22:17 <DIR> d-------- c:\program files\SopCast

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-19 00:11 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-02-13 18:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec

2009-02-04 20:38 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip

2009-02-04 19:08 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF

2009-02-04 19:08 60,808 ----a-w c:\windows\system32\S32EVNT1.DLL

2009-02-04 19:08 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS

2009-02-04 19:08 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT

2009-02-04 19:08 --------- d-----w c:\program files\Symantec

2009-02-03 23:38 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-01 00:11 --------- d-----w c:\program files\Common Files\InstallShield

2009-01-31 21:54 --------- d-----w c:\program files\ATI Technologies

2009-01-31 21:21 --------- d-----w c:\program files\ASUS

2009-01-31 21:17 --------- d-----w c:\program files\AMD

2009-01-31 21:15 --------- d-----w c:\program files\Realtek

2009-01-31 21:15 --------- d-----w c:\documents and settings\artur\Dane aplikacji\InstallShield

2009-01-31 21:07 --------- d-----w c:\program files\Norton Internet Security

2009-01-31 21:07 --------- d-----w c:\documents and settings\artur\Dane aplikacji\Symantec

2009-01-31 21:06 --------- d-----w c:\program files\Windows Sidebar

2009-01-31 20:47 --------- d-----w c:\program files\microsoft frontpage

2009-01-31 20:46 --------- d-----w c:\program files\Usługi online

2009-01-14 05:46 11,591,680 ----a-w c:\windows\system32\atioglxx.dll

2009-01-14 03:44 110,592 ----a-w c:\windows\system32\atiadlxx.dll

2009-01-14 02:36 45,056 ----a-w c:\windows\system32\amdcalrt.dll

2009-01-14 02:36 45,056 ----a-w c:\windows\system32\amdcalcl.dll

2009-01-14 02:34 3,227,648 ----a-w c:\windows\system32\Amdcaldd.dll

2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll

2008-06-30 12:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-31 39408]

"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]

"XSC SIP Client"="c:\program files\NewFon\NewFon.exe" [2005-04-15 3514368]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-11-13 2105176]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-07 718704]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]

"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-25 81920]

"UpdReg"="c:\windows\Updreg.exe" [2000-05-11 90112]

"tsnp2std"="c:\windows\tsnp2std.exe" [2005-11-14 110592]

"snp2std"="c:\windows\vsnp2std.exe" [2005-11-16 344064]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-10 155648]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"Adobe Version Cue CS2"="c:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-05-25 856064]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\ania\Menu Start\Programy\Autostart\

OpenOffice.ux.pl 2.2.0.lnk - c:\program files\OpenOffice.ux.pl 2.2.0\program\quickstart.exe [2007-04-12 17408]

 

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

Blue eye Calibration.lnk - c:\program files\LaCie blue eye Pro\Tools\CLCalibrationLoader.exe [2009-02-02 577536]

HotKey Driver.lnk - c:\program files\HotKey\HotKey.exe [2009-02-01 36864]

Kalendarz XP.lnk - c:\program files\Kalendarz XP\Kalendarz.exe [2009-02-01 882176]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"= ctwdm32.dll

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Acrobat Speed Launcher.lnk]

path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Acrobat Speed Launcher.lnk

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^artur^Menu Start^Programy^Autostart^Picture Motion Browser Media Check Tool.lnk]

path=c:\documents and settings\artur\Menu Start\Programy\Autostart\Picture Motion Browser Media Check Tool.lnk

backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]

--a------ 2001-05-10 17:49 102400 c:\program files\Creative\SBLive\Program\AHQInit.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-02-08 23:41 136600 c:\program files\Java\jre6\bin\jusched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]

--a------ 2007-02-12 16:22 397312 c:\program files\WinFast\WFDTV\WFWIZ.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]

--a------ 2007-02-12 18:16 69632 c:\program files\WinFast\WFDTV\DTVSchdl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\IEPro\\MiniDM.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=

"c:\\Program Files\\NewFon\\NewFon.exe"=

"d:\\GRY\\PES2009\\pes2009.exe"=

"c:\\Program Files\\Crystal FTP Free\\crystalftp.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-06 149352]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2009-02-01 46080]

R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2009-01-31 90112]

R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\progra~1\LACIEB~1\DDCDrv.sys [2009-02-02 7680]

R3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-01 99376]

R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2008-08-30 510992]

S3 i1display;i1 Display;c:\windows\system32\drivers\i1display.sys [2009-02-02 44344]

S3 MapMem;MapMem;\??\g:\mapmem.sys --> g:\mapmem.sys [?]

S3 MemStPCI;Kontroler modułów pamięci Memory Stick Sony (PCI);c:\windows\system32\drivers\MemStPCI.SYS [2009-02-11 26112]

S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2009-02-01 56960]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\g:\ntglm7x.sys --> g:\NTGLM7X.sys [?]

S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [2009-02-01 9446]

 

--- Inne Usługi/Sterowniki w Pamięci ---

 

*NewlyCreated* - COMHOST

.

Zawartość folderu 'Zaplanowane zadania'

 

2009-02-16 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - artur.job

- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 08:05]

.

- - - - USUNIĘTO PUSTE WPISY - - - -

 

MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe

 

 

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.gazeta.pl/

IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm

IE: Konwertuj do Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Konwertuj do istniejącego pliku PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Konwertuj miejsce docelowe łącza do Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Konwertuj wybrane łącza do Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Konwertuj wybrane łącza do istniejącego pliku PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Konwertuj zaznaczenie do Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Konwertuj zaznaczenie do istniejącego pliku PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

FF - ProfilePath -

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-19 01:11:04

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_045e&Pid_0040\6&3b874adb&0&0000\LogConf]

@DACL=(02 0000)

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'winlogon.exe'(1360)

c:\windows\system32\Ati2evxx.dll

.

Czas ukończenia: 2009-02-19 1:11:52

ComboFix-quarantined-files.txt 2009-02-19 00:11:50

 

Przed: 16 409 743 360 bajtów wolnych

Po: 16,695,603,200 bajtów wolnych

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

 

301 --- E O F --- 2009-02-12 20:16:02

z góry dzięki i pozdrawiam...

Edytowane 19 Lutego 2009 przez fumfel

[Kolobos]

Daj log z combofix w spoilerze (uzyj edytuj i popraw swoj pierwszy post).

[fumfel]

Daj log z combofix w spoilerze (uzyj edytuj i popraw swoj pierwszy post).

...poprawione dzięki za podpowiedź

[Kolobos]

Wykonaj: http://forum.purepc.pl/FAQ-f8/Debugger-Win...et-t104416.html wynik wklej na forum.

[fumfel]

...myślę, że to nic nie pomoże:

1. Mam drugi dysk syna na którym jest taki sam system i wszystko śmiga bez problemu.

2. Dziś już nie wytrzymałem i zapuściłem instalacje systemu od początku po sformatowaniu partycji C: ...zainstalowałem system bez problemu... efekt taki sam 8O po 20 minutach niebieski ekran.... może coś siedzi w sektorze startowym dysku, nie wiem gdybam... ale wszystko na to wskazuje. Niechciałbym tam zabardzo bez wskazówek cokolwiek usuwa - mam dużo ważnych danych na innych partycjach i boję się je utracic... proszę o pomoc....

Edytowane 20 Lutego 2009 przez fumfel

[Kolobos]

Usuwac nie pisze sie przez ó..

 

Wykonaj to co napisalem wczeniej tzn uzyj Debuggera i wklej wynik.

Zrob skan przy pomocy Dr.Web CureIt. Sprawdz temperatury procesora itd.

[fumfel]

Szanowny kolego KOLOBOS... bardzo doceniam, Twąpomoc, ale mam wątpliwości co do obranej przez Ciebie drogi. Fakty są następujące:

1. Komputer "wywala się" dokładnie co 20 minut... żaden sprzęt tego sam sobie nie zaprogramuje....

2. Pracuję na drugim dysku (zmieniam je w kieszeni) i nie ma najmniejszych problemów, czy gry czy praca nic się nie dzieje... jak w jednym z filmów 8O

 

...dlatego myśle że musimy się skupic na dysku twardym... co o tym sadzisz?

[Kolobos]

Nie chcesz wykonac, twoja sprawa. Uzyj HdTune i daj screeny ze wszystkich zakladek.

[fumfel]

HDTune nic nie wykrył... tzn pełnego skanownia nie mogłem zrobić bo sięwywala co 20 min... (screeny poniżej)

 

...a debug, z tego co sięorientuje wskazuje na problem z kartą graficzną.... myślisz może, że to to może być przyczyną problemów?

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "debugger"

Microsoft ® Windows Debugger Version 6.11.0001.402 X86

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\WINDOWS\Minidump\Mini022309-03.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

 

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700

Debug session time: Mon Feb 23 10:29:19.718 2009 (GMT+1)

System Uptime: 0 days 0:20:27.444

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

................................................................

................

Loading User Symbols

Loading unloaded module list

...........

Unable to load image ati2mtag.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ati2mtag.sys

*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 1000007F, {d, 0, 0, 0}

 

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

 

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Probably caused by : ati2mtag.sys ( ati2mtag+105a30 )

 

Followup: MachineOwner

---------

 

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)

This means a trap occurred in kernel mode, and it's a trap of a kind

that the kernel isn't allowed to have/catch (bound trap) or that

is always instant death (double fault). The first number in the

bugcheck params is the number of the trap (8 = double fault, etc)

Consult an Intel x86 family manual to learn more about what these

traps are. Here is a *portion* of those codes:

If kv shows a taskGate

use .tss on the part before the colon, then kv.

Else if kv shows a trapframe

use .trap on that value

Else

.trap on the appropriate frame will show where the trap was taken

(on x86, this will be the ebp that goes with the procedure KiTrap)

Endif

kb will then show the corrected stack.

Arguments:

Arg1: 0000000d, EXCEPTION_GP_FAULT

Arg2: 00000000

Arg3: 00000000

Arg4: 00000000

 

Debugging Details:

------------------

 

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

 

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

 

ADDITIONAL_DEBUG_TEXT:

Use '!findthebuild' command to search for the target build information.

If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

 

FAULTING_MODULE: 804d7000 nt

 

DEBUG_FLR_IMAGE_TIMESTAMP: 4767dee0

 

BUGCHECK_STR: 0x7f_d

 

CUSTOMER_CRASH_COUNT: 3

 

DEFAULT_BUCKET_ID: DRIVER_FAULT

 

LAST_CONTROL_TRANSFER: from b5c1c3f0 to b5ba2a30

 

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

a4dd8d94 b5c1c3f0 ba33c590 b5c1c63e 0de5bb78 ati2mtag+0x105a30

a4dd8d9c b5c1c63e 0de5bb78 0de56107 0de52fb2 ati2mtag+0x17f3f0

a4dd8da0 0de5bb78 0de56107 0de52fb2 a4dd8dc4 ati2mtag+0x17f63e

a4dd8da4 0de56107 0de52fb2 a4dd8dc4 adaed9a4 0xde5bb78

a4dd8da8 0de52fb2 a4dd8dc4 adaed9a4 8d1e60f7 0xde56107

a4dd8dac a4dd8dc4 adaed9a4 8d1e60f7 00007a23 0xde52fb2

a4dd8db0 adaed9a4 8d1e60f7 00007a23 0de5557e 0xa4dd8dc4

a4dd8dc4 00000000 0de5557e 0000001b 00000306 0xadaed9a4

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

ati2mtag+105a30

b5ba2a30 640fb60551000000 movzx eax,byte ptr fs:[51h]

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: ati2mtag+105a30

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: ati2mtag

 

IMAGE_NAME: ati2mtag.sys

 

BUCKET_ID: WRONG_SYMBOLS

 

Followup: MachineOwner

---------

 

[Kolobos]

Zainstaluj nowsze lub starsze sterowniki do kary graficznej. Do tego aktualizacje do systemu.

[fumfel]

....zainstalowałem najnowsze stery do grafiki... i po problemie 8O WIELKIE DZIĘKI Kolobos. Wygląda na to, że bez sensu się upierałem, mogliśmy rozwiązać problem parę dni wczesniej.... i owiele mniej stresu by mnie to kosztowało 8O

 

Tylko niewytłumaczalne dla mnie jest jedno: skąd to się wzięło?! W sterownikach nic nie zmieniałem, aktualizacje mam włączone i ściągają się na bieżąco (może to spowodowało jakąś nieporządaną zmiane w systemie i wysypki). Druga sprawa to ten wirus który Norton wykrył, zneutralizował i po tym zaczęły się problemy... a co z systemem który został postawiony na sformatowanej na nowo partycji i po zainstalowaniu sterowników do karty z oryginalnej płyty dalej zwis co 20 minut!!! Wcześniej nigdy nie miałem takich objawów (żadnych niebieskich ekranów). Piszę może trochę chaotycznie....ale nic to.... trzy dni pracy bez zwisów.... SIELANKA :)

 

Dziękuję bardzo i pozdrawiam.