Prosba O Sprawdzenie Loga

[hef44]

Prosze o sprawdzenie niniejszego loga 8O

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "ComboFix log."

ComboFix 09-07-09.08 - Aneta 2009-07-11 14:44.2.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1637 [GMT 2:00]

Uruchomiony z: c:\documents and settings\Aneta\Pulpit\ComboFix.exe

AV: avast! antivirus 4.8.1169 [VPS 090706-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\9vlgaqms.cmd

C:\autorun.inf

C:\p.exe

c:\program files\Norton2009Reset.exe

c:\winnt\AhnRpta.exe

c:\winnt\system32\e8main0.dll

c:\winnt\system32\e8main1.dll

D:\9vlgaqms.cmd

D:\Autorun.inf

E:\9vlgaqms.cmd

E:\autorun.inf

F:\9vlgaqms.cmd

F:\autorun.inf

G:\9vlgaqms.cmd

G:\autorun.inf

 

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_.norton2009Reset

-------\Service_AVPsys

 

 

((((((((((((((((((((((((( Pliki utworzone od 2009-06-11 do 2009-07-11 )))))))))))))))))))))))))))))))

.

 

2009-07-09 09:07 . 2009-07-07 18:05 107332 --sh--r- C:\q1alx.exe

2009-07-07 17:56 . 2009-06-30 07:28 108386 --sh--r- C:\2nuk.com

2009-07-05 15:49 . 2008-03-29 17:29 23152 ----a-w- c:\winnt\system32\drivers\aswRdr.sys

2009-07-05 15:49 . 2008-03-29 17:27 42912 ----a-w- c:\winnt\system32\drivers\aswTdi.sys

2009-07-05 15:49 . 2008-03-29 17:26 26944 ----a-w- c:\winnt\system32\drivers\aavmker4.sys

2009-07-05 15:49 . 2008-03-29 17:23 95608 ----a-w- c:\winnt\system32\AvastSS.scr

2009-07-05 15:49 . 2008-03-29 17:35 20560 ----a-w- c:\winnt\system32\drivers\aswFsBlk.sys

2009-07-05 15:49 . 2008-03-29 17:35 94544 ----a-w- c:\winnt\system32\drivers\aswmon2.sys

2009-07-05 15:49 . 2008-03-29 17:31 75856 ----a-w- c:\winnt\system32\drivers\aswSP.sys

2009-07-05 15:49 . 2008-01-17 15:34 93264 ----a-w- c:\winnt\system32\drivers\aswmon.sys

2009-07-05 15:49 . 2008-03-29 17:45 1146232 ----a-w- c:\winnt\system32\aswBoot.exe

2009-07-02 16:48 . 2009-07-02 16:48 -------- d-----w- c:\documents and settings\Aneta\Ustawienia lokalne\Dane aplikacji\Ahead

2009-06-19 21:01 . 2009-06-19 21:01 -------- d-----w- c:\documents and settings\Aneta\Dane aplikacji\CyberLink

2009-06-13 09:21 . 2009-06-13 09:21 -------- d-----w- c:\documents and settings\Aneta\Dane aplikacji\TreeCardGames

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-26 18:01 . 2009-04-16 20:39 -------- d-----w- c:\documents and settings\Aneta\Dane aplikacji\uTorrent

2009-06-23 18:32 . 2001-10-26 18:15 91506 ----a-w- c:\winnt\system32\perfc015.dat

2009-06-23 18:32 . 2001-10-26 18:15 505818 ----a-w- c:\winnt\system32\perfh015.dat

2009-06-05 21:50 . 2009-06-04 21:24 456736 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat

2009-06-05 13:56 . 2009-06-05 13:55 -------- d-----w- c:\program files\AGEIA Technologies

2009-06-05 13:55 . 2009-06-05 13:55 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-06-03 14:49 . 2009-01-13 14:37 70768 ----a-w- c:\documents and settings\Aneta\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-06-03 14:43 . 2009-06-03 14:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-06-03 14:43 . 2009-02-06 11:49 -------- d-----w- c:\program files\iTunes

2009-06-03 14:43 . 2009-06-03 14:43 -------- d-----w- c:\program files\iPod

2009-06-03 14:43 . 2009-02-06 11:48 -------- d-----w- c:\program files\Common Files\Apple

2009-06-03 14:42 . 2009-06-03 14:41 -------- d-----w- c:\program files\QuickTime

2009-06-03 14:41 . 2009-06-03 14:41 -------- d-----w- c:\program files\Apple Software Update

2009-05-30 20:57 . 2009-03-17 19:40 410984 ----a-w- c:\winnt\system32\deploytk.dll

2009-05-30 20:57 . 2009-05-30 20:57 -------- d-----w- c:\program files\Java

2009-05-30 20:56 . 2009-05-30 20:56 152576 ----a-w- c:\documents and settings\Aneta\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll

2009-05-30 20:06 . 2009-05-30 20:06 -------- d-----w- c:\documents and settings\Aneta\Dane aplikacji\Inkscape

2009-05-30 20:03 . 2009-05-30 19:57 -------- d-----w- c:\program files\Inkscape

2009-05-30 10:50 . 2009-05-30 10:50 75048 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

2009-05-28 13:51 . 2009-05-28 13:51 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BIFAB

2009-05-27 19:31 . 2009-05-27 19:31 -------- d-----w- c:\program files\SopCast

2009-05-24 16:35 . 2009-05-24 16:35 4096 ----a-w- c:\winnt\d3dx.dat

2009-05-24 15:52 . 2009-05-24 15:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\CyberLink

2009-05-24 15:52 . 2009-01-02 14:10 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-05-18 13:29 . 2009-05-18 13:29 -------- d-----w- c:\documents and settings\Aneta\Dane aplikacji\DAEMON Tools

2009-05-17 20:32 . 2009-05-17 20:32 -------- dc----w- c:\documents and settings\All Users\Dane aplikacji\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}

2009-05-14 18:43 . 2009-05-14 18:42 -------- dc-h--w- c:\documents and settings\All Users\Dane aplikacji\{92E7A367-8E12-4830-AA70-29C32E331A81}

2009-05-13 18:44 . 2009-05-13 18:44 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\TreeCardGames

2009-05-06 04:46 . 2009-05-06 04:46 413696 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Data.exe

2009-05-06 04:46 . 2009-05-06 04:46 413696 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Data.exe

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\winnt\system32\ctfmon.exe" [2008-04-14 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2005-05-25 6746112]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472]

"RemoteControl"="g:\dvd\PDVDServ.exe" [2004-11-02 32768]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-30 148888]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

"avast!"="g:\avast\ashDisp.exe" [2008-03-29 79224]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nlsf"="move" [X]

"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]

 

c:\documents and settings\Aneta\Menu Start\Programy\Autostart\

Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoFileAssociate"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"f:\\Fm 2009\\fm.exe"=

"f:\\torrent\\uTorrent.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

 

R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2009-07-05 75856]

R2 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2009-07-05 20560]

S3 7ByteIo;7ByteIo;\??\g:\hot cpu tester pro 4\SysInfo.sys --> g:\hot cpu tester pro 4\SysInfo.sys [?]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-24 33752]

S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\winnt\system32\drivers\s816bus.sys [2009-01-13 81832]

S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\winnt\system32\drivers\s816mdfl.sys [2009-01-13 13864]

S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\winnt\system32\drivers\s816mdm.sys [2009-01-13 107304]

S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\winnt\system32\drivers\s816mgmt.sys [2009-01-14 99112]

S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\winnt\system32\drivers\s816nd5.sys [2009-01-14 21928]

S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\winnt\system32\drivers\s816obex.sys [2009-01-14 97320]

S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\winnt\system32\drivers\s816unic.sys [2009-01-14 97704]

.

Zawartość folderu 'Zaplanowane zadania'

 

2009-07-06 c:\winnt\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.google.pl/

uInternet Settings,ProxyOverride = *.local

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-11 14:51

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'explorer.exe'(3952)

c:\winnt\system32\WPDShServiceObj.dll

c:\winnt\system32\PortableDeviceTypes.dll

c:\winnt\system32\PortableDeviceApi.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

g:\avast\aswUpdSv.exe

g:\avast\ashServ.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\winnt\system32\nvsvc32.exe

g:\avast\ashMaiSv.exe

g:\avast\ashWebSv.exe

c:\program files\iPod\bin\iPodService.exe

c:\winnt\system32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Czas ukończenia: 2009-07-11 14:53 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2009-07-11 12:53

ComboFix2.txt 2009-05-08 17:58

 

Przed: 14 224 666 624 bajtów wolnych

Po: 14 302 715 904 bajtów wolnych

 

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4

185 --- E O F --- 2009-01-04 11:04

[Kolobos]

Uzyj Flash Disinfector, usun z dysku: C:\q1alx.exe, C:\2nuk.com.