prosba o analize loga combofix

[Halfi]

ComboFix 10-03-08.02 - Domeradzki 2010-03-09 17:59:30.1.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.384.221 [GMT 1:00]

Uruchomiony z: c:\documents and settings\Domeradzki\Pulpit\ComboFix.exe

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\autorun.inf

c:\documents and settings\Domeradzki\Menu Start\PROTON+ 3.05 .lnk

c:\documents and settings\Domeradzki\Moje dokumenty\cc_20100309_115958.reg

c:\windows\system32\ieuinit.inf

c:\windows\system32\Thumbs.db

D:\autorun.inf

 

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_AVPsys

 

 

((((((((((((((((((((((((( Pliki utworzone od 2010-02-09 do 2010-03-09 )))))))))))))))))))))))))))))))

.

 

2010-03-09 16:53 . 2010-03-09 16:53 395776 ----a-w- c:\windows\system32\CF3475.exe

2010-03-09 16:30 . 2010-03-09 16:30 -------- d-----w- c:\program files\Trend Micro

2010-03-09 15:54 . 2010-03-09 15:54 -------- d-----w- c:\program files\SkanerOnline

2010-03-09 14:59 . 2010-03-09 14:59 -------- d-----w- c:\documents and settings\Domeradzki\Dane aplikacji\Malwarebytes

2010-03-09 14:59 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-09 14:59 . 2010-03-09 14:59 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes

2010-03-09 14:59 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-09 14:59 . 2010-03-09 14:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-03-09 13:35 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2010-03-09 13:35 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2010-03-09 13:35 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2010-03-09 13:34 . 2010-03-09 13:34 -------- d-----w- c:\program files\Avira

2010-03-09 13:34 . 2010-03-09 13:34 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Avira

2010-03-09 12:16 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-03-09 12:08 . 2010-03-09 12:08 -------- d-----w- c:\windows\system32\CatRoot_bak

2010-03-09 11:36 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll

2010-03-09 11:36 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll

2010-03-09 11:36 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll

2010-03-09 11:36 . 2010-02-02 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2010-03-09 11:36 . 2010-03-09 11:36 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-03-09 11:07 . 2010-03-09 11:07 -------- d-----w- c:\documents and settings\Domeradzki\Ustawienia lokalne\Dane aplikacji\Opera

2010-03-09 11:07 . 2010-03-09 11:07 -------- d-----w- c:\program files\Opera

2010-03-07 15:46 . 2010-03-07 15:46 -------- d-----w- c:\documents and settings\Gość

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-31 17:54 . 2010-01-31 17:54 -------- d-----w- c:\documents and settings\Domeradzki\Dane aplikacji\GlarySoft

2010-01-31 17:50 . 2010-01-31 17:50 -------- d-----w- c:\program files\Glary Utilities

2010-01-31 17:16 . 2010-01-31 17:16 -------- d-----w- c:\documents and settings\Domeradzki\Dane aplikacji\Tific

2010-01-31 16:47 . 2010-01-31 16:47 -------- d-----w- c:\program files\Windows Sidebar

2010-01-31 16:47 . 2010-01-31 16:47 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Norton

2010-01-31 16:45 . 2010-01-31 16:45 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NortonInstaller

2010-01-23 21:52 . 2009-12-27 17:27 79488 ----a-w- c:\documents and settings\Domeradzki\Dane aplikacji\Sun\Java\jre1.6.0_17\gtapi.dll

2010-01-17 17:57 . 2010-01-17 17:57 -------- d-----w- c:\program files\Common Files\Bcgsoft

2010-01-17 17:52 . 2010-01-17 17:52 -------- d-----w- c:\program files\SEE Building LT

2010-01-17 17:26 . 2010-01-17 17:26 -------- d-----w- c:\documents and settings\Domeradzki\Dane aplikacji\Bump Technologies, Inc

2009-12-12 14:15 . 2006-01-20 13:34 178176 ----a-w- c:\windows\system32\unrar.dll

2007-10-07 14:23 . 2007-10-07 14:24 774144 ----a-w- c:\program files\RngInterstitial.dll

2007-05-01 13:56 . 2007-05-01 13:56 14982136 ----a-w- c:\program files\setuppol.exe

2006-05-03 13:44 . 2006-05-03 13:44 172032 ----a-w- c:\program files\Onet-SkypeSetup.exe

2008-04-27 14:53 . 2008-04-27 14:53 23 --sha-w- c:\windows\system32\aeccbbffce_r.dll

.

 

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\documents and settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^STK014 PNP Monitor.lnk]

backup=c:\windows\pss\STK014 PNP Monitor.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^Domeradzki^Menu Start^Programy^Autostart^Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk]

path=c:\documents and settings\Domeradzki\Menu Start\Programy\Autostart\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk

backup=c:\windows\pss\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2005-11-10 12:03 36975 ----a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"ekrn"=2 (0x2)

"EhttpSrv"=3 (0x3)

"WMPNetworkSvc"=3 (0x3)

"ServiceLayer"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"Microsoft Office Groove Audit Service"=3 (0x3)

"MDM"=2 (0x2)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"wscsvc"=2 (0x2)

"clr_optimization_v2.0.50727_32"=3 (0x3)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Gadu-Gadu\\gg.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

 

R3 DCamUSBSTK014;STK014 Camera;c:\windows\system32\DRIVERS\STK014W2.sys [2003-07-15 99476]

R3 IrCOMM2k;Virtual IR COM Port;c:\windows\system32\DRIVERS\ircomm2k.sys [x]

R3 MA-660;Mobile Action MA-660 USB Infrared Adapter;c:\windows\system32\DRIVERS\MA-660.sys [2003-03-25 27136]

R3 NtApm;Sterownik interfejsu NT Apm/Legacy;c:\windows\system32\DRIVERS\NtApm.sys [2001-10-26 9600]

R4 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-03-19 107256]

S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-03-19 93848]

S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S2 port_nt;port_nt;c:\windows\system32\Drivers\port_nt.sys [2001-11-08 3912]

S3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [2003-04-08 820133]

 

.

Zawartość folderu 'Zaplanowane zadania'

 

2010-03-09 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2010-01-31 22:01]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.onet.pl/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

- - - - USUNIĘTO PUSTE WPISY - - - -

 

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

MSConfigStartUp-cdoosoft - c:\docume~1\DOMERA~1\USTAWI~1\Temp\herss.exe

MSConfigStartUp-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe

MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

MSConfigStartUp-SMSERIAL - sm56hlpr.exe

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

AddRemove-SiS7012 - c:\program files\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-03-09 18:13

Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]

@Denied: (Full) (Everyone)

"scansk"=hex(0):ea,d5,4a,be,00,ae,a2,6c,0f,6a,c0,96,64,eb,75,ef,a5,34,64,74,c7,

4e,d0,38,b7,66,3a,1e,89,44,cc,a2,9f,fe,60,5a,0d,9b,e6,fb,00,00,00,00,00,00,\

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{fe7820ee-11b6-49c5-bb90-8c1ae67570b1}]

@Denied: (Full) (Everyone)

"Model"=dword:0000001f

"Therad"=dword:0000001e

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,51,c4,5c,06,a5,56,2b,b8,8e,40,5c,bb,7e,5e,04,b3,83,e0,8b,c5,07,bb,\

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'explorer.exe'(2648)

c:\windows\system32\WPDShServiceObj.dll

c:\program files\ArcSoft\Software Suite\PhotoImpression\share\pihook.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Czas ukończenia: 2010-03-09 18:36:33 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2010-03-09 17:35

 

Przed: 6 683 246 592 bajtów wolnych

Po: 6 843 514 880 bajtów wolnych

 

- - End Of File - - 31A884EEF9BA70B9D60546DD1311317A

[Kolobos]

Zainstaluj KB971029 oraz uzyj Flash Disinfector.