Prosba o sprawdzenie loga.

[hef44]

Pojawił się poblem z winlogon.exe combofix usunął plik jednak nie jestem pewien czy komputer jest bezpieczny. W międzyczasie konto z popularnej gry online zostało opróżnione.

 

Log:

 

ComboFix 10-09-12.04 - Karol_2 2010-09-13 16:40:44.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2047.1615 [GMT 2:00]

Uruchomiony z: c:\documents and settings\Karol_2\Moje dokumenty\Downloads\ComboFix.exe

AV: ESET Smart Security 4.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Zapora osobista *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

* Rezydentny antywirus jest aktywny

 

.

 

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\Karol_2\Menu Start\Programy\Autostart\rundlll.exe

c:\windows\winlogon.exe

F:\Autorun.inf

F:\install.exe

 

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_AVPsys

 

 

((((((((((((((((((((((((( Pliki utworzone od 2010-08-13 do 2010-09-13 )))))))))))))))))))))))))))))))

.

 

2010-10-21 12:08 . 2010-06-08 09:29 52224 ------w- c:\documents and settings\Karol_2\Dane aplikacji\Mozilla\Firefox\Profiles\gm2u0hii.default\extensions\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}\components\FFExternalAlert.dll

2010-10-21 12:08 . 2010-06-08 09:29 101376 ------w- c:\documents and settings\Karol_2\Dane aplikacji\Mozilla\Firefox\Profiles\gm2u0hii.default\extensions\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}\components\RadioWMPCore.dll

2010-10-18 19:58 . 2010-10-18 19:58 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\Capcom

2010-10-18 18:44 . 2010-10-18 18:44 -------- d-----w- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\FlatOut Ultimate Carnage

2010-10-18 18:43 . 2010-10-18 18:43 -------- d-----w- c:\windows\system32\xlive

2010-10-03 13:19 . 2010-10-03 13:19 9040 ---ha-w- c:\windows\system32\mlfcache.dat

2010-10-03 13:09 . 2010-09-04 10:19 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\mIRC

2010-09-24 15:20 . 2010-09-24 15:20 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe

2010-09-12 09:38 . 2010-09-12 09:38 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\InstallShield

2010-09-12 06:33 . 2010-09-12 06:33 -------- d-----w- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\DNA

2010-09-12 06:33 . 2010-09-13 14:44 -------- d-----w- c:\program files\DNA

2010-09-12 06:33 . 2010-09-13 14:44 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\DNA

2010-09-11 10:50 . 2005-01-04 09:43 4682 ----a-w- c:\windows\system32\npptNT2.sys

2010-09-11 10:49 . 2010-09-11 10:49 -------- d-----w- c:\program files\Common Files\INCA Shared

2010-09-04 07:08 . 2010-09-04 07:08 -------- d-----w- c:\program files\Gameforge4D

2010-09-02 19:02 . 2010-09-02 19:02 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-09-02 19:02 . 2010-09-13 14:28 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\skypePM

2010-09-02 03:34 . 2010-09-02 03:34 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\FaxCtr

2010-09-01 16:32 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2010-09-01 16:32 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2010-09-01 16:32 . 2001-10-26 15:29 87040 -c--a-w- c:\windows\system32\dllcache\wiafbdrv.dll

2010-09-01 16:32 . 2001-10-26 15:29 87040 ----a-w- c:\windows\system32\wiafbdrv.dll

2010-09-01 15:17 . 2010-09-01 16:39 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\Lexmark Productivity Studio

2010-09-01 14:42 . 2007-12-10 19:33 12288 ----a-w- c:\windows\system32\LXF3PMRC.DLL

2010-09-01 14:42 . 2007-11-01 14:29 45056 ----a-w- c:\windows\system32\LXF3PMON.DLL

2010-09-01 14:42 . 2007-11-01 14:28 32768 ----a-w- c:\windows\system32\LXF3FXPU.DLL

2010-09-01 14:42 . 2007-08-27 17:44 53248 ----a-w- c:\windows\system32\lxf3oem.dll

2010-09-01 14:42 . 2007-05-02 02:05 98345 ----a-w- c:\windows\system32\IMHOST32.DLL

2010-09-01 14:42 . 2007-05-02 02:05 339968 ----a-w- c:\windows\system32\IMGMAN32.DLL

2010-09-01 14:42 . 2010-09-01 14:42 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\FaxCtr

2010-09-01 14:32 . 2004-08-03 21:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys

2010-09-01 14:32 . 2004-08-03 21:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-09-01 14:30 . 2004-08-03 21:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2010-09-01 14:30 . 2004-08-03 21:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2010-09-01 09:07 . 2010-09-01 09:07 -------- d-----w- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\Help

2010-09-01 05:55 . 2010-09-01 05:55 -------- d-----w- C:\found.000

2010-08-29 17:21 . 2010-09-13 14:28 -------- d-----w- c:\documents and settings\Karol_2\Dane aplikacji\Skype

2010-08-29 17:21 . 2010-08-29 17:21 -------- d-----w- c:\program files\Common Files\Skype

2010-08-29 17:21 . 2010-08-29 17:21 -------- d-----r- c:\program files\Skype

2010-08-29 17:21 . 2010-08-29 17:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Skype

2010-08-26 17:17 . 2010-08-26 17:17 -------- d--h--w- c:\windows\system32\GroupPolicy

2010-08-26 16:36 . 2010-08-26 16:36 249856 ------w- c:\windows\Setup1.exe

2010-08-26 16:36 . 2010-08-26 16:36 73216 ----a-w- c:\windows\ST6UNST.EXE

2010-08-26 10:18 . 2010-09-12 09:37 -------- d-----w- c:\program files\CS

2010-08-22 09:10 . 2010-09-12 09:35 -------- d-----w- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\Conduit

2010-08-22 09:10 . 2010-08-22 09:10 -------- d-----w- c:\program files\Conduit

2010-08-22 09:10 . 2009-05-31 16:45 51200 ----a-w- c:\documents and settings\Karol_2\Dane aplikacji\Mozilla\Firefox\Profiles\gm2u0hii.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\FFExternalAlert.dll

2010-08-22 09:10 . 2009-05-31 16:45 114688 ----a-w- c:\documents and settings\Karol_2\Dane aplikacji\Mozilla\Firefox\Profiles\gm2u0hii.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}\components\npmozax.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-28 08:52 . 2010-01-13 07:21 -------- d-----w- c:\program files\Gadu-Gadu 10

2010-09-12 09:37 . 2009-05-17 15:25 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-09-11 11:38 . 2009-08-31 10:12 14008 ----a-w- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2010-09-11 10:26 . 2009-05-17 15:55 -------- d-----w- c:\program files\Common Files\Adobe

2010-09-07 13:00 . 2009-05-24 16:16 -------- d-----w- c:\program files\Real Alternative

2010-08-21 15:00 . 2009-07-03 15:24 -------- d-----w- c:\program files\XviD

2010-08-17 08:59 . 2001-10-26 17:15 82010 ----a-w- c:\windows\system32\perfc015.dat

2010-08-17 08:59 . 2001-10-26 17:15 484634 ----a-w- c:\windows\system32\perfh015.dat

2010-08-16 06:06 . 2010-07-24 04:44 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-08-13 09:09 . 2009-05-17 16:06 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-08-13 09:09 . 2009-05-17 16:06 348160 ----a-w- c:\windows\system32\msvcr71.dll

2010-08-02 22:25 . 2009-05-17 15:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-07-28 11:14 . 2009-05-28 16:40 -------- d-----w- c:\program files\Codec Pack - All In 1

2010-07-26 18:32 . 2010-07-26 18:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10

2010-07-24 04:33 . 2010-07-24 04:33 -------- d-----w- c:\program files\Norton Security Scan

2010-07-24 04:33 . 2010-07-24 04:33 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Symantec

2010-07-24 04:33 . 2010-07-24 04:33 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Norton

2010-07-24 04:33 . 2010-07-24 04:33 -------- d-----w- c:\program files\NortonInstaller

2010-07-24 04:33 . 2010-07-24 04:33 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NortonInstaller

2010-07-21 23:23 . 2010-07-21 23:23 397312 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.3.dll

.

 

------- Sigcheck -------

 

[-] 2007-12-13 . 1A3B01CFF31B660EB43F228F4C468273 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

"Google Update"="c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-09-09 133104]

"Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2010-07-21 12477024]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2010-09-12 323392]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-02 17530368]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-19 13680640]

"nwiz"="nwiz.exe" [2009-02-19 1657376]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-19 86016]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

 

c:\documents and settings\Karol_2\Menu Start\Programy\Autostart\

nssvc32.exe [2010-8-2 208990]

winfirewall.exe [2010-8-2 244585]

 

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

REALTEK RTL8185 Wireless LAN Utility.lnk - c:\program files\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWlan.exe [2010-1-27 675840]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WiseStubReboot]

MSIEXEC [X]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 02:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

2007-06-25 06:47 1057064 ----a-w- c:\program files\Nero\Nero 7\InCD\InCD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2008-03-17 09:05 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]

2007-06-25 06:47 1629480 ----a-w- c:\program files\Nero\Nero 7\InCD\NBHGui.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-10-11 03:17 149280 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"UPS"=3 (0x3)

"TapiSrv"=3 (0x3)

"Spooler"=2 (0x2)

"SharedAccess"=2 (0x2)

"Schedule"=2 (0x2)

"lanmanserver"=2 (0x2)

"Eventlog"=2 (0x2)

"ERSvc"=2 (0x2)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256]

R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]

R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-09-08 13532]

S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-05-17 1684736]

S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-05-17 717296]

 

--- Inne Usługi/Sterowniki w Pamięci ---

 

*NewlyCreated* - SJYPKT

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Zawartość folderu 'Zaplanowane zadania'

 

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1993962763-725345543-1005Core1cb5cea869b6668.job

- c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-09-09 11:45]

 

2010-07-24 c:\windows\Tasks\Norton Security Scan for Karol_2.job

- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-24 10:50]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1708250

mStart Page = ${URL_STARTPAGE}

.

- - - - USUNIĘTO PUSTE WPISY - - - -

 

MSConfigStartUp-ALLUpdate - c:\program files\ALLPlayer\ALLUpdate.exe

MSConfigStartUp-Google Update - c:\documents and settings\Karol\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-09-13 16:44

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

 

- - - - - - - > 'explorer.exe'(2300)

c:\windows\system32\shdoclc.dll

c:\windows\system32\msi.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\program files\Nero\Nero 7\InCD\InCDsrv.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\wscntfy.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe

c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

c:\documents and settings\Karol_2\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.183.29\GoogleCrashHandler.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Czas ukończenia: 2010-09-13 16:46:57 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2010-09-13 14:46

 

Przed: 16 088 764 416 bajtów wolnych

Po: 16 009 019 392 bajtów wolnych

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

 

- - End Of File - - B1C984193832DDB654E915B456994A0D