przez el_banano 01 Wrz 2009, 22:51
Witam, mam ten sam problem z figaro.sys i całym tym badziewiem. Uruchomiłem comboFixa, a oto log:
ComboFix 09-09-01.04 - Banan 2009-09-01 22:38.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1014.558 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Banan\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Banan\Dane aplikacji\wiaserva.log
c:\documents and settings\Banan\delself.bat
c:\documents and settings\Banan\Menu Start\Programy\Autostart\ikowin32.exe
c:\documents and settings\Banan\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\system32\braviax.exe
c:\windows\system32\msconfig.exe
c:\windows\system32\trz14.tmp
c:\windows\system32\wisdstr.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2009-08-01 do 2009-09-01 )))))))))))))))))))))))))))))))
.
2009-08-28 19:04 . 2009-08-28 19:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-28 19:03 . 2009-08-28 19:03 -------- d-----w- c:\program files\HD Tune
2009-08-28 19:03 . 2009-08-28 19:03 -------- d-----w- c:\program files\WinPcap
2009-08-28 19:03 . 2009-08-28 19:03 -------- d-----w- c:\program files\Bonjour
2009-08-03 21:15 . 2009-06-17 07:51 781435 ----a-w- c:\documents and settings\Banan\Dane aplikacji\Mozilla\Firefox\Profiles\d4z9i1d0.default\extensions\firedownload@mozilla.org\Download.dll
2009-08-03 21:15 . 2009-05-07 10:49 22528 ----a-w- c:\documents and settings\Banan\Dane aplikacji\Mozilla\Firefox\Profiles\d4z9i1d0.default\extensions\firedownload@mozilla.org\components\firedownload.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 08:15 . 2009-07-16 20:17 -------- d-----w- c:\documents and settings\Banan\Dane aplikacji\Skype
2009-08-29 08:13 . 2009-07-16 20:20 -------- d-----w- c:\documents and settings\Banan\Dane aplikacji\skypePM
2009-08-28 19:03 . 2009-03-22 17:02 -------- d-----w- c:\program files\iPlus
2009-08-28 19:03 . 2009-03-22 17:02 -------- d-----w- c:\documents and settings\Banan\Dane aplikacji\iPlus
2009-08-27 20:03 . 2009-09-01 20:38 43520 ------w- c:\documents and settings\Banan\trz16.tmp
2009-08-27 20:03 . 2009-09-01 20:39 43520 ------w- c:\windows\system32\trz17.tmp
2009-08-24 22:32 . 2009-03-22 14:05 -------- d-----w- c:\documents and settings\Banan\Dane aplikacji\AIMP
2009-07-29 09:45 . 2009-07-29 09:41 -------- d-----w- c:\program files\SeaTools Enterprise
2009-07-16 20:20 . 2009-07-16 20:20 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-07-16 20:17 . 2009-07-16 20:16 -------- d-----r- c:\program files\Skype
2009-07-16 20:16 . 2009-07-16 20:16 -------- d-----w- c:\program files\Common Files\Skype
2009-07-16 20:16 . 2009-07-16 20:16 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Skype
.
------- Sigcheck -------
[-] 2008-07-25 18:37 487424 5F1CCDF37F28A88D0473B0C9EA1E0D58 c:\windows\system32\user32.dll
[-] 2008-07-25 18:05 361600 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3 c:\windows\system32\drivers\tcpip.sys
[-] 2008-07-25 18:29 1528832 B49A80A502FD86B2F05BC7BBD723DDAB c:\windows\explorer.exe
[-] 2008-07-25 18:28 40448 0277E1A3E8B337555A45943808451981 c:\windows\system32\ctfmon.exe
[-] 2008-07-25 18:27 1526784 9994E5A07D951FC1B0F5FB18501090FC c:\windows\system32\comres.dll
[-] 2008-07-25 18:27 689152 8CD81261DA6BD4BCFBD857A25220A1FB c:\windows\system32\comctl32.dll
[7] 2001-08-18 07:37 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-14 20:29 1054208 737739FACEAD60683AA8D7FF7602FD14 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-07-24 20:56 27136 C51B4A5C05A5475708E3C81C7765B71D c:\windows\system32\mspmsnsv.dll
[-] 2008-07-25 17:16 1571840 AD58E980CBCC1B8980D16D91408EB57A c:\windows\system32\sfcfiles.dll
c:\windows\system32\msgsvc.dll ... - brak elementu !!
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"LClock"="c:\program files\LClock\lclock.exe" [2004-09-19 65536]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 45056]
"iPlusManager"="c:\program files\iPlus\iPlusChecker.exe" [2009-05-06 438272]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-04 148888]
"HD Tune"="c:\progra~1\HDTUNE~1\HDTune.exe" [2008-02-09 401408]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-04-10 16861184]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
c:\documents and settings\Banan\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-4-7 1773568]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2009-03-22 14:15 176128 ----a-w- c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0aswBoot.exe /M:6803ab36
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-22 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-22 20560]
R2 GtDetectSc;GtDetectSc Service;c:\program files\iPlus\Drivers\Driver2k\GTMax\GtDetectSc.exe [2009-03-22 204800]
R2 GtFlashSwitch;GtFlashSwitch Service;c:\program files\iPlus\Drivers\Driver2k\GTMax\GtFlashSwitch.exe [2009-03-22 204800]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-08-02 32512]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Zawartość folderu 'Zaplanowane zadania'
2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-mset - c:\documents and settings\Banan\mset.exe
HKLM-Run-mset - c:\windows\system32\mset.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Banan\Dane aplikacji\Mozilla\Firefox\Profiles\d4z9i1d0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl
FF - component: c:\documents and settings\Banan\Dane aplikacji\Mozilla\Firefox\Profiles\d4z9i1d0.default\extensions\firedownload@mozilla.org\components\firedownload.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Banan\Dane aplikacji\Mozilla\Firefox\Profiles\d4z9i1d0.default\extensions\npdevalvr@devalvr.com\plugins\npdevalvr.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 22:43
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-507921405-1592454029-515967899-1001\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE]
"GameDir"="c:\\Documents and Settings\\Banan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\games"
"ShortlistDir"=""
"ScreenshotsDir"="c:\\Documents and Settings\\Banan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009"
"SaveDir"="c:\\Documents and Settings\\Banan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\"
"HistoryDir"="c:\\Program Files\\Sports Interactive\\Football Manager 2009\\scout\\FM Genie Scout 2009 XE\\History Points"
"LangDB"="c:\\Program Files\\Sports Interactive\\Football Manager 2009\\data\\db\\900\\lang_db.dat"
"LastSaveGame"="c:\\Documents and Settings\\Banan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\games\\Bez nazwy.fm"
"Language"="English"
"LoadLangDB"=dword:00000001
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"SkinName"="Champions League"
"LastUpdateCheck"=dword:00000000
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"Version"=dword:00000066
"UniqueID"="C4-70FF-C5BF"
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""
[HKEY_USERS\S-1-5-21-507921405-1592454029-515967899-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(1308)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
c:\windows\system32\COMRes.dll
- - - - - - - > 'lsass.exe'(1364)
c:\windows\system32\setupapi.dll
.
Czas ukończenia: 2009-09-01 22:45
ComboFix-quarantined-files.txt 2009-09-01 20:45
Przed: 45 244 928 000 bajtów wolnych
Po: 46 181 793 792 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /noexecute=alwaysoff
199 --- E O F --- 2009-03-22 12:47
Z góry dziękuje wszystkim za pomoc.
Pozdrawiam
