przez wiedzma 05 Sty 2009, 19:19
przez Mike 05 Sty 2009, 19:24
przez Lukesh 05 Sty 2009, 19:35
przez wiedzma 05 Sty 2009, 19:38
ComboFix 09-01-05.01 - Dom 2009-01-05 17:14:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.254.71 [GMT 1:00]
Uruchomiony z: c:\program files\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll
c:\windows\system\msvbvm60.dll
c:\windows\system32\ddr.exe
c:\windows\system32\drivers\tdssserv.sys
D:\Autorun.inf
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-05 do 2009-01-05 )))))))))))))))))))))))))))))))
.
2009-01-05 17:07 . 2009-01-05 17:07 2,888,371 -ra------ c:\program files\ComboFix.exe
2009-01-03 15:51 . 2009-01-03 15:50 121,184 -r-hs---- C:\wqesvxa.exe
2009-01-03 15:50 . 2008-12-27 13:57 115,669 -r-hs---- C:\e8kj.exe
2009-01-03 15:50 . 2009-01-03 15:50 84,992 -r-hs---- c:\windows\system32\kav320.dll
2009-01-03 15:50 . 2009-01-03 16:25 84,992 -r-hs---- c:\windows\system32\cvnmhg0.dll
2008-12-29 15:44 . 2008-12-29 15:44 <DIR> d-------- c:\program files\Lavasoft
2008-12-29 15:43 . 2008-12-29 15:43 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-28 22:55 . <DIR> c:\documents and settings\Gość\Pulpit
2008-12-28 22:55 . <DIR> c:\documents and settings\Gość\Menu Start
2008-12-28 22:55 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Identities
2008-12-28 22:55 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Adobe
2008-12-22 04:26 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Gadu-Gadu
2008-12-22 03:19 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Mozilla
2008-12-22 03:17 . <DIR> c:\documents and settings\Gość\Gadu-Gadu
2008-12-22 03:17 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Macromedia
2008-12-22 02:10 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Tibia
2008-12-22 02:02 . <DIR> c:\documents and settings\Gość\Ustawienia lokalne
2008-12-22 02:02 . <DIR> c:\documents and settings\Gość\Ulubione
2008-12-22 02:02 . <DIR> c:\documents and settings\Gość\Szablony
2008-12-22 02:02 . <DIR> c:\documents and settings\Gość\Dane aplikacji\Microsoft
2008-12-22 02:02 . <DIR> c:\documents and settings\Gość\Dane aplikacji
2008-12-22 02:02 . 2008-12-28 23:01 <DIR> d-------- c:\documents and settings\Go†
2008-12-08 19:31 . 2008-12-07 19:08 659,978 --a------ c:\windows\_detmp.1
2008-12-07 19:03 . 2008-12-08 19:32 <DIR> d-------- C:\Stupid Invaders
2008-12-07 19:02 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe
2008-12-05 16:49 . 2008-12-05 16:49 0 --a------ c:\windows\nsreg.dat
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 21:30 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\skypePM
2009-01-03 18:29 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\Skype
2009-01-02 19:31 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\Tlen.pl
2008-12-29 12:57 --------- d-----w c:\program files\Free Audio Pack
2008-12-28 22:45 --------- d-----w c:\program files\SkanerOnline
2008-12-20 11:23 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\Tibia
2008-12-18 22:02 --------- d-----w c:\program files\Google
2008-12-12 07:00 --------- d-----w c:\program files\Nokia
2008-11-26 16:54 --------- d-----w c:\program files\Tlen.pl
2008-11-26 16:54 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Tlen.pl
2008-11-26 16:17 --------- d-----w c:\program files\ArcaMicroScan
2008-11-26 14:37 --------- d-----w c:\program files\CodeStuff
2008-11-19 17:57 --------- d-----w c:\program files\Gadu-Gadu
2008-11-18 15:46 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-17 20:01 --------- d-----w c:\program files\Odkurzacz
2008-11-17 19:19 --------- d-----w c:\program files\eMule
2008-11-17 18:38 15,083,520 ----a-w c:\program files\spybotsd160.exe
2008-11-17 18:26 7,217,599 ----a-w c:\program files\odk11.3.0808setup.exe
2008-11-09 11:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-09 11:22 --------- d-----w c:\program files\Netropa
2008-10-21 11:23 13,824 ----a-w c:\program files\RemoveWGA.exe
2008-09-16 16:58 13,135,464 ----a-w c:\program files\MPsetup.exe
2008-05-29 18:07 36,125,344 ----a-w c:\program files\Nero-6.6.1.15d_wch.exe
2008-05-29 17:46 1,251,248 ----a-w c:\program files\Nero-6.6.1.15_plk.exe
2008-05-11 15:42 295,936 ----a-w c:\windows\inf\isprnt.exe
2008-03-31 17:54 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
2008-03-05 16:30 9,347,728 ----a-w c:\program files\winamp552_full_pl-pl.exe
2008-03-04 19:57 4,349,168 ----a-w c:\program files\gg77.exe
2008-09-14 14:10 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
2008-09-14 14:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-09-14 14:09 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008091420080915\index.dat
2008-09-14 14:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "c:\program files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2008-05-29 57344]
[HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-18 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"arp"="c:\ARP.EXE" [2008-04-17 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]lsdelete
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Tlen.pl\\tlen.exe"=
"c:\\Program Files\\gg77.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20947:TCP"= 20947:TCP:BitComet 20947 TCP
"20947:UDP"= 20947:UDP:BitComet 20947 UDP
"26203:TCP"= 26203:TCP:BitComet 26203 TCP
"26203:UDP"= 26203:UDP:BitComet 26203 UDP
"17658:TCP"= 17658:TCP:BitComet 17658 TCP
"17658:UDP"= 17658:UDP:BitComet 17658 UDP
"8303:TCP"= 8303:TCP:BitComet 8303 TCP
"8303:UDP"= 8303:UDP:BitComet 8303 UDP
"18160:TCP"= 18160:TCP:BitComet 18160 TCP
"18160:UDP"= 18160:UDP:BitComet 18160 UDP
"7343:TCP"= 7343:TCP:BitComet 7343 TCP
"7343:UDP"= 7343:UDP:BitComet 7343 UDP
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-02 78416]
R1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\drivers\Msikbd2k.sys [2008-11-09 6656]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [2008-03-12 10343168]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);c:\windows\system32\drivers\zebrceb.sys [2008-03-24 41792]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-02 20560]
R4 nhksrv;Netropa NHK Server;c:\program files\Netropa\Multimedia Keyboard\nhksrv.exe [2008-11-09 28672]
S0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys --> c:\windows\system32\Drivers\avgrkx86.sys [?]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys --> c:\windows\system32\Drivers\avgldx86.sys [?]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys --> c:\windows\system32\DRIVERS\avgfwdx.sys [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys --> c:\windows\system32\DRIVERS\avgfwdx.sys [?]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [2008-03-24 58288]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [2008-03-24 8336]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [2008-03-24 94064]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [2008-03-24 85408]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [2008-03-24 83344]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S4 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys --> c:\windows\system32\Drivers\avgtdix.sys [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38905fec-0b15-11dd-84ba-0007e992ab10}]
\Shell\Auto\command - activexdebugger32.exe f
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - activexdebugger32.exe f
\Shell\open\Command - activexdebugger32.exe f
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41049b74-96ad-11dd-86d9-85af5140af36}]
\Shell\AutoRun\command - F:\6x8be16.cmd
\Shell\explore\Command - F:\6x8be16.cmd
\Shell\open\Command - F:\6x8be16.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{550196ec-bcb7-11dd-8750-881bc3157635}]
\Shell\AutoRun\command - F:\6x8be16.cmd
\Shell\explore\Command - F:\6x8be16.cmd
\Shell\open\Command - F:\6x8be16.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0edfd2f-d1ca-11dd-8797-c15d2e970835}]
\Shell\AutoRun\command - F:\wqesvxa.exe
\Shell\open\Command - F:\wqesvxa.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe9f3dd1-ed14-11dc-8457-0007e992ab10}]
\Shell\AutoRun\command - xlu8a8sy.exe
\Shell\explore\Command - xlu8a8sy.exe
\Shell\open\Command - xlu8a8sy.exe
.
Zawartość folderu 'Zaplanowane zadania'
2009-01-04 c:\windows\Tasks\User_Feed_Synchronization-{545855CE-75B6-4EAE-B92E-5049C185CAE9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-neth - c:\NETH.EXE
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
c:\windows\system32\ArcaMicroScanUpdater.exe - c:\windows\system32\ArcaOnlineUninstall.exe
c:\windows\system32\ArcaOnline.dll
O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D}
hxxp://arcaonline.arcabit.com/ArcaOnline.cab
c:\windows\Downloaded Program Files\ArcaOnline.inf
c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll
O16 -: {68282C51-9459-467B-95BF-3C0E89627E55}
hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
c:\windows\Downloaded Program Files\SkanerOnline.inf
c:\windows\Downloaded Program Files\Mahjong.dll - O16 -: {E23FABEE-12E3-33DA-DA12-195DAC123984}
hxxp://67.15.101.33/g_bin/pl/mahjong_2_0_0_31.cab
c:\windows\Downloaded Program Files\Mahjong.inf
FF - ProfilePath - c:\documents and settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\ycjv3o38.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMAHJONG.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-05 17:18:01
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2009-01-05 17:20:40
ComboFix-quarantined-files.txt 2009-01-05 16:20:10
Przed: 30˙999˙171˙072 bajt˘w wolnych
Po: 31,094,865,920 bajt˘w wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
216 --- E O F --- 2008-12-17 21:26:53
Lukesh napisał(a):Urządzenie służące do odinstalowania programu avast!
No ale tak jak napisal Mike - logi rowniez wrzuc na forum
przez Lukesh 05 Sty 2009, 19:43
przez wojtas 05 Sty 2009, 19:56
File::
C:\wqesvxa.exe
C:\e8kj.exe
c:\windows\system32\kav320.dll
c:\windows\system32\cvnmhg0.dll
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\aswFsBlk.sys
Folder::
c:\program files\AskTBar
c:\progra~1\ALWILS~1
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"=-
"arp"="-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38905fec-0b15-11dd-84ba-0007e992ab10}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41049b74-96ad-11dd-86d9-85af5140af36}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{550196ec-bcb7-11dd-8750-881bc3157635}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0edfd2f-d1ca-11dd-8797-c15d2e970835}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe9f3dd1-ed14-11dc-8457-0007e992ab10}]
Driver::
aswFsBlk
aswSP
przez wiedzma 05 Sty 2009, 20:07
Lukesh napisał(a):No to wejdz w tryb awaryjny innym sposobem:
start >> uruchom >> msconfig >> zakładka BOOT.INI >> i zaznacz /SAFEBOOT
zapisz zmiany i OK
Po restarcie system uruchomi sie w trybie awaryjnym.
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 21 gości
