Od jakiegoś czasu Kaspersky mi coś tam wyświetla że znalazł zagrożenia i je neutralizuje. Dość często się to pojawia, jakoś nie miałem czasu się tym dokładnie zająć, a coś czuje że cos mi w kompie "siedzi"
Aha i jeszcze przed kazdym zamkniecie systemu wyskakuje raport o błędzie explorer.exe.
Poniżej dwa logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:23, on 2008-02-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Lavasoft Ad-Aware 2007\aawservice.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Konnekt\konnekt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.stk.net.pl:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wbsys.dll,C:\PROGRA~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 7712 bytes
ComboFix 08-02.03.1 - RufuS 2008-02-03 9:37:49.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1466 [GMT 1:00]
Running from: C:\Program Files\HijackThis\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.
2008-01-23 17:12 . 2008-01-23 17:12 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-01-22 10:29 . 2008-01-22 10:29 <DIR> d-------- C:\Program Files\AVIcodec
2008-01-22 09:57 . 2008-01-22 18:53 <DIR> d-------- C:\Program Files\Easy RealMedia Tools
2008-01-18 12:42 . 2008-01-18 12:43 <DIR> d-------- C:\Program Files\PDFCreator
2008-01-18 12:42 . 2004-03-09 00:00 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX
2008-01-18 12:42 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
2008-01-18 12:42 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
2008-01-18 12:42 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
2008-01-18 12:35 . 2008-01-18 12:35 <DIR> d-------- C:\Program Files\gs
2008-01-18 12:31 . 2008-01-18 12:38 <DIR> d-------- C:\Program Files\WordToPDF
2008-01-18 12:31 . 2008-01-18 12:35 <DIR> d-------- C:\Documents and Settings\RufuS\Dane aplikacji\WordToPDF
2008-01-18 12:29 . 2008-01-18 12:29 <DIR> d-------- C:\Program Files\GetPictures2
2008-01-18 12:01 . 2001-10-29 01:42 116,224 --a------ C:\WINDOWS\system32\pdfmonnt.dll
2008-01-18 12:00 . 2008-01-18 12:00 <DIR> d-------- C:\WINDOWS\system32\psconv
2008-01-18 12:00 . 2008-01-18 12:00 <DIR> d-------- C:\Program Files\psconvert
2008-01-18 12:00 . 2008-01-18 12:00 164 --a------ C:\WINDOWS\system32\psconv.ini
2008-01-18 09:23 . 2008-01-18 09:23 <DIR> d-------- C:\Program Files\RouterControl
2008-01-18 09:23 . 2008-01-18 09:23 <DIR> d-------- C:\Documents and Settings\RufuS\Dane aplikacji\RouterControl
2008-01-18 09:23 . 2008-01-15 14:20 330,336 --a------ C:\WINDOWS\RCoUn0.exe
2008-01-18 09:23 . 2008-01-18 09:23 1,873 -r------- C:\WINDOWS\RouterControl_Uninstall.in
2008-01-17 21:50 . 2008-01-17 21:50 <DIR> d-------- C:\Program Files\Activision
2008-01-13 15:56 . 2008-01-13 15:57 <DIR> d-------- C:\Python24
2008-01-13 15:54 . 2008-01-13 16:17 <DIR> d-------- C:\Program Files\Tibia Auto
2008-01-13 12:39 . 2006-06-26 02:49 1,867,776 --a------ C:\WINDOWS\python24.dll
2008-01-13 12:18 . 2008-01-18 12:37 <DIR> d-------- C:\Program Files\WinHex
2008-01-11 21:11 . 2008-01-13 15:54 <DIR> d-------- C:\Program Files\Tibia
2008-01-11 21:11 . 2008-01-13 13:17 <DIR> d-------- C:\Documents and Settings\RufuS\Dane aplikacji\Tibia
2008-01-06 09:36 . 2008-01-06 09:36 <DIR> d-------- C:\Program Files\Peer2Mail
2008-01-03 23:23 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 08:48 37,526,304 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-03 08:37 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-02 23:28 792,608 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-02 23:28 503,228 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-02 23:28 45,584 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-02 23:15 --------- d-----w C:\Program Files\English Translator XT
2008-02-02 23:10 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\uTorrent
2008-02-02 21:03 --------- d-----w C:\Program Files\ALLPlayer
2008-02-02 19:30 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Skype
2008-02-02 13:57 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-02 13:57 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-02 09:58 --------- d-----w C:\Program Files\FlashGet
2008-02-02 07:42 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-23 21:05 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\OpenOffice.ux.pl2
2008-01-22 08:58 --------- d-----w C:\Program Files\AviSynth 2.5
2008-01-21 17:19 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-21 09:55 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\mIRC
2008-01-21 09:54 --------- d-----w C:\Program Files\mIRC
2008-01-18 08:20 --------- d-----w C:\Program Files\AutoConnect
2008-01-16 12:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-13 17:46 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\teamspeak2
2008-01-13 14:37 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-06 09:30 3,532 ----a-w C:\drmHeader.bin
2008-01-03 17:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-12-31 21:57 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Gadu-Gadu
2007-12-31 14:42 --------- d-----w C:\Program Files\AIMP2
2007-12-30 21:45 --------- d-----w C:\Program Files\WindowBlinds
2007-12-29 20:08 --------- d-----w C:\Program Files\Konnekt
2007-12-28 12:19 --------- d-----w C:\Program Files\FM Modifier 2.2
2007-12-28 10:46 --------- d-----w C:\Program Files\cFosSpeed
2007-12-27 09:28 --------- d-----w C:\Program Files\Adobe Photoshop CS2
2007-12-27 09:27 --------- d-----w C:\Program Files\PSCS2Updater
2007-12-27 09:25 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-27 09:24 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-12-27 09:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2007-12-25 20:18 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Thunderbird
2007-12-25 20:18 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Talkback
2007-12-20 20:27 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Hamachi
2007-12-20 17:46 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-20 17:46 --------- d-----w C:\Program Files\Hamachi
2007-12-19 06:30 --------- d-----w C:\Program Files\Kaspersky Internet Security 7.0
2007-12-16 09:19 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-16 09:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-12-15 19:23 --------- d-----w C:\Program Files\URUSoft
2007-12-15 11:55 --------- d-----w C:\Program Files\Deluxe Ski Jump 3
2007-12-14 07:28 --------- d-----w C:\Program Files\NAPI-PROJEKT
2007-12-10 19:21 --------- d-----w C:\Program Files\CoreEditor
2007-12-09 17:10 --------- d-----w C:\Documents and Settings\RufuS\Dane aplikacji\Activision
2007-12-08 14:30 --------- d-----w C:\Program Files\AllMyMovies
2007-12-05 09:49 --------- d-----w C:\Program Files\Audio Phonics, Inc
2007-12-04 13:44 --------- d-----w C:\Program Files\Java
2007-11-30 20:24 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-11-12 15:33 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2007-11-12 15:33 22,328 ----a-w C:\Documents and Settings\RufuS\Dane aplikacji\PnkBstrK.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 13:46 28160 C:\WINDOWS\KHALMNPR.Exe]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 16:34 213936]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2006-09-28 20:21 57344]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35 90112]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 13:36 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 15:23 1953792]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 14:52 16841216 C:\WINDOWS\RTHDCPL.exe]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 01:08 2512392]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"AVP"="C:\Program Files\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360]
C:\Documents and Settings\RufuS\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-05 15:19:48 450560]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\WINDOW~4\wbsrv.dll 2005-12-06 20:16 176128 C:\PROGRA~1\WINDOW~4\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll,C:\PROGRA~1\KASPER~1.0\adialhk.dll
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11]
R1 Ext2fs;Ext2fs;C:\WINDOWS\system32\DRIVERS\ext2fs.sys [2006-10-23 18:20]
R1 IfsDrives;IfsDrives;C:\WINDOWS\system32\DRIVERS\IfsDrives.sys [2004-09-25 00:28]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40cd27b7-2b0b-11dc-9158-806d6172696f}]
\Shell\AutoRun\command - E:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eab007e8-2b20-11dc-87eb-806d6172696f}]
\Shell\AutoRun\command - E:\instaluj.exe /VERYSILENT
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 09:48:28
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.2180]
-> C:\Program Files\WindowBlinds\tray.dll
.
Completion time: 2008-02-03 9:49:53
ComboFix-quarantined-files.txt 2008-02-03 08:49:50
ComboFix2.txt 2008-02-03 08:32:47
ComboFix3.txt 2007-09-22 15:48:56
