Włączyłem go awaryjnie za pomocą antywirusa usunąłem wirus i komputera się włączył ,
Wszystko chodzi normalnie ale przeglądarka explorer i mozilla bardzo wolno chodzą w ok. 1 m załącz mi się strona ,
Skanowałem antywirusami i to co wykrył usunął ale ciągle bez żadnych skutków
Log z ComboFix
.,
- Kod: Zaznacz wszystko
ComboFix 09-02-17.02 - Właściciel 2009-02-18 20:34:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2047.1398 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Właściciel\Pulpit\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Właściciel\Dane aplikacji\inst.exe
c:\documents and settings\Właściciel\reader_s.exe
C:\install.exe
c:\program files\OneStepSearch
c:\program files\OneStepSearch\home.js
c:\program files\OneStepSearch\onestep.exe
c:\program files\OneStepSearch\readme.html
c:\program files\OneStepSearch\uninstall.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\drivers\ntndis.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\reader_s.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
[color=RED] . . . jest zainfekowany!![/color]
[color=RED] . . . jest zainfekowany!![/color]
[color=RED] . . . jest zainfekowany!![/color]
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ONESTEP_SEARCH_SERVICE
-------\Service_OneStep Search Service
-------\Service_restore
((((((((((((((((((((((((( Pliki utworzone od 2009-01-18 do 2009-02-18 )))))))))))))))))))))))))))))))
.
2009-02-18 20:09 . 2009-02-18 20:09 <DIR> d-------- c:\windows\ERUNT
2009-02-18 20:09 . 2009-02-18 20:09 <DIR> d-------- C:\ERDNT
2009-02-18 20:09 . 2009-02-18 20:09 <DIR> d-------- C:\!FixIEDef
2009-02-18 19:37 . 2009-02-18 20:10 <DIR> d-------- c:\program files\Mozilla Firefo
2009-02-17 20:24 . 2009-02-18 09:45 <DIR> d-------- c:\program files\AGEIA Technologies
2009-02-16 22:01 . 2009-02-17 13:10 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-16 22:01 . 2009-02-16 22:01 <DIR> d-------- c:\documents and settings\Właściciel\Dane aplikacji\AVGTOOLBAR
2009-02-16 22:01 . 2009-02-17 09:55 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-16 22:01 . 2009-02-17 09:55 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-16 22:01 . 2009-02-17 09:55 12,552 --a------ c:\windows\system32\drivers\avgrkx86.sys
2009-02-16 22:01 . 2009-02-17 09:55 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> d-------- c:\documents and settings\Administrator\Ulubione
2009-02-16 08:20 . 2008-06-11 08:34 <DIR> d--h----- c:\documents and settings\Administrator\Szablony
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> d-------- c:\documents and settings\Administrator\Pulpit
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> dr------- c:\documents and settings\Administrator\Menu Start
2009-02-16 08:20 . 2008-06-11 10:29 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji
2009-02-16 08:20 . 2009-02-16 22:01 <DIR> d-------- c:\documents and settings\Administrator
2009-02-15 22:51 . 2006-04-13 01:04 49,664 -ra------ c:\windows\system32\drivers\hpzid412.sys.bak
2009-02-15 22:51 . 2008-04-13 23:11 42,112 --a------ c:\windows\system32\drivers\imapi.sys.bak
2009-02-15 22:51 . 2006-04-13 01:04 16,496 -ra------ c:\windows\system32\drivers\hpzipr12.sys.bak
2009-02-15 22:50 . 2009-02-15 22:50 182,656 --a--c--- c:\windows\system32\dllcache\ndis.sys
2009-02-15 22:50 . 2009-02-15 22:50 67,072 ---h----- c:\windows\system32\secupdat.dat
2009-02-15 22:50 . 2009-02-15 22:50 32,256 --ah----- c:\documents and settings\Właściciel\pnlqp.exe
2009-02-15 22:50 . 2009-02-15 22:50 32,256 --ah----- c:\documents and settings\Właściciel\pnlqp.exe
2009-02-15 22:50 . 2008-05-29 11:33 27,672 -ra------ c:\windows\system32\drivers\entech.sys.bak
2009-02-08 20:20 . 2009-02-10 14:30 <DIR> d-------- c:\documents and settings\Właściciel\.gstreamer-0.10
2009-02-08 20:20 . 2009-02-10 14:30 <DIR> d-------- c:\documents and settings\Właściciel\.gstreamer-0.10
2009-02-07 12:05 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll
2009-02-07 12:05 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll
2009-02-07 12:05 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll
2009-02-07 12:04 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll
2009-02-07 12:04 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll
2009-02-07 12:04 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll
2009-02-07 12:04 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll
2009-01-31 11:52 . 2009-01-31 11:52 <DIR> d-------- c:\program files\UVMapper Professional Demo
2009-01-31 11:50 . 2009-01-31 11:50 <DIR> d-------- c:\program files\MilkShape 3D 1.8.4
2009-01-31 11:49 . 2009-01-31 11:49 <DIR> d-------- c:\program files\SimPE
2009-01-29 18:37 . 2009-01-29 18:37 <DIR> d-------- c:\program files\The Compressorizer
2009-01-27 17:17 . 2009-02-11 12:49 <DIR> d-------- c:\documents and settings\Właściciel\Dane aplikacji\Nowe Gadu-Gadu
2009-01-27 17:16 . 2009-02-10 12:53 <DIR> d-------- c:\program files\Nowe Gadu-Gadu
2009-01-23 13:59 . 2009-01-23 13:59 <DIR> d--h-c--- c:\documents and settings\All Users\Dane aplikacji\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-18 19:34 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\uTorrent
2009-02-18 08:46 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-17 08:55 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\avg8
2009-02-15 21:50 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-02-14 13:36 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-13 12:21 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-11 09:05 --------- d-----w c:\program files\Google
2009-02-09 20:03 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-01-29 19:50 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DVD Shrink
2009-01-24 13:48 --------- d-----w c:\program files\NAPI-PROJEKT
2009-01-23 12:50 --------- d-----w c:\program files\Electronic Arts
2009-01-16 22:15 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Hamachi
2009-01-12 20:31 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Ashampoo Photo Commander 5
2009-01-09 22:21 --------- d-----w c:\program files\Steam
2009-01-08 09:46 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Moje pliki gry Władca Pierścieni, Król Nazguli
2009-01-05 16:50 --------- d-----w c:\program files\PlayLinc
2009-01-05 12:25 --------- d-----w c:\program files\Odkurzacz
2008-12-26 21:15 640 ----a-w c:\documents and settings\Właściciel\ControlledCameraStates.bin
2008-12-26 21:15 640 ----a-w c:\documents and settings\Właściciel\ControlledCameraStates.bin
2008-12-25 23:08 6,301,344 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2008-12-25 18:10 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Image Zone Express
2008-12-22 16:39 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Mount&Blade
2008-12-18 17:08 --------- d-----w c:\program files\PowerISO
2008-11-18 12:43 19,456 ----a-w c:\windows\_MSRSTRT.EXE
2008-11-14 11:32 22,328 ----a-w c:\documents and settings\Właściciel\Dane aplikacji\PnkBstrK.sys
2008-11-04 16:46 47,360 ----a-w c:\documents and settings\Właściciel\Dane aplikacji\pcouffin.sys
.
------- Sigcheck -------
2004-08-04 13:00 182912 1df7f42665c94b825322fae71721130d c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 23:50 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2009-02-15 22:50 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-02-15 22:50 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys
2008-04-14 21:51 1052672 61b70287daba26e6d47367003643a87c c:\windows\explorer.exe
2007-06-13 14:12 1051648 d1366e1b7748ed24f8e593f41a705998 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 14:23 1242624 da95f2fdab4431300f9838c19cdfa97f c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-04 13:00 1050624 1a08ff1e2012275afab11256dc5c80ae c:\windows\$NtUninstallKB938828$\explorer.exe
2004-09-02 13:00 4938752 d879f39f722ce9a435fc63230fc476cd c:\windows\icon_TMP\explorer.exe
2008-04-14 21:51 1052160 a6224e24da61c10edcf0001424a9258a c:\windows\ServicePackFiles\i386\explorer.exe
2007-06-13 14:23 1052160 d412529209076a268432c1b1e92b921a c:\windows\system_backup\explorer.exe
2004-08-04 13:00 32256 85acf8ff9474f19ca0cbf2fb1f15a342 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 21:51 32768 a88eb12bc0b07a67687d56e3090cdc9a c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 21:51 32256 c6f99dac3dd7c6daaf06b69396490d58 c:\windows\system32\ctfmon.exe
2005-06-11 01:17 74752 d47cc4456ea538f43a11ee4d4898326c c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-11 00:53 74752 394d9bb965967ea4d4eb8854854ed190 c:\windows\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 13:00 75264 74a26b10964dd579fffe77e3baa26b84 c:\windows\$NtUninstallKB896423$\spoolsv.exe
2008-04-14 21:51 74752 efb7b7f0d4f70dccdb34effc972c1230 c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 21:51 75264 9aa53a834b1c79195713932e705063e7 c:\windows\system32\spoolsv.exe
2004-08-04 13:00 41984 889313e5e0781cb8f3590537454e7030 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 21:51 44032 2750d068c393438c880b75d6fb7e9315 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 21:51 43520 7d8b1374592fc9d7b55a9e29e7ce4850 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="d:\programy\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 282624]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-11-13 2105176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-02 405504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-17 1601304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 32256]
c:\documents and settings\Waciciel\Menu Start\Programy\Autostart\AutorunsDisabled
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-11-02 625952]
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-06-20 568320]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\AutorunsDisabled
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 46592]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-17 09:55 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"d:\\Gry\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"e:\\Program Files\\Empire Interactive\\FlatOut Ultimate Carnage\\Fouc.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"f:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"f:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"f:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Leaf Networks\\Leaf\\bin\\Leaf.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"f:\\Program Files\\Steam\\SteamApps\\kowalino\\dark messiah might and magic multi-player\\mm.exe"=
"f:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2ServerLauncher.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"d:\\Program Files\\Electronic Arts\\Władca Pierścieni® - Podbój™\\Conquest.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\server.exe"=
"f:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"f:\\Program Files\\Ubisoft\\Gearbox Software\\Brothers in Arms - Hell's Highway\\Binaries\\biahh.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-16 12552]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-16 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-16 107272]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-17 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-17 298264]
R3 leafnets;Leaf Networks Adapter;c:\windows\system32\drivers\leafnets.sys [2007-05-03 55296]
S1 ethapbgg;ethapbgg;c:\windows\system32\drivers\ethapbgg.sys --> c:\windows\system32\drivers\ethapbgg.sys [?]
S1 ethdpmbs;ethdpmbs;c:\windows\system32\drivers\ethdpmbs.sys --> c:\windows\system32\drivers\ethdpmbs.sys [?]
S1 ethlvfeb;ethlvfeb;c:\windows\system32\drivers\ethlvfeb.sys --> c:\windows\system32\drivers\ethlvfeb.sys [?]
S1 ethubqre;ethubqre;c:\windows\system32\drivers\ethubqre.sys --> c:\windows\system32\drivers\ethubqre.sys [?]
S2 gupdate1c985f8aee96fcc;Google Update Service (gupdate1c985f8aee96fcc);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-08-04 16512]
S3 EuMusDesignVirtualAudioCableWdm_s2x;Sound2x Audio Cable (WDM);c:\windows\system32\drivers\vacs2xkd.sys [2008-08-04 42880]
S3 WPRO_40_1123;WinPcap Packet Driver (WPRO_40_1123);c:\windows\system32\drivers\WPRO_40_1123.sys --> c:\windows\system32\drivers\WPRO_40_1123.sys [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\StudioStarter.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f1fa619-3b8e-11dd-910b-000e2e8e49d1}]
\Shell\AutoRun\command - K:\Install.exe
.
Zawartość folderu 'Zaplanowane zadania'
2009-02-18 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 13:12]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Toolbar-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
HKCU-Run-RGSC - d:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
HKLM-Run-<NO NAME> - (no file)
HKLM-Explorer_Run-ati2sgav - c:\windows\system32\ati2sgav.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.daemon-search.com/default
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A5CB37CF-2854-46E3-A9DC-03354766F4C3} = 10.4.24.1 192.168.8.230
FF - ProfilePath - c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\o7owjdma.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-18 20:45:54
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
detected NTDLL code modification:
ZwOpenFile
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-507921405-1078081533-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:17,21,04,6c,d9,7b,e4,3c,74,24,a3,25,eb,6f,55,9f,d8,88,a7,88,51,a9,1d,
4a,27,74,52,79,b8,40,47,96,35,ff,00,f6,86,27,98,31,7a,25,58,75,fc,2e,50,49,\
"??"=hex:85,88,87,26,64,8c,dc,42,fb,45,7c,44,93,e4,a1,0b
[HKEY_USERS\S-1-5-21-507921405-1078081533-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:4a,16,74,7b,2b,7d,dc,fd,6e,e4,22,46,cc,68,d9,2f,0e,88,32,1f,18,
76,e7,08,52,a4,a2,9e,a0,82,3d,c9,6c,b4,4b,31,06,c0,94,73,56,36,4e,0a,c0,d5,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\HPZipm12.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
.
**************************************************************************
.
Czas ukończenia: 2009-02-18 20:48:33 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-02-18 19:48:28
Przed: 6 649 905 152 bajtów wolnych
Po: 6,704,558,080 bajtów wolnych
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition (bootscreen)" /noexecute=optin /fastdetect /KERNEL=kernel1.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
306 --- E O F --- 2009-02-17 22:07:12
