Mam ten sam problem, tyle że mi AVG nie chce usunąć pliku bo go nie widzi.
Jakiś czas temu zachciało mi się eksperymentować i zainstalowałem Norton Internet Security 2010. Wyinstalowałem go i zainstalowałem AVG no i wyszło że jest "Ukryty sterownik" tyle że nie wiem czy to faktycznie przez NIS2010 czy może inne badziewie.
Zrobiłem skan Combofixsem i oto co wyszło:
- Kod: Zaznacz wszystko
ComboFix 09-11-23.04 - adi 2009-11-24 11:57.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.48.1045.18.3062.1832 [GMT 1:00]
Uruchomiony z: c:\users\adi\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
[i] ADS - Windows: deleted 24 bytes in 1 streams. [/i]
((((((((((((((((((((((((( Pliki utworzone od 2009-10-24 do 2009-11-24 )))))))))))))))))))))))))))))))
.
2009-11-24 11:08 . 2009-11-24 11:08 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-11-24 11:08 . 2009-11-24 11:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-24 10:41 . 2009-11-24 10:41 -------- d-----w- c:\program files\Panda Security
2009-11-24 10:39 . 2009-06-18 11:55 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys
2009-11-24 08:58 . 2009-11-24 08:58 -------- d-----w- c:\program files\Sophos
2009-11-23 12:41 . 2009-11-24 11:08 4096 d-----w- c:\users\adi\AppData\Local\temp
2009-11-18 14:37 . 2009-11-18 14:37 -------- d-----w- c:\programdata\McAfee
2009-11-17 12:24 . 2009-11-17 12:24 -------- d-----w- c:\users\adi\AppData\Local\Nero
2009-11-16 15:00 . 2009-11-16 15:00 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-16 14:37 . 2009-11-16 14:37 -------- d-----w- c:\programdata\McAfee Security Scan
2009-11-16 14:35 . 2009-11-16 14:35 86016 ----a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2009-11-16 14:35 . 2009-11-16 18:17 4096 d-----w- c:\programdata\NOS
2009-11-16 14:35 . 2009-11-16 14:35 -------- d-----w- c:\program files\NOS
2009-11-16 14:35 . 2009-11-06 08:20 34112 ----a-w- c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-11-16 14:35 . 2009-11-06 08:20 32448 ----a-w- c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-11-16 14:35 . 2009-11-06 08:20 22352 ----a-w- c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-11-16 14:33 . 2009-11-16 14:33 -------- d-----w- c:\users\adi\AppData\Roaming\AdobeUM
2009-11-14 19:02 . 2009-11-14 19:27 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-14 19:02 . 2009-11-14 19:27 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-11-14 19:02 . 2009-11-14 19:27 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-14 19:02 . 2009-11-14 19:27 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-14 19:02 . 2009-11-14 19:27 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-14 19:02 . 2009-11-24 10:32 4096 d-----w- c:\windows\system32\drivers\Avg
2009-11-14 19:01 . 2009-11-14 19:01 -------- d-----w- c:\program files\AVG
2009-11-13 07:29 . 2009-11-13 07:29 4096 d-----w- c:\program files\Odkurzacz
2009-11-11 06:54 . 2009-08-14 13:27 2036736 ----a-w- c:\windows\system32\win32k.sys
2009-11-11 06:54 . 2009-08-10 12:35 355328 ----a-w- c:\windows\system32\WSDApi.dll
2009-11-10 19:39 . 2009-11-10 19:39 -------- d-----w- c:\users\adi\AppData\Roaming\Oberon Media
2009-11-09 17:48 . 2009-11-09 17:48 -------- d-----w- C:\Intel
2009-11-09 14:17 . 2009-11-09 17:46 4096 d-----w- c:\program files\Microsoft Silverlight
2009-11-09 14:14 . 2009-11-09 14:14 -------- d-----w- c:\programdata\Apple Computer
2009-11-09 14:13 . 2009-11-09 14:13 -------- d-----w- c:\program files\Common Files\Apple
2009-11-09 14:12 . 2009-11-09 14:12 -------- d-----w- c:\users\adi\AppData\Local\Apple
2009-11-09 14:12 . 2009-11-09 14:12 4096 d-----w- c:\program files\Apple Software Update
2009-11-09 14:12 . 2009-11-09 14:12 -------- d-----w- c:\programdata\Apple
2009-11-09 10:27 . 2009-11-09 14:15 4096 d-----w- c:\program files\QuickTime
2009-11-04 06:39 . 2009-11-18 11:56 4096 d-----w- c:\users\adi\AppData\Local\CrashDumps
2009-11-02 19:35 . 2009-11-16 15:01 -------- d-----w- c:\users\adi\AppData\Local\Adobe
2009-10-31 17:12 . 2009-10-31 17:12 -------- d-----w- c:\program files\Windows Portable Devices
2009-10-31 11:27 . 2008-12-07 19:08 795648 ----a-w- c:\programdata\ALLPlayer\LIVE\XVID\xvidcore.dll
2009-10-31 11:27 . 2008-04-14 22:50 1291776 ----a-w- c:\programdata\ALLPlayer\LIVE\QUARTZ\quartzXP.dll
2009-10-31 11:27 . 2007-07-05 03:33 892928 ----a-w- c:\programdata\ALLPlayer\LIVE\DOLBY\iconv.dll
2009-10-31 11:27 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-10-31 11:27 . 2008-10-28 23:35 684032 ----a-w- c:\programdata\ALLPlayer\LIVE\DIVX\divx.dll
2009-10-31 11:27 . 2007-07-05 03:33 892928 ----a-w- c:\windows\system32\iconv.dll
2009-10-31 11:27 . 2009-10-31 11:27 4096 d-----w- c:\program files\ALLPlayer
2009-10-31 10:16 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2009-10-31 10:16 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2009-10-31 10:16 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2009-10-31 10:14 . 2009-10-01 01:02 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-31 10:13 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-31 10:13 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-31 10:13 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-30 18:17 . 2009-11-14 18:49 -------- d-----w- c:\users\adi\AppData\Local\Tific
2009-10-30 18:01 . 2009-10-30 18:01 -------- d-----w- c:\users\adi\AppData\Roaming\Tific
2009-10-30 18:01 . 2009-10-30 18:01 -------- d-----w- c:\users\adi\AppData\Local\Symantec
2009-10-30 17:59 . 2009-11-14 18:54 -------- d-----w- c:\programdata\Norton
2009-10-30 17:59 . 2009-11-14 18:36 -------- d-----w- c:\programdata\NortonInstaller
2009-10-30 13:29 . 2009-10-30 13:31 -------- d-----w- c:\windows\system32\ca-ES
2009-10-30 13:29 . 2009-10-30 13:31 -------- d-----w- c:\windows\system32\eu-ES
2009-10-30 13:29 . 2009-10-30 13:31 -------- d-----w- c:\windows\system32\vi-VN
2009-10-30 09:33 . 2009-10-30 09:33 4096 d-----w- c:\windows\system32\EventProviders
2009-10-30 09:31 . 2009-04-11 05:03 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-10-30 09:29 . 2009-04-11 06:28 550400 ----a-w- c:\windows\system32\rpcss.dll
2009-10-30 09:28 . 2009-04-11 06:28 777216 ----a-w- c:\windows\system32\slcc.dll
2009-10-30 09:27 . 2009-04-11 06:28 83968 ----a-w- c:\windows\system32\wbem\wmiutils.dll
2009-10-30 09:27 . 2009-04-11 06:28 744448 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2009-10-30 09:27 . 2009-04-11 06:28 30208 ----a-w- c:\windows\system32\wbem\wbemprox.dll
2009-10-30 09:27 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\repdrvfs.dll
2009-10-30 09:27 . 2009-04-11 06:28 189440 ----a-w- c:\windows\system32\wbem\mofd.dll
2009-10-30 09:27 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\esscli.dll
2009-10-30 09:27 . 2009-04-11 06:28 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll
2009-10-30 09:27 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll
2009-10-30 09:26 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll
2009-10-30 09:26 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe
2009-10-30 09:25 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll
2009-10-28 17:43 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 17:43 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-27 11:03 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-27 11:03 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-27 11:03 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-27 11:03 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-27 11:02 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-27 11:02 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-27 11:02 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-27 11:02 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-27 11:02 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 11:09 . 2008-10-03 11:42 40960 d-----w- c:\users\adi\AppData\Roaming\uTorrent
2009-11-24 10:46 . 2007-01-09 09:24 12 ----a-w- c:\windows\bthservsdp.dat
2009-11-23 23:38 . 2009-03-23 19:07 4096 d-----w- c:\program files\Windows Live Safety Center
2009-11-22 11:13 . 2006-12-05 05:19 677978 ----a-w- c:\windows\system32\perfh015.dat
2009-11-22 11:13 . 2006-12-05 05:19 134576 ----a-w- c:\windows\system32\perfc015.dat
2009-11-19 12:40 . 2007-05-18 01:42 4096 d-----w- c:\program files\Java
2009-11-14 19:01 . 2009-04-18 06:36 4096 d-----w- c:\programdata\avg8
2009-11-14 18:52 . 2007-05-18 01:31 8192 d-----w- c:\program files\Common Files\Symantec Shared
2009-11-11 17:24 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-11-11 07:19 . 2007-05-18 01:04 12288 d-----w- c:\programdata\Microsoft Help
2009-11-06 16:04 . 2009-10-17 13:14 -------- d-----w- c:\programdata\Avanquest Bluetooth SDK
2009-11-02 19:42 . 2009-10-05 14:38 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-31 17:11 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-31 17:11 . 2009-10-31 17:11 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-10-31 17:10 . 2009-10-31 17:10 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-10-31 13:45 . 2009-10-31 13:43 4096 d-----w- c:\program files\K-Lite Codec Pack
2009-10-31 11:27 . 2009-08-18 18:13 -------- d-----w- c:\programdata\ALLPlayer
2009-10-31 11:27 . 2008-09-29 16:59 4096 d-----w- c:\program files\NAPI-PROJEKT
2009-10-30 13:32 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-10-30 13:32 . 2006-11-02 12:35 4096 d-----w- c:\program files\Windows Sidebar
2009-10-30 13:32 . 2006-11-02 12:35 4096 d-----w- c:\program files\Windows Collaboration
2009-10-30 13:32 . 2006-11-02 12:35 4096 d-----w- c:\program files\Windows Photo Gallery
2009-10-30 13:32 . 2006-11-02 12:35 4096 d-----w- c:\program files\Windows Defender
2009-10-30 09:05 . 2009-10-11 10:27 12288 d-----w- c:\program files\AGEIA Technologies
2009-10-29 09:32 . 2009-08-08 15:05 -------- d-----w- c:\programdata\SlySoft
2009-10-29 09:32 . 2009-08-08 15:02 -------- d-----w- c:\program files\SlySoft
2009-10-27 18:00 . 2009-10-31 13:43 94208 ----a-w- c:\users\adi\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nprpjplug.dll
2009-10-27 18:00 . 2009-10-31 13:43 140864 ----a-w- c:\users\adi\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nppl3260.dll
2009-10-27 18:00 . 2009-10-31 13:43 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-10-20 15:25 . 2009-10-20 15:25 -------- d-----w- c:\program files\Oberon Media
2009-10-20 15:25 . 2009-10-20 15:25 -------- d-----w- c:\program files\MSN Games
2009-10-18 13:51 . 2009-10-03 13:40 4096 d-----w- c:\users\adi\AppData\Roaming\HpUpdate
2009-10-17 13:14 . 2009-10-17 13:14 -------- d-----w- c:\programdata\BVRP Software
2009-10-17 13:08 . 2009-10-17 13:08 148736 ----a-w- c:\programdata\hpe2040.dll
2009-10-17 13:08 . 2009-10-17 13:08 148736 ----a-w- c:\programdata\hpe2040.dll
2009-10-17 13:08 . 2009-10-17 13:08 -------- d-----w- c:\programdata\Sony Ericsson
2009-10-17 13:08 . 2009-10-17 13:08 -------- d-----w- c:\program files\Sony Ericsson
2009-10-17 13:08 . 2007-05-18 00:51 8192 d--h--w- c:\program files\InstallShield Installation Information
2009-10-11 10:26 . 2009-10-11 10:26 4096 d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-11 03:17 . 2009-10-07 08:57 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-03 14:15 . 2009-01-31 08:54 -------- d-----w- c:\users\adi\AppData\Roaming\BESTplayer
2009-10-03 13:41 . 2007-05-18 01:52 -------- d-----w- c:\program files\Hp
2009-10-01 01:02 . 2009-10-31 10:14 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02 . 2009-10-31 10:14 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02 . 2009-10-31 10:14 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02 . 2009-10-31 10:14 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-10-31 10:14 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01 . 2009-10-31 10:14 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01 . 2009-10-31 10:14 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01 . 2009-10-31 10:14 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01 . 2009-10-31 10:14 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01 . 2009-10-31 10:14 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01 . 2009-10-31 10:14 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-10-01 01:01 . 2009-10-31 10:14 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2009-10-01 01:01 . 2009-10-31 10:14 226816 ----a-w- c:\windows\system32\WpdMtp.dll
2009-10-01 01:01 . 2009-10-31 10:14 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll
2009-10-01 01:01 . 2009-10-31 10:14 33280 ----a-w- c:\windows\system32\WpdConns.dll
2009-09-25 02:10 . 2009-10-31 10:15 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-10-31 10:15 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-10-31 10:15 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-10-31 10:15 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-10-31 10:15 351232 ----a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-10-31 10:15 847360 ----a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-10-31 10:15 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-10-31 10:15 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-10-31 10:15 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-10-31 10:15 829440 ----a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-10-31 10:15 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-10-31 10:15 252928 ----a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-10-31 10:15 519680 ----a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-10-31 10:15 486912 ----a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-10-31 10:15 161280 ----a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-10-31 10:15 218112 ----a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-10-31 10:15 1030144 ----a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-10-31 10:15 828928 ----a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-10-31 10:15 481792 ----a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-10-31 10:15 190464 ----a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-10-31 10:15 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-10-31 10:15 37888 ----a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-10-31 10:15 793088 ----a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-10-31 10:15 1064448 ----a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-10-31 10:15 258048 ----a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-10-31 10:15 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-10-31 10:15 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-09-14 09:29 . 2009-10-20 19:52 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-10 16:48 . 2009-10-21 11:01 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 11:41 . 2009-10-21 07:52 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 00:27 . 2009-10-21 12:33 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-10-21 12:33 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22 . 2009-10-21 12:06 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-21 12:06 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 05:17 . 2009-10-21 12:06 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 03:42 . 2009-10-21 12:06 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2008-10-01 16:47 . 2008-10-01 16:47 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-11-23_12.33.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-18 00:40 . 2009-11-24 10:49 60012 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-09-29 15:47 . 2009-11-24 06:59 13584 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1736532156-3714844823-1150037027-1006_UserData.bin
+ 2008-09-29 15:40 . 2009-11-24 06:57 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-09-29 15:40 . 2009-11-23 08:02 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-29 15:40 . 2009-11-24 06:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-09-29 15:40 . 2009-11-23 08:02 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-29 15:41 . 2009-11-24 06:57 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-29 15:41 . 2009-11-23 08:02 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-23 13:40 . 2009-11-23 13:40 39424 c:\windows\Installer\2ce601.msi
+ 2009-11-24 07:02 . 2009-11-24 07:11 1566 c:\windows\SoftwareDistribution\EventCache\{4AA3ED0D-C4DA-4400-86F4-5CC81E1819F2}.bin
- 2009-11-23 12:32 . 2009-11-23 12:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-11-24 10:47 . 2009-11-24 10:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-11-23 12:32 . 2009-11-23 12:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-11-24 10:47 . 2009-11-24 10:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 13:02 . 2009-11-24 06:59 133740 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-11-23 13:41 . 2009-11-23 13:41 170496 c:\windows\Installer\2ce624.msp
+ 2009-11-23 13:41 . 2009-11-23 13:41 162304 c:\windows\Installer\2ce61d.msp
+ 2009-11-23 13:40 . 2009-11-23 13:40 189440 c:\windows\Installer\2ce616.msp
+ 2009-11-23 13:40 . 2009-11-23 13:40 217088 c:\windows\Installer\2ce60f.msp
+ 2009-11-23 13:40 . 2009-11-23 13:40 375296 c:\windows\Installer\2ce608.msp
+ 2009-11-23 23:37 . 2009-11-23 23:37 160768 c:\windows\Installer\2501c7a.msp
+ 2009-11-23 23:37 . 2009-11-23 23:37 430080 c:\windows\Installer\2501c6d.msp
+ 2009-11-23 13:42 . 2009-11-23 13:42 1927680 c:\windows\Installer\2ce62b.msp
+ 2009-11-23 14:06 . 2009-11-23 14:06 10194944 c:\windows\Installer\400b3c.msp
+ 2009-11-23 14:01 . 2009-11-23 14:01 32395264 c:\windows\Installer\400b2e.msp
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-09-24 1685816]
"Odkurzacz-SCD"="c:\program files\Odkurzacz\odk_scd.exe" [2008-08-17 535552]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BigDog305"="c:\windows\VM305_STI.EXE VIMICRO USB PC Camera V" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-02-20 331552]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-05 159744]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-05 184320]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-09 417792]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-13 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-13 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-13 129560]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-14 2028312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-09 44168]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-9-29 184320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):2b,e4,8e,5f,66,59,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1736532156-3714844823-1150037027-1006]
"EnableNotificationsRef"=dword:00000001
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2009-11-14 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-11-14 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-11-14 108552]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\System32\SAVRKBootTasks.sys [2009-11-24 18816]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [2009-02-01 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [2009-02-01 21504]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-11-14 297752]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2007-05-18 539936]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2007-01-23 179200]
R3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr73.sys [2007-05-11 329728]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-11-17 3668480]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys [2009-10-17 27632]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [2008-11-09 717296]
S2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2007-05-18 18944]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-10-17 90112]
S3 FontCache;Usług systemu Windows buforowania czcionek;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-02-01 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2009-03-31 55280]
S3 fsssvc;Bezpieczeństwo rodzinne usługi Windows Live;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [2009-02-01 21504]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [2009-10-17 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [2009-10-17 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [2009-10-17 120744]
S3 ZSMC0305;VIMICRO USB PC Camera V;c:\windows\System32\drivers\usbVM305.sys [2009-05-31 392316]
--- Inne Usługi/Sterowniki w Pamięci ---
*NewlyCreated* - SAVRKBOOTTASKS
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://google.pl/
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1396957&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
FF - prefs.js: keyword.URL - hxxp://nl.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_nl&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\extensions\{f592709f-ff4a-4862-b659-4afabda56312}\components\FFExternalAlert.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll
FF - plugin: c:\users\adi\AppData\Roaming\Mozilla\Firefox\Profiles\if6ysboj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\users\adi\AppData\Roaming\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: c:\users\adi\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nppl3260.dll
FF - plugin: c:\users\adi\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - USUNIĘTO PUSTE WPISY - - - -
AddRemove-Activation Assistant for the 2007 Microsoft Office suites - c:\programdata\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-Sophos-AntiRootkit - c:\program files\Sophos\Sophos Anti-Rootkit\helper.exe remove
AddRemove-{91810AFC-A4F8-4EBA-A5AA-B198BBC81144} - c:\program files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe REMOVEALL
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-24 12:08
Windows 6.0.6002 Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\E8E9.tmp"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'Explorer.exe'(6112)
c:\windows\system32\APSHook.dll
c:\program files\Hewlett-Packard\IAM\bin\ItClient.dll
.
Czas ukończenia: 2009-11-24 12:11
ComboFix-quarantined-files.txt 2009-11-24 11:11
ComboFix2.txt 2009-11-23 12:41
Przed: 28 789 350 400 bajtów wolnych
Po: 28 748 451 840 bajtów wolnych
- - End Of File - - BC855D40628CD615E96E34CE5851CBE8
Czy wie ktoś jak się tego pozbyć?
Proszę o pomoc za co z góry dziękuję
Pozdrawiam Adi
