

wiec kontrolnie odpaliłem combofixa, no i tradycyjnie już zaczął usuwać co nie co.. ;]
Oczywiście kontrolnie go tu umieszczam, bo obawiam sie ze coś w moim komie nie dobrego siedzi jeszcze.....
- Kod: Zaznacz wszystko
ComboFix 09-04-04.01 - Admin 2009-04-06 10:01:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1552 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Admin\Pulpit\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated)
FW: Kaspersky Anti-Virus *disabled*
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1utbfd.bat
C:\autorun.inf
c:\documents and settings\Admin\Dane aplikacji\EurekaLog
c:\documents and settings\Admin\Dane aplikacji\EurekaLog\EurekaLog.ini
C:\upw.bat
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\olhrwef.exe
D:\1utbfd.bat
D:\Autorun.inf
D:\upw.bat
E:\1utbfd.bat
E:\Autorun.inf
E:\upw.bat
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ISODRIVE
-------\Service_ISODrive
((((((((((((((((((((((((( Pliki utworzone od 2009-03-06 do 2009-04-06 )))))))))))))))))))))))))))))))
.
2009-04-06 01:23 . 2009-04-06 01:23 <DIR> d-------- c:\program files\Java
2009-04-06 01:23 . 2009-04-06 01:23 410,984 --a------ c:\windows\system32\deploytk.dll
2009-04-06 01:23 . 2009-04-06 01:23 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-04-03 13:03 . 2009-04-03 13:03 <DIR> d-------- c:\windows\Logs
2009-04-03 13:01 . 2009-04-03 13:01 <DIR> d-------- c:\program files\UltraISO
2009-04-03 13:01 . 2009-04-03 13:01 <DIR> d-------- c:\program files\Common Files\EZB Systems
2009-03-28 18:57 . 2009-04-01 08:26 49 --a------ c:\windows\NeroDigital.ini
2009-03-28 12:02 . 2009-03-28 12:02 162,816 --a------ c:\windows\system32\fmod.dll
2009-03-28 10:00 . 2009-03-28 10:01 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-28 10:00 . 2009-03-28 10:00 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-28 10:00 . 2009-03-28 10:00 <DIR> d-------- c:\program files\MSBuild
2009-03-28 10:00 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-27 17:07 . 2008-04-14 01:26 30,592 --a------ c:\windows\system32\drivers\rndismpx.sys
2009-03-27 17:07 . 2008-04-14 01:26 30,592 --a--c--- c:\windows\system32\dllcache\rndismpx.sys
2009-03-27 17:07 . 2008-04-14 01:26 12,800 --a------ c:\windows\system32\drivers\usb8023x.sys
2009-03-27 17:07 . 2008-04-14 01:26 12,800 --a--c--- c:\windows\system32\dllcache\usb8023x.sys
2009-03-25 20:34 . 2009-03-25 20:34 <DIR> d---s---- c:\documents and settings\Admin\UserData
2009-03-25 20:33 . 2009-03-25 20:34 <DIR> d-------- C:\UniScan
2009-03-25 20:33 . 2008-04-14 01:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-03-25 20:33 . 2008-04-14 01:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-03-23 23:57 . 2009-04-06 01:36 <DIR> d-------- c:\program files\UltraVNC
2009-03-23 22:10 . 2009-03-23 22:10 <DIR> d-------- c:\program files\Common Files\Ahead
2009-03-23 22:10 . 2009-03-23 22:10 <DIR> d-------- c:\program files\Ahead
2009-03-23 22:10 . 2001-07-06 15:41 569,344 --a------ c:\windows\system32\imagr5.dll
2009-03-23 22:10 . 2001-07-06 13:44 544,768 --a------ c:\windows\system32\imagx5.dll
2009-03-23 22:10 . 2001-07-06 19:24 283,920 --a------ c:\windows\system32\ImagXpr5.dll
2009-03-23 22:10 . 2001-07-09 12:50 155,648 --a------ c:\windows\system32\NeroCheck.exe
2009-03-23 22:10 . 2004-03-03 22:30 125,184 --a------ c:\windows\system32\drivers\imagesrv.sys
2009-03-23 22:10 . 2000-06-26 12:45 106,496 --a------ c:\windows\system32\TwnLib20.dll
2009-03-23 22:10 . 2001-06-26 09:15 38,912 --a------ c:\windows\system32\picn20.dll
2009-03-23 22:10 . 2004-03-03 22:30 5,504 --a------ c:\windows\system32\drivers\imagedrv.sys
2009-03-23 21:58 . 2009-03-23 21:58 <DIR> d-------- c:\program files\Bonjour
2009-03-22 12:11 . 2009-03-22 12:11 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Media Player Classic
2009-03-22 00:46 . 2009-03-22 00:46 <DIR> d-------- c:\documents and settings\Admin\.gstreamer-0.10
2009-03-21 21:41 . 2009-03-21 21:41 <DIR> d-------- c:\program files\HyperSnap 6
2009-03-21 12:30 . 2009-03-21 12:30 <DIR> d--hs---- c:\windows\ftpcache
2009-03-21 12:29 . 2009-03-21 12:29 <DIR> d-------- c:\program files\Arkadiusz Jachnik
2009-03-21 12:02 . 2009-03-21 12:05 1,222 --a------ c:\windows\unins000.dat
2009-03-20 22:09 . 2009-03-20 22:09 <DIR> d-------- c:\program files\WapSter
2009-03-20 22:09 . 2009-03-20 22:09 <DIR> d-------- c:\documents and settings\Admin\WapSter
2009-03-20 21:11 . 2009-03-20 21:11 <DIR> d-------- c:\program files\Nowe Gadu-Gadu
2009-03-20 21:11 . 2009-03-21 20:11 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu
2009-03-20 21:06 . 2008-04-14 01:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-03-20 17:56 . 2008-06-14 19:36 273,024 --------- c:\windows\system32\drivers\bthport.sys
2009-03-20 17:56 . 2008-06-14 19:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-03-20 17:55 . 2008-08-14 15:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-20 17:55 . 2008-08-14 15:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-20 17:55 . 2008-08-14 15:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-03-20 17:55 . 2008-08-14 15:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-03-20 17:55 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-20 17:53 . 2009-03-22 22:38 <DIR> d--h----- c:\windows\$hf_mig$
2009-03-20 17:53 . 2006-06-29 14:07 22,752 --a------ c:\windows\system32\spupdsvc.exe
2009-03-20 17:44 . 2009-03-20 17:44 <DIR> d-------- c:\program files\CyberLink
2009-03-20 17:44 . 2009-03-20 17:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CyberLink
2009-03-20 17:40 . 2009-04-06 09:59 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\uTorrent
2009-03-20 17:35 . 2009-03-20 17:35 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Blender Foundation
2009-03-20 17:32 . 2009-03-21 14:01 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\FLEXnet
2009-03-20 17:26 . 2009-03-20 17:26 <DIR> d-------- c:\program files\Adobe Media Player
2009-03-20 17:25 . 2009-03-20 17:25 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-03-20 17:22 . 2009-03-20 17:22 <DIR> d-------- c:\program files\Common Files\Macrovision Shared
2009-03-20 16:48 . 2009-03-20 16:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Tlen.pl
2009-03-20 16:47 . 2009-03-20 16:47 <DIR> d-------- c:\program files\Tlen.pl
2009-03-20 16:40 . 2009-04-06 09:59 <DIR> d-------- c:\program files\Mozilla Thunderbird
2009-03-20 16:40 . 2009-03-20 16:40 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Thunderbird
2009-03-20 16:38 . 2009-04-06 01:05 <DIR> d-------- c:\program files\Common Files\Adobe
2009-03-20 16:37 . 2009-03-28 12:01 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-03-20 16:36 . 2009-03-20 16:36 <DIR> d-------- c:\program files\Winamp
2009-03-20 16:36 . 2009-03-25 13:24 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Winamp
2009-03-20 16:31 . 2009-03-20 16:31 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-03-20 16:22 . 2009-03-20 16:22 0 --a------ c:\windows\nsreg.dat
2009-03-20 16:17 . 2007-04-09 16:23 28,040 --a------ c:\windows\system32\mdimon.dll
2009-03-20 16:17 . 2009-03-20 16:17 421 --a------ c:\windows\ODBC.INI
2009-03-20 16:16 . 2009-03-20 16:16 <DIR> d-------- c:\program files\Microsoft.NET
2009-03-20 16:12 . 2009-03-20 16:16 <DIR> d-------- c:\windows\SHELLNEW
2009-03-20 16:09 . 2009-03-20 16:09 <DIR> d-------- c:\program files\DIFX
2009-03-20 16:09 . 2006-11-23 06:55 73,728 --a------ c:\windows\system32\DeathAdder.cpl
2009-03-20 16:09 . 2005-03-03 20:47 31,104 --a------ c:\windows\system32\drivers\CYUSB.sys
2009-03-20 16:09 . 2007-08-02 18:32 22,784 --a------ c:\windows\system32\drivers\dadder.sys
2009-03-20 16:08 . 2009-03-20 16:08 <DIR> d-------- c:\program files\Razer
2009-03-20 16:08 . 2009-03-20 16:08 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\InstallShield
2009-03-20 16:06 . 2009-03-20 16:06 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard
2009-03-20 16:06 . 2009-03-20 16:06 <DIR> d-------- c:\documents and settings\Admin\Dane aplikacji\Folder przesyłania Share-to-Web
2009-03-20 16:06 . 2009-03-20 16:06 82,380 --a------ c:\windows\system32\drivers\AFS2K.SYS
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 08:06 458,784 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-06 08:06 4,744 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-06 08:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2009-04-06 08:04 33,248 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-06 08:04 3,849,248 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-03 11:03 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-20 15:44 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-20 14:20 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-20 14:20 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-20 14:20 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-20 14:06 --------- d-----w c:\program files\Hewlett-Packard
2009-03-20 13:46 --------- d-----w c:\program files\Kaspersky Lab
2009-03-20 13:46 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2009-03-20 13:42 --------- d-----w c:\program files\Creative
2009-03-20 13:37 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\nView_Profiles
2009-03-20 13:36 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-20 13:36 --------- d-----w c:\program files\AGEIA Technologies
2009-03-20 13:28 --------- d-----w c:\program files\Intel
2009-03-20 12:57 --------- d-----w c:\program files\microsoft frontpage
2009-03-20 12:56 --------- d-----w c:\program files\Usługi online
2009-02-09 12:18 6,307,328 ----a-w c:\windows\system32\drivers\nv4_mini.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"Steam"="d:\steam\steam.exe" [2009-04-03 1410296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-03-20 206088]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2008-09-05 159744]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-06 148888]
"nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32\nwiz.exe]
"P17Helper"="P17.dll" [2005-05-03 c:\windows\system32\P17.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Tlen.pl\\tlen.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"e:\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\UltraVNC\\vncviewer.exe"=
"d:\\Wheelman\\Binaries\\WheelmanGame-Final.exe"=
"c:\\Program Files\\UltraVNC\\winvnc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [2009-03-23 1519168]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2009-03-20 22784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
S3 AVPsys;AVPsys;\??\c:\windows\system32\drivers\cdaudio.sys --> c:\windows\system32\drivers\cdaudio.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ba11f20-2036-11de-a052-002185124066}]
\Shell\AutoRun\command - I:\1utbfd.bat
\Shell\open\Command - I:\1utbfd.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2df9813-1553-11de-bd96-806d6172696f}]
\Shell\AutoRun\command - F:\setup.exe
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
.
------- Skan uzupełniający -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]1ktg5hg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 10:06:17
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\Razer\DeathAdder\razertra.exe
c:\program files\Razer\DeathAdder\razerofa.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-04-06 10:08:25 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-04-06 08:08:22
Przed: 16 568 954 880 bajtów wolnych
Po: 16,773,677,056 bajtów wolnych
242 --- E O F --- 2009-03-26 10:52:15