kolezanka poprosila mnie o sprawdzenie komputera, byłbym wdzięczny jakby ktoś mi pomogł. Oto log z ComboFixa :
- Kod: Zaznacz wszystko
ComboFix 10-02-12.01 - Robert 2010-02-16 0:40.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.511.184 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Robert\Moje dokumenty\Pobieranie\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Menu Start\Programy\Autostart\BDARemote.lnk
c:\windows\system32\ieuinit.inf
.
((((((((((((((((((((((((( Pliki utworzone od 2010-01-15 do 2010-02-15 )))))))))))))))))))))))))))))))
.
2010-02-15 23:07 . 2010-02-15 23:07 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-02-15 23:06 . 2010-02-15 23:06 -------- d-----w- c:\program files\USB TV
2010-02-15 23:05 . 2010-02-15 23:05 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\InstallShield
2010-02-15 23:05 . 2010-02-15 23:05 -------- d-----w- c:\program files\ATI Technologies
2010-02-14 20:15 . 2010-02-14 20:15 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Alwil Software
2010-02-10 07:09 . 2009-12-31 16:14 352640 -c----w- c:\windows\system32\dllcache\srv.sys
2010-02-10 07:09 . 2009-12-04 14:41 453760 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-10 07:07 . 2009-12-09 10:28 2137600 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-10 07:07 . 2009-12-09 10:28 2059008 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-10 07:07 . 2009-12-09 10:28 2181632 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-10 07:07 . 2009-12-09 10:28 2017280 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-31 11:21 . 2010-01-31 11:46 -------- d-----w- c:\program files\Odkurzacz
2010-01-28 12:52 . 2010-02-12 07:55 -------- d-----w- c:\documents and settings\Robert\Ustawienia lokalne\Dane aplikacji\Temp
2010-01-18 10:19 . 2010-01-18 10:19 -------- d-----w- c:\program files\CCleaner
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-15 23:52 . 2007-09-01 07:53 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\Skype
2010-02-15 23:09 . 2007-09-01 06:48 -------- d-----w- c:\program files\neostrada tp
2010-02-15 23:07 . 2010-02-15 23:07 9158 ----a-r- c:\documents and settings\Robert\Dane aplikacji\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2010-02-15 23:06 . 2007-08-30 20:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-15 23:01 . 2009-12-16 19:35 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\skypePM
2010-02-14 20:21 . 2007-08-31 08:49 -------- d-----w- c:\program files\Alwil Software
2010-02-11 18:53 . 2007-08-31 08:50 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-11 18:53 . 2007-08-31 08:49 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-11 18:42 . 2007-08-31 08:50 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-11 18:42 . 2008-04-03 11:10 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-11 18:39 . 2007-08-31 08:50 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-11 18:38 . 2007-08-31 08:50 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-11 18:38 . 2007-08-31 08:50 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-11 18:38 . 2008-04-03 11:10 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-11 18:38 . 2007-08-31 08:50 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-10 20:13 . 2009-02-23 09:57 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\Nowe Gadu-Gadu
2010-02-08 20:16 . 2008-05-14 19:34 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\XnView
2010-02-04 22:29 . 2009-02-23 09:56 -------- d-----w- c:\program files\Nowe Gadu-Gadu
2010-01-11 17:13 . 2010-01-11 17:14 395776 ----a-w- c:\windows\system32\CF14180.exe
2010-01-11 17:08 . 2010-01-11 17:08 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\Earthsim
2010-01-10 17:23 . 2008-05-04 14:43 -------- d-----w- c:\program files\Bonjour
2009-12-31 16:14 . 2002-09-28 22:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:43 . 2002-09-28 22:00 664576 ----a-w- c:\windows\system32\wininet.dll
2009-12-22 05:43 . 2007-08-30 21:08 81920 ------w- c:\windows\system32\ieencode.dll
2009-12-19 08:59 . 2009-03-27 19:52 -------- d-----w- c:\documents and settings\Robert\Dane aplikacji\Samsung
2009-12-17 08:00 . 2007-08-30 19:58 345088 ----a-w- c:\windows\system32\mspaint.exe
2009-12-16 19:35 . 2009-12-16 19:35 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-14 07:37 . 2002-09-28 22:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 07:51 . 2002-09-28 22:00 49492 ----a-w- c:\windows\system32\perfc015.dat
2009-12-11 07:51 . 2002-09-28 22:00 355486 ----a-w- c:\windows\system32\perfh015.dat
2009-12-09 10:28 . 2002-09-20 17:12 2059008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:28 . 2002-09-28 22:00 2181632 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-04 14:41 . 2002-09-28 22:00 453760 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:35 . 2002-09-28 22:00 1294848 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:35 . 2001-10-26 17:29 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:40 . 2002-09-28 22:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:40 . 2002-09-28 22:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:40 . 2002-09-28 22:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:40 . 2001-10-26 17:29 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:40 . 2001-10-26 17:29 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 16:46 . 2002-09-28 22:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-29 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-13 185896]
"BigDog303"="c:\windows\VM303_STI.EXE" [BU]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\NAPI-PROJEKT\\napisy.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26835:TCP"= 26835:TCP:BitComet 26835 TCP
"26835:UDP"= 26835:UDP:BitComet 26835 UDP
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-10-13 35328]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-04-03 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-03 19024]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2009-03-07 116992]
R3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2007-09-01 428160]
S2 gupdate1ca7e869d62ac8c;Usługa Google Update (gupdate1ca7e869d62ac8c);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-16 133104]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2009-03-07 64000]
.
Zawartość folderu 'Zaplanowane zadania'
2010-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-16 19:32]
2010-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-16 19:32]
2010-02-15 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 20:18]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint – Dodaj do listy drukowania - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Drukuj - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Drukuj z dużą szybkością - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Podgląd - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Funkcja Google Sidewiki - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: { - c:\program files\Messenger\msmsgs.exe
TCP: {BF156C09-1523-4AE4-99C1-57410FEFAEA3} = 194.204.159.1 194.204.152.34
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Robert\Dane aplikacji\Mozilla\Firefox\Profiles\pkn96peq.default\
FF - prefs.js: browser.startup.homepage - wp.pl
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\Robert\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Notify-AtiExtEvent - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-16 00:51
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog303 = c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@??????????????
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1343024091-1532298954-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Czas ukończenia: 2010-02-16 00:58:17
ComboFix-quarantined-files.txt 2010-02-15 23:57
ComboFix2.txt 2009-04-09 22:31
Przed: 9 360 879 616 bajtów wolnych
Po: 9 375 080 448 bajtów wolnych
- - End Of File - - 6B91006FD8F31EDBB7D50962CE3F7ECB
Czy może lepiej format?
