od razu przepraszam za użycie Combofixa, wiem jest to zabronione na wlasną rękę, ale spróbuje wyjaśnić. Wczoraj wieczorem wszystko było ok, wyskoczyło okienko avast żebym zaktualizował program, więc zaktualizowałem i wyłączyłem komputer. Rano komputer tak się mulił że jedynym wyjściem był praktycznie reset. Co było nie tak: reakcja ok 2minut od kliknięcia, nie możliwe było praktycznie poruszanie się w mój komputer, gdyż wtedy wyskakiwało brak odpowiedzi i po 5 minutach wchodził do folderu. Wszedłem do trybu awaryjnego i chciałem odinstalować AVASTa i jakimś cudem udało mi się to zrobić programem Revo uninstaler, ale to nie dało żadnego efektu. Jedyne co przyszło mi na myśl to odpalenie combofixa (już o firefoxie nie mówie bo to zajeloby 3 godziny). Po otrzymaniu logu komp przyspieszył na tyle że udało mi się odpalić MKSa online, który wykrył: Trojan.Agent.xeh (C:\32788R22FWJFW.0.tmp/License\pv.exe) i Backdoor.Small.hvo(E:\programy\fraps 3.0.1 Build 10506\ Fraps 2.9.8.exe). Teraz moge odpalać przeglądarki, ale zauważyłem że uszkodzona została jedna partycja (F:\ ), na której miałem wszystkie dane do pracy dyplomowej
, co jest dziwne przegladarki w miare chodzą, a mój komputer ciągle się scina choć już nie tak strasznie. proszę o przejrzenie loga z combofixa (tego o którym mowa była wcześniej) i jak na razie tylko tyle moge dać bo nie moge odinstalować deamon tools, aktualnie ściągam gmer i OTL. oto log - Kod: Zaznacz wszystko
ComboFix 09-07-09.04 - mat 2010-06-14 17:34.13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.654 [GMT 2:00]
Uruchomiony z: e:\programy\Instalki\ComboFix.exe
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -
.
((((((((((((((((((((((((( Pliki utworzone od 2010-05-14 do 2010-06-14 )))))))))))))))))))))))))))))))
.
2010-06-14 14:56 . 2010-06-14 14:57 -------- d-----w- C:\32788R22FWJFW.0.tmp
2010-06-14 13:58 . 2010-06-14 13:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-14 05:37 . 2010-06-14 14:24 -------- d-----w- c:\program files\Alwil Software
2010-06-14 05:37 . 2010-06-14 14:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Alwil Software
2010-06-09 21:48 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 07:04 . 2010-06-07 07:04 -------- d-----w- c:\documents and settings\mat\Ustawienia lokalne\Dane aplikacji\Thunderbird
2010-06-07 07:04 . 2010-06-07 07:04 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\Thunderbird
2010-05-30 10:28 . 2010-05-30 10:28 -------- d-----w- c:\program files\WMV9_VCM
2010-05-25 21:33 . 2010-05-25 21:33 503808 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7b7082ab-n\msvcp71.dll
2010-05-25 21:33 . 2010-05-25 21:33 499712 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7b7082ab-n\jmc.dll
2010-05-25 21:33 . 2010-05-25 21:33 348160 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7b7082ab-n\msvcr71.dll
2010-05-25 21:33 . 2010-05-25 21:33 61440 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4f5c6251-n\decora-sse.dll
2010-05-25 21:33 . 2010-05-25 21:33 12800 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4f5c6251-n\decora-d3d.dll
2010-05-19 18:11 . 2010-05-19 18:18 8 ----a-w- c:\windows\system32\nvModes.dat
2010-05-19 18:05 . 2010-05-19 18:05 -------- d-----w- c:\windows\system32\AGEIA
2010-05-19 18:04 . 2010-05-19 18:05 -------- d-----w- c:\program files\AGEIA Technologies
2010-05-19 18:03 . 2008-12-08 15:42 453152 ----a-w- c:\windows\system32\nvudisp.exe
2010-05-19 18:02 . 2008-12-16 20:07 453152 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-05-19 17:41 . 2010-05-19 17:42 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NVIDIA
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 00:50 . 2010-04-28 08:41 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\BITS
2010-06-12 21:43 . 2010-04-17 17:49 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\uTorrent
2010-06-10 05:42 . 2001-10-26 15:15 558466 ----a-w- c:\windows\system32\perfh015.dat
2010-06-10 05:42 . 2001-10-26 15:15 105530 ----a-w- c:\windows\system32\perfc015.dat
2010-06-05 19:16 . 2009-10-24 18:45 188152 ----a-w- c:\documents and settings\mat\Dane aplikacji\Mozilla\Firefox\Profiles\yevpi2cv.default\FlashGot.exe
2010-05-19 17:55 . 2009-10-08 08:46 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-05-10 22:04 . 2010-05-10 22:04 1629768 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-2052111302-2025429265-725345543-1003-0.dat
2010-05-10 22:04 . 2010-05-10 22:04 239250 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat
2010-05-06 10:35 . 2004-08-03 22:44 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2004-08-03 22:37 1851520 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 09:40 . 2010-04-29 09:37 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\DAEMON Tools Lite
2010-04-29 09:37 . 2010-04-29 09:37 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-29 09:37 . 2010-04-29 09:37 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite
2010-04-29 05:26 . 2010-04-29 05:26 -------- d-----w- c:\program files\Microsoft Synchronization Services
2010-04-29 05:26 . 2010-04-29 05:26 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-04-29 05:25 . 2010-04-29 05:25 112832 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Microsoft\VCExpress\10.0\1033\ResourceCache.dll
2010-04-29 05:22 . 2010-04-29 05:22 -------- d-----w- c:\program files\Microsoft SDKs
2010-04-29 05:22 . 2010-04-29 05:22 -------- d-----w- c:\program files\Microsoft Help Viewer
2010-04-29 05:22 . 2010-04-29 05:22 -------- d-----w- c:\program files\Common Files\Merge Modules
2010-04-29 05:22 . 2009-08-31 20:55 -------- d-----w- c:\program files\MSBuild
2010-04-28 22:27 . 2010-01-07 10:01 -------- d-----w- c:\program files\Microsoft.NET
2010-04-28 11:02 . 2008-11-18 22:41 1 ----a-w- c:\documents and settings\mat\Dane aplikacji\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-27 17:36 . 2008-09-12 16:10 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\Cyberlink
2010-04-26 15:31 . 2009-11-12 09:33 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\IC_Katalog
2010-04-25 21:52 . 2010-04-25 13:36 -------- d-----w- c:\documents and settings\mat\Dane aplikacji\ChomikBox
2010-04-25 15:04 . 2009-09-08 19:23 -------- d-----w- c:\program files\Brother
2010-04-20 05:34 . 2004-08-03 22:42 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-18 13:15 . 2008-10-02 15:47 -------- d-----w- c:\program files\Java
2010-04-15 16:18 . 2008-09-09 18:52 51312 ----a-w- c:\documents and settings\mat\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-04-14 17:18 . 2010-04-14 17:18 503808 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71a86d0f-n\msvcp71.dll
2010-04-14 17:18 . 2010-04-14 17:18 499712 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71a86d0f-n\jmc.dll
2010-04-14 17:18 . 2010-04-14 17:18 348160 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-71a86d0f-n\msvcr71.dll
2010-04-14 17:18 . 2010-04-14 17:18 61440 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1247d6b6-n\decora-sse.dll
2010-04-14 17:18 . 2010-04-14 17:18 12800 ----a-w- c:\documents and settings\mat\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1247d6b6-n\decora-d3d.dll
2010-04-14 16:56 . 2010-04-14 16:56 86016 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NOS\Adobe_Downloads\arh.exe
2010-04-12 15:29 . 2010-04-18 13:15 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-03-29 13:24 . 2010-02-14 15:28 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 13:24 . 2010-02-14 15:28 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-18 14:47 . 2010-03-18 14:47 17760 ----a-w- c:\windows\system32\aspnet_counters.dll
2010-03-18 11:16 . 2010-03-18 11:16 771424 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
2010-03-18 11:16 . 2010-03-18 11:16 70472 ----a-w- c:\windows\system32\dxva2.dll
2010-03-18 11:16 . 2010-03-18 11:16 486216 ----a-w- c:\windows\system32\evr.dll
2010-03-18 08:09 . 2010-03-18 08:09 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-03-18 08:09 . 2010-03-18 08:09 49488 ----a-w- c:\windows\system32\netfxperf.dll
2010-03-18 08:09 . 2010-03-18 08:09 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-03-18 08:09 . 2010-03-18 08:09 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-03-18 07:15 . 2010-03-18 07:15 80720 ----a-w- c:\windows\system32\mfcm100u.dll
2010-03-18 07:15 . 2010-03-18 07:15 80208 ----a-w- c:\windows\system32\mfcm100.dll
2010-03-18 07:15 . 2010-03-18 07:15 770384 ----a-w- c:\windows\system32\msvcr100.dll
2010-03-18 07:15 . 2010-03-18 07:15 743248 ----a-w- c:\windows\system32\msvcp100d.dll
2010-03-18 07:15 . 2010-03-18 07:15 4368720 ----a-w- c:\windows\system32\mfc100u.dll
2010-03-18 07:15 . 2010-03-18 07:15 4342088 ----a-w- c:\windows\system32\mfc100.dll
2010-03-18 07:15 . 2010-03-18 07:15 421200 ----a-w- c:\windows\system32\msvcp100.dll
2010-03-18 07:15 . 2010-03-18 07:15 1498960 ----a-w- c:\windows\system32\msvcr100d.dll
2010-03-18 07:15 . 2010-03-18 07:15 138056 ----a-w- c:\windows\system32\atl100.dll
2004-03-11 11:27 . 2008-09-12 16:04 40960 ----a-w- c:\program files\Uninstall_CDS.exe
1765-05-30 03:37 . 1765-05-30 03:37 4263 --sh--w- c:\windows\windllreg1c.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
2010-02-08 12:28 804136 ----a-w- c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="e:\programy\nTune\nTune\nTuneCmd.exe" [2007-09-04 81920]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-08 13594624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-08 86016]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-12-08 1657376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-10-6 111376]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^oKalendarz v3.05.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\oKalendarz v3.05.lnk
backup=c:\windows\pss\oKalendarz v3.05.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Status Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Status Monitor.lnk
backup=c:\windows\pss\Status Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Uruchamianie pakietu Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Uruchamianie pakietu Office.lnk
backup=c:\windows\pss\Uruchamianie pakietu Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^mat^Menu Start^Programy^Autostart^oKalendarz v3.05.lnk]
path=c:\documents and settings\mat\Menu Start\Programy\Autostart\oKalendarz v3.05.lnk
backup=c:\windows\pss\oKalendarz v3.05.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^mat^Menu Start^Programy^Autostart^Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk]
path=c:\documents and settings\mat\Menu Start\Programy\Autostart\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk
backup=c:\windows\pss\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TOSHIBA Bluetooth Service"=2 (0x2)
"RalinkRegistryWriter"=2 (0x2)
"PnkBstrA"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"Brother XP spl Service"=2 (0x2)
"CPUCooLServer"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\programy\\FlashGet universal\\FlashGet.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"e:\\programy\\Real Alternative\\Media Player Classic\\mplayerc.exe"=
"e:\\programy\\Gadu-Gadu\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\programy\\Office 2007\\Office12\\OUTLOOK.EXE"=
"e:\\programy\\Office 2007\\Office12\\GROOVE.EXE"=
"e:\\programy\\Office 2007\\Office12\\ONENOTE.EXE"=
"e:\programy\Active Sync\rapimgr.exe"= e:\programy\Active Sync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"e:\programy\Active Sync\wcescomm.exe"= e:\programy\Active Sync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"e:\programy\Active Sync\WCESMgr.exe"= e:\programy\Active Sync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"e:\\programy\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R1 ntiomin;ntiomin;c:\windows\system32\drivers\ntiomin.sys [2010-01-03 11392]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\system32\drivers\nxsIO32.sys [2008-09-10 2208]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [2009-11-30 19072]
R3 StkCMini;Syntek AVStream USB2.0 2M WebCam;c:\windows\system32\drivers\StkCMini.sys [2008-09-09 1245056]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [2008-09-09 24576]
S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\mat\USTAWI~1\Temp\TII4.tmp\disk1\BIOSCHK.SYS --> c:\docume~1\mat\USTAWI~1\Temp\TII4.tmp\disk1\BIOSCHK.SYS [?]
S3 RAPIProtocol;Ralink RAPI Protocol Driver;c:\windows\system32\drivers\RAPIProtocol.sys [2009-10-28 16512]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-11-30 779136]
S3 SoftFSB;SoftFSB;\??\c:\documents and settings\mat\Pulpit\SoftFSB.SYS --> c:\documents and settings\mat\Pulpit\SoftFSB.SYS [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Ralink\Common\RalinkRegistryWriter.exe [2009-10-28 75040]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6baab182-7474-11df-99d8-e23e00897a3d}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d70b014c-92e7-11dd-99dc-001e8c432b8b}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-PowerBar - (no file)
.
------- Skan uzupełniający -------
.
uStart Page = google.pl/
IE: &Download All by FlashGet - e:\programy\FlashGet universal\ComDlls\Bhoall.htm
IE: &Download by FlashGet - e:\programy\FlashGet universal\ComDlls\Bholink.htm
IE: E&ksportuj do programu Microsoft Excel - e:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
LSP: c:\windows\system32\ua_lsp.dll
Trusted Zone: mks.com.pl\www
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\documents and settings\mat\Dane aplikacji\Mozilla\Firefox\Profiles\yevpi2cv.default\
FF - plugin: c:\documents and settings\mat\Dane aplikacji\Mozilla\Firefox\Profiles\yevpi2cv.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34}\plugins\npOggX.dll
FF - plugin: c:\documents and settings\mat\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll
FF - plugin: e:\programy\Real Alternative\browser\plugins\nppl3260.dll
FF - plugin: e:\programy\Real Alternative\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-14 17:42
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????????????,?@?,?@?D?????7~????????????&?7~,?@?,?@????? ?????????????9~0?7~????&?7~?x7~x????????x7~???????? ???????????s??|x???0???????????Q?ntA?7~?????????????????,??w???U???????,?@?,?@?????zw7~????4?@?????,?@???@?,?@?3??s??????????????????????@?_??s??@???@
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W%g*_*]
@Class="Shell"
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W%g*_*\OpenWithList]
@Class="Shell"
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows Mobile Disc\U*r*z*d*z*e*n*i*e* *o*p*a*r*t*e* *n*a* *s*y*s*t*e*m*i*e* *W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows Mobile Disc\U*r*z*d*z*e*n*i*e* *o*p*a*r*t*e* *n*a* *s*y*s*t*e*m*i*e* *W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows Mobile Disc\U*r*z*d*z*e*n*i*e* *o*p*a*r*t*e* *n*a* *s*y*s*t*e*m*i*e* *W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows Mobile Disc\U*r*z*d*z*e*n*i*e* *o*p*a*r*t*e* *n*a* *s*y*s*t*e*m*i*e* *W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-2052111302-2025429265-725345543-1003\Software\Microsoft\Windows Mobile Disc\U*r*z*d*z*e*n*i*e* *o*p*a*r*t*e* *n*a* *s*y*s*t*e*m*i*e* *W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:00000002
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'lsass.exe'(876)
c:\windows\system32\ua_lsp.dll
- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
.
Czas ukończenia: 2010-06-14 17:50
ComboFix-quarantined-files.txt 2010-06-14 15:49
ComboFix2.txt 2010-04-24 15:48
Przed: 2 992 168 960 bajtów wolnych
Po: 3 007 184 896 bajtów wolnych
367 --- E O F --- 2010-06-10 05:47
