witam jestem tu po raz pierwszy i od razu proszę o pomoc mam prawdopodobnie konia oto mój log z combofixa ComboFix 08-10-30.13 - daro 2008-10-31 20:56:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1179 [GMT 1:00]
Uruchomiony z: C:\Documents and Settings\daro\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-31 )))))))))))))))))))))))))))))))
.
2008-10-31 20:53 . 2008-10-31 20:53
2008-10-31 20:27 . 2004-08-04 13:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-10-31 20:26 . 2008-09-08 11:41 333,824 -----c— C:\WINDOWS\system32\dllcache\srv.sys
2008-10-31 20:26 . 2008-06-14 18:36 273,024 -----c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-10-31 20:26 . 2008-08-14 11:04 138,496 -----c— C:\WINDOWS\system32\dllcache\afd.sys
2008-10-31 20:25 . 2008-08-14 14:26 2,190,464 -----c— C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-31 20:25 . 2008-08-14 14:26 2,146,816 -----c— C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-31 20:25 . 2008-08-14 14:26 2,067,328 -----c— C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-31 20:25 . 2008-08-14 14:26 2,025,472 -----c— C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-31 20:25 . 2008-09-15 16:27 1,846,656 -----c— C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-31 20:25 . 2008-10-15 17:36 337,408 -----c— C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-31 20:24 . 2008-04-11 20:06 691,712 -----c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-10-31 20:24 . 2008-05-01 15:37 331,776 -----c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-10-31 20:24 . 2008-05-08 15:02 203,136 -----c— C:\WINDOWS\system32\dllcache\rmcast.sys
2008-10-31 20:19 . 2008-10-31 20:19 8 --a------ C:\WINDOWS\system32\nvModes.dat
2008-10-31 20:05 . 2008-10-31 20:05
2008-10-31 19:53 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-10-31 19:52 . 2008-10-31 19:53
2008-10-31 19:50 . 2008-10-31 19:50
2008-10-31 19:48 . 2008-10-31 19:48
2008-10-31 19:48 . 2008-10-31 19:48 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-10-31 19:47 . 2008-10-31 19:53
2008-10-31 19:46 . 2008-10-31 19:46
2008-10-31 19:46 . 2008-10-31 19:46
2008-10-31 19:45 . 2008-10-31 19:46
2008-10-31 19:42 . 2008-10-31 20:29
2008-10-31 19:42 . 2008-10-31 19:42
2008-10-31 19:42 . 2008-10-31 19:42
2008-10-31 19:37 . 2008-10-03 18:26 6,066,176 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-31 19:37 . 2007-04-17 10:32 2,455,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-31 19:37 . 2007-03-08 06:11 1,036,288 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-31 19:37 . 2008-08-26 09:26 459,264 -----c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-31 19:37 . 2008-08-26 09:26 383,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-31 19:37 . 2008-08-26 09:26 267,776 -----c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-31 19:37 . 2008-08-26 09:26 63,488 -----c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-31 19:37 . 2008-08-26 09:26 52,224 -----c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-31 19:37 . 2008-08-25 09:38 13,824 -----c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-31 19:34 . 2008-10-31 19:34
2008-10-31 19:34 . 2008-10-31 19:37
2008-10-31 19:27 . 2008-04-14 00:15 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-10-31 19:27 . 2008-04-14 00:15 32,128 --a–c— C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-10-31 19:27 . 2008-04-14 22:50 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-10-31 19:27 . 2008-04-14 22:50 21,504 --a–c— C:\WINDOWS\system32\dllcache\hidserv.dll
2008-10-31 19:27 . 2008-04-14 21:50 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-10-31 19:27 . 2008-04-14 21:50 14,720 --a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-10-31 19:27 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-10-31 19:27 . 2001-10-26 16:57 12,160 --a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2008-10-31 19:27 . 2008-04-14 00:15 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-10-31 19:27 . 2008-04-14 00:15 10,368 --a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-31 16:54 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-10-31 16:52 --------- d-----w C:\Program Files\Winamp
2008-10-31 16:52 --------- d-----w C:\Documents and Settings\daro\Dane aplikacji\Winamp
2008-10-31 16:51 --------- d-----w C:\Program Files\The KMPlayer
2008-10-31 16:49 --------- d-----w C:\Program Files\Real Alternative
2008-10-31 16:49 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2008-10-31 16:48 --------- d-----w C:\Program Files\ffdshow
2008-10-31 16:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-10-31 16:40 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-10-31 16:40 --------- d-----w C:\Program Files\Analog Devices
2008-10-31 16:38 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-31 16:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-10-31 16:26 --------- d-----w C:\Program Files\Usługi online
2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2008-04-14 15360]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 2131392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2005-05-20 925696]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2008-05-16 13529088]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2008-05-16 86016]
“egui”=“C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” [2008-07-01 1447168]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe” [2008-06-10 144784]
“High Definition Audio Property Page Shortcut”=“HDAShCut.exe” [2004-10-27 C:\WINDOWS\system32\HdAShCut.exe]
“nwiz”=“nwiz.exe” [2008-05-16 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2008-04-14 15360]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“C:\Program Files\Skype\Phone\Skype.exe”=
“C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe”=
“C:\Program Files\Gadu-Gadu\gg.exe”=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312]
*Newly Created Service* - PROCEXP90
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\daro\Dane aplikacji\Mozilla\Firefox\Profiles\6pg8xucn.default\
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 20:57:11
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2008-10-31 20:57:40
ComboFix-quarantined-files.txt 2008-10-31 19:57:37
Przed: 9 501 216 768 bajtów wolnych
Po: 9,495,937,024 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect
135 — E O F — 2008-10-31 19:29:17
