Problem windows security


(Partnerkk) #1

MAM PROBLEM PROSZę O POMOC

ComboFix 07-12-31.4 - PAWEŁ 2008-01-03 9:37:27.10 - FAT32 x86 MINIMAL

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.57 [GMT 1:00]

Running from: C:\Documents and Settings\PAWEŁ\Pulpit\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 )))))))))))))))))))))))))))))))

.

2008-01-03 09:41 . 2008-01-03 09:41 39,882 --a------ C:\WINDOWS\system32\spywarewarning.mht

2008-01-02 17:38 . 2008-01-02 17:38

2008-01-02 17:13 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2008-01-02 16:05 . 2008-01-02 16:05

2007-12-31 09:21 . 2007-12-31 09:21

2007-12-28 10:13 . 2007-12-28 10:13

2007-12-27 15:11 . 2007-12-27 15:11

2007-12-20 13:52 . 2007-12-20 13:52

2007-12-11 14:38 . 2007-12-11 14:38

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-11-28 15:30 --------- d-----w C:\Program Files\PITy

2007-11-28 13:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft

2007-11-06 11:58 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVSystemCare

2007-10-23 13:46 57,041 ----a-w C:\RVAXO.reg

2004-10-04 16:28 266 --sh--w C:\Program Files\desktop.ini

2004-10-04 16:28 11,232 ---h--w C:\Program Files\folder.htt

1999-05-17 11:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL

1998-12-09 00:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL

1998-12-09 00:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL

1998-12-09 00:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL

1998-12-09 00:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL

1998-12-09 00:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL

2007-09-24 10:54 371 --sha-w C:\WINDOWS\system32\2352653251.dat

2007-10-01 09:45 48,128 --sh--r C:\WINDOWS\system32\ikhcorec.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]

2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]

[HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Cmaudio"="cmicnfg.cpl" []

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 16:23:32]

Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2006-10-11 11:04:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ConfidentSurf]

C:\Program Files\ConfidentSurf\GDC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

2004-08-04 00:44 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]

2003-10-23 19:51 233472 --a------ C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]

2003-11-07 22:06 176128 --a------ C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 11:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netsv32]

C:\WINDOWS\sv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netzip]

C:\WINDOWS\svzip.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM_Monitor]

C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runsql]

C:\WINDOWS\runsql.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedX]

C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\supelek bogiego]

supb.exe -spr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperRam]

C:\Program Files\SuperRam\SuperRam.exe /start

R2 MSSQL$INSERTGT;MSSQL$INSERTGT;C:\Program Files\Microsoft SQL Server\MSSQL$INSERTGT\Binn\sqlservr.exe [2002-12-17 16:26]

R2 TrkWksNtmsSvc;Klient śledzenia łączy rozproszonych TrkWksNtmsSvc;C:\WINDOWS\system32\ikhcorec.exe srv []

R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2005-12-22 14:45]

S2 CryptSvcCryptSvc;Usługi kryptograficzne CryptSvcCryptSvc;C:\WINDOWS\system32\ikhcorep.exe srv []

S2 ProtectedStorageSSDPSRV;Magazyn chroniony ProtectedStorageSSDPSRV;C:\WINDOWS\system32\nslookupj.exe srv []

S2 SwPrvAudioSrv;MS Software Shadow Copy Provider SwPrvAudioSrv;C:\WINDOWS\system32\wbemj.exe srv []

S3 SQLAgent$INSERTGT;SQLAgent$INSERTGT;C:\Program Files\Microsoft SQL Server\MSSQL$INSERTGT\Binn\sqlagent.EXE [2002-12-17 16:23]

S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\System32\ZDCndis5.SYS []

.

**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-03 09:43:34

Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-03 9:47:06 - machine was rebooted [PAWEť]

C:\qoobox\ComboFix2.txt 2007-10-08 12:07:26

C:\qoobox\ComboFix3.txt 2007-09-25 12:18:46