Witam.
Chciałbym poprosić o pomoc w pokonaniu SALITY, nie mam pojecia co z tym zrobic z robiłem scan Antivirusem i ComboFix’em oto logi:
log z ComboFix’a:
ComboFix 09-03-15.01 - KRUPCZAK 2009-03-17 21:30:09.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.3582.3039 [GMT 1:00]
Uruchomiony z: c:\documents and settings\KRUPCZAK\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\odbcasvc.exe
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ODBCASVC
((((((((((((((((((((((((( Pliki utworzone od 2009-02-17 do 2009-03-17 )))))))))))))))))))))))))))))))
.
2009-03-17 19:21 . 2008-07-08 13:54 148,496 --a------ c:\windows\system32\drivers\43295700.sys
2009-03-17 14:49 . 2009-03-17 14:49 124,688 --a------ c:\windows\system32\mswinsck.ocx
2009-03-17 14:49 . 2009-03-17 14:49 111,104 --a------ c:\windows\system32\uha.exe
2009-03-17 11:31 . 2008-07-08 14:54 148,496 --a------ c:\windows\system32\drivers\60804452.sys
2009-03-16 21:50 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\fa71513.dll
2009-03-16 21:50 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\d7473b.dll
2009-03-16 20:17 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2422279a.dll
2009-03-16 20:17 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\208e1a46.dll
2009-03-16 07:48 . 2009-03-16 07:48
2009-03-16 07:32 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\baf99d2.dll
2009-03-16 07:32 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2b34f4c.dll
2009-03-16 07:07 . 2009-03-17 11:01 111,435 -r-hs---- C:\luk1ylq.com
2009-03-14 17:43 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\6dfc465.dll
2009-03-14 17:43 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2cb7d06.dll
2009-03-14 17:40 . 2009-03-17 20:20
2009-03-14 17:40 . 2009-03-16 07:18
2009-03-14 17:23 . 2009-03-17 20:20
2009-03-14 09:41 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\220c93dd.dll
2009-03-14 09:41 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\107d62c4.dll
2009-03-13 18:05 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\d089b7c.dll
2009-03-13 18:05 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1b7e4ea2.dll
2009-03-13 10:32 . 2009-03-13 10:32 108,968 -r-hs---- C:\xdw.com
2009-03-10 18:26 . 2009-03-12 12:28 107,190 -r-hs---- C:\cb.exe
2009-03-10 15:52 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1b1ac0e9.dll
2009-03-10 15:52 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\14d0276.dll
2009-03-10 15:51 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\4b8dd41.dll
2009-03-10 15:51 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1275344b.dll
2009-03-10 14:30 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\c4ca10f.dll
2009-03-10 14:30 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\6ddff0.dll
2009-03-09 11:49 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\275735f0.dll
2009-03-09 11:49 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\14899d48.dll
2009-03-09 09:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\5b37110.dll
2009-03-09 09:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\172bb200.dll
2009-03-08 18:53 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\704cb52.dll
2009-03-08 18:53 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\17db3861.dll
2009-03-08 15:03 . 2009-03-17 13:27
2009-03-07 17:30 . 2009-03-09 09:05 108,664 -r-hs---- C:\i.com
2009-03-07 14:14 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\99df354.dll
2009-03-07 14:14 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\4e3b008.dll
2009-03-07 11:45 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\355bc9c0.dll
2009-03-07 11:45 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\19338058.dll
2009-03-06 19:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\b3426fb.dll
2009-03-06 19:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\23aca830.dll
2009-03-06 17:57 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\48babbd.dll
2009-03-06 17:57 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\102cc1c3.dll
2009-03-06 12:04 . 2009-03-06 12:04
2009-03-05 10:38 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\ba84c8.dll
2009-03-05 10:38 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\3c42d92.dll
2009-03-03 15:28 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\466a5f0.dll
2009-03-03 15:28 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\18378816.dll
2009-03-03 14:44 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\d82b317.dll
2009-03-03 14:44 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2fc911a8.dll
2009-03-03 14:42 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1ac329a4.dll
2009-03-03 14:42 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\13265f7.dll
2009-03-03 14:36 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\79810d2.dll
2009-03-03 14:36 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\3d7cd5c.dll
2009-03-03 14:32 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\7f54d7.dll
2009-03-03 14:32 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\28a55494.dll
2009-03-02 16:52 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\de078d8.dll
2009-03-02 16:52 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\11e547bc.dll
2009-03-02 16:28 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\aec56e4.dll
2009-03-02 16:28 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\212923a4.dll
2009-03-02 16:26 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\5ac8cb.dll
2009-03-02 16:26 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\26bd5e6.dll
2009-03-02 16:14 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\72f1250.dll
2009-03-02 16:14 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2d7a20b.dll
2009-03-02 14:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\3a63384.dll
2009-03-02 14:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1c6d8b9a.dll
2009-03-02 08:17 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\3985401.dll
2009-03-02 08:17 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2e0bcc4.dll
2009-03-01 21:03 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\edb38dd.dll
2009-03-01 21:03 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\19bccf5a.dll
2009-03-01 18:31 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\90b479a.dll
2009-03-01 18:31 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\10132482.dll
2009-02-28 14:41 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\b7c0c24.dll
2009-02-28 14:41 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\3891b38.dll
2009-02-28 09:31 . 2009-02-28 09:31 108,843 -r-hs---- C:\gi2ky.exe
2009-02-27 12:04 . 2009-03-17 20:20
2009-02-27 12:04 . 2004-03-09 00:00 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX
2009-02-27 12:04 . 2005-10-15 12:32 196,608 --a------ c:\windows\system32\pdfcmnnt.dll
2009-02-27 12:04 . 1998-06-24 00:00 137,000 --a------ c:\windows\system32\MSMAPI32.OCX
2009-02-27 12:04 . 1998-07-06 00:00 23,552 --a------ c:\windows\system32\MSMPIDE.DLL
2009-02-27 11:57 . 2009-02-27 11:57
2009-02-27 00:00 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\30e8d886.dll
2009-02-27 00:00 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\1813cf78.dll
2009-02-26 15:09 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\85b2af0.dll
2009-02-26 15:09 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2b6f3892.dll
2009-02-26 08:23 . 2009-02-26 08:37 103,663 -r-hs---- C:\wx8o0bt1.com
2009-02-25 20:54 . 2007-04-24 11:33 100,488 -ra------ c:\windows\system32\drivers\s125mgmt.sys
2009-02-25 20:54 . 2007-04-24 11:33 98,696 -ra------ c:\windows\system32\drivers\s125obex.sys
2009-02-25 20:53 . 2007-04-24 11:33 108,680 -ra------ c:\windows\system32\drivers\s125mdm.sys
2009-02-25 20:53 . 2007-04-24 11:33 83,336 -ra------ c:\windows\system32\drivers\s125bus.sys
2009-02-25 20:53 . 2007-04-24 11:33 15,112 -ra------ c:\windows\system32\drivers\s125mdfl.sys
2009-02-25 20:53 . 2007-04-24 11:33 12,424 -ra------ c:\windows\system32\drivers\s125whnt.sys
2009-02-25 20:53 . 2007-04-24 11:33 12,424 -ra------ c:\windows\system32\drivers\s125wh.sys
2009-02-25 20:53 . 2007-04-24 11:33 12,424 -ra------ c:\windows\system32\drivers\s125cmnt.sys
2009-02-25 20:53 . 2007-04-24 11:33 12,424 -ra------ c:\windows\system32\drivers\s125cm.sys
2009-02-23 20:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\19ea3cce.dll
2009-02-23 20:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\182c3fe0.dll
2009-02-23 09:25 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\b098a07.dll
2009-02-23 09:25 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2388461a.dll
2009-02-23 09:00 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\e179d6e.dll
2009-02-23 09:00 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\209b2ca0.dll
2009-02-23 08:57 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\2bd75a0d.dll
2009-02-23 08:57 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\22c34408.dll
2009-02-21 17:09 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\176235a8.dll
2009-02-21 17:09 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\14bdcb0e.dll
2009-02-21 16:29 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\a43e540.dll
2009-02-21 16:29 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\867a8ce.dll
2009-02-20 17:59 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\fee9e7e.dll
2009-02-20 17:59 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\236df9d8.dll
2009-02-20 15:34 . 2009-02-20 11:29 106,970 -r-hs---- C:\w2.com
2009-02-20 12:31 . 2008-04-15 13:00 70,144 --a------ c:\windows\AhnRpta.exe
2009-02-19 19:40 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\5c6845.dll
2009-02-19 19:40 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\12a5d686.dll
2009-02-18 21:13 . 2009-03-17 20:20
2009-02-18 21:13 . 2009-02-18 21:13
2009-02-18 20:24 . 2009-03-17 20:20
2009-02-18 20:24 . 2009-02-18 21:14
2009-02-18 18:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\f1a7324.dll
2009-02-18 18:21 . 2008-04-15 13:00 82,432 —h---t- c:\windows\system32\34cbac9d.dll
2009-02-17 11:23 . 2009-02-17 11:23 107,564 -r-hs---- C:\hyetn1i.exe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-17 20:32 42,858,528 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-17 20:31 505,172 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-17 19:20 --------- d-----w c:\program files\RegCure
2009-03-17 19:20 --------- d-----w c:\program files\Common Files\Teleca Shared
2009-03-17 19:20 --------- d-----w c:\program files\Common Files\LightScribe
2009-03-17 18:05 --------- d-----w c:\documents and settings\KRUPCZAK\Dane aplikacji\teamspeak2
2009-03-17 12:36 --------- d–h--w c:\program files\InstallShield Installation Information
2009-02-23 21:45 --------- d-----w c:\documents and settings\KRUPCZAK\Dane aplikacji\uTorrent
2009-02-18 18:24 --------- d-----w c:\program files\NAPI-PROJEKT
2009-02-17 10:23 107,564 --sh–r C:\qphdin.com
2009-02-14 15:10 107,898 --sh–r C:\ur0.com
2009-02-14 10:24 --------- d-----w c:\program files\Rockstar Games
2009-02-13 14:27 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-12 13:15 --------- d-----w c:\documents and settings\KRUPCZAK\Dane aplikacji\Teleca
2009-02-12 13:12 --------- d-----w c:\program files\Sony Ericsson
2009-02-12 13:12 --------- d-----w c:\program files\Common Files\Sony Ericsson Shared
2009-02-12 13:12 --------- d-----w c:\documents and settings\KRUPCZAK\Dane aplikacji\Sony Ericsson
2009-02-12 13:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Teleca
2009-02-12 13:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson
2009-02-12 13:11 --------- d-----w c:\program files\Sony
2009-02-12 08:04 108,067 --sh–r C:\opgde.exe
2009-02-09 12:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NexonEU
2009-02-09 09:21 421,888 ----a-w c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-02-02 19:03 --------- d-----w c:\program files\Common Files\INCA Shared
2009-02-02 18:55 --------- d-----w c:\program files\softnyx
2009-01-31 14:58 109,930 --sh–r C:\a2h2.com
2009-01-31 08:47 109,127 --sh–r C:\hl80c6b1.com
2009-01-24 18:28 --------- d-----w c:\program files\Google
2009-01-22 18:20 107,882 --sh–r C:\w98.com
2009-01-22 14:20 --------- d-s—w c:\program files\Xfire
2009-01-21 23:27 --------- d-----w c:\program files\Winamp Remote
2009-01-21 23:27 --------- d-----w c:\program files\Kalendarz XP
2009-01-21 23:27 --------- d-----w c:\program files\EXPERTool
2008-11-10 23:09 22,328 ----a-w c:\documents and settings\KRUPCZAK\Dane aplikacji\PnkBstrK.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-03-17_13.48.10.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-17 20:32:37 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_430.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
“{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}”= “c:\program files\Winamp Toolbar\winamptb.dll” [2008-07-16 1266992]
[HKEY_CLASSES_ROOT\clsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2008-04-15 15360]
“RGSC”=“d:\gry\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe” [2008-12-15 306088]
“DAEMON Tools Lite”=“d:\programy\DAEMON Tools Lite\daemon.exe” [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2008-05-16 13529088]
“WinampAgent”=“e:\program files\Winamp\winampa.exe” [2008-08-04 36352]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-15 15360]
c:\documents and settings\KRUPCZAK\Menu Start\Programy\Autostart\
is-AGN9S.lnk - c:\documents and settings\KRUPCZAK\Pulpit\Virus Removal Tool\is-AGN9S\startup.exe [2009-03-17 65536]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
“{BB4C402F-882A-4526-8C08-51278EA437C1}”= “c:\windows\system32\afmain1.dll” [2008-04-15 78848]
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Kalendarz XP.lnk
backup=c:\windows\pss\Kalendarz XP.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^KRUPCZAK^Menu Start^Programy^Autostart^Xfire.lnk]
path=c:\documents and settings\KRUPCZAK\Menu Start\Programy\Autostart\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
-r------- 2007-08-29 09:55 1966080 c:\windows\system32\xRaidSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
–a------ 2008-07-24 16:02 490952 d:\programy\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
–a------ 2008-03-20 11:04 2127296 d:\programy\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
-r------- 2007-03-20 07:36 36864 c:\windows\RaidTool\xInsIDE.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a------ 2008-05-16 19:31 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-09-19 11:14 16844800 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
“AntiVirusOverride”=dword:00000001
“FirewallOverride”=dword:00000001
“UacDisableNotify”=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
“AntiVirusOverride”=dword:00000001
“AntiVirusDisableNotify”=dword:00000001
“FirewallDisableNotify”=dword:00000001
“FirewallOverride”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
“UacDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“%windir%\system32\sessmgr.exe”=
“c:\WINDOWS\system32\PnkBstrA.exe”=
“c:\WINDOWS\system32\PnkBstrB.exe”=
“c:\Program Files\uTorrent\uTorrent.exe”=
“d:\Gry\Far Cry 2\bin\FarCry2.exe”=
“d:\Gry\Call of Duty 4 - Modern Warfare\iw3mp.exe”=
“d:\Programy\Gadu-Gadu\gg.exe”=
“d:\Gry\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe”=
“d:\Gry\GTA IV\Grand Theft Auto IV\GTAIV.exe”=
“\\Michal\warrock\WRLauncher.exe”=
“d:\Gry\Grand Theft Auto Vice City\Combat Arms EU\NMService.exe”=
“c:\Documents and Settings\KRUPCZAK\Pulpit\Instalki\Super_Pi\SUPER_PI.EXE”=
“c:\WINDOWS\AhnRpta.exe”=
R1 is-L3CE5drv;is-L3CE5drv;c:\windows\system32\drivers\60804452.sys [2009-03-17 148496]
S1 is-97H9Pdrv;is-97H9Pdrv;c:\windows\system32\DRIVERS\99032400.sys --> c:\windows\system32\DRIVERS\99032400.sys [?]
S1 is-AGN9Sdrv;is-AGN9Sdrv;c:\windows\system32\drivers\43295700.sys [2009-03-17 148496]
S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?]
S3 abp470n5;abp470n5;??\c:\windows\system32\drivers\ntpglu.sys --> c:\windows\system32\drivers\ntpglu.sys [?]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\system32\drivers\s125bus.sys [2009-02-25 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\system32\drivers\s125mdfl.sys [2009-02-25 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\system32\drivers\s125mdm.sys [2009-02-25 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s125mgmt.sys [2009-02-25 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\system32\drivers\s125obex.sys [2009-02-25 98696]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2009-02-12 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [2009-02-12 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [2009-02-12 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [2009-02-12 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [2009-02-12 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [2009-02-12 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [2009-02-12 97704]
.
Zawartość folderu ‘Zaplanowane zadania’
2009-03-17 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe []
2009-02-13 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe []
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.allegro.pl/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\KRUPCZAK\Dane aplikacji\Mozilla\Firefox\Profiles\b315i9pa.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.allegro.pl
FF - component: c:\documents and settings\KRUPCZAK\Dane aplikacji\Mozilla\Firefox\Profiles\b315i9pa.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-17 21:32:44
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1844237615-854245398-682003330-1004\Software\SecuROM\License information*]
“datasecu”=hex:9c,17,c2,19,66,a5,9c,94,f1,01,03,01,d2,d7,da,03,5a,23,99,89,27,
ab,89,df,44,35,54,fe,5b,d8,90,92,2d,99,8a,b3,17,ba,43,a5,7e,98,2a,55,b6,98,\
“rkeysecu”=hex:73,4c,81,91,87,a6,f2,06,0b,a9,7a,f8,d8,9b,dc,6e
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\AhnRpta.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\documents and settings\KRUPCZAK\Pulpit\Virus Removal Tool\is-AGN9S\is-AGN9S.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Czas ukończenia: 2009-03-17 21:34:16 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-03-17 20:34:14
ComboFix2.txt 2009-03-17 12:49:31
ComboFix3.txt 2009-01-22 13:56:09
Przed: 92 971 012 096 bajtów wolnych
Po: 92,955,914,240 bajtów wolnych
340 — E O F — 2009-02-08 23:34:35
PROSZE O POMOC…