Prosze o sprawdzeni mojego loga gosci kazał zabym go tu wkle

Dla specjalistów Bezpieczeństwo
#1

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:22:30, on 2009-02-01

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\TweakRAM\TweakRAM.exe

C:\Program Files\EDIMAX\Common\RaUI.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Opera\opera.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [egui] “C:\Program Files\ESET\ESET Smart Security\egui.exe” /hide /waitservice

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [LeechGet] “C:\Program Files\LeechGet 2007\LeechGet.exe” -intray

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-19…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-20…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS\S-1-5-18…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - HKUS.DEFAULT…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘Default user’)

O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe

O4 - Global Startup: Wireless Utility.lnk = C:\Program Files\EDIMAX\Common\RaUI.exe

O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://C:\Program Files\LeechGet 2007\Parser.html

O8 - Extra context menu item: Pobierz używając kreatora LeechGet - file://C:\Program Files\LeechGet 2007\Wizard.html

O8 - Extra context menu item: Pobierz używając LeechGet - file://C:\Program Files\LeechGet 2007\AddUrl.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O17 - HKLM\System\CCS\Services\Tcpip…{3A1C7824-37E2-444C-ABD3-E10848F4625E}: NameServer = 192.168.10.202,194.204.159.1

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–

End of file - 4719 bytes

#2

Podaj log z Combofix. Instrukcja :arrow: viewtopic.php?f=16&t=36654

Logi dajesz na wklej.org lub wklej.eu a w poście podajesz tylko link.

#3

masz tu loga z combofix

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:22:30, on 2009-02-01

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\TweakRAM\TweakRAM.exe

C:\Program Files\EDIMAX\Common\RaUI.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Opera\opera.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM…\Run: [egui] “C:\Program Files\ESET\ESET Smart Security\egui.exe” /hide /waitservice

O4 - HKLM…\Run: [nwiz] nwiz.exe /install

O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM…\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [LeechGet] “C:\Program Files\LeechGet 2007\LeechGet.exe” -intray

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-19…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-20…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS\S-1-5-18…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - HKUS.DEFAULT…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User ‘Default user’)

O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe

O4 - Global Startup: Wireless Utility.lnk = C:\Program Files\EDIMAX\Common\RaUI.exe

O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://C:\Program Files\LeechGet 2007\Parser.html

O8 - Extra context menu item: Pobierz używając kreatora LeechGet - file://C:\Program Files\LeechGet 2007\Wizard.html

O8 - Extra context menu item: Pobierz używając LeechGet - file://C:\Program Files\LeechGet 2007\AddUrl.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O17 - HKLM\System\CCS\Services\Tcpip…{3A1C7824-37E2-444C-ABD3-E10848F4625E}: NameServer = 192.168.10.202,194.204.159.1

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–

End of file - 4719 bytes

– Dodane 01.02.2009 (N) 18:43 –

sorki nie to

ComboFix 09-01-31.03 - God Koyak 2009-02-01 18:37:36.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.511.254 [GMT 1:00]

Uruchomiony z: c:\documents and settings\God Koyak\Pulpit\ComboFix.exe

AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated)

FW: Zapora osobista *enabled*

* Utworzono nowy punkt przywracania

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

D:\Autorun.inf

D:\resycled

d:\resycled\ntldr.com

.

((((((((((((((((((((((((( Pliki utworzone od 2009-01-01 do 2009-02-01 )))))))))))))))))))))))))))))))

.

2009-02-01 18:21 . 2009-02-01 18:21

2009-02-01 16:28 . 2009-02-01 16:28

2009-02-01 16:28 . 2009-02-01 18:04

2009-02-01 16:28 . 2009-02-01 16:28

2009-02-01 16:28 . 2006-11-30 19:30 8,192 --a------ c:\windows\system32\rt2661.bin

2009-02-01 16:28 . 2006-11-30 19:30 8,192 --a------ c:\windows\system32\rt2561s.bin

2009-02-01 16:28 . 2006-11-30 19:30 8,192 --a------ c:\windows\system32\rt2561.bin

2009-02-01 16:27 . 2009-02-01 16:27

2009-02-01 16:09 . 2009-02-01 16:14

2009-02-01 16:01 . 2009-02-01 16:02

2009-02-01 15:17 . 2005-02-25 04:36 22,752 --a------ c:\windows\system32\spupdsvc.exe

2009-02-01 15:14 . 2009-02-01 15:14

2009-02-01 15:14 . 2009-02-01 15:14

2009-02-01 15:14 . 2009-02-01 15:14

2009-02-01 15:13 . 2009-02-01 15:13

2009-02-01 15:13 . 2009-02-01 15:13

2009-02-01 13:52 . 2009-02-01 13:52

2009-02-01 13:52 . 2009-02-01 16:27

2009-02-01 13:52 . 2009-02-01 13:52 25,280 --a------ c:\windows\system32\drivers\hamachi.sys

2009-02-01 07:57 . 2009-02-01 07:57

2009-02-01 07:52 . 2009-02-01 14:11 10 --a------ c:\windows\popcinfo.dat

2009-02-01 07:07 . 2009-02-01 07:07

2009-01-31 17:11 . 2009-01-31 17:29

2009-01-31 17:11 . 2009-01-31 17:11

2009-01-31 17:01 . 2009-02-01 07:53

2009-01-31 15:30 . 2009-01-31 15:38

2009-01-31 15:26 . 2009-01-31 15:23 737,280 --a------ c:\windows\iun6002.exe

2009-01-31 15:23 . 2009-02-01 13:19

2009-01-31 15:07 . 2009-01-31 15:07

2009-01-31 15:05 . 2009-01-31 15:05

2009-01-31 15:05 . 2009-01-31 15:05

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-01 15:28 21,361 ----a-w c:\windows\system32\drivers\AegisP.sys

2009-02-01 15:14 --------- d-----w c:\program files\RALINK

2009-01-31 12:20 --------- d–h--w c:\program files\InstallShield Installation Information

2009-01-31 12:14 --------- d-----w c:\program files\XP Codec Pack

2009-01-31 12:14 --------- d-----w c:\program files\SMPlayer

2009-01-31 12:13 --------- d-----w c:\program files\Opera

2009-01-31 12:12 --------- d-----w c:\program files\ToniArts

2009-01-31 12:09 --------- d-----w c:\documents and settings\God Koyak\Dane aplikacji\DivX

2009-01-31 12:06 --------- d-----w c:\program files\Common Files\Adobe

2009-01-31 12:04 --------- d-----w c:\program files\ACE Mega CoDecS Pack

2009-01-31 12:03 --------- d-----w c:\program files\Common Files\Adobe AIR

2009-01-31 11:58 --------- d-----w c:\program files\DivX

2009-01-31 11:53 --------- d-----w c:\program files\Realtek AC97

2009-01-31 11:53 --------- d-----w c:\program files\Common Files\InstallShield

2009-01-31 11:43 --------- d-----w c:\program files\microsoft frontpage

2009-01-31 11:41 --------- d-----w c:\program files\Usługi online

2009-01-31 11:38 --------- d-----w c:\program files\Windows Media Connect 2

2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll

2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll

2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll

2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll

2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll

2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll

2008-11-29 20:26 991,232 ----a-w c:\windows\system32\VSFilter.dll

2008-11-06 16:37 524,288 ----a-w c:\windows\system32\DivXsm.exe

2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll

2008-11-06 16:37 129,784 ------w c:\windows\system32\pxafs.dll

2008-11-06 16:37 120,056 ------w c:\windows\system32\pxcpyi64.exe

2008-11-06 16:37 118,520 ------w c:\windows\system32\pxinsi64.exe

2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll

2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll

2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx0c.dll

2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx07.dll

2008-11-06 16:33 815,104 ----a-w c:\windows\system32\divx_xx0a.dll

2008-11-06 16:33 802,816 ----a-w c:\windows\system32\divx_xx11.dll

2008-11-06 16:33 684,032 ----a-w c:\windows\system32\DivX.dll

2008-11-06 16:33 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll

.

------- Sigcheck -------

2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3gdr\tcpip.sys

2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3qfe\tcpip.sys

2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]

“TweakRAM”=“c:\program files\TweakRAM\TweakRAM.exe” [2008-09-21 1198080]

“Gadu-Gadu”=“c:\program files\Gadu-Gadu\gg.exe” [2008-03-20 2127296]

“LeechGet”=“c:\program files\LeechGet 2007\LeechGet.exe” [2007-05-31 742912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2005-12-10 7311360]

“egui”=“c:\program files\ESET\ESET Smart Security\egui.exe” [2008-10-24 1451264]

“NvMediaCenter”=“c:\windows\system32\NvMcTray.dll” [2005-12-10 86016]

“SoundMan”=“SOUNDMAN.EXE” [2007-04-16 c:\windows\soundman.exe]

“nwiz”=“nwiz.exe” [2005-12-10 c:\windows\system32\nwiz.exe]

“Tweak UI”=“TWEAKUI.CPL” [2003-03-25 c:\windows\system32\tweakui.cpl]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

“nltide_2”=“shell32” [X]

c:\documents and settings\God Koyak\Menu Start\Programy\Autostart\

hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-02-01 625952]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Wireless Utility.lnk - c:\program files\EDIMAX\Common\RaUI.exe [2009-02-01 716800]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

“NoWelcomeScreen”= 1 (0x1)

“NoSMHelp”= 1 (0x1)

“NoLowDiscSpaceChecks”= 000000000000f03f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

“ForceClassicControlPanel”= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

“msacm.iac2”= c:\progra~1\ACEMEG~1\SystemS\Intel\iac25_32.ax

“msacm.sl_anet”= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm

“vidc.yv12”= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL

“vidc.divx”= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll

“vidc.iyuv”= c:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll

“vidc.yvu9”= c:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll

“vidc.uyvy”= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll

“vidc.yuy2”= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll

“vidc.yvyu”= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll

“msacm.msaudio1”= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

“vidc.ffds”= ffdshow.ax

“msacm.ac3filter”= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\Network Diagnostic\xpnetdiag.exe”=

“%windir%\system32\sessmgr.exe”=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.google.pl

IE: Analizuj za pomocą LeechGet - file://c:\program files\LeechGet 2007\Parser.html

IE: Pobierz używając kreatora LeechGet - file://c:\program files\LeechGet 2007\Wizard.html

IE: Pobierz używając LeechGet - file://c:\program files\LeechGet 2007\AddUrl.html

TCP: {3A1C7824-37E2-444C-ABD3-E10848F4625E} = 192.168.10.202,194.204.159.1

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-01 18:38:59

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów …

skanowanie ukrytych wpisów autostartu …

skanowanie ukrytych plików …

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

Czas ukończenia: 2009-02-01 18:39:57

ComboFix-quarantined-files.txt 2009-02-01 17:39:55

Przed: 5 523 030 016 bajtów wolnych

Po: 5,517,586,432 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect

178 — E O F — 2009-02-01 14:17:31

#4

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=253052

Wykonaj skan Dr. Web CureIt