tomkiki / 8 lat, 10 miesięcy temu | Download | Plaintext | Odpowiedz |

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
ComboFix 09-01-21.04 - TOMKIKI 2009-02-07 21:47:33.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1250.1.1045.18.2038.1582 [GMT 1:00]
Uruchomiony z: c:\documents and settings\TOMKIKI\Pulpit\ComboFix.exe
AV: System antywirusowy NOD32 2.70 *On-access scanning enabled* (Updated)
FW: ZoneAlarm Pro Firewall *disabled*
 * Utworzono nowy punkt przywracania
 * Resident AV is active


UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\system\S-1-5-21-1482476501-1644491937-682003330-1013
c:\system\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\system\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-01-07 do 2009-02-07  )))))))))))))))))))))))))))))))
.

2009-01-29 19:04 . 2009-01-29 19:04	<DIR>	d--------	c:\documents and settings\All Users\Dane aplikacji\Office Genuine Advantage
2009-01-29 10:35 . 2007-10-01 12:06	451,968	--a------	c:\windows\system32\drivers\rt73.sys
2009-01-29 10:35 . 2009-01-29 10:35	21,419	--a------	c:\windows\system32\drivers\AegisP.sys
2009-01-29 10:34 . 2009-01-29 10:34	<DIR>	d--------	c:\program files\RALINK
2009-01-29 10:34 . 2009-01-29 10:34	<DIR>	d--------	c:\documents and settings\TOMKIKI\Dane aplikacji\InstallShield
2009-01-13 12:23 . 2009-02-07 21:47	<DIR>	dr-hs----	C:\SYSTEM

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 20:31	12,288	----a-w	c:\windows\system32\drivers\nhcDriver.sys
2009-02-07 19:33	---------	d-----w	c:\program files\Mozilla Thunderbird
2009-02-01 21:20	---------	d-----w	c:\program files\FlashGet
2009-01-29 09:34	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-01-26 10:02	---------	d-----w	c:\documents and settings\TOMKIKI\Dane aplikacji\Skype
2009-01-26 09:28	---------	d-----w	c:\documents and settings\TOMKIKI\Dane aplikacji\skypePM
2009-01-13 11:19	---------	d-----w	c:\documents and settings\TOMKIKI\Dane aplikacji\U3
2009-01-09 19:25	2,679,808	----a-w	c:\windows\Internet Logs\xDB8.tmp
2008-12-19 13:52	---------	d-----w	c:\documents and settings\TOMKIKI\Dane aplikacji\InterVideo
2008-12-12 23:45	---------	d-----w	c:\program files\Intel
2008-12-12 23:45	---------	d-----w	c:\program files\Common Files\Intel
2008-12-12 23:28	---------	d-----w	c:\documents and settings\LocalService\Dane aplikacji\Intel
2008-12-12 18:52	0	---ha-w	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-12-12 18:52	0	---ha-w	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2008-12-12 18:47	---------	d-----w	c:\documents and settings\All Users\Dane aplikacji\Nokia
2008-12-12 18:45	---------	d-----w	c:\program files\Nokia
2008-12-12 18:45	---------	d-----w	c:\program files\MSXML 6.0
2008-12-12 18:44	---------	d-----w	c:\program files\Common Files\Nokia
2008-12-12 18:44	---------	d-----w	c:\documents and settings\All Users\Dane aplikacji\Installations
2008-12-12 17:54	---------	d-----w	c:\documents and settings\TOMKIKI\Dane aplikacji\Nokia
2008-12-10 09:06	34,856	----a-w	c:\documents and settings\TOMKIKI\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-12-05 22:44	2,340,864	----a-w	c:\windows\Internet Logs\xDB7.tmp
2008-12-02 15:27	2,344,573	----a-w	c:\windows\Internet Logs\tvDebug.zip
2008-11-13 22:09	3,046,400	----a-w	c:\windows\Internet Logs\xDB5.tmp
2008-11-13 22:08	2,021,888	----a-w	c:\windows\Internet Logs\xDB6.tmp
2008-09-17 12:19	32	----a-w	c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2005-08-01 1093632]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"NotebookHardwareControl"="c:\program files\Notebook Hardware Control\nhc.exe" [2006-09-01 2228224]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-09-17 949376]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-02 1368064]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-02 1191936]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-08-11 07:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"idsvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-09-17 15424]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-17 7168]
S3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\drivers\GCXX.sys [2008-10-03 112640]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\drivers\GCXXNet.sys [2008-10-03 53248]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f97d848-e6c7-11dd-bed5-001a145c18cc}]
\Shell\AutoRun\command - G:\v63enh.exe
\Shell\open\Command - G:\v63enh.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd4e1e31-e163-11dd-bec9-001a145c18cc}]
\Shell\AutoRun\command - h:\system\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
\Shell\open\command - h:\system\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C643131}]
c:\system\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
.
- - - - USUNIĘTO PUSTE WPISY - - - -

Notify-WgaLogon - (no file)


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www./
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Ściągnij przy pomocy FlashGet'a - c:\program files\FlashGet\jc_link.htm
IE: Ściągnij wszystko przy pomocy FlashGet'a - c:\program files\FlashGet\jc_all.htm
LSP: c:\windows\system32\imon.dll
TCP: {62570E07-027C-40FA-A698-DA2997FA72EB} = 156.17.81.100,62.233.128.17
FF - ProfilePath - c:\documents and settings\TOMKIKI\Dane aplikacji\Mozilla\Firefox\Profiles\di0ytobd.default\
FF - prefs.js: browser.search.selectedEngine - Allegro
FF - prefs.js: browser.startup.homepage - hxxp://www.gazeta.pl/
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 21:47:50
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...  

skanowanie ukrytych wpisów autostartu ... 

skanowanie ukrytych plików ...  

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'lsass.exe'(796)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Czas ukończenia: 2009-02-07 21:49:01
ComboFix-quarantined-files.txt  2009-02-07 20:48:58

Przed: 7 188 119 552 bajtów wolnych
Po: 7,894,401,024 bajtów wolnych

166