|
 |
Sprawdzanie logów
|
 |
|---|
  |
Strona 1 z 1
|
Szopen_hauer
Mejoza
::: 2188 :::
STEAM_0:0:12877712
wiek: 33
|
Zarobaczyło mi strasznie komputer i jestem ciekaw czy ktoś tu potrafi coś wywróżyć z logów z hijackthis i combofix.
Jeśli tak, to bardzo proszę o pomoc:
| Kod: |
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:15:20, on 2012-01-06
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
d:\Programy\AlienGUIse\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Program Files\hijack\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback 3G\razerhid.exe
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [Gadu-Gadu 10] "d:\Programy\Gadu-Gadu 10\gg.exe"
O4 - HKCU\..\Run: [RDReminder] C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe -rem
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.122.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\wbsys.dll
O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: BCL EasyConverter SDK 3 Loader (becldr3Service) - Unknown owner - C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Windows Presentation Foundation Font Cache 4.0.0.0 (WPFFontCache_v0400) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (file missing)
--
End of file - 8215 bytes
|
| Kod: |
ComboFix 12-01-05.02 - Ja 2012-01-05 23:29:50.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.3071.2446 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Ja\Pulpit\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\assembly\tmp
c:\documents and settings\Ja\WINDOWS
c:\windows\IsUn0415.exe
c:\windows\msmqinst.log
c:\windows\unin0411.exe
.
.
((((((((((((((((((((((((( Pliki utworzone od 2011-12-05 do 2012-01-05 )))))))))))))))))))))))))))))))
.
.
2012-01-05 22:15 . 2012-01-05 22:15 388096 ----a-r- c:\documents and settings\Ja\Dane aplikacji\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-01-05 22:15 . 2012-01-05 22:15 -------- d-----w- c:\program files\hijack
2012-01-02 21:02 . 2012-01-02 23:22 -------- d-----w- c:\documents and settings\Ja\Dane aplikacji\BESTplayer
2011-12-31 12:28 . 2011-12-31 12:28 -------- d-----w- c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\Identities
2011-12-27 00:21 . 2011-12-27 00:21 -------- d-----w- c:\program files\NCsoft
2011-12-27 00:20 . 2012-01-05 22:41 -------- d-----w- c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\assembly
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2011-06-14 22:57 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-06-14 22:57 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-06-14 22:57 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-06-14 22:57 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-06-14 22:57 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-06-14 22:57 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-06-14 22:57 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-06-14 22:57 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-06-14 22:57 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-06-14 22:57 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-11-25 07:54 . 2011-06-14 21:00 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 14:40 . 2011-06-14 16:57 1859840 ----a-w- c:\windows\system32\win32k.sys
2011-11-02 14:15 . 2011-09-22 09:42 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-11-02 14:15 . 2011-09-22 09:42 22328 ----a-w- c:\documents and settings\Ja\Dane aplikacji\PnkBstrK.sys
2011-11-02 14:14 . 2011-09-22 09:42 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-11-02 14:14 . 2011-09-22 09:42 107832 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-11-02 14:14 . 2011-11-02 14:14 2337865 ----a-w- c:\windows\system32\pbsvc.exe
2011-11-01 16:07 . 2011-06-14 16:52 1288192 ----a-w- c:\windows\system32\ole32.dll
2011-10-31 23:37 . 2011-06-14 16:57 832512 ----a-w- c:\windows\system32\wininet.dll
2011-10-31 23:37 . 2011-06-14 16:45 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:37 . 2011-06-14 16:44 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-10-31 23:37 . 2011-06-14 16:40 17408 ----a-w- c:\windows\system32\corpol.dll
2011-10-28 05:32 . 2011-06-14 16:40 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2011-06-14 16:51 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-26 10:49 . 2008-04-14 21:59 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2011-06-14 16:42 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2011-06-14 18:30 692736 ----a-w- c:\windows\system32\inetcomm.dll
2010-01-26 10:11 . 2011-11-20 10:03 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-12-11 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu 10"="d:\programy\Gadu-Gadu 10\gg.exe" [2011-07-04 13374048]
"RDReminder"="c:\program files\Dll-Files.com Fixer\DLLFixer.exe" [2011-03-25 1461480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-09 61440]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-04-30 33619968]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-04-21 534528]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Diamondback"="c:\program files\Razer\Diamondback 3G\razerhid.exe" [2007-08-01 147456]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2008-01-23 7766016]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-06-24 159744]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2009-04-01 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2009-04-23 178744]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-01-19 1150976]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2009-01-09 114688]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 21:34 24576 ----a-w- d:\programy\AlienGUIse\fastload.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"d:\\Programy\\uTorrent\\uTorrent.exe"=
"d:\\Gry\\Steam\\Steam.exe"=
"d:\\Programy\\Gadu-Gadu\\gg.exe"=
"d:\\Gry\\Steam\\steamapps\\\\team fortress 2\\hl2.exe"=
"d:\\Gry\\Steam\\steamapps\\\\the ship\\ship.exe"=
"d:\\Gry\\FIFA 11\\Game\\fifa.exe"=
"d:\\Programy\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Programy\\Gadu-Gadu 10\\gg.exe"=
"d:\\Programy\\Sony Ericsson\\Emma\\Emma.exe"=
"d:\\Gry\\Steam\\steamapps\\\\counter-strike\\hl.exe"=
"d:\\Gry\\Soldat\\Soldat.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Gry\\Gruntz\\GRUNTZ.EXE"=
"d:\\Gry\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"d:\\Gry\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"d:\\Gry\\Steam\\steamapps\\\\half-life\\hl.exe"=
"d:\\Gry\\Prince of Persia\\Prince of Persia.exe"=
"d:\\Gry\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"d:\\Gry\\Steam\\steamapps\\common\\oblivion\\OblivionLauncher.exe"=
"d:\\Gry\\Steam\\steamapps\\common\\fallout new vegas enplczru\\FalloutNVLauncher.exe"=
"d:\\Gry\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57395:TCP"= 57395:TCP:Pando Media Booster
"57395:UDP"= 57395:UDP:Pando Media Booster
"54925:UDP"= 54925:UDP:BrotherNetwork Scanner
"57081:TCP"= 57081:TCP:Pando Media Booster
"57081:UDP"= 57081:UDP:Pando Media Booster
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-06-14 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-06-14 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-06-14 20568]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-01-27 50704]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [2011-06-14 89856]
R3 Razerlow;Diamondback 3G USB Filter Driver;c:\windows\system32\drivers\DB3G.sys [2011-06-15 13225]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2011-07-25 27632]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-06-14 1131264]
S3 becldr3Service;BCL EasyConverter SDK 3 Loader;c:\program files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [2011-04-19 176128]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2011-07-25 13224]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2011-10-04 86824]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2011-10-04 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2011-10-04 114600]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2011-10-04 108328]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2011-10-04 26024]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2011-10-04 104616]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2011-10-04 109736]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-07-09 155344]
S3 vproiah;vproiah;c:\windows\system32\drivers\vproiah.sys [2011-09-22 16128]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe --> c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [?]
.
Zawartość folderu 'Zaplanowane zadania'
.
2011-12-29 c:\windows\Tasks\DLL-files.com Fixer_MONTHLY.job
- c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2011-08-28 16:03]
.
2012-01-04 c:\windows\Tasks\DLL-files.com Fixer_UPDATES.job
- c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2011-08-28 16:03]
.
2012-01-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-1035525444-682003330-1003Core.job
- c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-07-25 15:19]
.
2012-01-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-1035525444-682003330-1003UA.job
- c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-07-25 15:19]
.
.
------- Skan uzupełniający -------
.
TCP: DhcpNameServer = 192.168.1.1
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
HKCU-Run-PlayNC Launcher - (no file)
HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe
AddRemove-Kangurek KAO - c:\windows\IsUn0415.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-05 23:42
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...
.
skanowanie ukrytych wpisów autostartu ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skanowanie ukrytych plików ...
.
.
C:\## aswSnx private storage
.
skanowanie pomyślnie ukończone
ukryte pliki: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_USERS\S-1-5-21-842925246-1035525444-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
d:\programy\AlienGUIse\fastload.dll
.
Czas ukończenia: 2012-01-05 23:48:32
ComboFix-quarantined-files.txt 2012-01-05 22:48
.
Przed: 12 764 540 928 bajtów wolnych
Po: 15 046 156 288 bajtów wolnych
.
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[Boot Loader]
timeout=2
Default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="USB Repair NOT to Start Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - ED5DF6324CDF4DEEF5CE700984D2E3D7
|
z góry dzięki
Ostatnio zmieniony przez Szopen_hauer dnia Pią Sty 06, 2012 5:43 pm, w całości zmieniany 1 raz
............................................
Pią Sty 06, 2012 1:13 pm
|
|
 
|
Piotrass
nocny_Gacek
::: 2500 :::
STEAM_0:1:164535
wiek: 40
|
Jak się używa Avasta, to nic dziwnego, że się syfy łapie. Tak na poważnie, to powyłączaj z autostartu te wszystkie zbędne, śmieciowe programy. btw. dobra nazwa profilu "Ja" 
Wywal Avasta, zainstaluj Kasperskiego i wywal z auto startu:
| Kod: |
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
d:\Programy\AlienGUIse\wbload.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe |
a dwa, co to za gówno?! "Dll-Files.com Fixer" ?! lol
| Kod: |
| c:\program files\Dll-Files.com Fixer\ |
trzy, widzę ciekawe gry:
zanim wstawisz takie logi na forum, weź pousuwaj swój login do konta steam bo ktoś może się połasić 
Ostatnio zmieniony przez Piotrass dnia Sob Sty 07, 2012 3:25 pm, w całości zmieniany 1 raz
............................................
Pią Sty 06, 2012 4:26 pm
|
|
|
Szopen_hauer
Mejoza
::: 2188 :::
STEAM_0:0:12877712
wiek: 33
|
no co Ty, w kangurka kao nigdy nie grałeś? Klasyka panie
Ten dll fixer mi się zainstalował przez przypadek przy ściąganiu jakiegoś dlla i jakoś mi się go nie odinstalowało 
login usunę, dzięki za zwrócenie mi uwagi, ale może usuń go też ze swojego posta
............................................
Pią Sty 06, 2012 5:42 pm
|
|
|
Karbulot
Chief O'Brien
::: 33327 :::
STEAM_0:1:204232
wiek: 54
|
Faktycznie, Punkbuster w autostarcie  .
............................................
Pią Sty 06, 2012 7:56 pm
|
|
|
|
Strona 1 z 1
|
| |
Nie możesz pisać nowych tematów
Nie możesz odpowiadać w tematach
Nie możesz zmieniać swoich postów
Nie możesz usuwać swoich postów
Nie możesz głosować w ankietach
|
|
|
|
|
|
|
|
Powered by phpBB © 2001, 2002 phpBB Group
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
