RogueKiller V8.7.6 [Oct 28 2013] od Tigzy mail : tigzyRKgmailcom Dodaj opinię : http://www.adlice.com/forum/ Strona internetowa : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ System Operacyjny : Windows XP (5.1.2600 Dodatek Service Pack 3) 32 bits version Uruchomiono z : Tryb normalny Użytkownik : Właściciel [Uprawnienia Administratora] Tryb : Skanuj -- Data : 10/31/2013 09:17:21 | ARK || FAK || MBR | ¤¤¤ Szkodliwe procesy : 1 ¤¤¤ [ZeroAccess][SERVICE] ???etadpug -- "C:\Program Files\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\ \ \???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" < [x] -> ZATRZYMANO ¤¤¤ Wpisy w Rejestrze : 10 ¤¤¤ [RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\???\???\???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" >) -> ZNALEZIONO [RUN][ZeroAccess] HKUS\S-1-5-21-507921405-1960408961-1801674531-1003\[...]\Run : Google Update ("C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\???\???\???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" >) -> ZNALEZIONO [SERVICE][ZeroAccess] HKLM\[...]\CCSet\[...]\Services : ???etadpug ("C:\Program Files\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\ \ \???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" < [x]) -> ZNALEZIONO [SERVICE][ZeroAccess] HKLM\[...]\CS001\[...]\Services : ???etadpug ("C:\Program Files\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\ \ \???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" < [x]) -> ZNALEZIONO [SERVICE][ZeroAccess] HKLM\[...]\CS002\[...]\Services : ???etadpug ("C:\Program Files\Google\Desktop\Install\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\ \ \???ﯹ๛\{b18ed660-06a9-4537-fd13-110bc05bf2b7}\GoogleUpdate.exe" < [x]) -> ZNALEZIONO [HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> ZNALEZIONO [HJ SECU][PUM] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> ZNALEZIONO [HJ SECU][PUM] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> ZNALEZIONO [HJ SECU][PUM] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> ZNALEZIONO [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> ZNALEZIONO ¤¤¤ Zaplanowane zadania : 0 ¤¤¤ ¤¤¤ Wpisy startowe : 0 ¤¤¤ ¤¤¤ przeglądarki internetowe : 0 ¤¤¤ ¤¤¤ Pliki / Foldery: ¤¤¤ [ZeroAccess][łączenie] Backup : C:\Program Files\Microsoft Security Client\Backup >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] DbgHelp.dll : C:\Program Files\Microsoft Security Client\DbgHelp.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] Drivers : C:\Program Files\Microsoft Security Client\Drivers >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] en-us : C:\Program Files\Microsoft Security Client\en-us >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] EppManifest.dll : C:\Program Files\Microsoft Security Client\EppManifest.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] LegitLib.dll : C:\Program Files\Microsoft Security Client\LegitLib.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpAsDesc.dll : C:\Program Files\Microsoft Security Client\MpAsDesc.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpClient.dll : C:\Program Files\Microsoft Security Client\MpClient.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpCmdRun.exe : C:\Program Files\Microsoft Security Client\MpCmdRun.exe >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpCommu.dll : C:\Program Files\Microsoft Security Client\MpCommu.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpEvMsg.dll : C:\Program Files\Microsoft Security Client\MpEvMsg.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpOAv.dll : C:\Program Files\Microsoft Security Client\MpOAv.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpRTP.dll : C:\Program Files\Microsoft Security Client\MpRTP.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MpSvc.dll : C:\Program Files\Microsoft Security Client\MpSvc.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MsMpCom.dll : C:\Program Files\Microsoft Security Client\MsMpCom.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MsMpEng.exe : C:\Program Files\Microsoft Security Client\MsMpEng.exe >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MsMpLics.dll : C:\Program Files\Microsoft Security Client\MsMpLics.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MsMpRes.dll : C:\Program Files\Microsoft Security Client\MsMpRes.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] msseces.exe : C:\Program Files\Microsoft Security Client\msseces.exe >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] MsseWat.dll : C:\Program Files\Microsoft Security Client\MsseWat.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] pl-pl : C:\Program Files\Microsoft Security Client\pl-pl >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] Setup.exe : C:\Program Files\Microsoft Security Client\Setup.exe >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] SetupRes.dll : C:\Program Files\Microsoft Security Client\SetupRes.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] shellext.dll : C:\Program Files\Microsoft Security Client\shellext.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] SqmApi.dll : C:\Program Files\Microsoft Security Client\SqmApi.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] SymSrv.dll : C:\Program Files\Microsoft Security Client\SymSrv.dll >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][łączenie] SymSrv.yes : C:\Program Files\Microsoft Security Client\SymSrv.yes >> \systemroot\system32\config [-] --> ZNALEZIONO [ZeroAccess][skoroszyt] Install : C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Desktop\Install [-] --> ZNALEZIONO [ZeroAccess][skoroszyt] Install : C:\Program Files\Google\Desktop\Install [-] --> ZNALEZIONO ¤¤¤ Sterownik : [ZAŁADOWANY] ¤¤¤ [Inline] EAT @explorer.exe (?_Clocptr@_Locimp@locale@std@@0PAV123@A) : MSVCP60.dll -> HOOKED (Unknown @ 0x5E0B386D) ¤¤¤ Gałąź rejestru (offline): ¤¤¤ ¤¤¤ Infekcja : ZeroAccess ¤¤¤ ¤¤¤ Plik HOSTS: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ Sprawdzenie MBR: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD3200AAJS-08L7A0 +++++ --- User --- [MBR] cb03ff0af38ed3279d45d5fdf3fb245e [BSP] 6ee36bae069c87712f8277aee5a7d341 : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 99998 Mo 1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 204796620 | Size: 205236 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE2 @ USB) SanDisk Cruzer Edge USB Device +++++ --- User --- [MBR] a124dc1f32b91ceacb765c7a5ad6ec2e [BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code Partition table: 0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 15266 Mo User = LL1 ... OK! Error reading LL2 MBR! Zakończono : << RKreport[0]_S_10312013_091721.txt >>