witam ;]
mialam problem z programem podanym jako tytul tematu i sama postanowilam poszukac rozwiazania <wszyscy dobrze wiemy, ze internet to kopalnia zlota wiec szybko znalazłam pare watkow dotyczacych zagadnienia... i szczerze mowiac niewiele z nich zrozumialam <do teraz do konca nie wiem co to sa logi... dla scislosci uruchomilam ComboFixa jakies 30 min temu i wlasnie ciesze sie 'zdrowym' systemem <ale czy oby na pewno>
w watkach ktore znalazlam pisze, aby umiescic loga na stronie co ma ulatwic jego interpretacje osobie, ktora nam pomogla - tylko maly myk sie pojawia - skoro sama sobie pomoglam to czy teraz bedzie ktos kto zinterpretuje mojego loga <ponizej>?
z gory dziekuje
ComboFix 10-09-01.04 - Olimpia 02/09/2010 23:31:32.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.353.1033.18.3038.2108 [GMT 1:00]
Running from: c:\users\Olimpia\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201
c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201\enemies-names.txt
c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201\local.ini
c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201\mediafix70700en02e.exe
c:\users\Olimpia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
c:\users\Olimpia\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk
c:\users\Olimpia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
c:\users\Olimpia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
c:\users\Olimpia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
c:\users\Olimpia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk
c:\users\Olimpia\Desktop\Antimalware Doctor.lnk
Infected copy of c:\windows\system32\drivers\crcdisk.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2010-08-02 to 2010-09-02 )))))))))))))))))))))))))))))))
.
2010-09-02 22:40 . 2010-09-02 22:41 -------- d-----w- c:\users\Olimpia\AppData\Local\temp
2010-09-02 22:40 . 2010-09-02 22:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\UC.PIF
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\RAR.PIF
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\PKZIP.PIF
2010-09-02 21:44 . 2010-09-02 21:45 -------- d-----w- C:\totalcmd
2010-09-02 21:44 . 2010-09-02 21:44 -------- d-----w- c:\users\Olimpia\AppData\Roaming\GHISLER
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\LHA.PIF
2010-09-02 21:44 . 2010-07-07 06:55 545 ----a-w- c:\windows\ARJ.PIF
2010-08-18 16:30 . 2010-08-18 16:30 170584 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\prloader.dll
2010-08-18 16:30 . 2010-08-18 16:30 340520 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\avp.exe
2010-08-12 06:20 . 2010-05-27 19:16 81920 ----a-w- c:\windows\system32\iccvid.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-02 22:24 . 2009-03-19 16:34 12 ----a-w- c:\windows\bthservsdp.dat
2010-09-02 22:17 . 2010-04-11 22:34 -------- d-----w- c:\programdata\Kaspersky Lab
2010-09-02 22:12 . 2010-07-18 20:33 -------- d-----w- c:\users\Olimpia\AppData\Roaming\Azureus
2010-09-01 22:53 . 2010-06-25 09:32 -------- d-----w- c:\users\Olimpia\AppData\Roaming\Skype
2010-09-01 21:30 . 2010-07-18 20:31 -------- d-----w- c:\program files\Vuze
2010-09-01 19:28 . 2010-06-25 09:51 -------- d-----w- c:\users\Olimpia\AppData\Roaming\skypePM
2010-08-27 20:50 . 2010-07-03 21:52 -------- d-----w- c:\programdata\FLEXnet
2010-08-27 20:11 . 2010-08-27 20:11 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-08-21 12:48 . 2010-05-26 18:07 -------- d-----w- c:\programdata\The Official Driver Theory Test
2010-08-13 02:01 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-29 15:48 . 2010-04-11 22:36 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-07-29 15:48 . 2010-04-11 22:36 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-07-18 20:31 . 2010-07-18 20:31 52224 ----a-w- c:\users\Olimpia\AppData\Roaming\Mozilla\Firefox\Profiles\4i2k4fhz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll
2010-07-18 20:31 . 2010-07-18 20:31 101376 ----a-w- c:\users\Olimpia\AppData\Roaming\Mozilla\Firefox\Profiles\4i2k4fhz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll
2010-07-18 20:31 . 2010-07-18 20:31 -------- d-----w- c:\program files\Conduit
2010-07-18 20:31 . 2010-07-18 20:31 -------- d-----w- c:\program files\Vuze_Remote
2010-07-16 10:23 . 2010-06-26 15:58 -------- d-----w- c:\programdata\NOS
2010-06-28 16:17 . 2010-08-12 06:19 833024 ----a-w- c:\windows\system32\wininet.dll
2010-06-28 16:13 . 2010-08-12 06:19 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-06-27 21:36 . 2010-06-27 21:36 53632 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-27 21:31 . 2010-06-27 21:31 71680 ----a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2010-06-25 09:51 . 2010-06-25 09:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-06-24 21:20 . 2010-06-24 21:20 133720 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\mmpprtc.dll
2010-06-21 13:18 . 2010-08-12 06:19 2036736 ----a-w- c:\windows\system32\win32k.sys
2010-06-18 16:43 . 2010-08-12 06:19 36352 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 14:43 . 2010-08-12 06:19 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 14:43 . 2010-08-12 06:19 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-16 15:59 . 2010-08-12 06:19 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-11 15:31 . 2010-08-12 06:19 274432 ----a-w- c:\windows\system32\schannel.dll
2010-06-11 15:30 . 2010-08-12 06:19 1257472 ----a-w- c:\windows\system32\msxml3.dll
2010-06-08 16:47 . 2010-08-12 06:19 3600784 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-08 16:47 . 2010-08-12 06:19 3548552 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-07-03 15:31 . 2010-02-09 19:59 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2010-06-13 18:10 2734688 ----a-w- c:\program files\Vuze_Remote\tbVuze.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-12-22 274432]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2005-03-31 790528]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-06 6703648]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2008-09-30 122880]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-12-18 317288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-03 30192]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-05-04 26112]
"AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2009-03-09 1101824]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-08-18 340520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-1-24 780840]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-01-19 19:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-03 30192]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-02-05 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-02-05 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-02-05 390440]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-02-05 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-02-05 91432]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-01-17 83240]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-11-03 21520]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-12-08 169312]
S2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2008-12-22 303104]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService.exe [2009-01-06 109088]
S2 uCamMonitor;CamMonitor;c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2008-12-19 415592]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-01-14 5184872]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-01-19 394536]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-24 17920]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-02-10 29736]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-29 3664384]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2008-11-19 9344]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNYT&bmod=EU01
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNYT&bmod=SNYT
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {4BE3719A-9278-4428-ACED-DFE7594DB38B} = 62.231.32.10,62.231.32.11
FF - ProfilePath - c:\users\Olimpia\AppData\Roaming\Mozilla\Firefox\Profiles\4i2k4fhz.default\
FF - prefs.js: browser.startup.homepage - hxxp://ling.pl/index.html
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - component: c:\users\Olimpia\AppData\Roaming\Mozilla\Firefox\Profiles\4i2k4fhz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll
FF - component: c:\users\Olimpia\AppData\Roaming\Mozilla\Firefox\Profiles\4i2k4fhz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-mediafix70700en02.exe - c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201\mediafix70700en02.exe
HKCU-Run-mediafix70700en02e.exe - c:\users\Olimpia\AppData\Roaming\7AD7588D49AB4F60C053E38F309F6201\mediafix70700en02e.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-02 23:41
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b4
.
Completion time: 2010-09-02 23:45:04
ComboFix-quarantined-files.txt 2010-09-02 22:45
Pre-Run: 106,731,827,200 bytes free
Post-Run: 109,051,744,256 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8,11
- - End Of File - - 94C72F12F192E44C5734FC7416C7264C
