Wštki
mateusz455 - Pon Kwi 28, 2008 1:57 pm
Witam, bardzo prosze o pomoc i sprawdzenie mojego loga z combofixa. Dodatkowo moge napisać że przy załączaniu komputera jak juz sie załaduje Windows wyskakuje mi taki komunikat:
"Instrukcja spod "0x10011faf" odwołuje się do pamięci pod adresem "0x000000ff". Pamiec nie moze być "read". Kliknij przycisk OK aby przerwać działanie aplikacji"
A OTO MÓJ LOG Z COMBOFIX'a
ComboFix 08-04-27.3 - Mateusz 2008-04-28 15:46:08.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.243 [GMT 2:00]
Running from: C:\Documents and Settings\Mateusz\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINNT\system32\amvo.exe
C:\WINNT\system32\amvo0.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_6TO4
-------\Service_6to4
((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-28 )))))))))))))))))))))))))))))))
.
2008-04-25 21:03 . 2008-04-25 21:03 <DIR> d-------- C:\Program Files\Common Files\LogiShared
2008-04-25 21:03 . 2008-04-25 21:03 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Logitech
2008-04-25 21:03 . 2008-04-25 21:03 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Leadertech
2008-04-25 21:02 . 2008-04-25 21:02 0 --ah----- C:\WINNT\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-04-25 21:02 . 2008-04-25 21:02 0 --ah----- C:\WINNT\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-04-25 21:01 . 2008-04-25 21:01 <DIR> d----c--- C:\WINNT\system32\DRVSTORE
2008-04-25 21:01 . 2007-04-11 15:33 1,419,024 --a------ C:\WINNT\system32\WdfCoInstaller01005.dll
2008-04-25 21:01 . 2007-04-11 15:32 56,080 --a------ C:\WINNT\KHALMNPR.Exe
2008-04-25 21:01 . 2007-04-11 15:32 36,112 --a------ C:\WINNT\system32\drivers\LMouFilt.Sys
2008-04-25 21:01 . 2007-04-11 15:32 34,832 --a------ C:\WINNT\system32\drivers\LHidFilt.Sys
2008-04-25 21:00 . 2008-04-25 21:00 <DIR> d-------- C:\Program Files\Logitech
2008-04-25 21:00 . 2008-04-25 21:01 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-04-25 21:00 . 2008-04-25 21:00 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\InstallShield
2008-04-25 21:00 . 2008-04-25 21:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Logitech
2008-04-25 21:00 . 2007-04-23 04:00 163,840 --a------ C:\WINNT\system32\kemutb.dll
2008-04-25 21:00 . 2007-04-23 04:00 135,168 --a------ C:\WINNT\system32\KemUtil.dll
2008-04-25 21:00 . 2007-04-23 04:00 110,592 --a------ C:\WINNT\system32\KemWnd.dll
2008-04-25 21:00 . 2007-04-23 04:00 69,632 --a------ C:\WINNT\system32\KemXML.dll
2008-04-25 20:59 . 2008-04-25 20:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LogiShrd
2008-04-25 19:22 . 2004-08-03 23:08 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys
2008-04-25 19:22 . 2004-08-03 23:08 31,616 --a--c--- C:\WINNT\system32\dllcache\usbccgp.sys
2008-04-23 14:53 . 2004-08-04 00:44 21,504 --a------ C:\WINNT\system32\hidserv.dll
2008-04-23 14:53 . 2004-08-04 00:44 21,504 --a--c--- C:\WINNT\system32\dllcache\hidserv.dll
2008-04-16 12:49 . 2008-04-25 21:32 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-04-16 12:49 . 2008-04-16 12:49 1,409 --a------ C:\WINNT\QTFont.for
2008-04-15 22:45 . 2008-04-15 22:45 <DIR> d-------- C:\Program Files\Konstal 2004
2008-04-15 21:31 . 2008-04-15 21:31 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Thinstall
2008-04-15 21:19 . 2008-04-16 15:03 574 --a------ C:\WINNT\maplev4.ini
2008-04-12 11:07 . 2008-04-12 11:07 <DIR> d-------- C:\WINNT\system32\xircom
2008-04-12 11:07 . 2008-04-12 11:07 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-03-29 18:43 . 2008-03-29 18:46 <DIR> d-------- C:\Program Files\Valve
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-25 19:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-02 15:00 --------- d-----w C:\Program Files\Java
2008-03-19 17:40 --------- d-----w C:\Documents and Settings\Mateusz\Dane aplikacji\SecondLife
2008-03-12 17:37 --------- d-----w C:\Program Files\Opera
2008-02-29 22:13 --------- d-----w C:\Program Files\Gadu-Gadu
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-03 10:43 61952 C:\WINNT\system32\CHDAudPropShortcut.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-30 16:09 737370]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [2005-12-15 11:42 7331840]
"nwiz"="nwiz.exe" [2005-12-15 11:42 1519616 C:\WINNT\system32\nwiz.exe]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2006-04-26 11:37 331776]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624]
"Samsung Common SM"="C:\WINNT\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 09:20 372736]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINNT\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-04 04:44 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2004-08-04 04:44 395776 C:\WINNT\system32\cmd.exe]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 04:33 44544]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-05 14:43:54 11000]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-25 21:00:57 692224]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk
backup=C:\WINNT\pss\BTTray.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 16:57 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
C:\Program Files\Save\Save.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"btwdins"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TC PowerPack\\TOTALCMD.EXE"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows
"3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINNT\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2psvc;Sieć równorzędna;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e66c2dc-0b95-11dd-a87f-0019d2123e32}]
\Shell\AutoRun\command - G:\xyw9tmdj.com
\Shell\explore\Command - G:\xyw9tmdj.com
\Shell\open\Command - G:\xyw9tmdj.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee5e96d4-70f3-11dc-a66e-cbf9381b803d}]
\Shell\AutoRun\command - ta2.cmd
\Shell\explore\Command - ta2.cmd
\Shell\open\Command - ta2.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4d69f6c-7c32-11dc-a691-0019d2123e32}]
\Shell\AutoRun\command - C:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-26 19:20:01 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-28 15:49:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\acs.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
.
**************************************************************************
.
Completion time: 2008-04-28 15:52:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-28 13:52:02
Pre-Run: 8,966,795,264 bajtów wolnych
Post-Run: 8,967,254,016 bajtËw wolnych
166 --- E O F --- 2008-04-09 13:55:33
huber2t - Pon Kwi 28, 2008 2:03 pm
otwórz notatnik i wklej
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]