Wątki
Ryssus - Pi± Lut 29, 2008 7:53 pm
Log combofix
Kod: Zaznacz wszystkoComboFix 08-02-25.3 - User 2008-02-29 20:39:27.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.528 [GMT 1:00]
Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-29 )))))))))))))))))))))))))))))))
.
2008-02-29 18:37 . 2008-02-29 18:37 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2008-02-29 18:37 . 2008-02-29 20:34 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-02-25 14:41 . 2008-02-25 14:41 <DIR> d-------- C:\Downloads
2008-02-25 14:38 . 2008-02-25 14:38 <DIR> d-------- C:\Program Files\Free Download Manager
2008-02-25 14:38 . 2008-02-29 20:41 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Free Download Manager
2008-02-25 14:38 . 2008-02-25 14:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FreeDownloadManager.ORG
2008-02-23 18:31 . 2008-02-23 18:31 <DIR> d-------- C:\Program Files\PSPad editor
2008-02-23 18:31 . 2008-02-23 18:43 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\PSpad
2008-02-21 22:30 . 2001-08-17 21:53 4,992 --a------ C:\WINDOWS\system32\drivers\loop.sys
2008-02-21 22:30 . 2001-08-17 21:53 4,992 --a------ C:\WINDOWS\system32\dllcache\loop.sys
2008-02-15 09:31 . 2008-02-15 09:31 <DIR> d-------- C:\TEMP\Microsoft Virtual PC 2007
2008-02-10 20:53 . 2008-02-10 20:53 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\InstallShield
2008-02-09 20:46 . 2008-02-09 20:46 <DIR> d-------- C:\TEMP\GTAINSTALLER
2008-02-09 20:46 . 2008-02-15 09:31 <DIR> d-------- C:\TEMP
2008-02-09 20:46 . 2008-02-09 20:46 <DIR> d-------- C:\Documents and Settings\User\WINDOWS
2008-02-09 20:46 . 1997-11-19 14:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
2008-02-06 19:35 . 2008-02-06 19:35 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-02-06 17:01 . 2008-02-06 17:01 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-05 21:56 . 2008-02-07 14:55 <DIR> d-------- C:\Program Files\DOSBox-0.72
2008-02-05 19:10 . 2008-02-05 19:11 <DIR> d-------- C:\Program Files\EditPlus 2
2008-02-05 19:10 . 2008-02-05 19:11 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\EditPlus 2
2008-02-05 19:07 . 2008-02-05 19:07 <DIR> d-------- C:\Program Files\MySQL
2008-02-01 08:44 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-01 08:44 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-01 08:44 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-02-01 08:44 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys
2008-02-01 08:44 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-02-01 08:44 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys
2008-01-31 16:10 . 2008-02-17 16:29 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-01-31 14:41 . 2008-01-31 14:41 <DIR> d-------- C:\Program Files\directx
2008-01-31 14:28 . 2008-01-31 14:38 139,264 --a------ C:\WINDOWS\War3Unin.exe
2008-01-31 14:28 . 2008-01-31 14:39 42,462 --a------ C:\WINDOWS\War3Unin.dat
2008-01-31 14:28 . 2008-01-31 14:38 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-01-31 14:17 . 2008-01-31 14:17 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\InterVideo
2008-01-31 14:13 . 2008-01-31 14:13 <DIR> d-------- C:\WINDOWS\Sun
2008-01-31 00:40 . 2008-02-09 01:50 50,042 --a------ C:\WINDOWS\php.ini
2008-01-31 00:38 . 2007-07-09 14:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-31 00:31 . 2008-01-31 00:53 <DIR> d-------- C:\Program Files\WebSerer
2008-01-31 00:23 . 2008-01-31 00:23 <DIR> d--hs---- C:\Documents and Settings\User\UserData
2008-01-30 23:46 . 2008-01-30 23:46 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-30 23:46 . 2008-02-22 23:04 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\skypePM
2008-01-30 23:46 . 2008-01-30 23:46 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-01-30 09:28 . 2008-02-05 23:27 454 -r-hs---- C:\autorun.inf
2008-01-29 13:16 . 2003-07-16 14:27 43,264 --------- C:\WINDOWS\system32\drivers\ser2pl.sys
2008-01-29 13:08 . 2008-02-15 16:17 185 --a------ C:\WINDOWS\mdm.ini
2008-01-29 13:07 . 2008-01-29 13:07 <DIR> d-------- C:\Program Files\Web Publish
2008-01-29 12:56 . 2008-01-29 12:56 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-29 12:54 . 2008-01-29 12:54 <DIR> dr-h----- C:\MSOCache
2008-01-29 12:54 . 2008-01-31 18:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-01-29 12:37 . 2008-01-30 23:46 <DIR> d-------- C:\Program Files\Skype
2008-01-29 12:37 . 2008-02-23 00:04 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Skype
2008-01-29 12:37 . 2008-01-30 23:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-01-29 12:34 . 2008-01-29 12:34 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-01-29 08:01 . 2008-01-29 08:01 60 --a------ C:\WINDOWS\system32\SYSDRV.DAT
2008-01-29 08:00 . 2008-01-29 08:00 <DIR> d-------- C:\WINDOWS\i386
2008-01-29 00:46 . 2008-01-29 00:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-01-29 00:46 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-01-29 00:43 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-01-29 00:43 . 2008-02-24 15:55 947 --a------ C:\WINDOWS\ODBC.INI
2008-01-29 00:42 . 2008-01-29 00:42 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-29 00:42 . 2008-01-29 00:42 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-29 00:39 . 2008-02-27 11:17 <DIR> d-------- C:\totalcmd
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\UC.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\RAR.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\LHA.PIF
2008-01-29 00:39 . 2005-05-31 06:53 545 --a------ C:\WINDOWS\ARJ.PIF
2008-01-29 00:39 . 2008-02-27 12:03 286 --a------ C:\WINDOWS\wincmd.ini
2008-01-29 00:03 . 2008-01-29 00:03 <DIR> d-------- C:\Program Files\Nero
2008-01-29 00:03 . 2008-01-29 00:35 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-29 00:00 . 2008-01-30 23:40 <DIR> d-------- C:\Program Files\Konnekt
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-23 23:07 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\foobar2000
2008-02-10 19:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 11:19 --------- d-----w C:\Program Files\Google
2008-01-30 23:43 155,995 ----a-w C:\WINDOWS\java\Packages\HJFTB39B.ZIP
2008-01-29 06:45 --------- d-----w C:\Program Files\Windows Media Connect
2008-01-29 06:45 --------- d-----w C:\Program Files\Usługi online
2008-01-29 06:44 --------- d-----w C:\Program Files\Synaptics
2008-01-29 06:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-29 06:43 --------- d-----w C:\Program Files\Java
2008-01-29 06:43 --------- d-----w C:\Program Files\Hp
2008-01-29 06:42 --------- d-----w C:\Program Files\Hewlett-Packard
2008-01-29 06:42 --------- d-----w C:\Program Files\Fingerprint Sensor
2008-01-29 06:42 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-29 06:42 --------- d-----w C:\Program Files\Common Files\Java
2008-01-29 06:42 --------- d-----w C:\Program Files\Analog Devices
2008-01-29 06:39 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Symantec
2008-01-29 06:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-01-29 06:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\hpqLog
2008-01-28 22:58 --------- d-----w C:\Program Files\foobar2000
2008-01-28 22:57 --------- d-----w C:\Program Files\Lavasoft
2008-01-28 22:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-01-28 22:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-01-28 22:51 --------- d-----w C:\Program Files\Alwil Software
2008-01-28 22:50 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-01-28 22:50 --------- d-----w C:\Program Files\DAEMON Tools
2008-01-28 22:48 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd1085.sys
2008-01-28 22:48 642,560 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-01-28 22:32 --------- d-----w C:\Program Files\Sonic
2008-01-28 22:32 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-28 22:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-28 22:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-28 22:10 --------- d-----w C:\Program Files\WIDCOMM
2008-01-28 22:09 --------- d-----w C:\Program Files\InterVideo
2008-01-28 22:08 1,814 --sha-r C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Compaq nx7400 (EY508ES#AKD)_YN_0U_QCNU6350ZDX_E410312243_46_I30A2_SHP_VKBC Version 40.17_B68YGU Ver. F.0B_T070418_WXH2_L415_M1016_J80_7Intel_8T2250_91.73_#080128_N14E4170C_(EY508ES#AKD)_XMOBILE_CN10.MRK
2008-01-28 22:07 --------- d-----w C:\Program Files\Skróty programów
2008-01-28 22:04 --------- d-----w C:\Program Files\HPQ
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00 15360]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 22:41 503808]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-30 23:37 171448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 13:06 716800]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03 36975]
"PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.exe" [2006-02-14 10:56 122880]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 19:04 761945]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 13:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 13:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 13:17 118784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 09:49 454656]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 19:12 17920]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 14:39 131072]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 07:03 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-20 14:51 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-01-23 15:11 802816]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 14:43 892928]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2005-11-08 11:59 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00 734872]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-02-15 16:16:02 581693]
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2008-01-28 23:09:17 184320]
Monitor Apache Servers.lnk - C:\Program Files\WebSerer\Apache2.2\bin\ApacheMonitor.exe [2008-01-18 00:38:50 41041]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 19:41 40960 C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\SMINST\\Scheduler.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"E:\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
"E:\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
"E:\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Free Download Manager\\fdm.exe"=
R2 Apache2.2;Apache2.2;"C:\Program Files\WebSerer\Apache2.2\bin\httpd.exe" [2008-01-18 00:37]
R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 09:00]
R3 msloop;Sterownik karty Microsoft Loopback;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 21:53]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-29 20:43:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????W??????(?@???????@
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mdm.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2008-02-29 20:44:56 - machine was rebooted
Trojan był przenoszony pendrivem, stamt±d też pousuwane zostały pliki. Czy jest jeszcze jakie¶ zagrożenie na pendrivie? W trakcie pracy combofix pendrive był włożony do portu usb.
pp3088 - Pi± Lut 29, 2008 8:02 pm
Nie widać ¶ladu wirusa. My¶lę iż nie ma zagrożenia.