usuwanie rootkita bagle (flec006. exe) - prośba o spr. loga
Prosze o sprawdzenie loga i pomoc jeżel ktoś ma czas.
Bardzo proszę o analizę loga z Hijackthis - help
Prosze o sprawdzenie loga - wolny net
Prosze o sprawdzenie Loga!!! Napewno Keylogger!!!
Uprzejma prośba o sprawdzenie Loga z HJT
Reklamiarz, trojan?? Proszę o sprawdzenie loga...
Prosze o sprawdzenie loga i instrukcje co dalej...
prosze o sprawdzenie loga HijackThis i ComboFix
1 paĹşdziernika ĹĂłdz
chomiki
Log z kumpla kompa. Zachowanie: brak możliwości instalacji AV, potem żaden się nie odpala, mimo, że usługa włączona, częste zamulenia komputera. Proszę o szybką pomoc!Logfile of HijackThis v1.99.1
Scan saved at 11:58:10, on 2008-08-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus 2008\PsCtrls.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Panda Security\Panda Antivirus 2008\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\CodeStuff\Starter\Starter.exe
C:\Program Files\Panda Security\Panda Antivirus 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vobis.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gozillasearch.com/install_thanks.php
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utw�rz ��cze Ulubione dla urz�dzenia przeno�nego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.vobis.pl/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/r...can_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware....s/as2stubie.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\PsImSvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\Script Blocking\SBServ.exe (file missing)
Ja bym to zafixował, nie znam tego dobrze ale co tam
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware....s/as2stubie.cab
Tak to czysto… profilaktycznie
Fix
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\Script Blocking\SBServ.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
Wklej log tutaj:
http://hijackthis.de
Gdzie ma zainstalowaną Pandę? Jeżeli w innym miejscu niż C:\Program Files\Panda Security\Panda Antivirus 2008, trzeba usunąć wpisy z etykietą "Possibly nasty!". W logach są jeszcze wpisy w Symanteca.
Wklej log tutaj:
http://hijackthis.de
nie zastąpi to analizy ręcznej.. to moze służyć co najwyżej do wstępnego proónania
Dalej go muli, nie otwiera różnych stron, te, które otworzy, zazwyczaj nie do końca
ComboFix:
ComboFix 08-08-30.03 - Administrator 2008-08-31 20:37:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.648 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\clofghls.dll
C:\WINDOWS\system32\1_exception.nls
.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-31 )))))))))))))))))))))))))))))))
.
2008-08-31 20:12 . 2008-08-31 20:12 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-31 19:42 . 2008-08-31 19:42 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-08-31 19:41 . 2008-08-31 19:42 <DIR> d-------- C:\Program Files\Skype
2008-08-31 19:19 . 2008-08-31 19:19 <DIR> d-------- C:\Program Files\HighMAT CD Writing Wizard
2008-08-31 19:05 . 2008-08-31 19:05 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-08-31 19:05 . 2008-08-31 19:05 <DIR> d-------- C:\Documents and Settings\Administrator\Gadu-Gadu
2008-08-31 19:05 . 2008-08-31 19:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gadu-Gadu
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d-------- C:\temp\{8096cb7a-73fa-4b4a-a863-5c8ca3b3c3c7}
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d-------- C:\Program Files\Paragon Software
2008-08-31 09:30 . 2008-08-31 09:31 <DIR> d-------- C:\temp\{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
2008-08-31 08:56 . 2008-08-31 08:56 <DIR> d-------- C:\temp\iss134.tmp
2008-08-31 08:56 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-08-31 08:56 . 2006-08-08 16:25 <DIR> d-------- C:\Documents and Settings\Administrator\iss1446.tmp
2008-08-31 08:56 . 2006-08-11 13:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Otto
2008-08-31 08:56 . 2006-07-10 00:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-08-31 08:56 . 2006-08-09 08:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-08-31 08:56 . 2008-08-31 20:20 <DIR> d-------- C:\Documents and Settings\Administrator
2008-08-31 08:55 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\NetworkService.NT AUTHORITY.000\UserData
2008-08-31 08:55 . 2008-08-31 08:55 <DIR> d--hs---- C:\Documents and Settings\NetworkService.NT AUTHORITY.000
2008-08-31 08:55 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\LocalService.NT AUTHORITY.000\UserData
2008-08-31 08:55 . 2008-08-31 08:55 <DIR> d--hs---- C:\Documents and Settings\LocalService.NT AUTHORITY.000
2008-08-31 00:48 . 2008-08-31 00:48 <DIR> d-------- C:\temp\_is10
2008-08-30 22:48 . 2008-08-30 22:48 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-30 21:30 . 2008-08-31 20:20 4,085,792 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-30 21:30 . 2008-08-31 20:20 294,944 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-30 21:30 . 2008-08-30 21:37 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-08-30 21:30 . 2008-08-30 21:37 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-08-30 21:30 . 2008-08-31 20:20 36,144 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-30 21:30 . 2008-08-31 20:20 2,088 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-30 21:29 . 2008-08-30 21:29 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-08-30 21:29 . 2008-08-30 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-30 21:29 . 2008-08-31 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-30 21:14 . 2008-08-30 21:56 <DIR> d-------- C:\temp\RarSFX0
2008-08-30 21:14 . 2008-02-07 12:03 179,640 --a------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-08-30 21:14 . 2008-03-04 15:59 41,144 --a------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-08-30 21:13 . 2008-08-30 21:13 <DIR> d-------- C:\Program Files\Common Files\Panda Security
2008-08-30 21:02 . 2008-08-31 09:41 3,416 --a------ C:\WINDOWS\system32\PerfStringBackup.TMP
2008-08-30 20:56 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\NetworkService.NT AUTHORITY\UserData
2008-08-30 20:56 . 2008-08-30 20:56 <DIR> d--hs---- C:\Documents and Settings\NetworkService.NT AUTHORITY
2008-08-30 20:56 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\LocalService.NT AUTHORITY\UserData
2008-08-30 20:56 . 2008-08-30 22:34 <DIR> d--hs---- C:\Documents and Settings\LocalService.NT AUTHORITY
2008-08-30 20:56 . 2006-08-09 08:46 <DIR> d---s---- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5\UserData
2008-08-30 20:56 . 2006-08-08 16:25 <DIR> d-------- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5\iss1446.tmp
2008-08-30 20:56 . 2006-08-11 13:53 <DIR> d-------- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5\Application Data\Otto
2008-08-30 20:56 . 2006-07-10 00:05 <DIR> d-------- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5\Application Data\Media Player Classic
2008-08-30 20:56 . 2006-08-09 08:39 <DIR> d-------- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5\Application Data\AdobeUM
2008-08-30 20:56 . 2008-08-31 07:49 <DIR> d-------- C:\Documents and Settings\Administrator.TWOJA-966CD6AF5
2008-08-29 20:29 . 2005-12-02 03:20 18,208 --a------ C:\WINDOWS\system32\drivers\hotcore.sys
2008-08-29 20:20 . 2008-08-29 20:20 0 --a------ C:\WINDOWS\WinPM.INI
2008-08-29 20:18 . 2004-09-03 10:53 3,870,720 --a------ C:\WINDOWS\system32\qt-mt323.dll
2008-08-29 20:16 . 2008-08-31 18:00 1,484 --a------ C:\WINDOWS\unins000.dat
2008-08-29 19:58 . 2008-08-29 19:58 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-08-29 19:58 . 2008-08-29 19:58 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-08-29 19:24 . 2006-12-16 22:36 16,384 --a------ C:\WINDOWS\system32\grwinsthlp.exe
2008-08-29 19:13 . 2008-08-29 19:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-29 19:13 . 2008-08-29 19:13 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-29 15:31 . 2008-08-31 19:54 <DIR> d-------- C:\Do przeniesienia
2008-08-29 11:40 . 2008-08-29 11:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\sentinel
2008-08-29 10:17 . 2008-08-30 21:18 151 --a------ C:\WINDOWS\AvDetected.ini
2008-08-26 13:00 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-26 12:43 . 2008-08-26 12:43 0 --a------ C:\WINDOWS\mozver.dat
2008-08-26 12:08 . 2008-08-26 12:08 129,507 --a------ C:\WINDOWS\PixArt.rar
2008-08-19 05:24 . 2008-08-29 20:03 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-23 19:33 . 2008-07-23 19:35 58 --a------ C:\WINDOWS\DeskToppers.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 18:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-29 17:28 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-08-29 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-29 16:59 --------- d-----w C:\Program Files\Common Files\Real
2008-08-29 13:15 --------- d-----w C:\Program Files\Multimedia Card Reader
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2007-12-04 20:13 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56 64512]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 18:21 201992]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"=
R0 hotcore;hotcore;C:\WINDOWS\system32\drivers\hotcore.sys [2005-12-02 03:20]
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 11:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11:39]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\BlueScrn\BioNT_bs.sys [2005-12-02 04:25]
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
2008-08-29 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer.job
- C:\PROGRA~1\Norton SystemWorks\Norton Antivirus\Navw32.exe []
2008-08-31 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE []
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
HKLM-Run-SSC_UserPrompt - C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
HKLM-Run-TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.vobis.pl/
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.idg.pl/news/97555.html
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 20:40:07
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-31 20:41:04
ComboFix-quarantined-files.txt 2008-08-31 18:41:00
Pre-Run: 66,190,512,128 bytes free
Post-Run: 66,493,394,944 bajtów wolnych
152
