Analiza loga z ComboFixa

[mR.Sepi 0]

ComboFix 11-06-08.01 - PC 2011-06-08  21:31:54.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1791.1161 [GMT 2:00]
Uruchomiony z: c:\documents and settings\PC\Pulpit\ComboFix.exe
.
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2011-05-08 do 2011-06-08  )))))))))))))))))))))))))))))))
.
.
2011-06-08 17:56 . 2011-06-08 17:56	--------	d-----w-	c:\documents and settings\PC\DoctorWeb
2011-05-25 15:34 . 2011-05-25 15:34	--------	d-----w-	c:\documents and settings\PC\Ustawienia lokalne\Dane aplikacji\AMD
2011-05-22 16:03 . 2011-05-22 16:03	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Symantec
2011-05-22 15:25 . 2006-07-01 21:32	43520	----a-w-	c:\windows\system32\drivers\AmdK8.sys
2011-05-22 10:08 . 2011-05-22 10:08	--------	d-----w-	C:\unzipped
2011-05-22 09:54 . 2011-05-22 09:54	--------	d-----w-	c:\program files\Gadu-Gadu
2011-05-22 09:33 . 2011-05-22 09:33	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\PC Tools
2011-05-22 08:49 . 2011-05-22 08:49	--------	d-----w-	c:\documents and settings\PC\Ustawienia lokalne\Dane aplikacji\Symantec
2011-05-22 07:04 . 2011-05-22 07:04	--------	d--h--w-	c:\windows\system32\GroupPolicy
2011-05-22 06:44 . 2011-05-22 06:44	--------	d-----w-	c:\documents and settings\PC\Ustawienia lokalne\Dane aplikacji\Downloaded Installations
2011-05-22 06:26 . 2010-01-20 21:03	36400	----a-r-	c:\windows\system32\drivers\SymIM.sys
2011-05-22 06:26 . 2011-05-22 11:35	60808	----a-w-	c:\windows\system32\S32EVNT1.DLL
2011-05-22 06:26 . 2011-05-22 11:35	--------	d-----w-	c:\program files\Symantec
2011-05-22 06:26 . 2011-05-22 11:35	124976	----a-w-	c:\windows\system32\drivers\SYMEVENT.SYS
2011-05-22 06:26 . 2011-05-22 06:29	--------	d-----w-	c:\program files\Common Files\Symantec Shared
2011-05-22 06:25 . 2011-05-22 14:41	--------	d-----w-	c:\windows\system32\drivers\NIS
2011-05-22 06:25 . 2011-05-22 06:25	--------	d-----w-	c:\program files\Norton Internet Security
2011-05-22 06:25 . 2011-05-22 06:25	--------	d-----w-	c:\program files\Windows Sidebar
2011-05-22 06:25 . 2011-05-22 06:26	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Norton
2011-05-22 06:19 . 2011-05-22 06:25	--------	d-----w-	c:\program files\NortonInstaller
2011-05-22 04:05 . 2011-05-22 04:05	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-05-20 23:42 . 2011-05-22 03:53	--------	d-s---w-	c:\documents and settings\Administrator
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-14 16:59 . 2011-05-22 09:59	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-02-01 18:17	1487240	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DF925EF3-7A87-44E4-9CAF-8D7B280BF616}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2011-02-07 1362944]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"IPLA!"="c:\program files\ipla\ipla.exe" [2010-11-15 18633728]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
"Spyware Doctor"="c:\documents and settings\PC\Pulpit\sdasetup_aff.exe" [2011-05-22 512992]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 17331200]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2011-3-2 950272]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2011-5-22 106560]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Documents and Settings\\PC\\Pulpit\\pobierane\\utorrent.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-06-20 717296]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1008000.029\SymEFA.sys [2011-05-22 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1008000.029\BHDrvx86.sys [2011-05-22 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1008000.029\cchpx86.sys [2011-05-22 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Dane aplikacji\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20110518.005\IDSXpx86.sys [2011-05-13 355256]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [2011-05-22 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-24 105592]
S3 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist --> c:\program files\AMD\OverDrive\AODAssist [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-11-29 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-11-29 8320]
S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2011-03-02 450560]
.
--- Inne Usługi/Sterowniki w Pamięci ---
.
*NewlyCreated* - 20744154
*Deregistered* - 20744154
*Deregistered* - Dwsh00000A6D
.
Zawartość folderu 'Zaplanowane zadania'
.
2011-06-08 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-04-29 18:17]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\PC\Dane aplikacji\Mozilla\Firefox\Profiles\uxqzrler.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=UT2V5&o=15158&locale=en_US&apn_uid=3D2EB768-9E05-4D20-B427-8255DD661AFF&apn_ptnrs=UG&apn_sauid=CACF396F-F57E-4F6D-9FC6-EF9F1E544957&apn_dtid=&q=
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.01.06
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
HKLM-Run-CBitSpirit - c:\program files\BitSpirit\BitSpirit.exe
AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-08 21:35
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AODService]
"ImagePath"="c:\program files\AMD\OverDrive\AODAssist"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(1076)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2011-06-08  21:37:07
ComboFix-quarantined-files.txt  2011-06-08 19:36
.
Przed: 15 061 635 072 bajtów wolnych
Po: 20 115 922 944 bajtów wolnych
.
- - End Of File - - 929AB75FCDDB4AC6D91D5B6E1A89CCCE

 

Jakiś syf siedzi w systemie. Usunąłem już TDSSa ale może coś jeszcze siedzi ??

 

Pozdro.

mR.Sepi

[tehawanka 0]

Wklej do systemowego notatnika:

Driver::

20744154

Dwsh00000A6D

Plik zapisz pod nazwą CFScript

Teraz plik przeciągnij i upuść na ikonę ComboFix:

Pokaż log który powstanie podczas usuwania.

[mR.Sepi 0]

Wklej do systemowego notatnika:

 

Plik zapisz pod nazwą CFScript

Teraz plik przeciągnij i upuść na ikonę ComboFix:

Pokaż log który powstanie podczas usuwania.

http://wklej.to/g1MuG

[tehawanka 0]

Log wygląda OK.

Naciśnij klawisz z logo Windows + R i do okienka Uruchamianie wklej to:

 

"c:\documents and settings\PC\Pulpit\ComboFix.exe" /uninstall

 

Foldery tymczasowe wyczyść TFC - Temp File Cleaner

Wyczyść foldery przywracania systemu - Klik