- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:43, on 2009-03-23
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\Gadu-Gadu\spellchecker_gg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: YouTube To ALLPlayer - {61DB16C5-B733-43F4-872E-B20DC9E72740} - C:\PROGRA~1\ALLPLA~1\YOUTUB~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: is-11DN8.lnk = C:\Documents and Settings\My\Pulpit\Virus Removal Tool\is-11DN8\startup.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - E:\Gry\Poker\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{998522C0-E24C-44F5-91FD-8BFFD528B5E8}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
--
End of file - 6126 bytes
EDIT: OK, oto log z ComboFixa:
- Kod: Zaznacz wszystko
ComboFix 09-03-22.01 - My 2009-03-23 22:24:09.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2047.1406 [GMT 1:00]
Uruchomiony z: c:\documents and settings\My\Pulpit\ComboFix.exe
FW: Sunbelt Personal Firewall *enabled*
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Pliki utworzone od 2009-02-23 do 2009-03-23 )))))))))))))))))))))))))))))))
.
2009-03-23 19:58 . 2009-03-23 19:58 <DIR> d-------- c:\program files\Trend Micro
2009-03-23 19:25 . 2009-03-23 19:25 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-23 19:25 . 2009-03-23 19:25 <DIR> d-------- c:\documents and settings\My\Dane aplikacji\Malwarebytes
2009-03-23 19:25 . 2009-03-23 19:25 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-03-23 19:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-23 19:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-23 19:07 . 2009-03-23 19:10 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-23 19:03 . 2009-03-09 20:06 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-03-23 18:28 . 2009-03-23 18:28 <DIR> d-------- c:\documents and settings\LocalService\Pulpit
2009-03-23 18:24 . 2009-03-09 20:06 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-03-23 18:20 . 2009-03-23 18:20 <DIR> d-------- c:\program files\Lavasoft
2009-03-23 18:20 . 2009-03-23 18:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2009-03-23 18:20 . 2009-03-23 18:20 <DIR> d--h-c--- c:\documents and settings\All Users\Dane aplikacji\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-23 01:08 . 2008-07-08 13:54 148,496 --a------ c:\windows\system32\drivers\87368682.sys
2009-03-22 13:53 . 2009-03-22 13:53 33,824 --a------ c:\windows\system32\drivers\oreans32.sys
2009-03-19 17:03 . 2009-03-19 17:03 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\Xfire
2009-03-17 16:47 . 2009-03-17 16:47 <DIR> d-------- c:\program files\xp-AntiSpy
2009-03-17 00:58 . 2009-03-17 00:58 <DIR> d-------- c:\program files\Video mp3 Extractor
2009-03-11 23:38 . 2009-03-11 23:38 <DIR> d-------- c:\documents and settings\NetworkService\Dane aplikacji\Xfire
2009-03-10 23:17 . 2009-03-20 14:12 <DIR> d-------- c:\program files\Xfire
2009-03-10 23:17 . 2009-03-23 22:28 <DIR> d-------- c:\documents and settings\My\Dane aplikacji\Xfire
2009-02-26 19:47 . 2009-02-26 19:47 42,320 --a------ c:\windows\system32\xfcodec.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-23 21:31 459,845,664 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-23 21:28 5,389,004 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-23 21:28 --------- d-----w c:\documents and settings\My\Dane aplikacji\Skype
2009-03-23 21:28 --------- d-----w c:\documents and settings\My\Dane aplikacji\Hamachi
2009-03-23 20:32 201,440 ----a-w c:\windows\system32\PnkBstrB.exe
2009-03-23 20:32 138,512 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-23 18:10 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2009-03-23 17:27 --------- d-----w c:\documents and settings\My\Dane aplikacji\skypePM
2009-03-19 18:26 --------- d-----w c:\program files\Teamspeak2_RC2
2009-03-18 23:14 --------- d-----w c:\program files\EVEREST Corporate Edition
2009-03-17 15:48 361,600 ----a-w c:\windows\system32\drivers\tcpip.sys
2009-02-26 15:09 --------- d-----w c:\program files\AutoConnect
2009-02-24 17:11 --------- d-----w c:\program files\Gadu-Gadu
2009-02-21 16:01 --------- d-----w c:\documents and settings\My\Dane aplikacji\Nowe Gadu-Gadu
2009-02-16 11:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 10:43 --------- d-----w c:\documents and settings\My\Dane aplikacji\uTorrent
2009-02-09 14:07 1,847,040 ----a-w c:\windows\system32\win32k.sys
2009-02-08 21:32 --------- d-----w c:\documents and settings\My\Dane aplikacji\teamspeak2
2009-01-31 16:38 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2009-01-31 16:01 --------- d-----w c:\program files\Rockstar Games
2009-01-04 20:53 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2009-01-03 14:09 22,328 ----a-w c:\documents and settings\My\Dane aplikacji\PnkBstrK.sys
2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2006-06-23 22:48 32,768 ----a-r c:\windows\inf\UpdateUSB.exe
.
------- Sigcheck -------
2008-06-20 11:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2008-06-20 11:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\$NtServicePackUninstall$\tcpip.sys
2008-04-13 20:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\$NtUninstallKB951748$\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB951748_0$\tcpip.sys
2009-03-17 16:48 361344 155f2c0775641f1c47cfa5e2ed25cfb3 c:\windows\ServicePackFiles\i386\tcpip.sys
2009-03-17 16:48 361600 656002b479e1c84c3d995ed42799f77d c:\windows\system32\dllcache\tcpip.sys
2009-03-17 16:48 361600 656002b479e1c84c3d995ed42799f77d c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-12-10 1412608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\My\Menu Start\Programy\Autostart\
is-11DN8.lnk - c:\documents and settings\My\Pulpit\Virus Removal Tool\is-11DN8\startup.exe [2009-03-23 65536]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk]
backup=c:\windows\pss\DSLMON.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^My^Menu Start^Programy^Autostart^is-DMI7P.lnk]
backup=c:\windows\pss\is-DMI7P.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Energy Saving]
--a------ 2008-01-24 10:02 1352192 c:\program files\ASUS\Ai Suite\EnergySaving\PwSave.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoConnect]
--a------ 2004-08-28 19:27 295424 c:\program files\AutoConnect\AutoConnect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpu Level Up help]
--a------ 2007-11-30 19:03 881152 c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPU Power Monitor]
--a------ 2008-01-09 09:17 627200 c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2008-11-21 14:03 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-12-26 00:08 13680640 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-12-26 00:08 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2009-03-05 16:07 2260480 c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-12-12 19:36 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
--a------ 2008-08-03 15:38 61440 e:\gry\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-12-26 00:08 1657376 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2007-12-20 09:47 16963072 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"e:\\Gry\\ETQW Demo 2\\etqw.exe"=
"e:\\Gry\\ETQW Demo 2\\etqwded.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"=
"c:\\Program Files\\ASUS\\Ai Suite\\EnergySaving\\PwSave.exe"=
"c:\\WINDOWS\\ALCMTR.EXE"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\ASUS\\AASP\\1.00.59\\aaCenter.exe"=
"c:\\Program Files\\AutoConnect\\AutoConnect.exe"=
"e:\\Gry\\Warcraft III\\euroloader.exe"=
"e:\\Gry\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\SbPFCl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"e:\\Gry\\World of Warcraft\\Launcher.exe"=
"c:\\Documents and Settings\\My\\Pulpit\\Krakersik2008\\Krakersik.exe"=
"e:\\Gry\\GRID\\GRID.exe"=
"e:\\Gry\\Call of Duty\\CoD4 Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\Gry\\Grand Theft Auto IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-03-23 64160]
R1 is-11DN8drv;is-11DN8drv;c:\windows\system32\drivers\87368682.sys [2009-03-23 148496]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-18 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [2008-11-18 65576]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [2008-11-07 58288]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 ute5otcy;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\ute5otcy.sys --> c:\windows\system32\Drivers\ute5otcy.sys [?]
.
Zawartość folderu 'Zaplanowane zadania'
2009-03-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 20:06]
.
.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm
TCP: {998522C0-E24C-44F5-91FD-8BFFD528B5E8} = 194.204.159.1,194.204.152.34
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
FF - ProfilePath - c:\documents and settings\My\Dane aplikacji\Mozilla\Firefox\Profiles\kyyxxigz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-23 22:30:22
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\My\USTAWI~1\Temp\ASFWHide"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-73586283-1343024091-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:47,9e,d7,92,8f,0f,b1,5b,8d,54,f1,27,d4,3a,c8,95,b0,c1,3c,6c,92,
29,2f,c5,ab,c7,4f,18,5a,f3,dc,c6,f4,c8,ba,38,92,aa,1f,e6,27,90,de,3c,32,6e,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
.
**************************************************************************
.
Czas ukończenia: 2009-03-23 22:33:05 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-03-23 21:33:00
ComboFix2.txt 2009-03-22 12:41:45
Przed: 1 669 140 480 bajtów wolnych
Po: 1,666,560,000 bajtów wolnych
Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
234 --- E O F --- 2009-03-14 00:23:21
