mozna to jako naprawic ? bo zainstalowalem sobie TCommandera,ale nie trawie tego programu 
pozdrawiam
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:14:16, on 2008-07-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\CTHELPER.EXE
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wpabaln.exe
E:\Program Files\foobar2000\foobar2000.exe
E:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "e:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F34E6760-9677-44E7-9229-5A32849459F0}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 4858 bytes
[ Dodano: Dzisiaj o 19:23 ]
- Kod: Zaznacz wszystko
ComboFix 08-07-01.5 - U2 2008-07-02 20:18:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1332 [GMT 2:00]
Running from: C:\Documents and Settings\U2\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
C:\WINDOWS\system32\ctcoinst.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.
2008-07-02 19:51 . 2008-07-02 19:51 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-02 19:51 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-07-02 19:51 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-07-02 19:51 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-07-02 19:51 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-07-02 19:51 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-07-02 19:51 . 2004-03-02 17:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2008-07-02 19:51 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-07-02 19:51 . 2004-03-02 17:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2008-07-02 19:40 . 2008-07-02 19:40 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\HEXelon
2008-07-02 19:39 . 2008-07-02 19:45 <DIR> d-------- C:\Program Files\TC UP
2008-07-02 19:36 . 2008-07-02 19:36 <DIR> d-------- C:\Program Files\Magellass
2008-06-30 20:18 . 2008-06-30 20:37 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-30 19:43 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-06-30 19:43 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-06-30 19:42 . 2008-06-30 19:42 <DIR> d-------- C:\Program Files\Google
2008-06-30 19:15 . 2008-07-01 20:28 <DIR> d-------- C:\Documents and Settings\U2\Phone Browser
2008-06-30 19:15 . 2008-06-30 19:15 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Datalayer
2008-06-30 19:14 . 2008-06-30 19:14 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Nokia
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\DIFX
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\PC Suite
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-06-30 19:13 . 2006-05-29 08:26 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-06-30 19:13 . 2006-05-29 08:26 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-30 19:13 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-06-30 19:13 . 2006-05-29 08:26 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-06-30 19:13 . 2006-05-29 08:26 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll
2008-06-30 19:12 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Nokia
2008-06-30 19:12 . 2008-06-30 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2008-06-30 19:12 . 2006-05-29 08:26 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-06-30 17:16 . 2008-06-30 17:16 <DIR> d-------- C:\Program Files\ESET
2008-06-30 17:16 . 2008-06-30 17:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-06-29 17:21 . 2008-06-29 17:21 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-06-29 15:48 . 2008-06-29 15:48 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-29 15:48 . 2008-06-29 15:49 <DIR> d-------- C:\Documents and Settings\U2\Gadu-Gadu
2008-06-29 15:48 . 2008-06-29 15:48 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Gadu-Gadu
2008-06-29 15:44 . 2008-06-29 15:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-29 15:41 . 2003-03-18 22:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-06-29 15:41 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-06-29 15:41 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-06-29 15:35 . 2008-06-29 15:35 <DIR> d---s---- C:\Documents and Settings\U2\UserData
2008-06-29 15:30 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-06-29 15:29 . 2008-06-29 15:29 <DIR> d-------- C:\Program Files\SAGEM
2008-06-29 15:18 . 2008-06-29 15:18 <DIR> d-------- C:\Program Files\Java
2008-06-29 15:18 . 2002-11-01 20:15 45,175 --------- C:\WINDOWS\system32\plugincpl140_03.cpl
2008-06-29 15:18 . 2002-11-01 20:15 41,068 --------- C:\WINDOWS\system32\ActPanel.dll
2008-06-29 15:17 . 2008-06-29 15:17 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-06-29 15:17 . 2008-07-02 19:29 <DIR> d-------- C:\Program Files\neostrada tp
2008-06-29 15:13 . 2008-07-02 20:20 9,900,064 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-29 15:13 . 2008-07-02 19:27 113,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-29 15:12 . 2008-06-29 15:12 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2008-06-29 15:11 . 2008-06-29 15:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier
2008-06-29 15:10 . 2008-07-02 20:17 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-06-29 15:05 . 2008-06-29 15:05 <DIR> d-------- C:\WINDOWS\system32\Defaults
2008-06-29 15:05 . 2008-07-02 20:17 4,958,588 --a------ C:\WINDOWS\{00000005-00000000-00000002-00001102-00000004-20021102}.BAK
2008-06-29 15:05 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
2008-06-29 15:05 . 2008-07-02 19:27 32,592 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,592 --a------ C:\WINDOWS\system32\BMXState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,088 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,088 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-06-29 15:05 . 2008-07-02 19:27 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-06-29 15:04 . 2008-06-29 15:05 <DIR> d-------- C:\Program Files\Creative
2008-06-29 15:04 . 2008-06-29 15:04 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Creative
2008-06-29 15:01 . 2008-06-29 15:01 <DIR> d-------- C:\WINDOWS\nview
2008-06-29 15:01 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-06-29 15:01 . 2008-06-29 15:01 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-06-29 15:01 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-06-29 15:00 . 2008-06-29 15:00 <DIR> d-------- C:\NVIDIA
2008-06-29 15:00 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-06-10 18:56 . 2008-06-10 18:56 34,312 --a------ C:\WINDOWS\system32\drivers\epfwtdir.sys
2008-06-10 18:48 . 2008-06-10 18:48 53,256 --a------ C:\WINDOWS\system32\drivers\easdrv.sys
2008-06-10 18:47 . 2008-06-10 18:47 39,944 --a------ C:\WINDOWS\system32\drivers\eamon.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-02 17:24 --------- d-----w C:\Documents and Settings\U2\Dane aplikacji\foobar2000
2008-06-29 13:29 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-06-29 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 13:18 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-29 13:04 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-06-29 13:04 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-06-29 12:37 --------- d-----w C:\Program Files\Attansic
2008-06-29 12:30 --------- d-----w C:\Program Files\Intel
2008-06-29 12:22 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-29 12:21 --------- d-----w C:\Program Files\Usługi online
2008-06-28 16:56 109,251 --sh--r C:\r.cmd
2008-04-02 19:07 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-04-02 19:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 18:23 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"ZoneAlarm Client"="e:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55 32768]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 12:36 229376]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2006-08-11 14:56 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 14:56 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 16:12]
*Newly Created Service* - CATCHME
*Newly Created Service* - UDFS
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-02 20:20:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-02 20:21:00
ComboFix-quarantined-files.txt 2008-07-02 18:20:57
Pre-Run: 8,552,882,176 bajtów wolnych
Post-Run: 8,859,947,008 bajtów wolnych
167
- Kod: Zaznacz wszystko
ComboFix 08-07-01.5 - U2 2008-07-02 20:18:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1332 [GMT 2:00]
Running from: C:\Documents and Settings\U2\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\amvo1.dll
C:\WINDOWS\system32\ctcoinst.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.
2008-07-02 19:51 . 2008-07-02 19:51 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-02 19:51 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-07-02 19:51 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-07-02 19:51 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-07-02 19:51 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-07-02 19:51 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-07-02 19:51 . 2004-03-02 17:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2008-07-02 19:51 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-07-02 19:51 . 2004-03-02 17:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2008-07-02 19:40 . 2008-07-02 19:40 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\HEXelon
2008-07-02 19:39 . 2008-07-02 19:45 <DIR> d-------- C:\Program Files\TC UP
2008-07-02 19:36 . 2008-07-02 19:36 <DIR> d-------- C:\Program Files\Magellass
2008-06-30 20:18 . 2008-06-30 20:37 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-30 19:43 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-06-30 19:43 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-06-30 19:42 . 2008-06-30 19:42 <DIR> d-------- C:\Program Files\Google
2008-06-30 19:15 . 2008-07-01 20:28 <DIR> d-------- C:\Documents and Settings\U2\Phone Browser
2008-06-30 19:15 . 2008-06-30 19:15 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Datalayer
2008-06-30 19:14 . 2008-06-30 19:14 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Nokia
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\DIFX
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\PC Suite
2008-06-30 19:13 . 2008-06-30 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-06-30 19:13 . 2006-05-29 08:26 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-06-30 19:13 . 2006-05-29 08:26 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-30 19:13 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-06-30 19:13 . 2006-05-29 08:26 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-06-30 19:13 . 2006-05-29 08:26 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll
2008-06-30 19:12 . 2008-06-30 19:13 <DIR> d-------- C:\Program Files\Nokia
2008-06-30 19:12 . 2008-06-30 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2008-06-30 19:12 . 2006-05-29 08:26 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-06-30 17:16 . 2008-06-30 17:16 <DIR> d-------- C:\Program Files\ESET
2008-06-30 17:16 . 2008-06-30 17:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-06-29 17:21 . 2008-06-29 17:21 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-06-29 15:48 . 2008-06-29 15:48 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-29 15:48 . 2008-06-29 15:49 <DIR> d-------- C:\Documents and Settings\U2\Gadu-Gadu
2008-06-29 15:48 . 2008-06-29 15:48 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Gadu-Gadu
2008-06-29 15:44 . 2008-06-29 15:44 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-29 15:41 . 2003-03-18 22:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-06-29 15:41 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-06-29 15:41 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-06-29 15:35 . 2008-06-29 15:35 <DIR> d---s---- C:\Documents and Settings\U2\UserData
2008-06-29 15:30 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-06-29 15:29 . 2008-06-29 15:29 <DIR> d-------- C:\Program Files\SAGEM
2008-06-29 15:18 . 2008-06-29 15:18 <DIR> d-------- C:\Program Files\Java
2008-06-29 15:18 . 2002-11-01 20:15 45,175 --------- C:\WINDOWS\system32\plugincpl140_03.cpl
2008-06-29 15:18 . 2002-11-01 20:15 41,068 --------- C:\WINDOWS\system32\ActPanel.dll
2008-06-29 15:17 . 2008-06-29 15:17 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-06-29 15:17 . 2008-07-02 19:29 <DIR> d-------- C:\Program Files\neostrada tp
2008-06-29 15:13 . 2008-07-02 20:20 9,900,064 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-29 15:13 . 2008-07-02 19:27 113,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-29 15:12 . 2008-06-29 15:12 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2008-06-29 15:11 . 2008-06-29 15:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier
2008-06-29 15:10 . 2008-07-02 20:17 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-06-29 15:05 . 2008-06-29 15:05 <DIR> d-------- C:\WINDOWS\system32\Defaults
2008-06-29 15:05 . 2008-07-02 20:17 4,958,588 --a------ C:\WINDOWS\{00000005-00000000-00000002-00001102-00000004-20021102}.BAK
2008-06-29 15:05 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
2008-06-29 15:05 . 2008-07-02 19:27 32,592 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,592 --a------ C:\WINDOWS\system32\BMXState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,088 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 32,088 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000005-00000000-00000002-00001102-00000004-20021102}.rfx
2008-06-29 15:05 . 2008-07-02 19:27 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-06-29 15:05 . 2008-07-02 19:27 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-06-29 15:04 . 2008-06-29 15:05 <DIR> d-------- C:\Program Files\Creative
2008-06-29 15:04 . 2008-06-29 15:04 <DIR> d-------- C:\Documents and Settings\U2\Dane aplikacji\Creative
2008-06-29 15:01 . 2008-06-29 15:01 <DIR> d-------- C:\WINDOWS\nview
2008-06-29 15:01 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-06-29 15:01 . 2008-06-29 15:01 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-06-29 15:01 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-06-29 15:00 . 2008-06-29 15:00 <DIR> d-------- C:\NVIDIA
2008-06-29 15:00 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-06-10 18:56 . 2008-06-10 18:56 34,312 --a------ C:\WINDOWS\system32\drivers\epfwtdir.sys
2008-06-10 18:48 . 2008-06-10 18:48 53,256 --a------ C:\WINDOWS\system32\drivers\easdrv.sys
2008-06-10 18:47 . 2008-06-10 18:47 39,944 --a------ C:\WINDOWS\system32\drivers\eamon.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-02 17:24 --------- d-----w C:\Documents and Settings\U2\Dane aplikacji\foobar2000
2008-06-29 13:29 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-06-29 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-29 13:18 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-29 13:04 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-06-29 13:04 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-06-29 12:37 --------- d-----w C:\Program Files\Attansic
2008-06-29 12:30 --------- d-----w C:\Program Files\Intel
2008-06-29 12:22 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-29 12:21 --------- d-----w C:\Program Files\Usługi online
2008-06-28 16:56 109,251 --sh--r C:\r.cmd
2008-04-02 19:07 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-04-02 19:07 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 18:23 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"ZoneAlarm Client"="e:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55 32768]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 12:36 229376]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2006-08-11 14:56 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 14:56 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 16:12]
*Newly Created Service* - CATCHME
*Newly Created Service* - UDFS
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-02 20:20:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-02 20:21:00
ComboFix-quarantined-files.txt 2008-07-02 18:20:57
Pre-Run: 8,552,882,176 bajtów wolnych
Post-Run: 8,859,947,008 bajtów wolnych
167
