z ComboFix
ComboFix 09-02-10.03 - admin 2009-02-11 17:55:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.446.267 [GMT 1:00]
Uruchomiony z: c:\documents and settings\admin\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1utbfd.bat
C:\2.exe
C:\2aaxaiy.exe
C:\8.bat
C:\autorun.inf
C:\eaywxx.cmd
C:\gldegkby.cmd
C:\ioockw.bat
C:\j60osk9.cmd
C:\m0vnonh.bat
C:\pook.com
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\History\search
C:\uvsqfgwd.cmd
c:\windows\IE4 Error Log.txt
c:\windows\system32\digeste.dll
c:\windows\system32\drivers\5fd09082.sys
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\nmdfgds2.dll
c:\windows\system32\olhrwef.exe
c:\windows\system32\optyhww0.dll
c:\windows\system32\shell31.dll
c:\windows\system32\urretnd.exe
c:\windows\wiaserviv.log
C:\x.cmd
D:\0oyl662q.cmd
D:\1utbfd.bat
D:\2aaxaiy.exe
D:\2w.cmd
D:\68.exe
D:\8.bat
D:\9.cmd
D:\a9.com
D:\Autorun.inf
D:\b.com
D:\b.exe
D:\ceb6eu98.bat
D:\cqdis.cmd
D:\eaywxx.cmd
D:\eb.bat
D:\ev60a2.cmd
D:\gfqgq.cmd
D:\gldegkby.cmd
D:\ioockw.bat
D:\iq.bat
D:\iqosrtk.bat
D:\j60osk9.cmd
D:\l8yuk.bat
D:\lky.exe
D:\m.cmd
D:\m0vnonh.bat
D:\pnt.com
D:\pook.com
D:\ps.bat
D:\qoes.bat
D:\qquq.bat
D:\r8.bat
D:\sq.com
D:\taqhptr.bat
D:\uvsqfgwd.cmd
D:\v0s.cmd
D:\vxl.exe
D:\x.bat
D:\x.cmd
D:\x0.com
D:\x2tpc.cmd
D:\xcisvxl.com
D:\xih9.cmd
D:\xrdygg.bat
D:\yb12j.cmd
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_5fd09082
((((((((((((((((((((((((( Pliki utworzone od 2009-01-11 do 2009-02-11 )))))))))))))))))))))))))))))))
.
2009-02-11 11:09 . 2009-02-11 11:08 109,724 -r-hs---- C:\opgde.exe
2009-02-11 11:06 . 2009-02-11 11:06 <DIR> d-------- c:\windows\LastGood
2009-02-07 14:02 . 2009-02-07 14:02 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\.clamwin
2009-02-07 14:01 . 2009-02-07 14:01 <DIR> d-------- c:\program files\ClamWin
2009-02-07 14:01 . 2009-02-07 14:01 <DIR> d-------- c:\documents and settings\All Users\.clamwin
2009-02-05 17:29 . 2009-02-05 17:29 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-02-04 10:56 . 2009-02-06 11:07 106,827 -r-hs---- C:\ft96s.exe
2009-02-02 16:56 . 2009-02-03 10:40 106,771 -r-hs---- C:\jr6.com
2009-02-02 11:02 . 2009-02-02 11:02 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-02-02 11:01 . 2009-02-02 11:01 <DIR> d-------- c:\program files\Common Files\Adobe
2009-02-02 10:58 . 2009-02-02 16:55 <DIR> d-------- c:\program files\NOS
2009-02-02 10:58 . 2009-02-02 16:55 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\NOS
2009-02-02 09:43 . 2009-02-02 19:48 109,930 -r-hs---- C:\a2h2.com
2009-01-29 19:34 . 2009-01-29 19:34 <DIR> d-------- c:\program files\INTERIAPL
2009-01-29 15:53 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-01-29 15:53 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2009-01-28 21:11 . 2009-01-28 21:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\WinZip
2009-01-28 21:05 . 2009-01-28 21:05 <DIR> d-------- c:\program files\7-Zip
2009-01-27 09:05 . 2009-01-27 09:05 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-26 16:58 . 2006-09-18 14:58 97,184 -ra------ c:\windows\system32\drivers\SE27mdm.sys
2009-01-26 16:58 . 2006-09-18 14:59 90,800 -ra------ c:\windows\system32\drivers\se27unic.sys
2009-01-26 16:58 . 2006-09-18 14:58 88,688 -ra------ c:\windows\system32\drivers\SE27mgmt.sys
2009-01-26 16:58 . 2006-09-18 14:59 86,560 -ra------ c:\windows\system32\drivers\SE27obex.sys
2009-01-26 16:58 . 2006-09-18 14:59 18,704 -ra------ c:\windows\system32\drivers\se27nd5.sys
2009-01-26 16:58 . 2006-09-18 14:58 9,360 -ra------ c:\windows\system32\drivers\SE27mdfl.sys
2009-01-26 16:58 . 2006-09-18 14:58 6,240 -ra------ c:\windows\system32\drivers\SE27cmnt.sys
2009-01-26 16:58 . 2006-09-18 14:58 6,240 -ra------ c:\windows\system32\drivers\SE27cm.sys
2009-01-26 16:58 . 2006-09-18 14:58 4,128 -ra------ c:\windows\system32\drivers\se27cr.sys
2009-01-26 16:57 . 2006-09-18 14:58 61,600 -ra------ c:\windows\system32\drivers\SE27bus.sys
2009-01-26 16:57 . 2006-09-18 14:59 5,872 -ra------ c:\windows\system32\drivers\SE27whnt.sys
2009-01-26 16:57 . 2006-09-18 14:59 5,872 -ra------ c:\windows\system32\drivers\SE27wh.sys
2009-01-26 16:56 . 2009-01-26 16:58 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Teleca
2009-01-26 16:54 . 2009-01-26 16:54 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Sony Ericsson
2009-01-26 16:52 . 2009-01-27 17:04 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-01-26 16:52 . 2009-01-26 16:54 <DIR> d-------- c:\windows\LastGood.Tmp
2009-01-26 16:51 . 2009-01-27 17:05 <DIR> d-------- c:\program files\Common Files\Teleca Shared
2009-01-26 16:49 . 2009-01-26 16:49 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-26 16:49 . 2009-01-26 16:49 1,409 --a------ c:\windows\QTFont.for
2009-01-26 12:24 . 2009-01-26 12:24 16,384 --a------ c:\windows\wxpw.dat
2009-01-26 12:24 . 2009-01-26 12:24 16,384 --ahs---- c:\windows\system32\wxpx.dat
2009-01-26 11:56 . 2009-01-26 11:56 16,384 --a------ c:\program files\uik.dat
2009-01-26 11:55 . 2009-01-26 11:55 <DIR> d-------- c:\program files\Casino
2009-01-26 11:55 . 2009-01-26 12:03 4 --a------ c:\program files\is.dat
2009-01-21 15:58 . 2009-01-23 14:04 107,882 -r-hs---- C:\w98.com
2009-01-20 11:01 . 2009-02-10 20:45 <DIR> d-------- C:\My Downloads
2009-01-19 10:38 . 2009-01-19 11:39 104,907 -r-hs---- C:\v63enh.exe
2009-01-19 09:21 . 2009-01-19 09:33 <DIR> d-------- c:\windows\system32\CatRoot_bak
2009-01-19 09:21 . 2008-06-14 19:01 273,024 --------- c:\windows\system32\drivers\bthport.sys
2009-01-19 09:21 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-01-19 09:20 . 2008-08-14 14:46 2,181,632 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-01-19 09:20 . 2008-08-14 14:46 2,137,600 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-19 09:20 . 2008-08-14 14:46 2,059,008 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-19 09:20 . 2008-08-14 14:46 2,017,280 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-01-19 09:19 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-01-17 11:03 . 2009-02-05 17:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-01-17 10:19 . 2003-05-23 12:28 1,060,864 --a------ c:\windows\system32\mfc71.dll
2009-01-17 10:19 . 2003-05-23 12:28 499,712 --a------ c:\windows\system32\msvcp71.dll
2009-01-17 10:19 . 2003-05-23 12:28 348,160 --a------ c:\windows\system32\msvcr71.dll
2009-01-17 09:03 . 2009-02-11 09:53 89,600 -r-hs---- c:\windows\system32\optyhww1.dll
2009-01-16 15:08 . 2009-01-16 15:08 0 --a------ c:\windows\nsreg.dat
2009-01-16 13:26 . 2006-03-02 13:00 70,144 --a------ c:\windows\AhnRpta.exe
2009-01-16 13:19 . 2009-01-17 11:13 106,047 -r-hs---- C:\982um3s9.exe
2009-01-16 13:17 . 2009-01-22 16:04 89,600 -r-hs---- c:\windows\system32\cvnmhg0.dll
2009-01-15 16:59 . 2006-03-02 13:00 221,184 --a------ c:\windows\system32\wmpns.dll
2009-01-15 15:18 . 2009-01-17 12:33 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Tibia
2009-01-15 15:17 . 2009-01-31 12:58 <DIR> d-------- c:\program files\Tibia
2009-01-15 15:10 . 2009-01-15 15:10 <DIR> d-------- c:\program files\Asprate
2009-01-15 11:07 . 2009-02-02 19:16 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\skypePM
2009-01-15 11:07 . 2009-01-15 11:07 56 --ah----- c:\windows\system32\ezsidmv.dat
2009-01-15 09:03 . 2009-01-15 09:03 22,528 --a------ c:\documents and settings\admin\S87ekhV.exe
2009-01-14 18:38 . 2009-01-22 12:36 <DIR> d-------- c:\program files\Odkurzacz
2009-01-14 18:33 . 2009-02-06 11:57 <DIR> d-------- c:\program files\Metin2_PL
2009-01-14 18:16 . 2009-02-03 15:18 <DIR> d-------- c:\program files\Valve
2009-01-14 18:15 . 2009-02-07 14:02 <DIR> d-------- C:\instal
2009-01-14 17:52 . 2009-01-24 11:37 <DIR> d-------- c:\program files\WarRock
2009-01-14 17:52 . 2009-01-14 17:52 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\InstallShield
2009-01-14 17:49 . 2009-01-14 17:52 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\U3
2009-01-14 17:49 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-01-14 16:36 . 2009-01-14 16:36 <DIR> d---s---- c:\documents and settings\admin\UserData
2009-01-14 11:08 . 2009-01-14 11:08 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Gadu-Gadu
2009-01-14 10:33 . 2009-01-14 10:33 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Creative
2009-01-14 10:33 . 2009-01-14 10:33 13,646 --a------ c:\windows\system32\wpa.bak
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-11 16:57 --------- d-----w c:\documents and settings\admin\Dane aplikacji\OpenOffice.ux.pl2
2009-02-02 18:25 --------- d-----w c:\documents and settings\admin\Dane aplikacji\Skype
2009-01-28 18:19 --------- d-----w c:\program files\Gadu-Gadu
2009-01-26 15:50 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-22 15:04 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-14 18:58 --------- d-----w c:\program files\Google
2009-01-14 17:15 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative WebCam Tray"="c:\program files\Creative\Shared Files\CamTray.exe" [2005-10-27 299008]
"Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"CreativeTaskScheduler"="c:\program files\Creative\Shared Files\CTSched.exe" [2006-01-09 53340]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ClamWin"="c:\program files\ClamWin\bin\ClamTray.exe" [2008-11-09 86016]
"nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
c:\documents and settings\admin\Menu Start\Programy\Autostart\
OpenOffice.ux.pl 2.3.1.lnk - c:\program files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe [2007-12-07 17408]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain1.dll" [2006-03-02 78848]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Metin2_PL\\metin2.bin"=
S3 getplus(r) helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe --> c:\program files\NOS\bin\getPlus_HelperSvc.exe [?]
S3 V0260VID;Live! Cam Vista IM;c:\windows\system32\drivers\V0260Vid.sys [2008-09-04 178913]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{025a438f-ef7b-11dd-b26f-001bb995e8bf}]
\shell\autorun\command - E:\8.bat
\shell\open\command - E:\8.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{025a4390-ef7b-11dd-b26f-001bb995e8bf}]
\shell\autorun\command - G:\gldegkby.cmd
\shell\open\command - G:\gldegkby.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ab0d0cc-e7cc-11dd-b243-001bb995e8bf}]
\shell\autorun\command - E:\gy.exe
\shell\open\command - E:\gy.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b95cf7d-f4fe-11dd-b285-001bb995e8bf}]
\shell\autorun\command - E:\m0vnonh.bat
\shell\open\command - E:\m0vnonh.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35a691a9-7a7c-11dd-9b93-806d6172696f}]
\Shell\AutoRun\command - F:\Setup.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38d350fa-f213-11dd-b277-001bb995e8bf}]
\shell\autorun\command - e:\webarooportable\WebarooPortable.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4102270e-e239-11dd-b226-001bb995e8bf}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4102270f-e239-11dd-b226-001bb995e8bf}]
\Shell\AutoRun\command - G:\m9ma.exe
\Shell\explore\Command - G:\m9ma.exe
\Shell\open\Command - G:\m9ma.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b093898-ebc1-11dd-b25a-001bb995e8bf}]
\shell\autorun\command - E:\x.cmd
\shell\open\command - E:\x.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83fd0f4e-e6fb-11dd-b239-001bb995e8bf}]
\shell\autorun\command - E:\2aaxaiy.exe
\shell\open\command - E:\2aaxaiy.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{876c7593-f296-11dd-b278-001bb995e8bf}]
\shell\autorun\command - E:\pook.com
\shell\open\command - E:\pook.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a16e34b6-ee14-11dd-b269-001bb995e8bf}]
\shell\autorun\command - G:\a2h2.com
\shell\open\command - G:\a2h2.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae63d1e2-e9ed-11dd-b256-001bb995e8bf}]
\shell\autorun\command - E:\2w.cmd
\shell\explore\command - E:\2w.cmd
\shell\open\command - E:\2w.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afa6a059-e956-11dd-b254-001bb995e8bf}]
\shell\autorun\command - E:\imo.exe
\shell\open\command - E:\imo.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afa6a05a-e956-11dd-b254-001bb995e8bf}]
\shell\autorun\command - G:\imo.exe
\shell\open\command - G:\imo.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b527034c-e861-11dd-b244-001bb995e8bf}]
\shell\autorun\command - E:\w98.com
\shell\open\command - E:\w98.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b527034e-e861-11dd-b244-001bb995e8bf}]
\shell\autorun\command - E:\w98.com
\shell\open\command - E:\w98.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb85f1ca-eb97-11dd-b259-001bb995e8bf}]
\shell\autorun\command - E:\x.cmd
\shell\open\command - E:\x.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd3f6e46-e46d-11dd-b231-001bb995e8bf}]
\shell\autorun\command - E:\x2csvg.exe
\shell\open\command - E:\x2csvg.exe
.
Zawartość folderu 'Zaplanowane zadania'
2009-02-11 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe []
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-cbvcs - c:\windows\system32\urretnd.exe
HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe
HKLM-Run-BearShare - c:\program files\BearShare\BearShare.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://google.bearshare.com/pl/
FF - ProfilePath - c:\documents and settings\admin\Dane aplikacji\Mozilla\Firefox\Profiles\l3lfwpd8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 17:57:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\OpenOffice.ux.pl 2.3.1\program\soffice.exe
c:\program files\OpenOffice.ux.pl 2.3.1\program\soffice.bin
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-02-11 17:59:31 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-02-11 16:59:24
Przed: 19 429 527 552 bajtów wolnych
Po: 20,315,516,928 bajtów wolnych
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
316 --- E O F --- 2009-02-11 10:06:49
z Hajackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:35:16, on 2009-02-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.exe
C:\Program Files\OpenOffice.ux.pl 2.3.1\program\soffice.BIN
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.ux.pl 2.3.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: getPlus(R) Helper (getplus(r) helper) - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (idrivert) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4518 bytes
