- Kod: Zaznacz wszystko
ComboFix 09-03-15.01 - bartek 2009-03-16 17:09:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.677 [GMT 1:00]
Uruchomiony z: c:\documents and settings\bartek\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((( Pliki utworzone od 2009-02-16 do 2009-03-16 )))))))))))))))))))))))))))))))
.
2009-03-11 20:51 . 2009-03-11 21:09 <DIR> d-------- c:\program files\7-Zip
2009-03-06 17:02 . 2009-03-06 17:02 <DIR> d-------- c:\windows\system32\Lang
2009-03-06 17:02 . 2009-03-06 17:02 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-03-06 17:02 . 2009-03-06 17:02 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-02-26 19:46 . 2009-02-26 19:48 <DIR> d-------- c:\program files\uTorrent
2009-02-26 19:46 . 2009-03-15 13:57 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\uTorrent
2009-02-25 10:26 . 2009-02-25 10:26 427 --a------ c:\windows\ODBC.INI
2009-02-25 10:24 . 2009-02-25 10:24 <DIR> d-------- c:\windows\ShellNew
2009-02-25 10:23 . 2009-02-25 10:23 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\Microsoft Web Folders
2009-02-24 20:37 . 2009-02-24 20:37 <DIR> d-------- c:\program files\ffdshow
2009-02-24 20:37 . 2008-12-08 12:53 57,344 --a------ c:\windows\system32\ff_vfw.dll
2009-02-24 20:37 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-24 13:24 . 2009-02-24 13:24 <DIR> d-------- c:\program files\IrfanView
2009-02-24 10:59 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-02-23 11:27 . 2009-02-23 11:27 <DIR> d-------- c:\program files\Winamp Toolbar
2009-02-23 11:27 . 2009-02-23 11:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar
2009-02-23 11:23 . 2009-02-23 11:51 <DIR> d-------- c:\program files\Winamp
2009-02-23 11:23 . 2009-02-23 11:53 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\Winamp
2009-02-23 11:22 . 2009-02-23 11:22 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\CyberLink
2009-02-23 11:22 . 2009-03-11 20:57 69 --a------ c:\windows\NeroDigital.ini
2009-02-23 11:21 . 2009-02-23 11:21 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CyberLink
2009-02-23 11:17 . 2009-02-23 11:17 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\BESTplayer
2009-02-23 11:15 . 2009-02-23 11:15 <DIR> d-------- c:\windows\system32\Adobe
2009-02-23 11:15 . 2009-02-23 11:15 <DIR> d-------- c:\windows\Profiles
2009-02-23 11:15 . 2009-02-23 11:15 <DIR> d-------- c:\program files\Common Files\LightScribe
2009-02-23 11:15 . 2009-02-25 10:30 <DIR> d-------- c:\program files\Common Files\Adobe
2009-02-23 11:15 . 2009-02-23 11:15 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\InterTrust
2009-02-23 11:15 . 1998-10-29 15:45 306,688 --a------ c:\windows\IsUninst.exe
2009-02-23 11:13 . 2004-07-09 08:43 364,544 --------- c:\windows\system32\TwnLib4.dll
2009-02-23 11:13 . 2000-06-26 10:45 106,496 --a------ c:\windows\system32\TwnLib20.dll
2009-02-23 11:12 . 2004-07-26 16:16 1,568,768 --------- c:\windows\system32\ImagX7.dll
2009-02-23 11:12 . 2004-07-26 16:16 476,320 --------- c:\windows\system32\ImagXpr7.dll
2009-02-23 11:12 . 2004-07-26 16:16 471,040 --------- c:\windows\system32\ImagXRA7.dll
2009-02-23 11:12 . 2004-07-26 16:16 262,144 --------- c:\windows\system32\ImagXR7.dll
2009-02-23 11:12 . 2001-07-09 10:50 155,648 --a------ c:\windows\system32\NeroCheck.exe
2009-02-23 11:11 . 2009-02-23 11:11 <DIR> d-------- c:\program files\Common Files\Ahead
2009-02-23 11:11 . 2009-02-23 11:13 <DIR> d-------- c:\program files\Ahead
2009-02-23 11:10 . 2009-02-23 11:10 <DIR> d-------- c:\program files\CyberLink DVD Solution
2009-02-23 11:10 . 2004-10-01 15:00 40,960 --a------ c:\program files\Uninstall_CDS.exe
2009-02-22 16:25 . 2009-02-22 16:25 <DIR> d-------- c:\program files\ESET
2009-02-22 16:25 . 2009-02-22 16:25 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET
2009-02-22 15:29 . 2009-02-22 15:34 <DIR> d-------- c:\windows\nview
2009-02-22 15:29 . 2005-06-15 10:20 176,128 --a------ c:\windows\system32\nvudisp.exe
2009-02-22 15:29 . 2009-03-16 17:03 26,682 --a------ c:\windows\system32\nvapps.xml
2009-02-22 15:29 . 2005-06-15 10:20 14,757 --a------ c:\windows\system32\nvdisp.nvu
2009-02-22 15:28 . 2004-05-02 09:47 23,040 -ra------ c:\windows\system32\drivers\GVCplDrv.sys
2009-02-22 15:26 . 2009-02-22 15:26 <DIR> d-------- c:\program files\SubEdit-Player
2009-02-22 15:18 . 2009-02-22 15:18 <DIR> d-------- c:\program files\Nowe Gadu-Gadu
2009-02-22 15:18 . 2009-02-22 20:32 <DIR> d-------- c:\documents and settings\bartek\Dane aplikacji\Nowe Gadu-Gadu
2009-02-22 15:13 . 2009-02-22 15:13 0 --a------ c:\windows\nsreg.dat
2009-02-22 15:04 . 2009-02-22 15:04 <DIR> d-------- c:\program files\SAGEM WiFi manager
2009-02-22 15:04 . 2009-02-22 15:04 <DIR> d-------- c:\program files\SAGEM
2009-02-22 15:04 . 2006-01-18 14:09 29,184 --a------ c:\windows\system32\drivers\BRGSp50a64.sys
2009-02-22 15:04 . 2006-01-18 14:09 20,608 --a------ c:\windows\system32\drivers\BRGSp50.sys
2009-02-22 15:04 . 2006-01-18 14:09 17,664 --a------ c:\windows\system32\drivers\ZDPSp50.sys
2009-02-22 15:03 . 2005-12-22 14:45 493,440 --a------ c:\windows\system32\drivers\WlanBZ64.SYS
2009-02-22 15:03 . 2005-12-22 14:45 402,432 --a------ c:\windows\system32\drivers\WlanBZXP.sys
2009-02-22 15:03 . 2005-06-17 10:26 114,688 --a------ c:\windows\system32\WLANUTL.dll
2009-02-22 15:03 . 2005-06-17 10:26 61,440 --a------ c:\windows\system32\W32N50.dll
2009-02-22 15:03 . 2006-01-18 14:09 31,744 --a------ c:\windows\system32\drivers\ZDPSp50a64.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-25 09:23 --------- d-----w c:\program files\microsoft frontpage
2009-02-23 10:10 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-22 11:32 --------- d-----w c:\program files\Realtek Sound Manager
2009-02-22 11:32 --------- d-----w c:\program files\AvRack
2009-02-22 11:31 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-22 11:30 --------- d-----w c:\program files\AMD
2009-02-22 11:21 --------- d-----w c:\program files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"ares"="e:\ares\Ares.exe" [2009-02-03 1004544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-06-15 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2005-06-15 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2009-02-22 925696]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Ares\\Ares.exe"=
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-07-01 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2009-02-22 402432]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]
.
.
------- Skan uzupełniający -------
.
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
FF - ProfilePath - c:\documents and settings\bartek\Dane aplikacji\Mozilla\Firefox\Profiles\mjcxom0g.default\
FF - component: c:\documents and settings\bartek\Dane aplikacji\Mozilla\Firefox\Profiles\mjcxom0g.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-16 17:10:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2009-03-16 17:10:36
ComboFix-quarantined-files.txt 2009-03-16 16:10:34
ComboFix2.txt 2009-03-16 15:46:47
Przed: 5 964 623 872 bajtów wolnych
Po: 5,956,743,168 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
146
