Oto log z ComboFixa:
- Kod: Zaznacz wszystko
ComboFix 10-08-24.0A - Wlasciciel 2010-08-25 10:26:12.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1045.18.1023.648 [GMT 2:00]
Uruchomiony z: G:\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Wlasciciel\Dane aplikacji\.#
c:\documents and settings\Wlasciciel\Dane aplikacji\Desktopicon
c:\documents and settings\Wlasciciel\Dane aplikacji\Desktopicon\eBayShortcuts.exe
c:\documents and settings\Wlasciciel\Dane aplikacji\LOVE
c:\documents and settings\Wlasciciel\Dane aplikacji\LOVE\EDITOR\data.lua
c:\progra~1\MYWEBS~1\bar\5.bin\mwsoemon.exe
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\5.bin\mwsoemon.exe
c:\program files\MyWebSearch\bar\5.bin\mwsoestb.dll
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\windows\system32\1124861431.dll
c:\windows\system32\f3PSSavr.scr
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
((((((((((((((((((((((((( Pliki utworzone od 2010-07-25 do 2010-08-25 )))))))))))))))))))))))))))))))
.
2010-08-18 13:12 . 2010-08-18 13:20 -------- d-----w- c:\program files\Crawler
2010-08-14 22:12 . 2010-08-14 22:28 -------- d-----w- c:\program files\Mount&Blade
2010-08-13 22:16 . 2009-11-03 12:07 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-08-13 22:16 . 2009-11-03 12:07 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-08-13 22:16 . 2010-08-14 14:23 -------- d-----w- c:\program files\Cheat Engine
2010-08-11 13:10 . 2010-08-14 13:28 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\Mount&Blade
2010-08-09 14:58 . 2010-08-09 14:58 -------- dc----w- C:\G3iMap
2010-08-06 17:42 . 2010-08-06 17:42 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-08-06 17:42 . 2010-08-06 17:42 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-08-06 17:42 . 2010-08-06 17:42 -------- d-----w- c:\program files\OpenAL
2010-08-05 12:33 . 2010-08-05 12:33 -------- d-----w- c:\windows\system32\xlive
2010-08-05 12:18 . 2010-08-05 12:18 -------- d-----w- c:\documents and settings\Wlasciciel\Ustawienia lokalne\Dane aplikacji\FlatOut Ultimate Carnage
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 08:31 . 2007-03-13 15:13 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\OpenOffice.ux.pl2
2010-08-25 08:28 . 2010-04-30 18:33 70968 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2010-08-13 20:25 . 2010-05-01 11:42 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\Winamp
2010-08-06 18:25 . 2010-04-30 19:10 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\BlackBean
2010-08-06 17:41 . 2010-03-06 13:37 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-08-06 17:34 . 2007-03-13 18:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-26 16:37 . 2010-01-09 18:55 43520 -c--a-w- c:\windows\system32\CmdLineExt03.dll
2010-07-08 16:50 . 2006-03-02 12:00 84208 ----a-w- c:\windows\system32\perfc015.dat
2010-07-08 16:50 . 2006-03-02 12:00 491152 ----a-w- c:\windows\system32\perfh015.dat
2010-07-07 08:54 . 2010-07-07 08:54 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\CyberLink
2010-07-05 10:26 . 2010-07-05 10:26 -------- d-----w- c:\program files\3DO
2010-07-03 12:43 . 2010-07-03 12:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles
2010-07-02 11:59 . 2010-07-02 11:59 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\OpenFM
2010-07-02 11:59 . 2010-07-02 11:59 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM
2010-07-01 09:35 . 2010-07-01 09:35 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10
2010-07-01 09:33 . 2010-07-01 09:32 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\Gadu-Gadu 10
2010-06-29 19:34 . 2010-06-29 19:34 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\Thinstall
2010-06-29 19:33 . 2010-05-22 10:08 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\gtk-2.0
2010-06-29 14:26 . 2009-04-20 14:38 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\HLSW
2010-06-27 19:03 . 2010-04-30 16:07 -------- d-----w- c:\program files\Windows Media Connect 2
2010-06-27 14:27 . 2010-06-24 17:42 -------- d-----w- c:\documents and settings\Wlasciciel\Dane aplikacji\Gearbox Software
2004-10-01 14:00 . 2007-03-13 19:14 40960 -c--a-w- c:\program files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-07-10 16:28 1174920 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-07-10 1174920]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-07-10 1174920]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]
"GoD"="d:\moje dokumenty\GoD\GoD.exe" [2008-07-20 2456576]
"Comrade.exe"="c:\program files\GameSpy\Comrade\Comrade.exe" [2008-12-09 800256]
"Gadu-Gadu 10"="d:\program files\Gadu-Gadu 10\gg.exe" [2010-04-21 11985504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-27 16208384]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-24 7573504]
"nwiz"="nwiz.exe" [2006-11-24 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-24 86016]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2006-07-12 1397760]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"QuickTime Task"="D:\qttask.exe" [2007-07-23 98304]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
c:\documents and settings\Wlasciciel\Menu Start\Programy\Autostart\
OpenOffice.ux.pl 2.0.lnk - c:\program files\OpenOffice.ux.pl 2.0\program\quickstart.exe [2005-10-26 61440]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BumbleBeast\\Big Scale Racing\\Big Scale Racing.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"d:\\Program Files\\CSS\\hl2.exe"=
"d:\\FlatOut2.exe"=
"d:\\Program Files\\Ubisoft\\Blue Byte\\SETTLERS - Dziedzictwo Królów - Złota edycja\\extra1\\bin\\settlershok.exe"=
"d:\\Program Files\\HLSW\\hlsw.exe"=
"d:\\Program Files\\MiniRacingOnline\\MiniRacingOnLine.exe"=
"d:\\Valve\\Condition Zero\\czero.exe"=
"d:\\Program Files\\Valve Polski\\hl.exe"=
"d:\\Program Files\\Gadu-Gadu 10\\gg.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 appdrv01;Application Driver (01);c:\windows\system32\drivers\appdrv01.sys [2009-07-28 3110512]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-05-14 162768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-05-14 19024]
R2 athsgt;athsgt;c:\windows\system32\drivers\athsgt.sys [2007-04-22 164992]
R2 Devx;Devx;c:\windows\system32\drivers\Devx.sys [2007-04-02 4448]
R2 limsgt;limsgt;c:\windows\system32\drivers\limsgt.sys [2007-04-22 12544]
R2 SeekService Service;SeekService Service;c:\documents and settings\All Users\Dane aplikacji\SeekService\seekservice110.exe [2009-07-20 54784]
R2 VtPr;VtPr;c:\windows\system32\drivers\VtPr.sys [2007-04-02 3328]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc --> c:\windows\System32\appdrvrem01.exe svc [?]
S2 gupdate;Usługa Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 133104]
S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?]
.
Zawartość folderu 'Zaplanowane zadania'
2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 17:00]
2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 17:00]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.crawler.com/homepage.aspx?tbid=66016
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Steam - c:\program files\Steam\Steam.exe
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\5.bin\M3PLUGIN.DLL
ActiveSetup-{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} - c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\xop32.exe
AddRemove-DirectShowPack - c:\program files\DirectShow Pack\uninst-dshowpack.exe
AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\FlashUtil9b.exe
AddRemove-Speedway Liga - d:\program files\Techland\Speedway Liga\Speedway Liga\Odinstaluj.exe
AddRemove-Spolszczenie - c:\program files\Mount&Blade\uninst.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-25 10:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-507921405-1343024091-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-507921405-1343024091-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:11,41,e5,00,10,2f,8a,6d,02,35,26,fd,d8,c0,4a,0d,26,df,68,b1,c9,9e,5a,
c7,09,de,40,d6,05,10,09,7a,0e,5f,7d,a3,f3,fc,2b,c7,88,66,aa,6c,eb,c4,e4,91,\
"??"=hex:80,e5,f9,e9,c1,b0,32,ad,6a,18,0a,35,e0,c5,18,0b
[HKEY_USERS\S-1-5-21-507921405-1343024091-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:19,f1,24,a9,0c,9c,76,88,52,2f,83,fe,d9,54,8d,f5,23,b3,73,32,8a,
45,c5,02,fc,d4,d4,54,97,d8,7e,9e,10,89,9c,bc,3f,7f,ab,26,1f,e3,6d,7f,ef,ca,\
"rkeysecu"=hex:a8,a3,cb,3b,9e,10,da,4f,e6,ec,6c,62,8a,a7,84,85
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(2860)
c:\program files\Windows Media Player\wmpband.dll
c:\program files\SeekService\seekservice.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\windows\system32\ODBC32.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.POL
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\program files\SeekService\seekservice.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.ux.pl 2.0\program\soffice.exe
c:\program files\OpenOffice.ux.pl 2.0\program\soffice.BIN
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Czas ukończenia: 2010-08-25 10:33:14 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2010-08-25 08:33
Przed: 25 284 583 424 bajtów wolnych
Po: 25 798 103 040 bajtów wolnych
- - End Of File - - 582330D889F2E87C8D6DEE18352946F9
