o to logi
ComboFix 10-03-15.06 - Owner 17/03/2010 17:37:27.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.734.519 [GMT 0:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Owner\Application Data\wiaserva.log
c:\documents and settings\Owner\csrss.exe
c:\documents and settings\Owner\nigzss.txt
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\History\search
c:\program files\TimeSink
c:\program files\TimeSink\AdGateway\Ads\2345\01010001.004
c:\program files\TimeSink\AdGateway\Ads\2345\rc
c:\program files\TimeSink\AdGateway\Ads\2346\01010001.004
c:\program files\TimeSink\AdGateway\Ads\2346\01010002.004
c:\program files\TimeSink\AdGateway\Ads\2346\rc
c:\program files\TimeSink\AdGateway\Profiles\MJStudio\Owner\dlusion\Done.cdb
c:\program files\TimeSink\AdGateway\Profiles\MJStudio\Owner\dlusion\Done.idx
c:\recycler\S-1-5-21-1200983842-5549021157-605754717-3313
c:\recycler\S-1-5-21-1708537768-308236825-839522115-1003
c:\recycler\S-1-5-21-3029496156-4809529220-448810458-1168
c:\recycler\S-1-5-21-6572295369-4678702963-933083148-4741
c:\recycler\S-1-5-21-842298532-3574062915-3479823535-1003
c:\windows\BM6f8ab5e4.txt
c:\windows\BM6f8ab5e4.xml
c:\windows\cookies.ini
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\Fonts\'
c:\windows\nigzss.txt
c:\windows\system32\ahtrtapi.ini
c:\windows\system32\blkltppb.ini
c:\windows\system32\bsbnhrgr.ini
c:\windows\system32\cqahxusa.ini
c:\windows\system32\ddeeg.ini
c:\windows\system32\ddeeg.ini2
c:\windows\system32\dmmvhfpc.ini
c:\windows\system32\dvxosanv.ini
c:\windows\system32\eaxkpsgu.ini
c:\windows\system32\eytacspt.ini
c:\windows\system32\fbcnqupt.ini
c:\windows\system32\fcswykea.ini
c:\windows\system32\fikpsdkq.ini
c:\windows\system32\gdctpaqv.ini
c:\windows\system32\hecddgaw.ini
c:\windows\system32\hsaqndnt.ini
c:\windows\system32\inpkmvuf.ini
c:\windows\system32\lconypqx.ini
c:\windows\system32\lkkuqfuv.ini
c:\windows\system32\loecrfko.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\mdnnpwar.ini
c:\windows\system32\mlnmp.ini
c:\windows\system32\mlnmp.ini2
c:\windows\system32\mrdqduxq.ini
c:\windows\system32\mytlychb.ini
c:\windows\system32\nkylspdo.ini
c:\windows\system32\oculuibu.ini
c:\windows\system32\ojrdubes.ini
c:\windows\system32\phgvdyrv.ini
c:\windows\system32\qbfqdttx.ini
c:\windows\system32\qqsvtcfc.ini
c:\windows\system32\qtfnilyd.ini
c:\windows\system32\tfribeao.ini
c:\windows\system32\twpaoopp.ini
c:\windows\system32\uqclyiim.ini
c:\windows\system32\usephrbq.ini
c:\windows\system32\wfkqvyfg.ini
c:\windows\system32\wurahgbp.ini
c:\windows\system32\xonptwmm.ini
c:\windows\system32\xseojkqm.ini
.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.
2010-03-13 17:14 . 2010-03-13 17:14 98304 --sh--r- c:\windows\portmgr.exe
2010-03-13 15:36 . 2010-03-13 15:36 143360 --sh--r- c:\windows\msexp.exe
2010-03-12 17:15 . 2010-03-12 17:12 135168 --sh--r- c:\windows\windirs.exe
2010-03-08 15:53 . 2009-11-10 10:26 767952 ----a-w- c:\windows\BDTSupport.dll
2010-03-08 15:53 . 2009-11-10 10:28 149456 ----a-w- c:\windows\SGDetectionTool.dll
2010-03-08 15:53 . 2009-10-28 01:36 1152444 ----a-w- c:\windows\UDB.zip
2010-03-08 15:53 . 2008-11-26 12:08 131 ----a-w- c:\windows\IDB.zip
2010-03-08 15:53 . 2009-11-10 10:28 165840 ----a-w- c:\windows\PCTBDRes.dll
2010-03-08 15:53 . 2009-11-10 10:28 1640400 ----a-w- c:\windows\PCTBDCore.dll
2010-03-08 15:51 . 2010-02-05 09:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-03-08 15:51 . 2009-10-06 16:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-03-08 15:51 . 2009-09-23 16:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-03-08 15:50 . 2010-03-10 20:57 -------- d-----w- c:\program files\Common Files\PC Tools
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 17:50 . 2008-01-21 21:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-11 15:40 . 2010-03-11 15:41 151552 --sh--r- c:\documents and settings\Owner\Application Data\rbeb.exe
2010-03-11 15:40 . 2010-03-11 15:41 151552 --sh--r- c:\documents and settings\Owner\Application Data\rbeb.exe
2010-03-10 22:43 . 2008-03-29 14:54 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-03-10 21:46 . 2007-12-04 22:16 -------- d-----w- c:\documents and settings\Owner\Application Data\skypePM
2010-03-10 19:36 . 2005-11-24 21:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-02 22:30 . 2010-03-02 22:30 163840 --sh--r- c:\documents and settings\Owner\Application Data\aagx.exe
2010-03-02 22:30 . 2010-03-02 22:30 163840 --sh--r- c:\documents and settings\Owner\Application Data\aagx.exe
2010-02-20 17:43 . 2007-11-27 17:43 -------- d-----w- c:\documents and settings\Owner\Application Data\LimeWire
2009-12-22 12:29 . 2006-08-20 23:07 4222 ----a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2006-04-02 10:24 . 2006-04-02 10:23 5616888 ----a-w- c:\program files\winamp521_full_emusic-7plus.exe
2006-04-01 23:08 . 2006-04-01 23:08 5284152 ----a-w- c:\program files\Firefox.exe
2008-03-20 21:25 . 2008-03-20 21:25 1233810 --sha-w- c:\windows\system32\fbcnqupt.tmp
2006-04-20 00:58 . 2006-04-20 00:23 848 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
- Kod: Zaznacz wszystko
<pre>
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\Common Files\Symantec Shared\ccApp .exe
c:\program files\Hp\HP Software Update\HPWuSchd2 .exe
c:\program files\HPQ\Default Settings\cpqset .exe
c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
c:\program files\HPQ\Quick Launch Buttons\EabServr .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\Java\jre1.6.0_03\bin\jusched .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb07 .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [N/A]
"BitComet"="c:\program files\BitComet\BitComet.exe" [N/A]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [N/A]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [N/A]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [N/A]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [N/A]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [N/A]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [N/A]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [N/A]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-03 188416]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-01-22 267048]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [N/A]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [N/A]
"BearShare"="c:\program files\BearShare\BearShare.exe" [N/A]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"MCM"="c:\program files\Mp3 Convert Master\Mp3ConvertMaster.exe" [N/A]
"Internet Connection Wizard Setup Tool"="c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe" [N/A]
"Windows Data Serivce"="windirs.exe" [2010-03-12 135168]
"melt"="msexp.exe" [2010-03-13 143360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-1-8 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\windirs.exe"=
"c:\\WINDOWS\\msexp.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12994:TCP"= 12994:TCP:*:Disabled:BitComet 12994 TCP
"12994:UDP"= 12994:UDP:*:Disabled:BitComet 12994 UDP
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [08/03/2010 15:51 207280]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07/02/2007 00:54 717296]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 09:06 231424]
S1 580e2ef9;580e2ef9;c:\windows\system32\drivers\580e2ef9.sys [06/06/2009 18:34 0]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\fotki01\Spyware Doctor\BDT\BDTUpdateService.exe [08/03/2010 15:53 112592]
.
Contents of the 'Scheduled Tasks' folder
2008-06-24 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-03 11:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0ibbf7ml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.interia.pl/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPBILLARD8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin9.dll
.
- - - - ORPHANS REMOVED - - - -
BHO-{5C62FA8B-EC6C-4622-A765-D9C3FB01D906} - c:\windows\system32\geedd.dll
AddRemove-hp deskjet 3420 series - c:\program files\hp deskjet 3420 series\hpfiui.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 17:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????????????????????? ???B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll >>UNKNOWN [0x82DDC1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf78a6fc3
\Driver\ACPI -> ACPI.sys @ 0xf7601cb8
\Driver\atapi -> 0x82ddc1f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578c34
ParseProcedure -> ntkrnlpa.exe @ 0x80577896
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578c34
ParseProcedure -> ntkrnlpa.exe @ 0x80577896
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf7471bc3
PacketIndicateHandler -> NDIS.sys @ 0xf745fa0b
SendHandler -> NDIS.sys @ 0xf7473b31
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(588)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\windirs.exe
c:\windows\msexp.exe
c:\windows\windirs.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-03-17 18:00:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-17 18:00
Pre-Run: 1,431,805,952 bytes free
Post-Run: 4,334,821,376 bytes free
- - End Of File - - 82FAEB065A85937A8A2CB55CFFF619DE
jezeli ktos umie to rozszyfrowac bede bardzo wdzieczna
pozdrawiam Renata
ale postaram sie to zlatwic szybko. 