- Kod: Zaznacz wszystko
ComboFix 09-12-01.01 - User 2009-12-02 0:01.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.511.147 [GMT 1:00]
Uruchomiony z: c:\firefox ściągnięte pliki\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\docume~1\User\USTAWI~1\Temp\cvasds0.dll
C:\mbdm.exe
c:\windows\system32\msconfig.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2009-11-01 do 2009-12-01 )))))))))))))))))))))))))))))))
.
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\windows\system32\wbem\snmp
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\windows\system32\oobe
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\windows\srchasst
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\windows\system32\xircom
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\windows\msagent
2009-12-01 23:11 . 2009-12-01 23:11 -------- d-----w- c:\program files\microsoft frontpage
2009-11-30 20:34 . 2009-11-30 20:34 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\cache
2009-11-30 20:18 . 2009-11-30 20:34 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10
2009-11-30 20:17 . 2009-11-30 20:18 -------- d-----w- C:\Gadu-Gadu 10
2009-11-29 21:11 . 2009-08-23 21:00 23856 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-29 21:10 . 2009-11-29 21:11 -------- d-----w- c:\program files\Google
2009-11-27 10:25 . 2009-11-29 13:37 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Canon
2009-11-25 19:45 . 2009-11-25 19:45 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe
2009-11-25 19:44 . 2009-11-25 19:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-25 19:41 . 2009-11-25 19:41 -------- d-----w- c:\windows\Cache
2009-11-23 10:53 . 2009-11-23 10:53 37376 ----a-w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll
2009-11-23 10:53 . 2009-11-23 10:53 11776 ----a-w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll
2009-11-17 11:28 . 2009-11-17 11:28 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Scansoft
2009-11-16 20:27 . 2008-04-13 19:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-11-16 20:25 . 2009-11-16 20:25 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\InstallShield
2009-11-16 20:25 . 2009-11-16 20:25 -------- d-----w- c:\documents and settings\User\Dane aplikacji\ScanSoft
2009-11-16 20:25 . 2009-11-16 20:25 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ScanSoft
2009-11-16 20:25 . 2009-11-16 20:25 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-11-16 20:24 . 2009-11-16 20:24 -------- d-----w- c:\program files\ScanSoft
2009-11-16 20:23 . 2009-11-16 20:25 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-16 20:21 . 2009-11-16 20:21 -------- d--h--w- c:\documents and settings\All Users\Dane aplikacji\CanonBJ
2009-11-16 20:20 . 2006-12-25 20:00 69632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8R.DLL
2009-11-16 20:20 . 2006-12-25 20:00 27136 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8R.DLL
2009-11-16 20:20 . 2006-12-25 20:00 198656 ----a-w- c:\windows\system32\CNMLM8R.DLL
2009-11-16 20:20 . 2009-11-16 20:20 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-11-16 20:20 . 2006-11-10 01:59 57344 ----a-w- c:\windows\system32\CNCI140.DLL
2009-11-16 20:20 . 2006-06-29 05:29 106496 ----a-w- c:\windows\system32\cnco140.dll
2009-11-16 20:20 . 2006-05-26 01:54 135168 ----a-w- c:\windows\system32\CNCL140.DLL
2009-11-16 20:20 . 2006-11-10 02:00 1314816 ----a-w- c:\windows\system32\CNCC140.DLL
2009-11-16 20:20 . 2009-11-16 20:20 -------- d--h--w- c:\program files\CanonBJ
2009-11-16 20:19 . 2009-11-16 20:28 -------- d-----w- c:\program files\Canon
2009-11-15 17:12 . 2008-04-13 19:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-11-15 17:11 . 2008-04-13 21:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-15 17:00 . 2009-11-15 17:00 306432 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-11-14 18:25 . 2009-11-14 18:25 -------- d--h--w- c:\windows\PIF
2009-11-14 16:49 . 2009-11-14 18:08 -------- d-----w- C:\filmy
2009-11-14 16:45 . 2009-11-14 16:45 -------- d---a-w- c:\program files\ALLPlayer 3.1 PL
2009-11-14 16:42 . 2008-09-16 19:23 168448 ----a-w- c:\windows\system32\unrar.dll
2009-11-14 16:42 . 2009-01-07 18:14 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2009-11-14 16:41 . 2009-11-14 16:42 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-11-14 16:41 . 2009-11-14 16:41 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Real
2009-11-14 16:28 . 2009-12-01 22:55 -------- d-----w- C:\firefox ściągnięte pliki
2009-11-14 16:27 . 2009-11-14 16:27 0 ----a-w- c:\windows\nsreg.dat
2009-11-14 16:26 . 2009-11-14 16:26 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-11-14 16:23 . 2009-11-14 16:23 39080 ----a-w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-11-14 16:15 . 2009-11-14 16:15 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Ashampoo
2009-11-14 16:15 . 2009-11-14 16:15 -------- d-----w- c:\program files\Ashampoo
2009-11-14 16:09 . 2009-11-14 16:09 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead
2009-11-14 15:58 . 2009-11-14 15:58 -------- d-----w- c:\program files\Globe Software
2009-11-14 15:35 . 2009-11-14 15:35 -------- d-----w- c:\documents and settings\User\Dane aplikacji\TuneUp Software
2009-11-14 14:49 . 2009-11-14 16:11 -------- d-----w- C:\użytki
2009-11-14 14:37 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2009-11-14 14:37 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2009-11-14 14:36 . 2009-11-14 14:36 -------- d-----w- c:\program files\Microsoft.NET
2009-11-14 14:35 . 2009-11-14 14:36 -------- d-----w- c:\windows\SHELLNEW
2009-11-14 14:32 . 2009-11-14 14:32 -------- d-----r- C:\MSOCache
2009-11-14 14:29 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-11-11 16:11 . 2009-11-11 16:14 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Temp
2009-11-11 16:11 . 2009-11-29 21:12 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Google
2009-11-11 15:50 . 2001-10-26 11:57 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-11-11 15:44 . 2008-04-13 21:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 23:54 . 2009-11-14 15:40 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-11-14 15:40 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2009-11-14 15:40 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-11-14 15:40 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-11-14 15:40 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-11-14 15:40 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-17 23:43 . 2008-06-16 13:28 49374 ----a-w- c:\windows\system32\perfc015.dat
2009-11-17 23:43 . 2008-06-16 13:28 356330 ----a-w- c:\windows\system32\perfh015.dat
2009-11-14 15:40 . 2009-11-14 15:40 -------- d-----w- c:\program files\Alwil Software
2009-11-10 14:29 . 2009-11-10 14:29 -------- d-----w- c:\program files\Usługi online
2009-11-10 14:27 . 2009-11-10 14:27 21856 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-10 14:23 . 2009-11-10 14:23 -------- d-----w- c:\program files\Windows Media Connect 2
2009-10-30 00:29 . 2009-10-30 00:29 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-09-15 11:56 . 2009-11-14 15:40 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 11:55 . 2009-11-14 15:40 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 11:55 . 2009-11-14 15:40 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
.
------- Sigcheck -------
[-] 2008-06-16 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-06-16 . 335813EACD16E84F3047A3326F6E5473 . 549888 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-06-16 . 37ED43F3DEC4400586554D61C3129478 . 112128 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe
[-] 2008-06-16 . 7F059A93D251284A8BC758327ECD3D69 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2008-07-07 . 37D5DAAEDA594B9BEE00C82F185CC549 . 2197376 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe
[-] 2007-07-11 . CE594E18FE0D0AF804F1F3694921CE62 . 642560 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll
[-] 2008-06-27 . 4EC7ED41D95D18B3CD1A2BD9DFEFB591 . 1424896 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-06-16 . C8BDAD4065118558B3DC360FC96D81DB . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2008-07-19 . 0DBF1939DF18AC8F8C1E4BD63D7D4B0F . 2074240 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe
c:\windows\System32\wscntfy.exe ... - brak elementu !!
c:\windows\System32\ctfmon.exe ... - brak elementu !!
c:\windows\System32\regsvc.dll ... - brak elementu !!
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StatBar"="c:\program files\Globe Software\StatBar\StatBar.exe" [2003-07-25 335872]
"Gadu-Gadu 10"="c:\gadu-gadu 10\gg.exe" [2009-11-23 11797096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"DefragTaskBar"="c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2007-08-28 169312]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Gadu-Gadu 10\\gg.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-14 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-14 20560]
--- Inne Usługi/Sterowniki w Pamięci ---
*NewlyCreated* - HELPSVC
.
Zawartość folderu 'Zaplanowane zadania'
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\y021580x.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
FF - plugin: c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - USUNIĘTO PUSTE WPISY - - - -
AddRemove-Easy-LayoutPrint - c:\program files\Canon\Easy-LayoutPrint\uninst.exe uninst.ini
AddRemove-Easy-PhotoPrint - c:\program files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-02 00:12
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
StatBar = c:\program files\Globe Software\StatBar\StatBar.exe??
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(704)
c:\windows\system32\scecli.dll
- - - - - - - > 'explorer.exe'(4068)
c:\windows\system32\SHDOCVW.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\msi.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\devldr32.exe
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-12-02 00:16 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-12-01 23:16
Przed: 7 376 384 000 bajtów wolnych
Po: 7 358 087 168 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 50AF0E5C3F33E4BC9C373602E345A04B
