- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:46, on 2009-01-27
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\lsassd.exe
C:\WINDOWS\system32\ctfmon.exe
D:\_program no install\HijackThis v2.0.2\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [WheelMouse] "C:\Program Files\A4Tech\Mouse\Amoumain.exe"
O4 - HKLM\..\Run: [UpdReg] "C:\WINDOWS\UpdReg.EXE"
O4 - HKLM\..\Run: [CTxfiHlp] "C:\WINDOWS\system32\CTXFIHLP.EXE"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LSAS] lsassd.exe
O4 - HKLM\..\RunServices: [LSAS] lsassd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [nodenable] "C:\Program Files\eset\nodenable.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229978809062
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15106/CTPID.cab
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
--
End of file - 6366 bytes
Log z ComboFix 09-01-21.04:
- Kod: Zaznacz wszystko
ComboFix 09-01-21.04 - usr 2009-01-27 18:43:58.1 - NTFSx86
Uruchomiony z: d:\software\_spyware\ComboFix.exe
* Resident AV is active
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\npf.sys
c:\windows\system32\packet.dll
c:\windows\system32\pthreadGC2.dll
c:\windows\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((( Pliki utworzone od 2008-12-27 do 2009-01-27 )))))))))))))))))))))))))))))))
.
2009-01-25 00:37 . 2009-01-26 20:34 <DIR> d-------- c:\program files\FlashGet
2009-01-24 22:08 . 2009-01-24 22:08 <DIR> d-------- c:\documents and settings\usr\OngameNetwork
2009-01-24 17:58 . 2009-01-24 17:58 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Cerberus LLC
2009-01-24 17:57 . 2009-01-24 17:58 <DIR> d-------- c:\program files\Cerberus
2009-01-22 22:05 . 2009-01-22 22:05 <DIR> d-------- c:\program files\HDDGURU LLF Tool
2009-01-20 22:44 . 2008-04-14 22:50 159,232 --a------ c:\windows\system32\ptpusd.dll
2009-01-20 22:44 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll
2009-01-19 22:28 . 2009-01-19 22:28 <DIR> d-------- c:\program files\BetterJPEG 2
2009-01-19 17:13 . 2009-01-19 17:13 <DIR> d-------- c:\program files\onOne Software
2009-01-18 08:49 . 2009-01-18 08:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Uniblue
2009-01-18 08:48 . 2008-08-25 15:44 20,232 --a------ c:\windows\system32\AntiSpyNative64.exe
2009-01-18 08:48 . 2008-08-25 15:44 16,648 --a------ c:\windows\system32\AntiSpyNative32.exe
2009-01-18 08:46 . 2009-01-18 08:46 <DIR> d-------- c:\documents and settings\usr\Dane aplikacji\Corel
2009-01-18 08:44 . 2009-01-18 08:44 <DIR> d-------- c:\program files\Common Files\Protexis
2009-01-18 08:44 . 2009-01-18 08:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Corel
2009-01-18 08:42 . 2009-01-18 08:42 <DIR> d-------- c:\program files\Corel
2009-01-17 21:21 . 2009-01-25 12:12 <DIR> d-------- c:\program files\ffdshow
2009-01-17 21:21 . 2008-12-08 12:53 57,344 --a------ c:\windows\system32\ff_vfw.dll
2009-01-17 21:21 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-17 21:19 . 2009-01-17 21:19 <DIR> d-------- c:\program files\7-Zip
2009-01-13 22:23 . 2009-01-13 22:23 <DIR> d-------- c:\program files\Pidgin
2009-01-13 22:23 . 2009-01-13 22:23 <DIR> d-------- c:\program files\Common Files\GTK
2009-01-13 20:27 . 2009-01-14 22:10 389,120 --------- c:\windows\system32\fpres632.dll
2009-01-13 20:27 . 2009-01-14 22:09 380,928 --------- c:\windows\system32\fpmon6.dll
2009-01-11 15:18 . 2009-01-11 15:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Creative Labs
2009-01-11 13:12 . 2009-01-22 20:04 <DIR> d-------- c:\program files\VS Revo Group
2009-01-11 07:00 . 2009-01-11 07:00 47,228 --a------ c:\windows\FontData.fdb
2009-01-01 14:20 . 2009-01-01 14:20 <DIR> d-------- c:\documents and settings\usr\Dane aplikacji\Microsoft Games
2008-12-30 18:15 . 2008-12-30 19:03 <DIR> d-------- c:\program files\The KMPlayer
2008-12-28 22:55 . 2008-12-28 22:55 <DIR> d-------- c:\documents and settings\usr\Dane aplikacji\Playrix Entertainment
2008-12-28 22:39 . 2008-12-28 22:39 <DIR> d-------- c:\documents and settings\usr\Dane aplikacji\Nero
2008-12-28 22:38 . 2008-12-28 22:38 <DIR> d-------- c:\program files\Nero
2008-12-28 22:38 . 2008-12-28 22:38 <DIR> d-------- c:\program files\Common Files\Nero
2008-12-28 22:38 . 2008-12-28 22:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero
2008-12-28 22:34 . 2008-12-28 22:34 <DIR> d-------- c:\windows\Fishdom
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-27 17:46 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-01-27 17:36 --------- d-----w c:\documents and settings\usr\Dane aplikacji\foobar2000
2009-01-27 17:36 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Azureus
2009-01-27 17:36 --------- d-----w c:\documents and settings\usr\Dane aplikacji\.purple
2009-01-26 21:55 --------- d-----w c:\documents and settings\usr\Dane aplikacji\gtk-2.0
2009-01-26 19:22 --------- d-----w c:\program files\foobar2000
2009-01-25 19:57 2,516 --sha-w c:\documents and settings\All Users\Dane aplikacji\KGyGaAvL.sys
2009-01-23 23:00 238,592 ----a-w c:\windows\system32\notepad.exe
2009-01-22 22:58 --------- d-----w c:\program files\The Bat!
2009-01-22 19:09 --------- d-----w c:\documents and settings\usr\Dane aplikacji\NewsLeecher
2009-01-19 19:06 --------- d-----w c:\program files\SpeedFan
2009-01-19 16:13 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-18 07:48 --------- d-----w c:\program files\Uniblue
2009-01-18 07:48 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Uniblue
2009-01-11 09:17 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Creative
2008-12-27 22:02 --------- d-----w c:\program files\Vuze
2008-12-27 20:13 --------- d-----w c:\documents and settings\usr\Dane aplikacji\TransAng3
2008-12-21 12:08 --------- d-----w c:\program files\TransANG3
2008-12-21 09:31 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-21 09:15 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Gadu-Gadu
2008-12-18 19:44 --------- d-----w c:\documents and settings\usr\Dane aplikacji\ImgBurn
2008-12-18 19:41 --------- d-----w c:\program files\ImgBurn
2008-12-15 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ABBYY
2008-12-15 21:11 --------- d-----w c:\program files\Common Files\Adobe
2008-12-15 17:05 --------- d-----w c:\documents and settings\usr\Dane aplikacji\ABBYY
2008-12-15 16:58 --------- d-----w c:\program files\ABBYY FineReader 9.0
2008-12-15 16:57 --------- d-----w c:\program files\Common Files\ABBYY
2008-12-14 16:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\KONAMI
2008-12-14 15:42 --------- d-----w c:\program files\AGEIA Technologies
2008-12-14 15:32 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-14 15:25 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-14 10:34 --------- d-----w c:\documents and settings\usr\Dane aplikacji\DAEMON Tools Pro
2008-12-13 22:41 --------- d--h--r c:\documents and settings\usr\Dane aplikacji\SecuROM
2008-12-12 23:07 --------- d-----w c:\program files\DIFX
2008-12-12 23:00 --------- d-----w c:\documents and settings\usr\Dane aplikacji\DAEMON Tools Lite
2008-12-12 23:00 --------- d-----w c:\documents and settings\usr\Dane aplikacji\DAEMON Tools
2008-12-12 23:00 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite
2008-12-08 22:23 --------- d-----w c:\program files\Java
2008-12-07 12:43 --------- d-----w c:\program files\Softland
2008-12-05 16:19 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-12-05 16:16 --------- dc-h--w c:\documents and settings\All Users\Dane aplikacji\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-12-04 19:58 --------- d-----w c:\program files\HP
2008-12-04 19:58 --------- d-----w c:\program files\Hewlett-Packard
2008-12-04 19:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP
2008-12-04 19:53 --------- d-----w c:\documents and settings\usr\Dane aplikacji\HP
2008-12-03 18:29 --------- d-----w c:\program files\WinFast
2008-12-03 18:29 --------- d-----w c:\program files\Common Files\Ulead Systems
2008-12-03 18:29 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ulead Systems
2008-12-02 16:50 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-01 22:12 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-01 22:12 --------- d-----w c:\program files\Common Files\ATI Technologies
2008-12-01 22:07 --------- d-----w c:\program files\DriverCleanerDotNET
2008-12-01 21:52 8 --sh--r c:\documents and settings\All Users\Dane aplikacji\5BE5F9389A.sys
2008-12-01 21:50 --------- d-----w c:\program files\Common Files\Corel
2008-12-01 18:30 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Aegisub
2008-12-01 18:03 2,208 ----a-w c:\windows\system32\drivers\nxsIO32.sys
2008-12-01 17:23 --------- d-----w c:\documents and settings\usr\Dane aplikacji\Media Player Classic
2008-11-30 22:03 --------- d-----w c:\program files\Plustek
2008-11-30 21:13 1,234,130 ----a-w c:\windows\wrar380-ce.exe
2008-11-30 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Azureus
2008-11-30 21:00 --------- d-----w c:\program files\QuickTime Alternative
2008-11-30 21:00 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2008-11-30 20:57 --------- d-----w c:\program files\QuickPar
2008-11-30 20:56 --------- d-----w c:\program files\hkSFV
2008-11-30 20:55 --------- d-----w c:\program files\oZone3D
2008-11-30 20:44 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-30 20:42 --------- d-----w c:\program files\Auslogics
2008-11-30 20:41 --------- d-----w c:\program files\Atomic Clock Sync
2008-11-30 20:38 --------- d-----w c:\program files\Microsoft.NET
2008-11-30 20:12 --------- dc-h--w c:\documents and settings\All Users\Dane aplikacji\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
2008-11-30 20:07 --------- d-----w c:\program files\OO Software
2008-11-30 20:01 --------- d-----w c:\program files\Gadu-Gadu
2008-11-30 19:45 --------- d-----w c:\program files\DAMN NFO Viewer
2008-11-30 19:43 --------- d-----w c:\program files\Aegisub
2008-11-30 19:43 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Creative
2008-11-30 19:19 --------- d-----w c:\program files\Creative
2008-11-30 19:00 --------- d-----w c:\program files\CoreCodec
2008-11-30 18:58 --------- d-----w c:\program files\MKVtoolnix
2008-11-30 18:58 --------- d-----w c:\program files\Haali
2008-11-30 18:52 --------- d-----w c:\program files\AC3Filter
2008-11-30 17:40 --------- d-----w c:\documents and settings\usr\Dane aplikacji\ACD Systems
2008-11-30 17:39 --------- d-----w c:\program files\ACD Systems
2008-11-30 17:39 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ACD Systems
2008-11-30 17:34 --------- d-----w c:\program files\VID_0E8F&PID_0012
2008-11-30 17:33 --------- d-----w c:\program files\ESET
2008-11-30 17:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET
2008-11-30 17:22 444,952 ----a-w c:\windows\system32\wrap_oal.dll
2008-11-30 17:22 109,080 ----a-w c:\windows\system32\OpenAL32.dll
2008-11-30 17:22 --------- d-----w c:\program files\OpenAL
2008-11-30 17:22 --------- d-----w c:\program files\Common Files\Creative Labs Shared
2008-11-30 17:15 --------- d-----w c:\program files\totalcmd
2008-11-30 17:02 --------- d-----w c:\program files\A4Tech
2008-11-30 16:58 --------- d-----w c:\program files\ATI Technologies
2008-11-30 13:29 --------- d-----w c:\program files\Realtek
2008-11-30 13:29 --------- d-----w c:\documents and settings\usr\Dane aplikacji\InstallShield
2008-11-30 13:01 --------- d-----w c:\program files\microsoft frontpage
2008-11-30 13:00 --------- d-----w c:\program files\Usługi online
2008-11-24 02:06 129,520 ------w c:\windows\system32\pxafs.dll
2008-11-24 02:06 120,568 ------w c:\windows\system32\pxcpyi64.exe
2008-11-24 02:06 118,256 ------w c:\windows\system32\pxinsi64.exe
2008-04-15 12:00 1,220,608 --sh--r c:\windows\system32\lsassd.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
"nodenable"="c:\program files\eset\nodenable.exe" [2008-09-22 326829]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 241664]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"CTxfiHlp"="c:\windows\system32\CTXFIHLP.EXE" [2008-08-27 23552]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"VolPanel"="c:\program files\Creative\Volume Panel\VolPanlu.exe" [2008-08-06 233576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"LSAS"="lsassd.exe" [2008-04-15 c:\windows\system32\lsassd.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LSAS"="lsassd.exe" [2008-04-15 c:\windows\system32\lsassd.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"e:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2004-06-09 116264]
R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [2004-06-09 19240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-08-18 34312]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2008-08-27 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2008-08-27 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2008-08-27 72728]
R4 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 660768]
R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R4 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\system32\drivers\nxsIO32.sys [2008-12-01 2208]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-11-30 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2008-08-27 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2008-08-27 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2008-08-27 72728]
S3 PortTalk;PortTalk;c:\windows\system32\drivers\PortTalk.sys [2008-11-30 3567]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [2008-12-03 9446]
.
Zawartość folderu 'Zaplanowane zadania'
2009-01-18 c:\windows\Tasks\Uniblue SpyEraser Nag.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2008-08-25 15:44]
2009-01-18 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2008-08-25 15:44]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: &Ściągnij przy pomocy FlashGet'a - c:\program files\FlashGet\jc_link.htm
IE: &Ściągnij wszystko przy pomocy FlashGet'a - c:\program files\FlashGet\jc_all.htm
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
FF - ProfilePath - c:\documents and settings\usr\Dane aplikacji\Mozilla\Firefox\Profiles\4ksgm80r.default\
FF - prefs.js: browser.search.selectedEngine - BTJunkie
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 18:48:09
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-73586283-1229272821-1801674531-1003\Software\Creative Tech\Creative Audio Playback Redirection Engine\Session\* *´H¬**']
"Config"=dword:00000000
[HKEY_USERS\S-1-5-21-73586283-1229272821-1801674531-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ea,f6,e8,0a,05,64,8a,85,5b,cb,21,f6,78,3a,b6,6b,0a,7f,7c,7a,4d,28,c8,
12,ba,d2,95,d3,2e,09,3b,84,2f,ad,72,90,a1,a6,50,91,ef,f0,7d,ac,06,33,29,b5,\
"??"=hex:07,08,f7,04,3b,b1,73,73,8e,17,5f,94,bd,19,ef,5d
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="301C5335CE0087ADACFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933A2D97226D213B555A9C6AECB7A5D14076D571C55334F9A580E8086B3131DB6F92AED1445A25731E3544E77869AC079282EB99085D24D354FC8FBDD7CEDA6B7D89AC7093E10FD9A12832AF5F42D27523D5955EF2DDF0D617F0F34DBB159F19AAC67D90039D3FCE656B234DAE3A69EAA33291B0A81D6C03252459FBF3949C1309E3ABC49697CCC493678CB25F0CBF5B98D3CCE2F2FD3297D63B0874BE8D66F0F86266037F3387B3B67CD245B2F080D787F150BB4549C9E5C86FE0BC50F3D6714741D87A2EF5EAAF7D510C606A4E7DCA47299BA7583958CAE413D1AF9EADBA85EAA79C7E76C658F7FA0808DAF4B9E6E3D82149FCDC44B72154A617C362F3749CF9F778EE4E9ECF2161D45296B9001DF89FEB3CEA0926BE17612C14A4E077770117D35187DDBB4B144D0679D4C578863916D8BB0D15CCA057C3919F1178A675A8BA33A781A2D20BE5678D341EB7555BFA38710014D04DE94951506B56BCC78D7EF23ED16273A3A9DDB82DBC1E534A74F4FB79C517F62C2E0F4AF8E2B2BCFBC4D30C49BAB92D4AF68A993B69E5C52E480E99FEF08D942354D0F45983C398DEDB18401F44751C0504B5783FAAAF20218548E14ABDBD16099501F48EF257AEFE613E7878D4EDA37910A40DB280DD2686FE1981D57D8E272F5F6A25E43F85BD8289019B9DD74A9658C7707DD9F4428A0BAD329F65CE2871EF55E5C61A71EC91B54DE1B30C2C5BDEC7DFD8D7DA41E2338F168261309AB45FD683BD15E124DB700B44535B2FBA11D62C59AFCDF633EF9B0AEF1389590BD9EA24054CD175F151CC2B42273C1AFB8CB4F6B5FC062E71DE3002E55CD5609759E8E1485DD004ED5729264E323106315D73095F08A94A3861E91D28E16E1EC0452B820BC55C304C73914778F5902860F50F511874CB9EB19E842A3AB07F91A6DCC8AC0FD48BF85F1F160473DECB4E6D54905D071BF497ACA8965C74DDA92D38AA1657B61928540342582CC1AF7F53BECD9386790606E6C61493E8E2C8D543F896C1CF49152D9813E5CFA296559C619AA1DDA8FD9EE094379F2896A915F1BE7E8C8737ACDE8B7FE18A4BC21F2B6DE0039B3AEA4566FAC6403D8F4715A58F73CFE5A29F7E9FCCA4F1A14B01D2DF32ACE184168A822A9A019C14E21DB7ABEAE8DF2456B834BF8F6ECF23FB3A60E3F44C8996C32C0EF2A6010CD2D2589F7A1B9944434DB52EE0A4F37A34193EFA6068198E56229B405409C5811518B7AECD04368C1D4133FE3A21FF203B716CB9AFAE7C976515B71BA81B7684D9B505608612D8A90D71B494D79E2C6B947F3312496B24C9A6E51097EC4C91B9571E7668AAE0CDAA9737493E209"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\CTxfispi.exe
.
**************************************************************************
.
Czas ukończenia: 2009-01-27 18:49:12 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-01-27 17:49:06
Przed: 18 242 174 976 bajtów wolnych
Po: 18,182,647,808 bajtów wolnych
266
