zamieszczam log z combofixa. mial jakies problemy z tym, że niby nie mogł sie dostac do jakichś plików, ponieważ nie jest admin zalogowany do systemu, podczas gdy ja jestem adminem.
ComboFix 08-03-23.2 - Daniel 2008-03-24 13:24:52.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1045.18.214 [GMT 0:00]
Running from: C:\N95\gry i programy\ComboFix.exe
* Created a new restore point
.
-- Other TimeOuts --
VFind -td "C:\Windows\system32\baiso*"
C:\Windows\system32\conime.exe
CF13284.exe /c " VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\* >Windir.dat"
VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\*
CF13284.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*" >progfile.dat"
VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*"
CF13284.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"
pv -d10000 * -t -l
\SystemRoot\System32\smss.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\services.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\vssvc.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
"C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe"
"C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe"
"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"
{2BC308F8-3291-45A9-B07E-915F39D4AB93}
{E69974D4-E359-44DD-A700-CEB29905BEFF}
{8B415DBF-1F69-45E0-BD6E-574E6FA11AF5}
"C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe"
"C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe"
C:\Windows\system32\drivers\CDAC11BA.EXE
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Programy\AVG Anti-Spyware 7.5\guard.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k netsvcs
taskeng.exe {0FF1555F-1569-49F0-B71F-C4551D15DFE4}
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1beffb99-95ed-403e-a26a-6df4a6ae5ffa -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-72a284ad-da66-4553-86b8-4ee34aa6cd40 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7d813d95-5bae-47ff-87c0-0812b0bb0c02 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c525b3bc-fb80-4a64-8fb7-55fea22cc5e2
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-001c97dd-f69b-488d-831e-c2b2bd6fcde2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-faad7b8c-6245-4b62-b0d3-0d2e2af46cd4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2dec6a6b-e1c6-4eb2-8991-544fa89369bd -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:17339067-80ac-407a-98ad-344f0422010b
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k Cognizance
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" -Embedding
"C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" -Embedding
C:\Windows\ehome\ehmsas.exe -Embedding
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
explorer.exe
"C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Windows\RtHDVCpl.exe"
"C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe"
"C:\Program Files\HP\QuickPlay\QPService.exe"
"C:\Program Files\HP\HP Software Update\hpwuSchd2.exe"
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"C:\Programy\PowerISO\PWRISOVM.EXE"
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
/a /h ccApp "C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE"
"C:\Windows\ehome\ehtray.exe"
"C:\Programy\Registry Clean Expert\RCHelper.exe" /startup
"C:\Programy\nokia PC suite\Nokia PC Suite 6\PCSuite.exe" -onlytray
"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"
"C:\Programy\Cisco Clean Access Agent\CCAAgent.exe"
"C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE" /recycle
SED "/32\\[0-9]*\\insatll.~tmp/I!d"
VFind -tf "C:\Windows\system32\insatll.~tmp"
C:\Windows\system32\conime.exe
CF13284.exe /c " VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\* >Windir.dat"
VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\*
CF13284.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*" >progfile.dat"
VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*"
CF13284.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"
pv -d10000 * -t -l
\SystemRoot\System32\smss.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\services.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\vssvc.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
"C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe"
"C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe"
"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"
{2BC308F8-3291-45A9-B07E-915F39D4AB93}
{E69974D4-E359-44DD-A700-CEB29905BEFF}
{8B415DBF-1F69-45E0-BD6E-574E6FA11AF5}
"C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe"
"C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe"
C:\Windows\system32\drivers\CDAC11BA.EXE
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Programy\AVG Anti-Spyware 7.5\guard.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k netsvcs
taskeng.exe {0FF1555F-1569-49F0-B71F-C4551D15DFE4}
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1beffb99-95ed-403e-a26a-6df4a6ae5ffa -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-72a284ad-da66-4553-86b8-4ee34aa6cd40 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7d813d95-5bae-47ff-87c0-0812b0bb0c02 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c525b3bc-fb80-4a64-8fb7-55fea22cc5e2
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-001c97dd-f69b-488d-831e-c2b2bd6fcde2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-faad7b8c-6245-4b62-b0d3-0d2e2af46cd4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2dec6a6b-e1c6-4eb2-8991-544fa89369bd -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:17339067-80ac-407a-98ad-344f0422010b
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k Cognizance
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" -Embedding
"C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" -Embedding
C:\Windows\ehome\ehmsas.exe -Embedding
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
explorer.exe
"C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Windows\RtHDVCpl.exe"
"C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe"
"C:\Program Files\HP\QuickPlay\QPService.exe"
"C:\Program Files\HP\HP Software Update\hpwuSchd2.exe"
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"C:\Programy\PowerISO\PWRISOVM.EXE"
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
/a /h ccApp "C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE"
"C:\Windows\ehome\ehtray.exe"
"C:\Programy\Registry Clean Expert\RCHelper.exe" /startup
"C:\Programy\nokia PC suite\Nokia PC Suite 6\PCSuite.exe" -onlytray
"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"
"C:\Programy\Cisco Clean Access Agent\CCAAgent.exe"
"C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE" /recycle
Findstr -MIF:/ sursen
C:\Windows\system32\conime.exe
CF13284.exe /c " VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\* >Windir.dat"
VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\Windows\*
CF13284.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*" >progfile.dat"
VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*"
CF13284.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"
pv -d80000 * -t -l
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\hosts
C:\Windows\system32\ceforllf.dll
C:\Windows\System32\fgggh.ini
C:\Windows\System32\fgggh.ini2
C:\Windows\system32\forfsowk.dll
C:\Windows\system32\rlabiaom.dll
C:\Windows\system32\tvcueebf.dll
C:\Windows\system32\uulqtjgj.dll
C:\Windows\System32\vuxyb.ini
C:\Windows\System32\vuxyb.ini2
C:\Windows\system32\wgoaoygs.dll
C:\Windows\System32\wxxyb.ini
C:\Windows\System32\wxxyb.ini2
C:\Windows\System32\xxycf.ini
C:\Windows\System32\xxycf.ini2
.
((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-24 13:23 6,736 ----a-w C:\Windows\system32\drivers\PROCEXP90.SYS
2008-03-23 20:25 --------- d-----w C:\Users\Daniel\AppData\Roaming\Skype
2008-03-23 20:18 --------- d---a-w C:\PROGRA~2\TEMP
2008-03-23 20:17 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-03-23 16:08 --------- d-----w C:\Users\Daniel\AppData\Roaming\skypePM
2008-03-23 15:37 2,560 ----a-w C:\Windows\system32\drivers\mchInjDrv.sys
2008-03-23 00:39 --------- d-----w C:\Program Files\Norton AntiVirus
2008-03-23 00:39 --------- d-----w C:\Program Files\F-Secure
2008-03-23 00:39 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-23 00:31 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-03-23 00:31 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-03-23 00:31 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-03-23 00:31 --------- d-----w C:\Program Files\Symantec
2008-03-23 00:28 --------- d-----w C:\PROGRA~2\Symantec
2008-03-23 00:06 --------- d-----w C:\PROGRA~2\F-Secure
2008-03-22 22:43 --------- d-----w C:\Users\Daniel\AppData\Roaming\Winamp
2008-03-22 22:43 --------- d-----w C:\Users\Daniel\AppData\Roaming\uTorrent
2008-03-21 22:16 --------- d-----w C:\PROGRA~2\eMule
2008-03-20 23:19 27,934 ----a-w C:\Users\Daniel\AppData\Roaming\nvModes.dat
2008-03-20 14:47 --------- d-----w C:\Program Files\Google
2008-03-19 16:35 --------- d-----w C:\PROGRA~2\Bluetooth
2008-03-17 08:57 --------- d-----w C:\Users\Daniel\AppData\Roaming\Nokia
2008-03-16 18:24 --------- d-----w C:\Users\Daniel\AppData\Roaming\VeriSoft Access Manager
2008-03-13 12:41 --------- d-----w C:\Users\Daniel\AppData\Roaming\F-Secure
2008-03-13 12:28 --------- d-----w C:\Program Files\Common Files\Steam
2008-03-12 16:49 --------- d-----w C:\PROGRA~2\Application Data
2008-03-12 16:32 --------- d-----w C:\Program Files\Longman
2008-03-12 12:44 --------- d-----w C:\Program Files\Windows Mail
2008-03-12 12:17 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-11 20:51 54,784 ----a-w C:\Windows\system32\drivers\CDAC11BA.EXE
2008-03-11 20:51 12,464 ----a-w C:\Windows\system32\drivers\CdaC15BA.SYS
2008-03-11 20:51 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-11 20:51 --------- d-----w C:\PROGRA~2\Macrovision
2008-03-09 16:00 --------- d-----w C:\Program Files\Real
2008-03-09 02:06 --------- d-----w C:\PROGRA~2\Apple Computer
2008-03-08 23:11 --------- d-----w C:\Program Files\NCH Software
2008-03-06 16:51 --------- d-----w C:\Program Files\QuickTime
2008-03-06 14:26 --------- d-----w C:\PROGRA~2\NCH Software
2008-03-06 14:20 --------- d-----w C:\Program Files\AviSynth 2.5
2008-03-03 04:41 --------- d-----w C:\Users\Daniel\AppData\Roaming\GARMIN
2008-03-03 01:26 --------- d-----w C:\Users\Daniel\AppData\Roaming\Grisoft
2008-03-03 01:26 --------- d-----w C:\PROGRA~2\Grisoft
2008-03-01 18:05 --------- d-----w C:\Users\Daniel\AppData\Roaming\PC Tools
2008-02-29 15:39 --------- d-----w C:\Program Files\Nokia
2008-02-29 15:39 --------- d-----w C:\Program Files\Common Files\Nokia
2008-02-29 14:57 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-02-29 14:54 --------- d-----w C:\Users\Daniel\AppData\Roaming\PC Suite
2008-02-29 14:52 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-02-29 14:49 --------- d-----w C:\PROGRA~2\Installations
2008-02-29 14:36 --------- d-----w C:\PROGRA~2\Nokia
2008-02-29 04:32 7,296 ----a-w C:\Windows\system32\drivers\grmnusb.sys
2008-02-29 04:32 17,024 ----a-w C:\Windows\system32\drivers\grmngen.sys
2008-02-17 17:54 --------- d-----w C:\PROGRA~2\Coolroom
2008-02-16 19:00 --------- d-----w C:\Program Files\uTorrent
2008-02-15 15:59 --------- d-----w C:\Program Files\Common Files\xing shared
2008-02-15 15:58 --------- d-----w C:\Program Files\Common Files\Real
2008-02-13 12:04 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 12:04 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-13 12:04 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-13 12:04 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 12:04 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 12:04 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-13 12:04 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 12:03 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 12:03 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 12:03 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-13 12:03 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 12:03 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 12:03 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-13 12:01 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-02-13 11:51 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 11:51 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-13 11:51 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-13 11:51 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 11:51 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-13 11:51 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-13 11:51 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 11:48 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-13 11:48 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-13 11:48 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 11:48 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-12 13:07 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-02-06 14:05 --------- d-----w C:\PROGRA~2\NVIDIA
2008-02-04 12:24 --------- d-----w C:\Program Files\Error Repair Professional
2008-02-03 21:59 --------- d-----w C:\Users\Daniel\AppData\Roaming\iExpert Software
2008-01-31 14:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 09:41 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-06 12:43 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-06 12:43 32 ----a-w C:\PROGRA~2\ezsid.dat
2008-01-05 17:25 174 --sha-w C:\Program Files\desktop.ini
2008-01-05 17:16 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-01-05 17:16 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-01-05 17:16 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-01-05 17:16 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-01-05 17:16 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-01-05 17:16 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-01-05 17:16 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-01-05 17:16 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-01-05 17:16 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-01-05 17:16 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-23 00:32 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 09:41 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 12:35 125440]
"RegClean Expert Scheduler"="C:\Programy\Registry Clean Expert\RCHelper.exe" [2008-01-31 02:09 604920]
"Steam"="C:\Gry\Counter Strike\Steam.exe" [2008-02-24 00:01 1266936]
"PC Suite Tray"="C:\Programy\nokia PC suite\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-16 22:34 634880]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 02:50 1021224]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 17:50 4390912 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 14:37 174872]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 16:11 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 09:54 50696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 21:11 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"CognizanceTS"="c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 18:12 17920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400]
"PWRISOVM.EXE"="C:\Programy\PowerISO\PWRISOVM.EXE" [2007-08-07 00:05 200704]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-07 08:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-07 08:05 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-07 08:05 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-15 15:58 185896]
"MSServer"="C:\Windows\system32\mllli.dll" [ ]
"!AVG Anti-Spyware"="C:\Programy\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Programy\nokia PC suite\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-415828500-1633433616-1486023953-1001]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DC6B58C1-F27F-46B6-BC49-7F3725435A97}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{A7EE9358-BE7C-43D9-B98E-AFFD8596C1B8}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{0C2F0C4D-11B0-449B-B2CE-F9DE879042EA}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{117AAEA7-4901-44AA-9A45-A82CB9348197}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{370CDB45-9DCC-47B7-989D-A63C779B61CC}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{0AD5A1F0-3E76-442E-A82F-24B4124189F4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{AA95D80D-A137-4CDB-88F4-87DCFD5BFAE5}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{7F7275B4-C323-4C0F-B0C7-125EE407E8B4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{E3F21315-93B2-47B3-A4D8-5A79B5DDC75A}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{377A626A-98FA-46CA-8659-0638604B412C}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{7CE0CC62-5154-4DE0-82C0-396C669E8393}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{28B2E05A-57E1-4880-A288-D8FD4D0C3535}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{A4448FAD-E6FC-49D4-BA57-33258CC001B8}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{9F6366ED-3CE9-4BF0-ACE5-C89286197E8E}C:\\programy\\gadu-gadu\\gg.exe"= UDP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program glówny
"UDP Query User{8FBE4A73-D74C-49A6-BBDC-020B9B645058}C:\\programy\\gadu-gadu\\gg.exe"= TCP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program glówny
"TCP Query User{22444A00-A229-47FD-A17F-80EBBB00EA76}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{A58B7650-649A-42C1-A275-747E25B76017}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{D1B368B0-0AB9-4E59-A2C2-A8C3B52359E5}C:\\programy\\bearshare\\bearshare.exe"= UDP:C:\programy\bearshare\bearshare.exe:BearShare
"UDP Query User{9024FCFF-CA92-4F9B-A9BD-9631498966BD}C:\\programy\\bearshare\\bearshare.exe"= TCP:C:\programy\bearshare\bearshare.exe:BearShare
"{D3D3E5AD-A84B-4930-B109-65685C42BA19}"= UDP:40757:torrent
"{1858E258-2347-4A49-8C36-6AD3C8612DA6}"= TCP:40757:utorrent
"TCP Query User{01FE7D03-4EDE-4D32-BB64-09699C93D97A}C:\\gry\\colin mcrae dirt\\dirt.exe"= UDP:C:\gry\colin mcrae dirt\dirt.exe:DiRT Executable
"UDP Query User{2DA8F62E-51F0-4679-ACDB-32FAB7456995}C:\\gry\\colin mcrae dirt\\dirt.exe"= TCP:C:\gry\colin mcrae dirt\dirt.exe:DiRT Executable
"TCP Query User{8FBA147D-1E35-4A41-949E-8E5C30FFE67C}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{DA5CDEAE-9956-4A33-B3CF-0A141B6E1840}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{8ABB6BCA-4400-4BF7-9F99-6ABAE8BD50C1}C:\\programy\\dc++\\dcplusplus.exe"= UDP:C:\programy\dc++\dcplusplus.exe:DC++
"UDP Query User{8E311FC7-25A4-4F71-955A-97EF15EFA8AF}C:\\programy\\dc++\\dcplusplus.exe"= TCP:C:\programy\dc++\dcplusplus.exe:DC++
"TCP Query User{B5602181-FB69-4E91-AE15-2DB3C741DE03}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{A29E45E8-F664-4297-AE06-13DF181C7885}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"TCP Query User{BCFC087B-495E-477F-A044-5BA7E311BFAA}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{C8DAA94B-0DE1-4342-B8C0-E8B96D30C5CC}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{513BB99A-B30F-46A4-92D3-C88DD6625420}C:\\gry\\spliner cell\\tcscda\\scda-offline\\system\\splintercell4.exe"= UDP:C:\gry\spliner cell\tcscda\scda-offline\system\splintercell4.exe:SplinterCell4
"UDP Query User{081BEAFD-FAA6-4F7E-94A6-EA3BF80F0C96}C:\\gry\\spliner cell\\tcscda\\scda-offline\\system\\splintercell4.exe"= TCP:C:\gry\spliner cell\tcscda\scda-offline\system\splintercell4.exe:SplinterCell4
"TCP Query User{74CAF593-D926-4BEB-92FB-40901B52CAFC}C:\\programy\\realplayer\\realplay.exe"= UDP:C:\programy\realplayer\realplay.exe:RealPlayer
"UDP Query User{1C03A351-69FF-4207-8EAF-206C6A287B0D}C:\\programy\\realplayer\\realplay.exe"= TCP:C:\programy\realplayer\realplay.exe:RealPlayer
"{07062087-D05A-42AF-9A11-39DBB230B39B}"= Disabled:UDP:C:\Programy\Skype\Phone\Skype.exe:Skype
"{94143D07-E01E-430F-AD55-35B71A05BAEC}"= Disabled:TCP:C:\Programy\Skype\Phone\Skype.exe:Skype
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080314.001\IDSvix86.sys [2008-02-13 16:18]
R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 09:45]
R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 09:45]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R3 SymIMMP;SymIMMP;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 16:27]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 12:50]
S2 Harmonogram automatycznej uslugi LiveUpdate;Harmonogram automatycznej uslugi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-08-23 12:35]
S3 BCM43XV;Sterownik karty sieciowej Broadcom Extensible 802.11;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 07:30]
S3 btwaudio;Urzadzenie dzwiekowe Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-01-02 10:45]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-01-02 10:45]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-01-02 10:45]
S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-03-13 12:00]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 16:27]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
GPSvcGroup REG_MULTI_SZ GPSvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\Setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\Setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2438eba3-b01f-11dc-a87a-001b24ddfff6}]
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\shell\Open(&0)\command - Recycled\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d478b75-a42b-11dc-aa1a-806e6f6e6963}]
\shell\AutoRun\command - E:\setup.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 13:37:13
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Programy\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\drivers\CDAC11BA.EXE
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Programy\Cisco Clean Access Agent\CCAAgent.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2008-03-24 13:44:17 - machine was rebooted [Daniel]
ComboFix-quarantined-files.txt 2008-03-24 13:44:05
.
2008-03-23 03:19:35 --- E O F ---
i bedzie ok
a tych procesow svchost nie jest za duzo?
napisz nazwę i rozszerzenie. jaka wersja Visty