Log:
ComboFix 08-11-22.02 - USER 2008-11-23 16:52:36.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.153 [GMT 1:00]
Uruchomiony z: c:\documents and settings\USER\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-23 do 2008-11-23 )))))))))))))))))))))))))))))))
.
2008-11-23 16:46 . 2008-11-23 16:46 <DIR> d-------- c:\program files\Aspect one
2008-11-16 13:14 . 2008-11-16 13:13 106,436 -rahs---- C:\xfl3hx.exe
2008-11-16 13:13 . 2008-11-16 13:13 84,992 -r-hs---- c:\windows\system32\kav320.dll
2008-11-16 13:12 . 2008-11-01 19:13 104,927 -r-hs---- C:\vfjc8mxm.exe
2008-11-15 15:33 . 2008-11-15 16:46 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-13 15:34 . 2008-11-13 15:34 <DIR> d-------- c:\program files\MSXML 6.0
2008-11-13 15:32 . 2008-11-13 15:32 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-13 15:03 . 2008-06-14 19:01 273,024 --------- c:\windows\system32\drivers\bthport.sys
2008-11-13 15:03 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-13 15:00 . 2008-08-14 14:40 2,187,264 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-13 15:00 . 2008-08-14 14:40 2,144,256 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-13 15:00 . 2008-08-14 14:40 2,064,256 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-13 15:00 . 2008-08-14 14:40 2,022,400 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-13 14:57 . 2008-10-24 12:25 455,936 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-13 14:55 . 2008-09-04 17:46 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 14:54 . 2008-11-13 15:35 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-08 16:10 . 2006-09-19 02:09 31,872 --a------ c:\windows\system32\drivers\wceusbsh.sys
2008-11-08 16:10 . 2006-09-19 02:09 31,872 --a--c--- c:\windows\system32\dllcache\wceusbsh.sys
2008-10-28 17:04 . 2001-10-19 14:40 1,683,792 --a------ c:\windows\system32\wmvcore2.dll
2008-10-28 17:04 . 2001-10-19 14:40 665,424 --a------ c:\windows\system32\wmv8dmoe.dll
2008-10-28 17:04 . 2001-10-19 14:39 572,752 --a------ c:\windows\system32\wmvdmoe.dll
2008-10-28 17:04 . 2001-10-19 14:40 438,608 --a------ c:\windows\system32\wmv8dmod.dll
2008-10-28 17:04 . 2001-10-19 02:05 285,184 --a------ c:\windows\system32\wmidx2.ocx
2008-10-28 17:04 . 2008-10-28 17:04 156,910 --a------ c:\windows\WMSysPr8.prx
2008-10-28 17:03 . 2008-11-23 14:00 <DIR> d-------- c:\program files\coolpro2
2008-10-28 16:59 . 2008-10-28 16:59 <DIR> d-------- c:\program files\ASIO4ALL v2
2008-10-27 19:21 . 2008-10-28 16:59 <DIR> d-------- c:\program files\VstPlugins
2008-10-27 19:21 . 2002-07-07 23:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
2008-10-27 19:21 . 2006-06-20 09:56 225,280 --a------ c:\windows\system32\rewire.dll
2008-10-27 19:20 . 2008-10-27 19:20 <DIR> d-------- c:\program files\Outsim
2008-10-27 19:18 . 2008-10-28 16:59 <DIR> d-------- c:\program files\Image-Line
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 12:54 --------- d-----w c:\documents and settings\USER\Dane aplikacji\OpenOffice.org2
2008-10-27 18:28 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-24 11:25 455,936 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-22 16:51 --------- d-----w c:\program files\NAPI-PROJEKT
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:17 1,847,168 ----a-w c:\windows\system32\win32k.sys
2008-09-04 16:46 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-29 19:06 1,350,664 ----a-w c:\windows\system32\msxml6.dll
2008-01-18 20:53 21,528 ----a-w c:\documents and settings\USER\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-11-22 20:56 2,560 --sh--r c:\windows\system32\fooool.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-11-17 49152]
"RemoteCenter"="c:\program files\Creative\MediaSource\RemoteControl\RcMan.exe" [2004-08-17 143360]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
"SetDefaultMIDI"="MIDIDef.exe" [2006-08-11 c:\windows\MIDIDEF.EXE]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-11-17 3022848]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-18 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-26 286720]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 c:\windows\system32\CTXFIHLP.EXE]
"nwiz"="nwiz.exe" [2003-11-17 c:\windows\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2003-10-06 c:\windows\system32\CTHELPER.EXE]
"Barsaka"="explorer.exe" [2006-09-19 c:\windows\explorer.exe]
"CHotkey"="mHotkey.exe" [2002-07-23 c:\windows\mHotkey.exe]
c:\documents and settings\USER\Menu Start\Programy\Autostart\
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 393216]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
hp officejet 4100 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpomau08.exe [2003-04-06 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22329:TCP"= 22329:TCP:BitComet 22329 TCP
"22329:UDP"= 22329:UDP:BitComet 22329 UDP
"10044:TCP"= 10044:TCP:BitComet 10044 TCP
"10044:UDP"= 10044:UDP:BitComet 10044 UDP
"2026:UDP"= 2026:UDP:Windows Media Format SDK (iexplore.exe)
"2027:UDP"= 2027:UDP:Windows Media Format SDK (iexplore.exe)
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-03-31 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-03-31 20560]
R2 UltiDev Cassini Web Server for ASP.NET 2.0;UltiDev Cassini Web Server for ASP.NET 2.0;"c:\program files\UltiDev\Cassini Web Server for ASP.NET 2.0\UltiDevCassinWebServer2a.exe" [2007-02-08 49152]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d6a7510-4350-11dd-836e-806d6172696f}]
\Shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{736abb38-8b01-11dc-aec1-00196633b086}]
\Shell\AutoRun\command - I:\fooool.exe
\Shell\explore\Command - I:\fooool.exe
\Shell\open\Command - I:\fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8cdce612-93ab-11dc-aed5-00196633b086}]
\Shell\AutoRun\command - H:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fce4e86a-6a64-11dc-85b0-00196633b086}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL PROGRAMY\narzedzia\TCPowerPack1.7\TCPowerPack.exe
.
Zawartość folderu 'Zaplanowane zadania'
2008-01-03 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp officejet 4100 series#1190657616.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\nuxfb3o0.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://search.bearshare.com/pl/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 16:54:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(608)
c:\windows\system32\rsaenh.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(664)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
Czas ukończenia: 2008-11-23 16:54:59
ComboFix-quarantined-files.txt 2008-11-23 15:54:57
ComboFix2.txt 2008-11-23 15:41:14
ComboFix3.txt 2008-11-23 15:14:07
ComboFix4.txt 2008-11-12 16:52:39
Przed: 37 991 759 872 bajtów wolnych
Po: 37,980,327,936 bajtów wolnych
169 --- E O F --- 2008-11-13 14:35:52
