przez Pszemo 23 Paź 2008, 19:09
Komp ogólnie mi zwolnił ma problemy z otwieraniem czegokolwiek (najgorzej jest z siecią lokalną)
- Kod: Zaznacz wszystko
ComboFix 08-10-22.05 - PROAUTO 2008-10-23 18:30:51.13 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.510 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\PROAUTO\Pulpit\ComboFix.exe
[COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR]
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\DOCUME~1\PROAUTO\USTAWI~1\Temp\tmp2.tmp
.
((((((((((((((((((((((((( Pliki utworzone od 2008-09-23 do 2008-10-23 )))))))))))))))))))))))))))))))
.
2008-10-23 12:48 . 2008-10-23 12:48 <DIR> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-10-23 12:47 . 2008-10-23 12:49 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-10-23 11:19 . 2008-10-23 11:19 <DIR> d-------- C:\WINDOWS\Logs
2008-10-23 10:53 . 2008-10-23 10:53 <DIR> d-------- C:\Documents and Settings\PROAUTO\Dane aplikacji\DAEMON Tools
2008-10-22 12:05 . 2008-10-22 12:05 <DIR> dr------- C:\Documents and Settings\PROAUTO\Dane aplikacji\Brother
2008-10-17 14:22 . 2008-03-16 14:47 872,192 --a------ C:\WINDOWS\system32\drivers\mod7700.sys
2008-10-17 14:22 . 2008-03-17 11:56 103,168 --a------ C:\WINDOWS\system32\drivers\ewusbfake.sys
2008-10-17 14:22 . 2008-03-17 11:03 101,376 -ra------ C:\WINDOWS\system32\drivers\ewusbmdm.sys
2008-10-17 14:22 . 2008-01-22 15:09 100,992 --a------ C:\WINDOWS\system32\drivers\ewusbnet.sys
2008-10-17 14:22 . 2007-08-09 04:13 24,448 -ra------ C:\WINDOWS\system32\drivers\ewdcsc.sys
2008-10-17 14:21 . 2008-10-17 14:24 <DIR> d-------- C:\Program Files\PLAY ONLINE
2008-10-15 08:31 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 08:30 . 2008-08-14 15:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 08:30 . 2008-08-14 15:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 08:30 . 2008-08-14 15:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 08:30 . 2008-08-14 15:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 08:30 . 2008-09-15 17:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-13 10:56 . 2008-10-13 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FreeDownloadManager.ORG
2008-10-06 14:04 . 2008-10-06 14:04 <DIR> d-------- C:\Program Files\TightVNC
2008-09-27 14:54 . 2008-09-27 14:54 45,056 --a------ C:\WINDOWS\NCUNINST.EXE
2008-09-27 14:52 . 2008-09-27 14:52 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-09-27 14:52 . 2008-09-27 14:55 280,364 --a------ C:\WINDOWS\hplj1010.his
2008-09-27 14:52 . 2008-09-27 14:55 18,975 --a------ C:\WINDOWS\hplj1010.ini
2008-09-27 14:50 . 2008-09-27 14:50 <DIR> d-------- C:\lj1010seriesprintsys
2008-09-27 14:37 . 2008-09-27 14:37 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-09-27 13:31 . 2008-04-13 20:39 206,976 --a------ C:\WINDOWS\system32\drivers\Dot4.sys
2008-09-27 13:31 . 2008-04-13 20:39 206,976 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys
2008-09-27 13:31 . 2001-10-26 16:46 23,936 --a------ C:\WINDOWS\system32\drivers\Dot4usb.sys
2008-09-27 13:31 . 2001-10-26 16:46 23,936 --a--c--- C:\WINDOWS\system32\dllcache\dot4usb.sys
2008-09-27 13:31 . 2001-08-17 21:47 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys
2008-09-27 13:31 . 2001-08-17 21:47 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 16:28 --------- d-----w C:\Documents and Settings\PROAUTO\Dane aplikacji\skypePM
2008-10-23 16:28 --------- d-----w C:\Documents and Settings\PROAUTO\Dane aplikacji\Skype
2008-10-23 11:16 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-10-23 09:17 --------- d-----w C:\Documents and Settings\PROAUTO\Dane aplikacji\Free Download Manager
2008-10-23 08:54 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-10-23 08:47 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-10-23 08:30 --------- d-----w C:\Program Files\DITel
2008-10-13 08:56 --------- d-----w C:\Program Files\Free Download Manager
2008-10-07 12:48 --------- d-----w C:\Program Files\Nokia
2008-09-27 12:53 --------- d-----w C:\Program Files\Hewlett-Packard
2008-09-25 06:30 --------- d-----w C:\Program Files\Ashampoo
2008-09-25 06:30 --------- d-----w C:\Documents and Settings\PROAUTO\Dane aplikacji\Ashampoo
2008-09-16 06:44 --------- d-----w C:\Program Files\Java
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-06-23 19:15 22,328 ----a-w C:\Documents and Settings\PROAUTO\Dane aplikacji\PnkBstrK.sys
2007-12-12 14:14 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 21760296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-07 159744]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-05-18 138008]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-05-18 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-05-18 138008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 155648]
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" [2007-05-07 589824]
"NWTRAY"="NWTRAY.EXE" [2001-12-18 C:\WINDOWS\system32\nwtray.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-06 561213]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Program Files\\Free Download Manager\\fdm.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"C:\\Program Files\\TightVNC\\WinVNC.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21882:TCP"= 21882:TCP:BitComet 21882 TCP
"21882:UDP"= 21882:UDP:BitComet 21882 UDP
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S3 PCANDIS5_RETWIFI;PCANDIS5_RETWIFI Protocol Driver;C:\PROGRA~1\EEYEDI~1\RETINA~1\PCANDIS5_RETWIFI.SYS [ ]
S3 PCANDIS5_WIFISCAN.SYS;PCANDIS5_WIFISCAN.SYS;C:\Program Files\eEye Digital Security\Retina Wireless Scanner\PCANDIS5_WIFISCAN.SYS [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dbcff1d-9c11-11dd-9b36-001a4b5bd67d}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dbcff20-9c11-11dd-9b36-001a4b5bd67d}]
\Shell\AutoRun\command - H:\AutoRun.exe
.
Zawartość folderu 'Zaplanowane zadania'
2008-10-23 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Toolbar-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\PROAUTO\Dane aplikacji\Mozilla\Firefox\Profiles\sn3o3ygq.default\
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-23 18:37:30
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
PROCES: C:\WINDOWS\Explorer.exe
-> C:\WINDOWS\system32\NWSHLXNT.dll
-> C:\WINDOWS\system32\NLS\ENGLISH\NWSHLXNR.DLL
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Czas ukończenia: 2008-10-23 18:41:06 - komputer został uruchomiony ponownie [PROAUTO]
ComboFix-quarantined-files.txt 2008-10-23 16:41:02
Przed: 35,833,626,624 bajtów wolnych
Po: 35,964,239,872 bajtów wolnych
168 --- E O F --- 2008-10-17 07:00:41
