Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.312 [GMT 1:00]
Uruchomiony z: c:\documents and settings\xxx\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BNDMSS
-------\Service_BNDMSS
((((((((((((((((((((((((( Pliki utworzone od 2008-10-18 do 2008-11-18 )))))))))))))))))))))))))))))))
.
2008-10-29 19:17 . 2008-10-29 19:17 <DIR> d-------- c:\program files\Microsoft Works
2008-10-29 19:11 . 2008-10-29 19:12 <DIR> d-------- c:\windows\SHELLNEW
2008-10-29 19:10 . 2008-10-30 20:55 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-10-29 19:09 . 2008-10-29 19:09 <DIR> dr-h----- C:\MSOCache
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-18 20:15 --------- d-----w c:\documents and settings\xxx\Dane aplikacji\OpenOffice.org2
2008-10-01 13:56 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-01 13:55 --------- d-----w c:\program files\Common Files\Panda Software
2008-10-01 13:52 0 ----a-w c:\windows\system32\drivers\wnmsav.dat
2008-09-25 22:28 --------- d-----w c:\program files\OpenOffice.org 2.4
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-06 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-06 114688]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\xxx\Menu Start\Programy\Autostart\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Ares\\Ares.exe"=
"c:\\Documents and Settings\\xxx\\Pulpit\\Ares.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-12 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-12 20560]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39acc649-8240-11dd-a0d0-00112fcff3ad}]
\Shell\AutoRun\command - F:\0w.com
\Shell\explore\Command - F:\0w.com
\Shell\open\Command - F:\0w.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae8c0245-7602-11dd-a0a2-00112fcff3ad}]
\Shell\AutoRun\command - F:\00hoeav.com
\Shell\explore\Command - F:\00hoeav.com
\Shell\open\Command - F:\00hoeav.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae8c0246-7602-11dd-a0a2-00112fcff3ad}]
\Shell\AutoRun\command - G:\00hoeav.com
\Shell\explore\Command - G:\00hoeav.com
\Shell\open\Command - G:\00hoeav.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8af1a1a-79e1-11dd-a0b3-00112fcff3ad}]
\Shell\AutoRun\command - F:\00hoeav.com
\Shell\explore\Command - F:\00hoeav.com
\Shell\open\Command - F:\00hoeav.com
.
- - - - USUNIĘTO PUSTE WPISY - - - -
Notify-avldr - avldr.dll
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\xxx\Dane aplikacji\Mozilla\Firefox\Profiles\pdj3zutc.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.onet.pl/
FF -: plugin - c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-18 21:14:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\xxx\USTAWI~1\Temp\ASFWHide"
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\a-squared Free\a2service.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
.
**************************************************************************
.
Czas ukończenia: 2008-11-18 21:17:25 - komputer został uruchomiony ponownie [xxx]
ComboFix-quarantined-files.txt 2008-11-18 20:17:18
Przed: 9,222,017,024 bajtów wolnych
Po: 9,596,813,312 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
126
jak to uczynisz, to ktoś Ci pewnie pomoże.