- Kod: Zaznacz wszystko
ComboFix 09-01-16.02 - Rafał 2009-01-16 22:29:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.190.15 [GMT 1:00]
Uruchomiony z: d:\programy\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090116-0] *On-access scanning disabled* (Outdated)
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Poprzednie uruchomienie -------
.
c:\documents and settings\Rafa\Ustawienia lokalne\Temporary Internet Files\
D:\Autorun.inf
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-16 do 2009-01-16 )))))))))))))))))))))))))))))))
.
2009-01-14 14:53 . 2009-01-16 14:27 32 --a------ c:\windows\CD-Start.INI
2009-01-12 13:10 . 2009-01-12 13:10 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-12 13:10 . 2009-01-12 13:10 1,409 --a------ c:\windows\QTFont.for
2009-01-11 21:19 . 2009-01-11 21:19 <DIR> d-------- c:\documents and settings\Rafał\Dane aplikacji\Skinux
2009-01-11 21:08 . 2009-01-11 21:09 <DIR> d-------- c:\program files\QuickTime
2009-01-11 21:08 . 2009-01-11 21:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-01-11 21:04 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll
2009-01-11 21:04 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-01-11 21:04 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-01-11 21:04 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll
2009-01-11 20:59 . 2009-01-11 21:03 <DIR> d-------- c:\program files\Common Files\Kodak
2009-01-11 20:51 . 2009-01-11 21:05 <DIR> d-------- c:\program files\Kodak
2009-01-11 20:47 . 2009-01-11 21:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kodak
2009-01-03 14:15 . 2009-01-16 14:46 <DIR> d-------- c:\program files\Mad Tracks
2008-12-24 18:03 . 2008-12-24 18:03 <DIR> d-------- c:\program files\GrandPrix Championship 2
2008-12-24 17:33 . 2009-01-16 14:46 <DIR> d-------- c:\program files\LudoRace
2008-12-24 16:45 . 2008-12-24 16:45 <DIR> d-------- c:\windows\USB Vibration
2008-12-24 16:44 . 2008-12-24 16:44 <DIR> d-------- c:\program files\USB Vibration
2008-12-21 14:43 . 2005-10-21 02:47 30,592 --------- c:\windows\system32\drivers\rndismpx.sys
2008-12-21 14:43 . 2005-10-21 02:47 12,800 --------- c:\windows\system32\drivers\usb8023x.sys
2008-12-21 14:40 . 2008-12-21 14:41 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-12-20 22:53 . 2008-12-20 22:53 <DIR> d-------- c:\program files\Techland
2008-12-20 15:47 . 2008-12-20 15:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Winferno
2008-12-20 15:44 . 2008-12-20 15:44 <DIR> d-------- c:\program files\Freeze.com
2008-12-20 15:42 . 2008-12-20 15:43 <DIR> d-------- c:\program files\Free Offers from Freeze.com
2008-12-20 15:42 . 2006-07-24 08:56 212,240 --a------ c:\windows\system32\Richtx32.ocx
2008-12-19 12:33 . 2008-12-24 12:54 <DIR> d-------- c:\documents and settings\Rafał\Dane aplikacji\Smart-Shopper
2008-12-19 12:32 . 2008-12-19 12:34 <DIR> d-------- c:\program files\Smart-Shopper
2008-12-19 12:32 . 2009-01-11 15:47 <DIR> d-------- c:\program files\Seekeen
2008-12-17 01:30 . 2006-11-06 18:04 28,672 --a------ c:\windows\system32\drivers\wceusbsh.sys
2008-12-17 01:30 . 2006-11-06 18:04 28,672 --a--c--- c:\windows\system32\dllcache\wceusbsh.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 14:47 --------- d-----w c:\program files\Java
2009-01-04 15:11 --------- d-----w c:\documents and settings\Rafał\Dane aplikacji\BearShare
2008-12-29 18:40 --------- d-----w c:\documents and settings\Rafał\Dane aplikacji\Nokia Multimedia Player
2008-12-24 17:03 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-24 11:54 --------- d-----w c:\program files\Gadu-Gadu
2008-12-23 23:27 --------- d-----w c:\program files\XOP Plus
2008-12-23 23:27 --------- d-----w c:\program files\Odkurzacz
2008-12-23 23:27 --------- d-----w c:\documents and settings\Rafał\Dane aplikacji\Winamp
2008-12-21 13:31 7,921,152 ----a-w c:\program files\setup.msi
2008-12-20 21:46 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-14 17:00 --------- d-----w c:\documents and settings\Rafał\Dane aplikacji\Skype
2008-12-14 16:51 --------- d-----w c:\documents and settings\Rafał\Dane aplikacji\skypePM
2008-10-04 19:59 285,035 ----a-w c:\program files\JEDNOREKI.ZIP
2008-09-29 19:27 27,573,696 ----a-w c:\program files\setuppol.exe
2008-09-19 20:46 6,966,272 ----a-w c:\program files\try-vsp.exe
2008-09-13 23:59 1,440,832 ----a-w c:\program files\Silverlight.exe
2008-09-13 16:20 18,381,096 ----a-w c:\program files\Onet-SkypeSetup.exe
2008-09-05 20:50 4,350,416 ----a-w c:\program files\gg77.exe
2008-04-25 21:24 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiscSpaceChecks"= 000000000000f03f
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HideBUS.exe]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HideBUS.exe
backup=c:\windows\pss\HideBUS.exeCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Oprogramowanie Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Oprogramowanie Kodak EasyShare.lnk
backup=c:\windows\pss\Oprogramowanie Kodak EasyShare.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
--a------ 2008-11-27 09:41 1261336 c:\progra~1\AVG\AVG8\avgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2005-12-21 08:02 53248 c:\program files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
--a------ 2007-09-28 09:05 722160 c:\program files\CCleaner\CCleaner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Domino]
--a------ 2006-06-28 16:54 49152 c:\windows\Domino.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 15:57 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD]
--a------ 2007-05-03 09:02 264704 c:\program files\Odkurzacz\odk_mcd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2006-03-16 00:07 421888 c:\program files\Picasa2\PicasaMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMSnap3]
--a------ 2006-08-30 09:58 49152 c:\windows\VMSnap3.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 06:28 36352 d:\programy\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2006-03-14 10:01 16010752 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"W32Time"=2 (0x2)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"TrkWks"=2 (0x2)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"SSDPSRV"=3 (0x3)
"srservice"=2 (0x2)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SharedAccess"=2 (0x2)
"ServiceLayer"=3 (0x3)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"PolicyAgent"=2 (0x2)
"PlugPlay"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NwSapAgent"=2 (0x2)
"NWCWorkstation"=2 (0x2)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"NBService"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"LmHosts"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"Irmon"=2 (0x2)
"ImapiService"=3 (0x3)
"HTTPFilter"=3 (0x3)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"Dnscache"=2 (0x2)
"dmserver"=2 (0x2)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=2 (0x2)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"Browser"=2 (0x2)
"BITS"=3 (0x3)
"avg8wd"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"AudioSrv"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"aswUpdSv"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"ALG"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"c:\\Program Files\\Avant Browser\\avant.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-23 111184]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-09-05 97928]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-23 20560]
S3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\drivers\GCXX.sys [2008-04-25 114944]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\drivers\GCXXNet.sys [2008-04-25 53248]
S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2008-09-06 428160]
S4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-09-05 231704]
S4 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2004-08-03 14336]
.
Zawartość folderu 'Zaplanowane zadania'
2009-01-16 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe []
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; InfoPath.2; .NET
Notify-WgaLogon - (no file)
.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - {4CF088BD-BE95-40a5-BE9B-677F8683EDEA} - c:\program files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll
TCP: {1524B869-4F6C-419C-9FF1-F54569D93318} = 10.0.0.254,213.241.79.37
c:\windows\Downloaded Program Files\OnetInstalator012s.ocx - O16 -: {631FF594-EC25-4CFF-B869-402DF294E1D6}
hxxp://slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx
c:\windows\Downloaded Program Files\IR87.txt - c:\windows\Downloaded Program Files\IR6.txt
c:\windows\Downloaded Program Files\IR159.txt
c:\windows\Downloaded Program Files\IR149.txt
c:\windows\Downloaded Program Files\IR148.txt
c:\windows\Downloaded Program Files\IR144.txt
c:\windows\Downloaded Program Files\IR14.txt
c:\windows\Downloaded Program Files\IR138.txt
c:\windows\Downloaded Program Files\IR13.txt
c:\windows\Downloaded Program Files\IR127.txt
c:\windows\Downloaded Program Files\IR126.txt
c:\windows\Downloaded Program Files\IR110.txt
c:\windows\Downloaded Program Files\IR109.txt
c:\windows\Downloaded Program Files\IR101.txt
c:\windows\Downloaded Program Files\IR100.txt
c:\windows\Downloaded Program Files\dict.dat
c:\windows\Downloaded Program Files\unicows.dll
c:\windows\Downloaded Program Files\iiscomplib2.dll
c:\windows\Downloaded Program Files\picn6320.dll
c:\windows\Downloaded Program Files\picn9120.dll
c:\windows\Downloaded Program Files\picn9020.dll
c:\windows\Downloaded Program Files\picn20.dll
c:\windows\Downloaded Program Files\AmiDicomDirTreeView21.ocx
c:\windows\Downloaded Program Files\AmiViewerLite21.ocx
O16 -: {FC11A119-C2F7-46F4-9E32-937ABA26816E}
file://e:\cdviewer\CdViewer.cab
c:\windows\Downloaded Program Files\cdviewer.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-16 22:36:25
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(680)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-01-16 22:40:45 - komputer został uruchomiony ponownie [Rafał]
ComboFix-quarantined-files.txt 2009-01-16 21:40:40
Przed: 14,214,754,304 bajtów wolnych
Po: 14,135,136,256 bajtów wolnych
315 --- E O F --- 2008-05-17 07:13:17
