Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1535.1136 [GMT 1:00]
Uruchomiony z: c:\documents and settings\M&M\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090113-0] *On-access scanning disabled* (Outdated)
FW: ActiveArmor Firewall *disabled*
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-13 do 2009-01-13 )))))))))))))))))))))))))))))))
.
2009-01-12 17:45 . 2009-01-12 17:45 <DIR> d-------- C:\!KillBox
2009-01-12 17:22 . 2009-01-12 17:23 <DIR> d-------- c:\program files\Ad-Aware
2009-01-12 17:22 . 2009-01-12 17:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2009-01-12 17:20 . 2009-01-12 17:20 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-12 16:44 . 2009-01-12 16:44 <DIR> d-------- c:\program files\HD Tune
2009-01-09 14:18 . 2009-01-09 14:34 <DIR> d-------- c:\program files\SkanerOnline
2009-01-08 14:00 . 2009-01-08 14:00 <DIR> d-------- c:\program files\GPLGS
2009-01-08 13:57 . 2009-01-08 13:57 <DIR> d-------- c:\program files\Acro Software
2009-01-08 13:57 . 2007-07-12 22:33 87,552 --a------ c:\windows\system32\cpwmon2k.dll
2008-12-27 18:12 . 2008-12-27 18:12 <DIR> dr-h----- c:\documents and settings\M&M\Dane aplikacji\SecuROM
2008-12-27 18:09 . 2008-12-27 18:09 <DIR> d-------- c:\program files\Electronic Arts
2008-12-27 18:07 . 2008-12-27 18:07 1,620 --a------ c:\windows\system32\ealregsnapshot1.reg
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-13 16:19 --------- d-----w c:\program files\Avast4
2009-01-11 20:24 16 ----a-w c:\documents and settings\M&M\pkww21.dll
2009-01-09 14:30 --------- d-----w c:\documents and settings\M&M\Dane aplikacji\Image Zone Express
2009-01-06 11:58 --------- d-----w c:\documents and settings\M&M\Dane aplikacji\AdobeUM
2008-12-29 16:52 --------- d-----w c:\program files\ALLPlayer
2008-12-27 17:09 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-23 20:51 --------- d-----w c:\program files\MoorHunt
2008-12-21 19:53 --------- d-----w c:\program files\eMule
2008-12-14 18:06 --------- d-----w c:\program files\Java
2008-12-08 20:59 --------- d-----w c:\documents and settings\M&M\Dane aplikacji\Skype
2008-12-08 20:09 --------- d-----w c:\documents and settings\M&M\Dane aplikacji\skypePM
2008-12-08 19:22 --------- d-----w c:\program files\Teczka kierownika budowy
2008-12-03 18:23 --------- d-----w c:\documents and settings\M&M\Dane aplikacji\foobar2000
2008-12-02 20:39 --------- d-----w c:\program files\Purmo3
2008-12-02 20:35 --------- d-----w c:\program files\Common Files\Audytor
2008-12-02 19:55 --------- d-----w c:\program files\Common Files\Borland Shared
2008-11-25 18:45 --------- d-----w c:\program files\Gadu-Gadu
2008-11-18 18:04 17,920 ----a-w c:\windows\system32\drivers\aksusb.sys
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-04 19:20 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-04 19:20 249,856 ------w c:\windows\Setup1.exe
2008-10-13 17:24 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2004-03-11 11:27 40,960 ----a-w c:\program files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"nTrayFw"="c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-09-30 270336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"e:\\Gry zainstalowane\\Fifa09\\FIFA09.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-29 111184]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-07-27 13696]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-07-29 20560]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4230af8c-6062-11dd-a6ca-00e04d16cba4}]
\Shell\AutoRun\command - u.bat
\Shell\explore\Command - u.bat
\Shell\open\Command - u.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44bfd0d9-8d8b-11dd-a71f-00e04d16cba4}]
\Shell\AutoRun\command - u.bat
\Shell\explore\Command - u.bat
\Shell\open\Command - u.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ce899e8-5e67-11dd-a6c7-00e04d16cba4}]
\Shell\Auto\command - J:\activexdebugger32.exe f
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - J:\activexdebugger32.exe f
\Shell\open\Command - J:\activexdebugger32.exe f
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll
O16 -: {68282C51-9459-467B-95BF-3C0E89627E55}
hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
c:\windows\Downloaded Program Files\SkanerOnline.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 17:49:28
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1202660629-1677128483-1801674531-1003\Software\SecuROM\License information*]
"datasecu"=hex:ff,1e,6b,0b,c1,4f,e7,b8,72,26,32,40,44,9f,bb,05,d5,e8,84,31,74,
a6,ce,bf,78,fd,f6,06,dc,b5,3d,9f,9e,b6,2c,eb,2b,04,55,f2,fe,9a,15,99,8b,7b,\
"rkeysecu"=hex:bc,51,b0,af,12,b3,9e,e6,a5,91,85,ec,a3,ad,32,2a
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'lsass.exe'(780)
c:\windows\system32\nvappfilter.dll
.
Czas ukończenia: 2009-01-13 17:50:18
ComboFix-quarantined-files.txt 2009-01-13 16:50:14
Przed: 31 155 212 288 bajtów wolnych
Po: 31,241,433,088 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(4)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(4)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
157
