- Kod: Zaznacz wszystko
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.669 [GMT 2:00]
Running from: D:\Damian\Internet\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\actskn43.ocx
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\system32\sys_dll.dll
.
((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 )))))))))))))))))))))))))))))))
.
2008-09-08 01:43 . 2008-09-08 01:43 <DIR> d-------- C:\Program Files\Sun
2008-09-08 01:43 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-08 01:39 . 2008-09-08 01:39 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-06 10:13 . 2008-09-06 10:13 <DIR> d-------- C:\Documents and Settings\Dominik.DAMIAN-FF61F570\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-09-06 10:13 . 2008-09-06 10:13 <DIR> d-------- C:\Documents and Settings\Dominik.DAMIAN-FF61F570\Dane aplikacji\EmailNotifier
2008-09-05 01:59 . 2008-09-05 01:59 <DIR> d-------- C:\Program Files\CAPCOM
2008-09-05 01:56 . 2008-09-05 01:56 <DIR> d-------- C:\Documents and Settings\DAMIAN~1~DAM\USTAWI~1
2008-09-05 01:56 . 2008-09-05 01:56 <DIR> d-------- C:\Documents and Settings\DAMIAN~1~DAM
2008-09-05 01:39 . 2008-09-06 02:17 4 --a------ C:\timestmp.tmp
2008-09-05 00:54 . 2008-09-06 21:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-09-02 16:40 . 2008-09-02 16:40 <DIR> d-------- C:\WINDOWS\Start Menu
2008-08-30 11:04 . 2008-08-30 11:04 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-08-30 00:08 . 2008-08-30 00:08 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\TigerPlayer
2008-08-30 00:06 . 2008-08-30 00:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer
2008-08-30 00:05 . 2008-08-30 00:07 <DIR> d-------- C:\Program Files\MpcStar
2008-08-29 21:38 . 2008-08-29 21:38 314,368 --a------ C:\WINDOWS\KSGDeInstall.exe
2008-08-27 12:02 . 2008-09-08 13:29 <DIR> d-------- C:\Program Files\WinAce
2008-08-22 23:00 . 2008-08-22 23:00 <DIR> d-------- C:\Program Files\Need For Speed Underground
2008-08-22 22:54 . 2008-08-26 00:12 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\NFS Underground
2008-08-22 22:50 . 2008-08-22 22:50 <DIR> d-------- C:\Program Files\Common Files\DirectX
2008-08-21 23:28 . 2008-08-21 23:28 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\InstallShield
2008-08-21 23:27 . 2004-06-16 06:03 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-08-21 22:05 . 2008-08-22 13:43 <DIR> d-------- C:\Program Files\NetPanel
2008-08-21 22:02 . 2008-08-21 22:02 <DIR> d---s---- C:\Program Files\Xfire
2008-08-21 22:02 . 2008-08-21 22:02 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Xfire
2008-08-21 22:01 . 2008-08-21 22:01 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-08-21 22:01 . 2008-08-21 22:01 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-08-20 20:52 . 2008-08-20 20:52 <DIR> d-------- C:\Program Files\1st Benison
2008-08-20 20:18 . 2008-08-20 20:18 <DIR> d-------- C:\NEED
2008-08-16 21:25 . 2008-08-29 10:09 <DIR> d-------- C:\Program Files\eMule
2008-08-16 21:23 . 2008-08-16 21:23 <DIR> d-------- C:\Program Files\Free Download Manager
2008-08-16 21:23 . 2008-09-08 12:14 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Free Download Manager
2008-08-16 21:23 . 2008-08-16 21:23 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\FreeDownloadManager.ORG
2008-08-16 21:22 . 2008-08-16 21:22 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2008-08-16 15:12 . 2008-08-17 14:20 50 --a------ C:\WINDOWS\MegaManager.INI
2008-08-15 21:51 . 2008-08-15 21:51 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Media Player Classic
2008-08-15 20:02 . 2008-08-15 20:02 <DIR> d-------- C:\Program Files\MegauploadToolbar
2008-08-15 20:02 . 2008-08-15 20:02 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Megaupload
2008-08-15 20:02 . 2008-08-15 20:02 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\EmailNotifier
2008-08-15 20:02 . 2008-08-15 20:02 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Megaupload
2008-08-15 20:02 . 2008-08-15 20:02 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\EmailNotifier
2008-08-15 20:01 . 2008-08-15 20:01 <DIR> d-------- C:\Program Files\Megaupload
2008-08-15 20:01 . 2008-09-02 16:45 <DIR> d-------- C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\MegauploadToolbar
2008-08-15 16:24 . 2008-08-15 16:25 <DIR> d-------- C:\Program Files\Real Alternative
2008-08-12 21:14 . 2008-05-01 16:37 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-12 21:13 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-10 13:14 . 2008-08-10 13:14 <DIR> d-------- C:\Program Files\Paint.NET
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-08 21:26 77,009,440 ----a-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-08 21:23 3,078,432 ----a-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-08 21:20 299,000 ----a-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-08 21:20 262,144 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-09-08 21:20 262,144 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-09-08 21:20 262,144 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-09-08 21:20 262,144 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-09-08 21:20 1,046,972 ----a-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-08 21:20 --------- d-----w C:\Program Files\Kalendarz XP
2008-09-08 19:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab
2008-09-07 23:43 --------- d-----w C:\Program Files\Java
2008-09-06 00:23 196,608 ----a-w C:\WINDOWS\system32\drivers\nAsmedia.bin
2008-09-04 23:53 --------- d-----w C:\Program Files\Winamp
2008-09-04 23:51 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Winamp
2008-09-04 15:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-31 14:01 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Ahead
2008-08-27 08:51 --------- d-----w C:\Program Files\Opera
2008-08-21 21:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-21 08:10 --------- d-----w C:\Program Files\WinClamAVShield
2008-08-20 19:14 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-08-20 18:34 --------- d-----w C:\Program Files\Spyware Terminator
2008-08-20 18:34 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Spyware Terminator
2008-08-20 18:32 --------- d-----w C:\Program Files\Ares
2008-08-20 12:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spyware Terminator
2008-08-20 09:28 --------- d-----w C:\Program Files\Disk Checker
2008-08-20 08:39 --------- d-----w C:\Program Files\DivX
2008-08-20 01:51 --------- d-----w C:\Program Files\a-squared Free
2008-08-19 22:40 --------- d-----w C:\Program Files\Anti Trojan Elite
2008-08-07 17:42 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2008-08-07 17:38 --------- d-----w C:\Program Files\Nufsoft
2008-08-07 15:30 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-06 11:22 --------- d-----w C:\Program Files\neostrada tp
2008-08-04 19:07 --------- d-----w C:\Program Files\ZTE ZXDSL 852
2008-08-04 14:09 --------- d-----w C:\Documents and Settings\Teresa\Dane aplikacji\Skype
2008-08-04 14:07 --------- d-----w C:\Documents and Settings\Teresa\Dane aplikacji\skypePM
2008-08-04 13:13 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\DivX
2008-07-24 11:53 --------- d-----w C:\Documents and Settings\Waldek.DAMIAN-FF61F570\Dane aplikacji\Spyware Terminator
2008-07-24 10:20 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-23 10:05 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ipla
2008-07-18 12:40 --------- d-----w C:\Program Files\XoftSpySE
2008-07-18 12:14 --------- d-----w C:\Program Files\TrojanHunter 5.0
2008-07-18 12:10 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\TrojanHunter
2008-07-18 12:09 --------- d-----w C:\Program Files\freedom GUi
2008-07-18 09:50 --------- d-----w C:\Program Files\Trisnap Technologies
2008-07-18 09:39 --------- d-----w C:\Program Files\Smart PC Solutions
2008-07-18 08:08 141,312 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-07-17 23:07 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\ipla
2008-07-17 23:04 --------- d-----w C:\Program Files\IPLA
2008-07-17 21:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2008-07-17 20:54 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-17 20:28 --------- d-----w C:\Program Files\Sophos
2008-07-17 20:06 --------- d-----w C:\Program Files\SDFIX
2008-07-17 14:30 --------- d-----w C:\Program Files\RogueRemover FREE
2008-07-17 13:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ParetoLogic Anti-Spyware
2008-07-17 13:30 --------- d-----w C:\Program Files\Orban
2008-07-17 13:00 --------- d-----w C:\Program Files\illiminable
2008-07-17 10:47 --------- d-----w C:\Program Files\Hitman Pro
2008-07-17 10:22 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Prevx
2008-07-17 09:30 --------- d-----w C:\Program Files\FreeFixer
2008-07-16 15:15 --------- d-----w C:\Program Files\ABBYY PDF Transformer 2.0
2008-07-16 12:39 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\BOC426
2008-07-16 12:31 --------- d-----w C:\Program Files\Comodo
2008-07-16 10:55 --------- d-----w C:\Program Files\Advanced Spyware Remover
2008-07-16 10:39 --------- d-----w C:\Program Files\a-squared HiJackFree
2008-07-09 19:42 --------- d-----w C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\AdobeUM
2008-07-08 21:33 --------- d-----w C:\Program Files\Common Files\EasyInfo
2008-07-08 17:52 --------- d-----w C:\Program Files\Winamp Remote
2008-06-16 14:44 118,784 ----a-w C:\WINDOWS\SeaMonkeyUninstall.exe
2008-06-16 14:44 118,784 ----a-w C:\WINDOWS\GREUninstall.exe
2008-03-25 10:30 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]
2008-08-04 22:44 1947080 --a------ C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 1947080]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]
[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-19 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"AsusStartupHelp"="C:\Program Files\ASUS\AASP\1.00.17\AsRunHelp.exe" [2006-11-15 363008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-19 C:\WINDOWS\RTHDCPL.exe]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 C:\WINDOWS\system32\stmctrl.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2007-12-21 882176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"vidc.tscc"= C:\PROGRA~1\MpcStar\Codecs\tscc\tsccvid.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Action Manager 32.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Action Manager 32.lnk
backup=C:\WINDOWS\pss\Action Manager 32.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Martusia.DAMIAN-FF61F570^Menu Start^Programy^Autostart^desktop.ini]
path=C:\Documents and Settings\Martusia.DAMIAN-FF61F570\Menu Start\Programy\Autostart\desktop.ini
backup=C:\WINDOWS\pss\desktop.iniStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a------ 2006-01-08 18:26 118784 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 2008-02-20 16:33 963072 C:\Program Files\Ares\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
--a------ 2007-08-28 11:58 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWWFSPU]
--a------ 2006-12-18 13:19 712781 C:\Program Files\ASUS WiFi-AP Solo\AWWFSPU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
--a------ 2007-12-07 17:03 1913656 C:\Program Files\BitComet\BitComet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 19:21 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
--a------ 2007-05-13 16:57 5308416 C:\Program Files\eMule\emule.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C62 Series]
--------- 2002-04-10 04:00 74240 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S0BIC1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Upload Manager]
--a------ 2007-07-29 19:13 253952 C:\Program Files\Free Download Manager\FUM\fum.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]
--a------ 2007-06-10 18:02 40960 C:\Program Files\Free Download Manager\FUM\fumoei.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPLA!]
--a------ 2008-07-22 13:12 2182392 C:\Program Files\IPLA\IPLA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetPanel]
--a------ 2008-08-21 22:05 100032 C:\Program Files\NetPanel\Starter.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0]
--a------ 2007-03-28 20:41 2037352 C:\Program Files\Norton Ghost\Agent\VProTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
--a------ 2008-07-24 12:20 1783808 C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a------ 2006-01-08 18:26 1006938 C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Norton Ghost"=2 (0x2)
"NBService"=3 (0x3)
"sp_rssrv"=2 (0x2)
"AcrSch2Svc"=2 (0x2)
"a2free"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"C:\\Program Files\\ASUS\\GamerOSD\\SBS.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"H:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Need\\Speed.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\Program Files\\Frontline Attack\\config.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26098:TCP"= 26098:TCP:BitComet 26098 TCP
"26098:UDP"= 26098:UDP:BitComet 26098 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"10172:TCP"= 10172:TCP:BitComet 10172 TCP
"10172:UDP"= 10172:UDP:BitComet 10172 UDP
"24098:TCP"= 24098:TCP:BitComet 24098 TCP(ED2K)
"24098:UDP"= 24098:UDP:BitComet 24098 UDP(ED2K)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)
R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 39472]
R1 ElRawDisk;ElRawDisk;C:\WINDOWS\system32\drivers\elrawdsk.sys [2007-09-24 29768]
R1 SAVRKBootTasks;Boot Tasks Driver;C:\WINDOWS\system32\SAVRKBootTasks.sys [2007-08-14 18816]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-07-18 141312]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R2 XWMSMFP1;XWMSPAC;C:\WINDOWS\system32\Drivers\XWMSPAC.SYS [2001-10-09 31712]
R2 XWMSMFP2;XWMSPRO;C:\WINDOWS\system32\Drivers\XWMSPRO.SYS [2001-10-09 22828]
R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-08-28 12416]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 684265]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-08-28 10752]
S3 AR2425;AzureWave AR5006 Wireless Network Adapter Service;C:\WINDOWS\system32\DRIVERS\aw5006.sys [2006-12-18 556832]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-10-31 35840]
S3 ATE_PROCMON;ATE_PROCMON;C:\Program Files\Anti Trojan Elite\ATEPMon.sys [ ]
S3 GT680xNT;USB Scanner Driver;C:\WINDOWS\system32\drivers\gt680x.sys [2002-10-04 17932]
S3 hitmanpro2;Hitman Pro 2 Driver;C:\Program Files\Hitman Pro\hitmanpro2.sys [2006-11-03 10336]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\6D.tmp [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{559744d1-766d-11dd-8859-a6203ecb3267}]
\Shell\AutoRun\command - K:\start.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Damian.DAMIAN-FF61F570\Dane aplikacji\Mozilla\Firefox\Profiles\27co6zod.default\
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPOJI610.dll
FF -: plugin - C:\Program Files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npdivx32.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npfdm.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npmmaud.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npmmprog.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npmmvid.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npmmzip.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-08 23:23:46
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MEMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\6D.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Comodo\CBOClean\BOCore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\snmp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-09-08 23:31:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-08 21:31:38
Pre-Run: 4,876,607,488 bajtów wolnych
Post-Run: 4,992,020,480 bajt˘w wolnych
345 --- E O F --- 2008-09-06 09:07:56
- Kod: Zaznacz wszystko
Czy o to chodziło?
