Logi z hijackthis
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:15, on 2008-12-21
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Gadu-Gadu\gg.exe
E:\Programy\jetaudio\JetAudio.exe
C:\Documents and Settings\Macióś\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 4879 bytes
Z góry dziękuję za pomoc.
Log z Combofixa
- Kod: Zaznacz wszystko
ComboFix 08-12-20.05 - Macióś 2008-12-21 18:17:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2046.1482 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Macióś\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\OPTIONS\CABS\_desktop.ini
c:\windows\system32\amvo.exe
c:\windows\system32\amvo0.dll
c:\windows\system32\j6UdyP3t.exe.a_a
c:\windows\system32\msxml71.dll
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IPRIP
-------\Service_Iprip
((((((((((((((((((((((((( Pliki utworzone od 2008-11-21 do 2008-12-21 )))))))))))))))))))))))))))))))
.
2008-12-21 18:01 . 2008-12-21 18:01 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CrucialSoft Ltd
2008-12-21 18:00 . 2008-12-21 18:00 73,728 --a------ c:\windows\system32\j6UdyP3t.exe_
2008-12-21 18:00 . 2008-12-21 18:02 73,728 --a------ c:\windows\system32\j6UdyP3t.exe
2008-12-21 17:41 . 2008-12-21 17:41 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP
2008-12-21 17:39 . 2008-12-21 17:40 <DIR> d-------- c:\program files\Common Files\HP
2008-12-21 17:37 . 2008-12-21 17:37 <DIR> d-------- c:\program files\Hewlett-Packard
2008-12-21 17:36 . 2008-12-21 17:36 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard
2008-12-21 17:35 . 2004-12-14 19:33 51,120 -ra------ c:\windows\system32\drivers\HPZid412.sys
2008-12-21 17:35 . 2004-12-14 19:33 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys
2008-12-21 17:34 . 2008-04-14 00:15 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-12-21 17:34 . 2008-04-14 00:15 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-12-21 17:34 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2008-12-21 17:34 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2008-12-21 17:34 . 2004-12-14 19:33 21,744 -ra------ c:\windows\system32\drivers\HPZius12.sys
2008-12-21 17:34 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-21 17:34 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-21 17:32 . 2004-09-29 12:12 278,584 --a------ c:\windows\system32\HPZidr12.dll
2008-12-21 17:32 . 2004-09-29 12:15 204,800 --a------ c:\windows\system32\HPZipr12.dll
2008-12-21 17:32 . 2004-09-29 12:09 94,208 --a------ c:\windows\system32\HPZipt12.dll
2008-12-21 17:32 . 2004-09-29 12:14 69,632 --a------ c:\windows\system32\HPZipm12.exe
2008-12-21 17:32 . 2004-09-29 12:08 61,440 --a------ c:\windows\system32\HPZinw12.exe
2008-12-21 17:32 . 2004-09-29 12:09 57,344 --a------ c:\windows\system32\HPZisn12.dll
2008-12-21 17:30 . 2008-12-21 17:41 <DIR> d-------- c:\program files\HP
2008-12-21 17:25 . 2008-12-21 17:41 69,543 --a------ c:\windows\hpoins05.dat
2008-12-21 17:25 . 2004-12-14 19:33 19,696 --------- c:\windows\hpomdl05.dat
2008-12-21 16:59 . 2008-12-21 17:31 <DIR> d-------- c:\windows\LastGood.Tmp
2008-12-21 16:37 . 2008-12-21 16:37 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-12-21 16:10 . 2008-12-21 16:12 6,503 --a------ c:\windows\system32\spupdsvc.inf
2008-12-21 16:07 . 2008-12-21 16:07 <DIR> d-------- c:\windows\system32\pl-pl
2008-12-21 16:07 . 2008-12-21 16:07 <DIR> d-------- c:\windows\system32\pl
2008-12-21 16:07 . 2008-12-21 16:07 <DIR> d-------- c:\windows\system32\bits
2008-12-21 16:07 . 2008-12-21 16:07 <DIR> d-------- c:\windows\l2schemas
2008-12-21 16:07 . 2008-04-14 22:50 69,120 --------- c:\windows\system32\wlanapi.dll
2008-12-21 16:07 . 2008-04-14 22:51 32,866 --------- c:\windows\slrundll.exe
2008-12-21 16:06 . 2008-12-21 16:08 <DIR> d-------- c:\windows\ServicePackFiles
2008-12-21 16:05 . 2008-04-14 22:51 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe
2008-12-21 16:05 . 2008-04-14 22:51 124,928 --------- c:\windows\system32\mplay32.exe
2008-12-21 16:03 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]02757_.tmp
2008-12-21 16:01 . 2008-12-21 16:01 <DIR> d-------- c:\windows\EHome
2008-12-21 15:11 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-12-21 15:11 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-21 15:11 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-21 15:11 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-12-21 13:33 . 2008-12-21 13:33 <DIR> d-------- C:\d9012a2f1e4739f10886
2008-12-21 12:59 . 2008-12-21 12:59 <DIR> d-------- c:\documents and settings\Macióś\Dane aplikacji\COWON
2008-12-21 12:27 . 2008-12-21 12:36 <DIR> d-------- c:\program files\ESET
2008-12-21 12:27 . 2008-12-21 12:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET
2008-12-21 12:24 . 2008-12-21 12:24 <DIR> d-------- c:\documents and settings\Macióś\Dane aplikacji\DAEMON Tools Pro
2008-12-20 23:35 . 2008-12-20 23:44 <DIR> d-------- c:\documents and settings\Macióś\Dane aplikacji\OpenOffice.ux.pl2
2008-12-20 23:17 . 2008-12-21 12:54 <DIR> d-------- c:\documents and settings\Macióś\Dane aplikacji\Azureus
2008-12-20 23:17 . 2008-12-20 23:17 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Azureus
2008-12-20 22:50 . 2008-04-14 22:36 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2008-12-20 22:49 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-20 22:49 . 2008-12-20 22:49 749 -rah----- c:\windows\WindowsShell.Manifest
2008-12-20 22:49 . 2008-12-20 22:49 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-12-20 22:49 . 2008-12-20 22:49 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-12-20 22:49 . 2008-12-20 22:49 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-12-20 22:49 . 2008-12-20 22:49 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-12-20 21:51 . 2008-12-21 11:13 84,992 -r-hs---- c:\windows\system32\kav321.dll
2008-12-20 20:06 . 2008-12-21 14:06 <DIR> d-------- c:\documents and settings\Mama\Dane aplikacji\OpenOffice.ux.pl2
2008-12-20 18:12 . 2008-12-20 18:12 <DIR> d-------- c:\windows\system32\xlive
2008-12-20 18:12 . 2008-12-20 18:13 <DIR> d-------- c:\windows\system32\drivers\umdf
2008-12-20 18:12 . 2008-12-21 17:24 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2008-12-20 18:12 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll
2008-12-20 18:12 . 2008-03-05 15:56 1,420,824 --a------ c:\windows\system32\D3DCompiler_37.dll
2008-12-20 18:12 . 2008-02-05 23:07 462,864 --a------ c:\windows\system32\d3dx10_37.dll
2008-12-20 18:12 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-12-20 17:44 . 2008-12-20 17:44 <DIR> d-------- c:\program files\MSBuild
2008-12-20 17:42 . 2008-12-20 17:42 <DIR> d-------- c:\windows\system32\XPSViewer
2008-12-20 17:42 . 2008-12-10 20:30 4,224 --a------ c:\windows\system32\drivers\NVStrap.sys
2008-12-20 17:41 . 2008-12-20 17:41 <DIR> d-------- c:\program files\Reference Assemblies
2008-12-20 17:41 . 2006-06-29 13:07 14,048 --a------ c:\windows\system32\spmsg2.dll
2008-12-20 17:39 . 2008-12-20 17:56 <DIR> d-------- c:\program files\Rockstar Games
2008-12-20 17:18 . 2008-12-21 17:00 <DIR> d-------- c:\program files\RivaTuner v2.21
2008-12-20 17:04 . 2008-12-20 17:04 <DIR> d-------- c:\documents and settings\Macióś\Dane aplikacji\Gadu-Gadu
2008-12-20 16:49 . 2008-12-20 16:49 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-20 16:44 . 2008-12-20 16:45 <DIR> d-------- c:\program files\Common Files\COWON
2008-12-20 16:40 . 2008-12-21 11:13 116,977 -r-hs---- C:\2vk6wn.exe
2008-12-20 16:39 . 2008-12-20 16:39 <DIR> d-------- c:\program files\OpenOffice.ux.pl 2.3.1
2008-12-20 16:39 . 2008-12-20 16:49 <DIR> d-------- c:\program files\Java
2008-12-20 16:39 . 2008-12-20 16:39 <DIR> d-------- c:\program files\Common Files\Java
2008-12-20 16:39 . 2008-12-21 16:54 84,992 -r-hs---- c:\windows\system32\kav320.dll
2008-12-20 16:39 . 2008-12-20 16:49 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-20 16:35 . 2008-12-20 16:35 <DIR> d-------- c:\documents and settings\Mama\Dane aplikacji\Gadu-Gadu
2008-12-20 16:34 . 2008-12-20 16:35 <DIR> d-------- c:\documents and settings\Mama\Gadu-Gadu
2008-12-20 16:32 . 2008-12-21 18:18 <DIR> d--h----- c:\documents and settings\Mama\Ustawienia lokalne
2008-12-20 16:32 . 2008-12-20 16:32 <DIR> dr------- c:\documents and settings\Mama\Ulubione
2008-12-20 16:32 . 2008-12-20 15:07 <DIR> d--h----- c:\documents and settings\Mama\Szablony
2008-12-20 16:32 . 2008-12-20 16:41 <DIR> d-------- c:\documents and settings\Mama\Pulpit
2008-12-20 16:32 . 2008-12-21 11:27 <DIR> dr------- c:\documents and settings\Mama\Moje dokumenty
2008-12-20 16:32 . 2008-12-20 14:32 <DIR> dr------- c:\documents and settings\Mama\Menu Start
2008-12-20 16:32 . 2008-12-20 20:06 <DIR> dr-h----- c:\documents and settings\Mama\Dane aplikacji
2008-12-20 16:32 . 2008-12-20 16:34 <DIR> d-------- c:\documents and settings\Mama
2008-12-20 16:29 . 2008-12-20 16:29 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-12-20 16:28 . 2008-12-20 16:28 685,816 --a------ c:\windows\system32\drivers\sptd.sys
2008-12-20 16:28 . 2008-12-20 16:27 13,646 --a------ c:\windows\system32\wpa.bak
2008-12-20 16:25 . 2008-12-20 16:25 <DIR> d-------- c:\program files\Gadu-Gadu
2008-12-20 16:25 . 2008-12-20 17:06 <DIR> d-------- c:\documents and settings\Macióś\Gadu-Gadu
2008-12-20 16:25 . 2008-12-20 17:06 <DIR> d-------- c:\documents and settings\Macióś\Gadu-Gadu
2008-12-20 16:23 . 2008-12-20 16:23 <DIR> d-------- c:\program files\Opera
2008-12-20 16:21 . 2008-12-20 16:28 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-20 16:16 . 2008-12-20 16:16 <DIR> d-------- c:\windows\system32\URTTemp
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 16:16 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-21 16:16 --------- d-----w c:\program files\GameFace Messenger
2008-12-21 16:16 --------- d-----w c:\program files\ASUS
2008-12-21 15:59 --------- d-----w c:\program files\Intel
2008-12-21 11:24 --------- d-----w c:\program files\Common Files\LightScribe
2008-12-21 11:24 --------- d-----w c:\documents and settings\Macióś\Dane aplikacji\Ahead
2008-12-20 21:54 196,608 ----a-w c:\windows\system32\drivers\nStandard.bin
2008-12-20 14:57 15,600 ----a-w c:\windows\gdrv.sys
2008-12-20 14:56 --------- d-----w c:\program files\Wireless LAN Driver
2008-12-20 14:46 315,392 ----a-w c:\windows\HideWin.exe
2008-12-20 14:46 --------- d-----w c:\program files\Realtek
2008-12-20 14:46 --------- d-----w c:\documents and settings\Macióś\Dane aplikacji\InstallShield
2008-12-20 14:31 737,280 ----a-w c:\windows\iun6002.exe
2008-12-20 14:30 --------- d-----w c:\program files\My Company Name
2008-12-20 14:29 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-20 14:22 --------- d-----w c:\program files\Common Files\Ahead
2008-12-20 14:21 --------- d-----w c:\program files\Nero
2008-12-20 14:21 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero
2008-12-20 14:10 --------- d-----w c:\program files\microsoft frontpage
2008-12-20 14:09 --------- d-----w c:\program files\Usługi online
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-04-23 1443072]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 171520]
"nwiz"="nwiz.exe" [2007-05-10 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mama\Menu Start\Programy\Autostart\
OpenOffice.ux.pl 2.3.1.lnk - c:\program files\OpenOffice.ux.pl 2.3.1\program\quickstart.exe [2007-12-07 17408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Image Zone - szybkie uruchamianie.lnk
backup=c:\windows\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
--a------ 2007-05-22 16:21 1114112 c:\program files\ASUS\SmartDoctor\SmartDoctor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
--a------ 2007-06-01 09:37 380928 c:\program files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2007-08-16 12:24 167368 e:\programy\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"e:\\Programy\\Azureus\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows
"3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Zawartość folderu 'Zaplanowane zadania'
2008-12-21 c:\windows\Tasks\At1.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At10.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At11.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At12.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At13.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At14.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At15.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At16.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At17.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At18.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At19.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At2.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At20.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At21.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At22.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At23.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At24.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At25.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At26.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At27.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At28.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At29.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At3.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At30.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At31.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At32.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At33.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At34.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At35.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At36.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At37.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At38.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At39.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At4.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At40.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At41.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At42.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At43.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At44.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At45.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At46.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At47.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At48.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At5.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At6.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At7.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At8.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
2008-12-21 c:\windows\Tasks\At9.job
- c:\windows\system32\j6UdyP3t.exe [2008-12-21 18:02]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
MSConfigStartUp-Cognac - c:\docume~1\MACI~1\USTAWI~1\Temp\~tmpb.exe
MSConfigStartUp-DAEMON Tools Pro Agent - e:\programy\DAEMON Tools Pro\DTProAgent.exe
MSConfigStartUp-GameFace Messenger - c:\program files\GameFace Messenger\GameFace.exe
MSConfigStartUp-InstallProgram - c:\docume~1\MACI~1\USTAWI~1\Temp\yyy3873.exe
MSConfigStartUp-MSFox - c:\docume~1\MACI~1\USTAWI~1\Temp\yyy3961.exe
MSConfigStartUp-OutpostFeedBack - c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe
MSConfigStartUp-OutpostMonitor - c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe
MSConfigStartUp-RivaTunerStartupDaemon - c:\program files\RivaTuner v2.21\RivaTuner.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 18:20:29
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\ATKKBService.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\tcpsvcs.exe
.
**************************************************************************
.
Czas ukończenia: 2008-12-21 18:21:36 - komputer został uruchomiony ponownie [Macióś]
ComboFix-quarantined-files.txt 2008-12-21 17:21:32
Przed: 57 867 247 616 bajtów wolnych
Po: 58,011,189,248 bajtów wolnych
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
350 --- E O F --- 2008-12-21 14:33:47
