Syfu to tutaj pewnie od liku
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:05:33, on 2008-12-20
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\TPSrv.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA GLOBAL PROTECTION 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PsImSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Security\Panda Global Protection 2009\ApvxdWin.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PskSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\AVENGINE.EXE
c:\program files\panda security\panda global protection 2009\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Global Protection 2009\SRVLOAD.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PavBckPT.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Orbitdownloader\orbitnet.exe
C:\DOCUME~1\Ja\USTAWI~1\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - d:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - d:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Global Protection 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Global Protection 2009\Inicio.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orbit.lnk = D:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Download by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfGyabB - khfGyabB.dll (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\pavsrv51.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda global protection 2009\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PskSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\TPSrv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
--
End of file - 7775 bytes
<Na czas combofixa wyłączyłem antyvirusa>
ComboFix 08-12-20.01 - Ja 2008-12-20 18:21:04.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1526.746 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Ja\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Ja\Menu Start\Cheap Pharmacy Online.url
c:\documents and settings\Ja\Menu Start\Search Online.url
c:\documents and settings\Ja\Ulubione\Cheap Pharmacy Online.url
c:\documents and settings\Ja\Ulubione\Search Online.url
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Process.exe
c:\windows\system32\s.ico
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\Tasks\kelocmwg.job
.
((((((((((((((((((((((((( Pliki utworzone od 2008-11-20 do 2008-12-20 )))))))))))))))))))))))))))))))
.
2008-12-20 12:06 . 2008-12-20 12:06 11 -ra------ c:\windows\amunres.lsl
2008-12-20 10:18 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-20 10:09 . 2008-12-20 10:09 <DIR> d-------- c:\windows\system32\pl-pl
2008-12-20 10:07 . 2008-12-20 10:10 <DIR> d-------- c:\windows\ServicePackFiles
2008-12-20 10:06 . 2008-04-14 22:51 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe
2008-12-20 10:04 . 2008-04-13 22:04 1,897,408 --------- c:\windows\system32\drivers\nv4_mini.sys
2008-12-20 10:03 . 2006-12-29 00:31 19,569 --a------ c:\windows\002716_.tmp
2008-12-19 22:34 . 2008-12-19 22:34 <DIR> d-------- c:\program files\Lavalys
2008-12-19 18:07 . 2008-12-19 18:07 <DIR> d-------- c:\program files\Robster Productions
2008-12-19 13:16 . 2008-12-19 13:17 <DIR> d-------- c:\program files\Hamachi
2008-12-17 14:06 . 2008-12-17 14:06 <DIR> d-------- c:\program files\DownloadToolz
2008-12-01 19:34 . 2008-12-01 19:48 <DIR> d-------- c:\program files\Counter-Strike Source
2008-12-01 18:06 . 2008-12-01 18:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Panda Software
2008-11-30 23:08 . 2008-12-20 16:04 8,627 --a------ c:\windows\system32\PAV_FOG.OPC
2008-11-30 22:47 . 2008-12-20 16:11 13,880 --a------ c:\windows\system32\drivers\COMFiltr.sys
2008-11-30 22:43 . 2008-11-30 22:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Backup
2008-11-30 22:42 . 2008-11-30 22:42 <DIR> d-------- c:\windows\system32\PAV
2008-11-30 22:42 . 2008-11-30 22:42 <DIR> d-------- c:\program files\Panda Security
2008-11-30 22:42 . 2008-11-30 22:42 <DIR> d-------- c:\documents and settings\Ja\Dane aplikacji\Panda Security
2008-11-30 22:42 . 2008-11-30 22:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Panda Security
2008-11-30 22:42 . 2008-06-18 18:03 520,448 --a------ c:\windows\system32\PavSHook.dll
2008-11-30 22:42 . 2003-10-22 18:23 446,464 --a------ c:\windows\system32\HHActiveX.dll
2008-11-30 22:42 . 2008-06-26 11:25 197,888 --a------ c:\windows\system32\drivers\neti1634.sys
2008-11-30 22:42 . 2008-06-24 14:48 193,280 --a------ c:\windows\system32\TpUtil.dll
2008-11-30 22:42 . 2007-02-08 11:53 107,568 --a------ c:\windows\system32\SYSTOOLS.DLL
2008-11-30 22:42 . 2008-06-18 18:03 87,296 --a------ c:\windows\system32\PavLspHook.dll
2008-11-30 22:42 . 2008-03-18 16:58 58,672 --a------ c:\windows\system32\avldr.dll
2008-11-30 22:42 . 2008-06-18 18:03 55,552 --a------ c:\windows\system32\pavipc.dll
2008-11-30 22:41 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-11-30 22:40 . 2008-11-30 22:40 <DIR> d-------- c:\program files\Common Files\Panda Security
2008-11-30 22:40 . 2008-02-07 12:03 179,640 --a------ c:\windows\system32\drivers\PavProc.sys
2008-11-30 22:40 . 2008-03-04 15:59 41,144 --a------ c:\windows\system32\drivers\ShlDrv51.sys
2008-11-30 17:24 . 2008-11-30 17:24 <DIR> d-------- c:\program files\Teamspeak2_RC2
2008-11-30 17:24 . 2008-11-30 17:24 <DIR> d-------- c:\documents and settings\Ja\Dane aplikacji\teamspeak2
2008-11-30 17:24 . 2008-11-30 17:24 34,064 --a------ c:\windows\system32\lhacm.acm
2008-11-30 17:09 . 2008-11-30 17:09 <DIR> d-------- c:\documents and settings\Ja\Dane aplikacji\skypePM
2008-11-30 17:08 . 2008-11-30 18:24 <DIR> d-------- c:\documents and settings\Ja\Dane aplikacji\Skype
2008-11-30 16:45 . 2008-11-30 16:45 <DIR> d-------- c:\documents and settings\LocalService\Pulpit
2008-11-30 15:45 . 2008-11-30 15:45 <DIR> d-------- c:\documents and settings\Ja\Dane aplikacji\TuneUp Software
2008-11-30 15:45 . 2008-11-30 15:45 603,904 --a------ c:\windows\system32\TUProgSt.exe
2008-11-30 15:45 . 2008-11-30 15:45 362,240 --a------ c:\windows\system32\TuneUpDefragService.exe
2008-11-30 15:45 . 2008-11-12 16:44 27,904 --a------ c:\windows\system32\uxtuneup.dll
2008-11-30 15:44 . 2008-11-30 15:45 <DIR> d-------- c:\program files\TuneUp Utilities 2009
2008-11-30 15:44 . 2008-11-30 15:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TuneUp Software
2008-11-30 15:44 . 2008-11-30 15:44 <DIR> d--hs---- c:\documents and settings\All Users\Dane aplikacji\{55A29068-F2CE-456C-9148-C869879E2357}
2008-11-29 15:13 . 2008-12-20 15:39 <DIR> d-------- c:\program files\sXe Injected
2008-11-20 20:51 . 2008-11-20 20:54 <DIR> d-------- c:\program files\RegCleaner
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-20 15:16 --------- d-----w c:\documents and settings\Ja\Dane aplikacji\Orbit
2008-12-20 15:12 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck
2008-12-20 15:12 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG
2008-12-20 11:05 --------- d-----w c:\program files\AoA Audio Extractor
2008-12-20 09:19 284,268 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck
2008-12-20 09:19 284,268 ----a-w c:\windows\system32\drivers\APPFCONT.DAT
2008-12-19 18:14 --------- d-----w c:\program files\Valve
2008-12-19 12:24 --------- d-----w c:\documents and settings\Ja\Dane aplikacji\Hamachi
2008-12-19 12:16 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2008-12-03 14:19 --------- d-----w c:\program files\Java
2008-11-30 21:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-29 13:14 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\Skype
2008-11-29 12:47 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\skypePM
2008-11-19 08:23 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\Orbit
2008-11-15 10:00 --------- d-----w c:\documents and settings\Ja\Dane aplikacji\BESTplayer
2008-11-15 09:51 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-15 09:21 --------- d-----w c:\program files\Common Files\Real
2008-11-10 23:13 --------- d-----w c:\program files\BitComet
2008-11-10 23:02 --------- d-----w c:\program files\ToniArts
2008-11-10 22:56 --------- d-----w c:\program files\Trend Micro
2008-11-10 22:43 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-10 21:59 2,560 ----a-w c:\windows\_MSRSTRT.EXE
2008-11-10 21:59 --------- d-----w c:\program files\DAP
2008-11-10 21:58 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\SpeedBit
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-09 11:01 50,688 ----a-w c:\windows\system32\wbhelp2.dll
2008-10-30 12:27 --------- d-----w c:\program files\Ahead
2008-10-30 12:24 --------- d-----w c:\program files\Common Files\Nero
2008-10-30 12:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ahead
2008-10-30 12:19 --------- d-----w c:\program files\Common Files\Ahead
2008-10-26 20:27 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Wru
2008-10-21 19:18 --------- d-----w c:\documents and settings\Ja\Dane aplikacji\MargonemMapki
2008-10-18 12:24 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-07-27 07:05 3,853,750 ----a-w c:\program files\screen (00001).bmp
2008-07-27 07:05 181,948 ----a-w c:\program files\screen (00002).jpg
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"APVXDWIN"="c:\program files\Panda Security\Panda Global Protection 2009\APVXDWIN.EXE" [2008-10-22 869632]
"SCANINICIO"="c:\program files\Panda Security\Panda Global Protection 2009\Inicio.exe" [2008-07-07 50432]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Orbit.lnk - d:\program files\Orbitdownloader\orbitdm.exe [2008-11-06 1690824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 c:\windows\system32\avldr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\EA GAMES\\MOHAA\\MOHAA.exe"=
"d:\\Program Files\\Tibia811\\Tibia.exe"=
"d:\\Program Files\\Gadu-Gadu\\gg.exe"=
"d:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"d:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"d:\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
"25558:TCP"= 25558:TCP:BitComet 25558 TCP
"25558:UDP"= 25558:UDP:BitComet 25558 UDP
R0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2008-11-30 28544]
R1 APPFLT;App Filter Plugin;\??\c:\windows\system32\Drivers\APPFLT.SYS [2008-11-30 73728]
R1 DSAFLT;DSA Filter Plugin;\??\c:\windows\system32\Drivers\DSAFLT.SYS [2008-11-30 52992]
R1 FNETMON;NetMon Filter Plugin;\??\c:\windows\system32\Drivers\fnetmon.SYS [2008-11-30 22072]
R1 IDSFLT;Ids Filter Plugin;\??\c:\windows\system32\Drivers\IDSFLT.SYS [2008-11-30 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];\??\c:\windows\system32\Drivers\NETFLTDI.SYS [2008-11-30 22:43:14 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2008-11-30 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;\??\c:\windows\system32\Drivers\WNMFLT.SYS [2008-11-30 46720]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda []
R2 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys [2008-11-30 179640]
R2 PskSvcRetail;Panda PSK service;"c:\program files\Panda Security\Panda Global Protection 2009\PskSvc.exe" [2008-11-30 28928]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2008-11-30 603904]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys []
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\DRIVERS\neti1634.sys [2008-11-30 197888]
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys []
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - PROCEXP90
.
Zawartość folderu 'Zaplanowane zadania'
2008-12-20 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 16:28]
2008-12-14 c:\windows\Tasks\Podstawowe porządkowanie.job
- c:\program files\Panda Security\Panda Global Protection 2009\PlaTasks.exe [2008-07-03 17:55]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
ShellExecuteHooks-{0AF6F4C1-A419-4EED-BA4E-CBF12A16ADFE} - (no file)
Notify-khfGyabB - khfGyabB.dll
.
------- Skan uzupełniający -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Download by Orbit - d:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - d:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - d:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - d:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&ksport do programu Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\huohpt0e.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.my-fantasy.net/start/index.php
FF - component: c:\documents and settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\huohpt0e.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: d:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF - plugin: d:\program files\Real Alternative\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\Real Alternative\browser\plugins\nprpjplug.dll
ATTENTION: FIREFOX POLICES IS IN FORCE
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-20 18:22:15
btw. nie skacz
