Temat jest zamknięty
oto z Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:46, on 2009-02-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
D:\xampp\apache\bin\apache.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
d:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
D:\xampp\apache\bin\apache.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\x\Pulpit\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js
O17 - HKLM\System\CCS\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apache2.2 - Apache Software Foundation - D:\xampp\apache\bin\apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - d:\xampp\FileZillaFTP\FileZillaServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: mysql - Unknown owner - d:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 8113 bytesa to z combofix'a
ComboFix 09-02-02.03 - x 2009-02-02 21:55:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.198 [GMT 1:00]
Uruchomiony z: c:\documents and settings\x\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090202-0] *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\install.exe
c:\windows\system32\lsprst7.dll
c:\windows\system32\ssprs.dll
.
((((((((((((((((((((((((( Pliki utworzone od 2009-01-02 do 2009-02-02 )))))))))))))))))))))))))))))))
.
2009-01-27 16:24 . 2009-01-27 16:25 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Ulead Systems
2009-01-27 16:24 . 2009-01-27 16:24 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-27 16:24 . 2009-01-27 16:24 1,409 --a------ c:\windows\QTFont.for
2009-01-27 09:39 . 2009-01-27 09:39 <DIR> d-------- c:\program files\Common Files\InterVideo
2009-01-27 09:39 . 2009-01-27 09:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InterVideo
2009-01-27 09:39 . 2007-03-27 19:56 210,456 --a------ c:\windows\system32\IVIresizeW7.dll
2009-01-27 09:39 . 2007-03-27 19:56 206,360 --a------ c:\windows\system32\IVIresizeA6.dll
2009-01-27 09:39 . 2007-03-27 19:56 198,168 --a------ c:\windows\system32\IVIresizeP6.dll
2009-01-27 09:39 . 2007-03-27 19:56 198,168 --a------ c:\windows\system32\IVIresizeM6.dll
2009-01-27 09:39 . 2007-03-27 19:56 194,072 --a------ c:\windows\system32\IVIresizePX.dll
2009-01-27 09:39 . 2007-03-27 19:56 26,136 --a------ c:\windows\system32\IVIresize.dll
2009-01-27 09:38 . 2009-01-27 09:38 <DIR> d-------- c:\program files\Windows Media Components
2009-01-27 09:36 . 2009-01-27 09:36 <DIR> d-------- c:\program files\Ulead Systems
2009-01-27 09:36 . 2009-01-27 09:38 <DIR> d-------- c:\program files\Common Files\Ulead Systems
2009-01-27 09:36 . 2009-01-27 16:23 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ulead Systems
2009-01-23 22:06 . 2009-01-23 22:10 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\REAPER
2009-01-23 21:56 . 2009-01-23 21:56 <DIR> d--h----- c:\windows\PIF
2009-01-22 11:13 . 2009-01-22 11:13 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Corel
2009-01-22 11:13 . 2009-01-22 11:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InstallShield
2009-01-22 11:12 . 2009-01-22 11:13 <DIR> d-------- c:\program files\Common Files\Corel
2009-01-21 16:52 . 2009-01-21 16:52 <DIR> d-------- c:\program files\VirtualDJ
2009-01-21 10:12 . 2009-02-02 17:23 5,852 --ahs---- c:\windows\system32\KGyGaAvL.sys
2009-01-21 10:12 . 2009-02-02 17:23 88 -r-hs---- c:\windows\system32\8AD2F8CD48.sys
2009-01-21 10:10 . 2009-01-22 11:12 <DIR> d-------- c:\program files\Corel
2009-01-19 19:29 . 2009-01-20 17:11 396 --a------ c:\windows\wcx_ftp.ini
2009-01-19 19:28 . 2009-01-20 17:11 1,035 --a------ c:\windows\wincmd.ini
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\UC.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\RAR.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\PKZIP.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\PKUNZIP.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\NOCLOSE.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\LHA.PIF
2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\ARJ.PIF
2009-01-18 13:36 . 2009-01-18 13:36 <DIR> d-------- c:\documents and settings\x\.jpi_cache
2009-01-18 13:36 . 2009-01-18 13:36 <DIR> d-------- c:\documents and settings\x\.java
2009-01-16 20:30 . 2000-04-03 16:52 103,744 --a------ c:\windows\system32\mscomm32.ocx
2009-01-14 18:31 . 2009-01-14 18:31 <DIR> d-------- c:\program files\No-IP
2009-01-14 18:09 . 2009-02-01 11:40 <DIR> d-------- c:\program files\Winamp
2009-01-14 18:09 . 2009-01-29 13:21 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Winamp
2009-01-09 23:13 . 2009-02-02 17:30 16,376 --a------ c:\windows\system32\BMXStateBkp-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx
2009-01-09 23:13 . 2009-02-02 17:30 16,376 --a------ c:\windows\system32\BMXState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx
2009-01-09 23:13 . 2009-02-02 17:30 288 --a------ c:\windows\system32\DVCStateBkp-{00000002-00000000-00000006-00001102-00000002-100A1102}.dat
2009-01-09 23:13 . 2009-02-02 17:30 288 --a------ c:\windows\system32\DVCState-{00000002-00000000-00000006-00001102-00000002-100A1102}.dat
2009-01-09 17:39 . 2009-02-02 21:50 3,375,239 --a------ c:\windows\{00000002-00000000-00000006-00001102-00000002-100A1102}.BAK
2009-01-09 17:38 . 2009-02-02 21:50 3,375,239 --a------ c:\windows\{00000002-00000000-00000006-00001102-00000002-100A1102}.CDF
2009-01-09 17:38 . 2009-02-02 17:30 24,144 --a------ c:\windows\system32\BMXCtrlState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx
2009-01-09 17:38 . 2009-02-02 17:30 24,144 --a------ c:\windows\system32\BMXBkpCtrlState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx
2009-01-09 17:36 . 1998-01-08 02:00 1,048,576 --------- c:\windows\system32\SFMAN.DAT
2009-01-09 17:36 . 2000-05-11 01:00 90,112 --------- c:\windows\Updreg.EXE
2009-01-09 17:36 . 1998-06-05 03:00 84,992 --------- c:\windows\system32\SFCVRT32.DLL
2009-01-09 17:36 . 1995-08-30 03:02 82,432 --------- c:\windows\system32\CTWFLT32.DLL
2009-01-09 17:36 . 1994-12-05 04:11 53,552 --------- c:\windows\CTCCW.DLL
2009-01-09 17:36 . 1995-07-13 03:01 26,768 --------- c:\windows\system32\CTL3D.DLL
2009-01-09 17:36 . 1996-05-23 03:24 24,976 --------- c:\windows\CTRES.DLL
2009-01-09 17:36 . 1999-01-14 07:04 231 --------- c:\windows\AC3API.INI
2009-01-09 17:34 . 2000-12-05 02:11 4,174,814 --a------ c:\windows\system32\CT4MGM.SF2
2009-01-09 17:32 . 2001-09-24 05:01 364,544 --a------ c:\windows\system32\ctmp3.acm
2009-01-09 17:31 . 2003-03-05 12:19 15,840 --------- c:\windows\system32\drivers\PFMODNT.SYS
2009-01-07 15:28 . 2009-01-07 15:28 <DIR> d-------- c:\program files\<a href="http://www.download.net.pl/107/Real-Alternative/">Real Alternative</a>
2009-01-05 23:33 . 2009-01-05 23:33 3,751,995 --a------ c:\windows\system32\GPhotos.scr
2009-01-03 23:45 . 2009-01-26 02:00 201 --a------ c:\windows\AWS.ini
2009-01-03 23:38 . 2009-01-03 23:38 <DIR> d-------- c:\program files\SkaWit
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-02 20:55 --------- d-----w c:\program files\Neostrada TP
2009-02-02 10:56 --------- d-----w c:\documents and settings\x\Dane aplikacji\Skype
2009-02-02 10:54 --------- d-----w c:\documents and settings\x\Dane aplikacji\skypePM
2009-02-01 17:04 --------- d-----w c:\program files\BitComet
2009-02-01 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-01 10:40 --------- d-----w c:\documents and settings\x\Dane aplikacji\Samsung
2009-01-28 13:39 766 ----a-w c:\program files\Common Files\sms.ico
2009-01-28 13:39 70 ----a-w c:\program files\Common Files\moje.js
2009-01-26 10:44 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-01-22 10:13 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-12 18:35 --------- d-----w c:\program files\Gadu-Gadu
2009-01-09 20:40 --------- d-----w c:\documents and settings\x\Dane aplikacji\Tibia
2009-01-09 16:39 --------- d-----w c:\program files\Creative
2008-12-30 13:42 --------- d-----w c:\program files\Nstorm
2008-12-28 17:24 --------- d-----w c:\program files\Google
2008-12-23 19:55 --------- d-----w c:\program files\Ares
2008-12-17 19:38 18,304 ----a-w c:\documents and settings\x\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-12-17 16:25 --------- d-----w c:\program files\HyCam2
2008-12-17 16:00 --------- d-----w c:\program files\AIMP2
2008-12-17 15:50 --------- d-----w c:\documents and settings\x\Dane aplikacji\AIMP
2008-12-16 15:29 --------- d-----w c:\documents and settings\x\Dane aplikacji\GetRightToGo
2008-12-16 15:19 --------- d-----w c:\documents and settings\x\Dane aplikacji\DMCache
2008-12-15 20:14 --------- d-----w c:\documents and settings\x\Dane aplikacji\gtk-2.0
2008-12-15 20:10 --------- d-----w c:\documents and settings\x\Dane aplikacji\avidemux
2008-12-15 18:25 --------- d-----w c:\documents and settings\x\Dane aplikacji\AdobeUM
2008-12-13 19:22 --------- d-----w c:\documents and settings\x\Dane aplikacji\PC Suite
2008-12-13 19:21 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-13 19:21 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-12-13 19:21 --------- d-----w c:\documents and settings\x\Dane aplikacji\Nokia
2008-12-13 19:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\PC Suite
2008-12-13 19:19 --------- d-----w c:\program files\Nokia
2008-12-13 19:19 --------- d-----w c:\program files\Common Files\PCSuite
2008-12-13 19:19 --------- d-----w c:\program files\Common Files\Nokia
2008-12-13 19:18 --------- d-----w c:\program files\PC Connectivity Solution
2008-12-13 19:18 --------- d-----w c:\program files\DIFX
2008-12-13 19:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations
2008-12-11 16:29 --------- d-----w c:\documents and settings\x\Dane aplikacji\Leadertech
2008-12-10 21:02 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-10 21:00 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-10 20:59 --------- d-----w c:\documents and settings\x\Dane aplikacji\DAEMON Tools
2008-12-10 19:58 --------- d-----w c:\documents and settings\x\Dane aplikacji\ATI
2008-12-10 19:53 --------- d-----w c:\program files\ATI Technologies
2008-12-09 19:40 --------- d-----w c:\program files\AIDA32 - Enterprise System Information
2008-12-07 16:08 --------- d-----w c:\program files\Common Files\Adobe
2008-12-06 12:10 --------- d-----w c:\program files\Skype
2008-12-06 12:10 --------- d-----w c:\program files\Common Files\Skype
2008-12-06 12:10 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2008-12-05 20:38 --------- d-----w c:\program files\4t Tray Minimizer
2008-12-05 14:06 --------- d-----w c:\documents and settings\x\Dane aplikacji\Media Player Classic
2008-12-04 18:17 --------- d-----w c:\program files\HP
2008-12-04 18:15 --------- d-----w c:\program files\Common Files\HP
2008-12-04 18:13 --------- d-----w c:\program files\Hewlett-Packard
2008-12-04 15:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP
2008-12-04 14:57 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2008-12-04 14:42 --------- d-----w c:\documents and settings\x\Dane aplikacji\Creative
2008-12-04 14:40 23 ----a-w c:\windows\system32\drivers\adidsl.cfg
2008-12-04 14:40 --------- d-----w c:\program files\SAGEM
2008-12-04 14:40 --------- d-----w c:\program files\Java Web Start
2008-12-04 14:39 --------- d-----w c:\program files\Java
2008-12-04 14:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Creative
2008-12-04 14:25 --------- d-----w c:\documents and settings\x\Dane aplikacji\Gadu-Gadu
2008-12-04 14:24 --------- d-----w c:\program files\Alwil Software
2008-12-04 14:23 --------- d-----w c:\program files\MarBit
2008-12-04 14:23 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-04 14:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2008-12-04 14:20 --------- d-----w c:\program files\ULI5289
2008-12-04 06:08 --------- d-----w c:\documents and settings\x\Dane aplikacji\Ahead
2008-12-04 06:05 --------- d-----w c:\program files\Ahead
2008-12-04 06:02 --------- d-----w c:\program files\Common Files\Ahead
2008-12-04 06:02 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ahead
2008-12-03 19:04 --------- d-----w c:\program files\microsoft frontpage
2008-12-03 19:02 --------- d-----w c:\program files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ALi5289"="c:\program files\ULI5289\ALi5289.exe" [2005-03-10 405504]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"WooCnxMon"="c:\progra~1\NEOSTR~1\CnxMon.exe" [2003-10-16 24576]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2003-10-16 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 53248]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 339968]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]
"UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 340136]
"CTHelper"="CTHELPER.EXE" [2003-08-28 c:\windows\system32\CTHELPER.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
c:\documents and settings\x\Menu Start\Programy\Autostart\
4t Tray Minimizer.lnk - c:\program files\4t Tray Minimizer\4t-min.exe [2008-12-05 1091584]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 32768]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-04 962661]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
HP Image Zone - szybkie uruchamianie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"VIDC.X264"= x264vfw.dll
"vidc.I263"= i263_32.drv
"msacm.ctmp3"= c:\windows\system32\ctmp3.acm
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"d:\\xampp\\apache\\bin\\apache.exe"=
"d:\\xampp\\mysql\\bin\\mysqld.exe"=
"e:\\Grigo\\OTS\\SILNIKI\\Armonia\\Ali Manager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26676:TCP"= 26676:TCP:BitComet 26676 TCP
"26676:UDP"= 26676:UDP:BitComet 26676 UDP
R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [2008-12-04 51840]
R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [2008-12-04 45056]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-05 111184]
R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\AliEhci.sys [2008-12-04 84159]
R2 Apache2.2;Apache2.2;d:\xampp\apache\bin\apache.exe [2008-06-14 17408]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-05 20560]
R3 aliroothub;USB 2.0 Root Hub;c:\windows\system32\drivers\AliRtHub.sys [2008-12-04 5318]
S1 SysTool;SysTool Overclocking Utility;c:\windows\system32\drivers\SysTool.sys [2006-11-10 24064]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d3ad5b3-c9cc-11dd-9849-4d6564696130}]
\Shell\Auto\command - H:\qq.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL qq.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e30ac442-dff8-11dd-98c9-4d6564696130}]
\Shell\AutoRun\command - H:\
\Shell\open\Command - rundll32.exe .\desktop.dll,InstallM
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-adiras - adiras.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.neostrada.pl
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: { - c:\program files\Messenger\msmsgs.exe
IE: {{215940F1-E7E0-4801-BEE3-44D045534106} - c:\program files\Common Files\moje.js
FF - ProfilePath - c:\documents and settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\edcs3x5u.default\
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - component: c:\documents and settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\edcs3x5u.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll
FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava11.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava12.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJPI140_03.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-02 21:56:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(532)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-02-02 21:57:25
ComboFix-quarantined-files.txt 2009-02-02 20:57:17
Przed: 1 712 136 192 bajtów wolnych
Po: 1,847,222,272 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
282z góry dzięki
