oto z Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:59:46, on 2009-02-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\ULI5289\ALi5289.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\4t Tray Minimizer\4t-min.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe D:\xampp\apache\bin\apache.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\CTsvcCDA.exe d:\xampp\mysql\bin\mysqld-nt.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\MsPMSPSv.exe D:\xampp\apache\bin\apache.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\x\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js O17 - HKLM\System\CCS\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip\..\{02E606E2-A5D9-48E7-8417-0684631E26BC}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apache2.2 - Apache Software Foundation - D:\xampp\apache\bin\apache.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - d:\xampp\FileZillaFTP\FileZillaServer.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: mysql - Unknown owner - d:\xampp\mysql\bin\mysqld-nt.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8113 bytes
a to z combofix'a
ComboFix 09-02-02.03 - x 2009-02-02 21:55:12.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.198 [GMT 1:00] Uruchomiony z: c:\documents and settings\x\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090202-0] *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\install.exe c:\windows\system32\lsprst7.dll c:\windows\system32\ssprs.dll . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-02 do 2009-02-02 ))))))))))))))))))))))))))))))) . 2009-01-27 16:24 . 2009-01-27 16:25 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Ulead Systems 2009-01-27 16:24 . 2009-01-27 16:24 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-27 16:24 . 2009-01-27 16:24 1,409 --a------ c:\windows\QTFont.for 2009-01-27 09:39 . 2009-01-27 09:39 <DIR> d-------- c:\program files\Common Files\InterVideo 2009-01-27 09:39 . 2009-01-27 09:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InterVideo 2009-01-27 09:39 . 2007-03-27 19:56 210,456 --a------ c:\windows\system32\IVIresizeW7.dll 2009-01-27 09:39 . 2007-03-27 19:56 206,360 --a------ c:\windows\system32\IVIresizeA6.dll 2009-01-27 09:39 . 2007-03-27 19:56 198,168 --a------ c:\windows\system32\IVIresizeP6.dll 2009-01-27 09:39 . 2007-03-27 19:56 198,168 --a------ c:\windows\system32\IVIresizeM6.dll 2009-01-27 09:39 . 2007-03-27 19:56 194,072 --a------ c:\windows\system32\IVIresizePX.dll 2009-01-27 09:39 . 2007-03-27 19:56 26,136 --a------ c:\windows\system32\IVIresize.dll 2009-01-27 09:38 . 2009-01-27 09:38 <DIR> d-------- c:\program files\Windows Media Components 2009-01-27 09:36 . 2009-01-27 09:36 <DIR> d-------- c:\program files\Ulead Systems 2009-01-27 09:36 . 2009-01-27 09:38 <DIR> d-------- c:\program files\Common Files\Ulead Systems 2009-01-27 09:36 . 2009-01-27 16:23 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ulead Systems 2009-01-23 22:06 . 2009-01-23 22:10 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\REAPER 2009-01-23 21:56 . 2009-01-23 21:56 <DIR> d--h----- c:\windows\PIF 2009-01-22 11:13 . 2009-01-22 11:13 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Corel 2009-01-22 11:13 . 2009-01-22 11:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InstallShield 2009-01-22 11:12 . 2009-01-22 11:13 <DIR> d-------- c:\program files\Common Files\Corel 2009-01-21 16:52 . 2009-01-21 16:52 <DIR> d-------- c:\program files\VirtualDJ 2009-01-21 10:12 . 2009-02-02 17:23 5,852 --ahs---- c:\windows\system32\KGyGaAvL.sys 2009-01-21 10:12 . 2009-02-02 17:23 88 -r-hs---- c:\windows\system32\8AD2F8CD48.sys 2009-01-21 10:10 . 2009-01-22 11:12 <DIR> d-------- c:\program files\Corel 2009-01-19 19:29 . 2009-01-20 17:11 396 --a------ c:\windows\wcx_ftp.ini 2009-01-19 19:28 . 2009-01-20 17:11 1,035 --a------ c:\windows\wincmd.ini 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\UC.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\RAR.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\PKZIP.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\PKUNZIP.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\NOCLOSE.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\LHA.PIF 2009-01-19 19:28 . 2008-07-29 07:04 545 --a------ c:\windows\ARJ.PIF 2009-01-18 13:36 . 2009-01-18 13:36 <DIR> d-------- c:\documents and settings\x\.jpi_cache 2009-01-18 13:36 . 2009-01-18 13:36 <DIR> d-------- c:\documents and settings\x\.java 2009-01-16 20:30 . 2000-04-03 16:52 103,744 --a------ c:\windows\system32\mscomm32.ocx 2009-01-14 18:31 . 2009-01-14 18:31 <DIR> d-------- c:\program files\No-IP 2009-01-14 18:09 . 2009-02-01 11:40 <DIR> d-------- c:\program files\Winamp 2009-01-14 18:09 . 2009-01-29 13:21 <DIR> d-------- c:\documents and settings\x\Dane aplikacji\Winamp 2009-01-09 23:13 . 2009-02-02 17:30 16,376 --a------ c:\windows\system32\BMXStateBkp-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx 2009-01-09 23:13 . 2009-02-02 17:30 16,376 --a------ c:\windows\system32\BMXState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx 2009-01-09 23:13 . 2009-02-02 17:30 288 --a------ c:\windows\system32\DVCStateBkp-{00000002-00000000-00000006-00001102-00000002-100A1102}.dat 2009-01-09 23:13 . 2009-02-02 17:30 288 --a------ c:\windows\system32\DVCState-{00000002-00000000-00000006-00001102-00000002-100A1102}.dat 2009-01-09 17:39 . 2009-02-02 21:50 3,375,239 --a------ c:\windows\{00000002-00000000-00000006-00001102-00000002-100A1102}.BAK 2009-01-09 17:38 . 2009-02-02 21:50 3,375,239 --a------ c:\windows\{00000002-00000000-00000006-00001102-00000002-100A1102}.CDF 2009-01-09 17:38 . 2009-02-02 17:30 24,144 --a------ c:\windows\system32\BMXCtrlState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx 2009-01-09 17:38 . 2009-02-02 17:30 24,144 --a------ c:\windows\system32\BMXBkpCtrlState-{00000002-00000000-00000006-00001102-00000002-100A1102}.rfx 2009-01-09 17:36 . 1998-01-08 02:00 1,048,576 --------- c:\windows\system32\SFMAN.DAT 2009-01-09 17:36 . 2000-05-11 01:00 90,112 --------- c:\windows\Updreg.EXE 2009-01-09 17:36 . 1998-06-05 03:00 84,992 --------- c:\windows\system32\SFCVRT32.DLL 2009-01-09 17:36 . 1995-08-30 03:02 82,432 --------- c:\windows\system32\CTWFLT32.DLL 2009-01-09 17:36 . 1994-12-05 04:11 53,552 --------- c:\windows\CTCCW.DLL 2009-01-09 17:36 . 1995-07-13 03:01 26,768 --------- c:\windows\system32\CTL3D.DLL 2009-01-09 17:36 . 1996-05-23 03:24 24,976 --------- c:\windows\CTRES.DLL 2009-01-09 17:36 . 1999-01-14 07:04 231 --------- c:\windows\AC3API.INI 2009-01-09 17:34 . 2000-12-05 02:11 4,174,814 --a------ c:\windows\system32\CT4MGM.SF2 2009-01-09 17:32 . 2001-09-24 05:01 364,544 --a------ c:\windows\system32\ctmp3.acm 2009-01-09 17:31 . 2003-03-05 12:19 15,840 --------- c:\windows\system32\drivers\PFMODNT.SYS 2009-01-07 15:28 . 2009-01-07 15:28 <DIR> d-------- c:\program files\<a href="http://www.download.net.pl/107/Real-Alternative/">Real Alternative</a> 2009-01-05 23:33 . 2009-01-05 23:33 3,751,995 --a------ c:\windows\system32\GPhotos.scr 2009-01-03 23:45 . 2009-01-26 02:00 201 --a------ c:\windows\AWS.ini 2009-01-03 23:38 . 2009-01-03 23:38 <DIR> d-------- c:\program files\SkaWit . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-02 20:55 --------- d-----w c:\program files\Neostrada TP 2009-02-02 10:56 --------- d-----w c:\documents and settings\x\Dane aplikacji\Skype 2009-02-02 10:54 --------- d-----w c:\documents and settings\x\Dane aplikacji\skypePM 2009-02-01 17:04 --------- d-----w c:\program files\BitComet 2009-02-01 10:40 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-01 10:40 --------- d-----w c:\documents and settings\x\Dane aplikacji\Samsung 2009-01-28 13:39 766 ----a-w c:\program files\Common Files\sms.ico 2009-01-28 13:39 70 ----a-w c:\program files\Common Files\moje.js 2009-01-26 10:44 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-22 10:13 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-12 18:35 --------- d-----w c:\program files\Gadu-Gadu 2009-01-09 20:40 --------- d-----w c:\documents and settings\x\Dane aplikacji\Tibia 2009-01-09 16:39 --------- d-----w c:\program files\Creative 2008-12-30 13:42 --------- d-----w c:\program files\Nstorm 2008-12-28 17:24 --------- d-----w c:\program files\Google 2008-12-23 19:55 --------- d-----w c:\program files\Ares 2008-12-17 19:38 18,304 ----a-w c:\documents and settings\x\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-12-17 16:25 --------- d-----w c:\program files\HyCam2 2008-12-17 16:00 --------- d-----w c:\program files\AIMP2 2008-12-17 15:50 --------- d-----w c:\documents and settings\x\Dane aplikacji\AIMP 2008-12-16 15:29 --------- d-----w c:\documents and settings\x\Dane aplikacji\GetRightToGo 2008-12-16 15:19 --------- d-----w c:\documents and settings\x\Dane aplikacji\DMCache 2008-12-15 20:14 --------- d-----w c:\documents and settings\x\Dane aplikacji\gtk-2.0 2008-12-15 20:10 --------- d-----w c:\documents and settings\x\Dane aplikacji\avidemux 2008-12-15 18:25 --------- d-----w c:\documents and settings\x\Dane aplikacji\AdobeUM 2008-12-13 19:22 --------- d-----w c:\documents and settings\x\Dane aplikacji\PC Suite 2008-12-13 19:21 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-12-13 19:21 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-12-13 19:21 --------- d-----w c:\documents and settings\x\Dane aplikacji\Nokia 2008-12-13 19:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\PC Suite 2008-12-13 19:19 --------- d-----w c:\program files\Nokia 2008-12-13 19:19 --------- d-----w c:\program files\Common Files\PCSuite 2008-12-13 19:19 --------- d-----w c:\program files\Common Files\Nokia 2008-12-13 19:18 --------- d-----w c:\program files\PC Connectivity Solution 2008-12-13 19:18 --------- d-----w c:\program files\DIFX 2008-12-13 19:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations 2008-12-11 16:29 --------- d-----w c:\documents and settings\x\Dane aplikacji\Leadertech 2008-12-10 21:02 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-10 21:00 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-10 20:59 --------- d-----w c:\documents and settings\x\Dane aplikacji\DAEMON Tools 2008-12-10 19:58 --------- d-----w c:\documents and settings\x\Dane aplikacji\ATI 2008-12-10 19:53 --------- d-----w c:\program files\ATI Technologies 2008-12-09 19:40 --------- d-----w c:\program files\AIDA32 - Enterprise System Information 2008-12-07 16:08 --------- d-----w c:\program files\Common Files\Adobe 2008-12-06 12:10 --------- d-----w c:\program files\Skype 2008-12-06 12:10 --------- d-----w c:\program files\Common Files\Skype 2008-12-06 12:10 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-05 20:38 --------- d-----w c:\program files\4t Tray Minimizer 2008-12-05 14:06 --------- d-----w c:\documents and settings\x\Dane aplikacji\Media Player Classic 2008-12-04 18:17 --------- d-----w c:\program files\HP 2008-12-04 18:15 --------- d-----w c:\program files\Common Files\HP 2008-12-04 18:13 --------- d-----w c:\program files\Hewlett-Packard 2008-12-04 15:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-04 14:57 --------- d-----w c:\program files\Common Files\Hewlett-Packard 2008-12-04 14:42 --------- d-----w c:\documents and settings\x\Dane aplikacji\Creative 2008-12-04 14:40 23 ----a-w c:\windows\system32\drivers\adidsl.cfg 2008-12-04 14:40 --------- d-----w c:\program files\SAGEM 2008-12-04 14:40 --------- d-----w c:\program files\Java Web Start 2008-12-04 14:39 --------- d-----w c:\program files\Java 2008-12-04 14:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Creative 2008-12-04 14:25 --------- d-----w c:\documents and settings\x\Dane aplikacji\Gadu-Gadu 2008-12-04 14:24 --------- d-----w c:\program files\Alwil Software 2008-12-04 14:23 --------- d-----w c:\program files\MarBit 2008-12-04 14:23 --------- d-----w c:\program files\K-Lite Codec Pack 2008-12-04 14:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-04 14:20 --------- d-----w c:\program files\ULI5289 2008-12-04 06:08 --------- d-----w c:\documents and settings\x\Dane aplikacji\Ahead 2008-12-04 06:05 --------- d-----w c:\program files\Ahead 2008-12-04 06:02 --------- d-----w c:\program files\Common Files\Ahead 2008-12-04 06:02 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ahead 2008-12-03 19:04 --------- d-----w c:\program files\microsoft frontpage 2008-12-03 19:02 --------- d-----w c:\program files\Usługi online . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "ALi5289"="c:\program files\ULI5289\ALi5289.exe" [2005-03-10 405504] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WooCnxMon"="c:\progra~1\NEOSTR~1\CnxMon.exe" [2003-10-16 24576] "WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2003-10-16 20480] "WOOTASKBARICON"="c:\progra~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 53248] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 339968] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672] "UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 340136] "CTHelper"="CTHELPER.EXE" [2003-08-28 c:\windows\system32\CTHELPER.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768] c:\documents and settings\x\Menu Start\Programy\Autostart\ 4t Tray Minimizer.lnk - c:\program files\4t Tray Minimizer\4t-min.exe [2008-12-05 1091584] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 32768] DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-04 962661] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048] HP Image Zone - szybkie uruchamianie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv "VIDC.X264"= x264vfw.dll "vidc.I263"= i263_32.drv "msacm.ctmp3"= c:\windows\system32\ctmp3.acm "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"= "d:\\xampp\\apache\\bin\\apache.exe"= "d:\\xampp\\mysql\\bin\\mysqld.exe"= "e:\\Grigo\\OTS\\SILNIKI\\Armonia\\Ali Manager.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26676:TCP"= 26676:TCP:BitComet 26676 TCP "26676:UDP"= 26676:UDP:BitComet 26676 UDP R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [2008-12-04 51840] R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [2008-12-04 45056] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-05 111184] R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\AliEhci.sys [2008-12-04 84159] R2 Apache2.2;Apache2.2;d:\xampp\apache\bin\apache.exe [2008-06-14 17408] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-05 20560] R3 aliroothub;USB 2.0 Root Hub;c:\windows\system32\drivers\AliRtHub.sys [2008-12-04 5318] S1 SysTool;SysTool Overclocking Utility;c:\windows\system32\drivers\SysTool.sys [2006-11-10 24064] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d3ad5b3-c9cc-11dd-9849-4d6564696130}] \Shell\Auto\command - H:\qq.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL qq.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e30ac442-dff8-11dd-98c9-4d6564696130}] \Shell\AutoRun\command - H:\ \Shell\open\Command - rundll32.exe .\desktop.dll,InstallM . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-adiras - adiras.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.neostrada.pl uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: { - c:\program files\Messenger\msmsgs.exe IE: {{215940F1-E7E0-4801-BEE3-44D045534106} - c:\program files\Common Files\moje.js FF - ProfilePath - c:\documents and settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\edcs3x5u.default\ FF - prefs.js: browser.startup.homepage - www.google.pl FF - component: c:\documents and settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\edcs3x5u.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava11.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava12.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava13.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava32.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJPI140_03.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOJI610.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-02 21:56:12 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(532) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-02-02 21:57:25 ComboFix-quarantined-files.txt 2009-02-02 20:57:17 Przed: 1 712 136 192 bajtów wolnych Po: 1,847,222,272 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 282
z góry dzięki