Temat jest zamknięty
CODE-BOX
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1023.658 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Isabell\Pulpit\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Isabell\Dane aplikacji\EurekaLog
c:\documents and settings\Isabell\Dane aplikacji\EurekaLog\EurekaLog.ini
H:\autorun.inf
H:\em8tqm.cmd
.
((((((((((((((((((((((((( Pliki utworzone od 2009-03-05 do 2009-04-05 )))))))))))))))))))))))))))))))
.
2009-04-02 11:07 . 2009-04-05 11:10 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\skypePM
2009-04-02 11:07 . 2009-04-02 11:07 56 --ah----- c:\windows\system32\ezsidmv.dat
2009-04-02 11:05 . 2009-04-02 11:05 <DIR> dr------- c:\program files\Skype
2009-04-02 11:05 . 2009-04-02 11:05 <DIR> d-------- c:\program files\Common Files\Skype
2009-04-02 11:05 . 2009-04-05 12:30 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\Skype
2009-04-02 11:05 . 2009-04-02 11:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype
2009-04-02 10:20 . 2009-04-02 10:20 <DIR> d-------- c:\windows\system32\pl-PL
2009-04-02 10:18 . 2009-04-02 10:20 <DIR> d-------- c:\windows\system32\XPSViewer
2009-04-02 10:18 . 2009-04-02 10:18 <DIR> d-------- c:\program files\Reference Assemblies
2009-04-02 10:18 . 2009-04-02 10:18 <DIR> d-------- c:\program files\MSBuild
2009-04-02 10:17 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-04-02 10:15 . 2009-04-02 10:15 <DIR> d-------- c:\program files\MSXML 6.0
2009-04-02 10:06 . 2009-04-02 10:06 <DIR> d-------- c:\program files\Microsoft SQL Server Compact Edition
2009-03-29 01:14 . 2009-03-29 01:17 <DIR> d--h----- c:\windows\Icons
2009-03-28 11:57 . 2009-03-28 11:57 2,289,664 --a------ c:\windows\system32\TUKernel.exe
2009-03-28 11:51 . 2009-03-28 11:51 <DIR> d-------- c:\program files\TuneUp Utilities 2007
2009-03-28 11:51 . 2009-03-28 11:51 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\TuneUp Software
2009-03-28 11:51 . 2009-03-28 11:51 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TuneUp Software
2009-03-28 11:51 . 2007-05-16 09:41 29,704 --a------ c:\windows\system32\uxtuneup.dll
2009-03-28 11:50 . 2009-03-28 11:50 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-03-19 00:13 . 2009-03-19 00:13 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\id Software
2009-03-19 00:06 . 2009-03-19 00:06 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-19 00:06 . 2009-03-19 00:11 2,246,144 --a------ c:\windows\system32\pbsvc.exe
2009-03-19 00:06 . 2009-03-19 00:11 107,832 --a------ c:\windows\system32\PnkBstrB.exe
2009-03-19 00:06 . 2009-03-19 00:06 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2009-03-19 00:06 . 2009-03-19 00:12 22,328 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2009-03-19 00:06 . 2009-03-19 00:12 22,328 --a------ c:\documents and settings\Isabell\Dane aplikacji\PnkBstrK.sys
2009-03-18 01:48 . 2009-03-19 00:02 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\gtk-2.0
2009-03-16 22:43 . 2009-03-16 22:43 <DIR> d-------- c:\documents and settings\Isabell\.thumbnails
2009-03-16 22:42 . 2009-03-19 00:02 <DIR> d-------- c:\documents and settings\Isabell\.gimp-2.6
2009-03-16 22:42 . 2009-03-16 22:42 <DIR> d-------- c:\documents and settings\Isabell\.gegl-0.0
2009-03-16 22:37 . 2009-03-17 23:46 <DIR> d-------- c:\program files\GIMP-2.0
2009-03-16 22:30 . 2009-03-16 22:30 <DIR> d-------- c:\documents and settings\Isabell\.gimp-2.2
2009-03-05 14:31 . 2009-03-05 14:32 <DIR> d-------- c:\documents and settings\Isabell\Dane aplikacji\KDE
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 10:28 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2009-04-05 10:27 434,208 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-05 10:27 4,660 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-05 10:27 25,924 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-05 10:27 2,777,632 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-05 10:24 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\foobar2000
2009-04-05 10:08 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\uTorrent
2009-04-04 20:13 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\HPAppData
2009-04-02 07:05 --------- d-----w c:\program files\Java
2009-03-28 10:09 --------- d-----w c:\program files\Last.fm
2009-03-09 03:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 16:51 564,736 ----a-w c:\windows\system32\ah.scr
2009-03-04 16:51 45,056 ----a-w c:\windows\system32\sstunst3.exe
2009-03-04 14:18 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Instantbird
2009-03-04 13:40 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Gajim
2009-03-01 22:41 --------- d-----w c:\program files\ALLPlayer
2009-02-26 11:52 --------- d-----w c:\program files\NAPI-PROJEKT
2009-02-26 11:24 --------- d-----w c:\program files\Common Files\Adobe
2009-02-26 11:22 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FLEXnet
2009-02-26 11:17 --------- d-----w c:\program files\Bonjour
2009-02-26 11:09 --------- d-----w c:\program files\Common Files\Macrovision Shared
2009-02-26 10:56 --------- d-----w c:\program files\Common Files\Ahead
2009-02-26 10:56 --------- d-----w c:\program files\Ahead
2009-02-26 10:44 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-26 10:44 --------- d-----w c:\program files\JoWood
2009-02-25 19:08 --------- d-----w c:\program files\NCH Swift Sound
2009-02-25 19:08 --------- d-----w c:\program files\NCH Software
2009-02-25 19:08 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\NCH Swift Sound
2009-02-25 19:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound
2009-02-25 18:35 --------- d-----w c:\program files\foobar2000
2009-02-25 13:11 --------- d-----w c:\program files\PITy
2009-02-23 18:46 --------- d-----w c:\program files\HDD Regenerator
2009-02-23 16:43 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Media Player Classic
2009-02-22 21:09 --------- d-----w c:\program files\PDFCreator
2009-02-22 19:50 --------- d-----w c:\program files\CCleaner
2009-02-22 19:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2009-02-20 19:34 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\DAEMON Tools Pro
2009-02-20 19:34 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\DAEMON Tools Lite
2009-02-20 19:34 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\DAEMON Tools
2009-02-20 19:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite
2009-02-20 19:29 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-02-19 19:11 --------- d-----w c:\program files\Screamer Radio
2009-02-19 12:28 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA
2009-02-18 13:53 --------- d-----w c:\program files\VS Revo Group
2009-02-18 13:02 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Winamp
2009-02-17 20:53 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Notepad++
2009-02-17 20:45 --------- d-----w c:\program files\Notepad++
2009-02-17 20:10 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\OpenOffice.org
2009-02-17 20:07 --------- d-----w c:\program files\OpenOffice.org 3
2009-02-17 18:44 --------- d-----w c:\program files\McAfee
2009-02-17 10:26 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\HP
2009-02-17 10:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WEBREG
2009-02-17 10:22 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP
2009-02-17 10:21 --------- d-----w c:\program files\HP
2009-02-17 10:21 --------- d-----w c:\program files\Hewlett-Packard
2009-02-17 10:21 --------- d-----w c:\program files\Common Files\HP
2009-02-17 10:21 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-02-17 10:21 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-02-17 10:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard
2009-02-17 09:42 --------- d-----w c:\documents and settings\LocalService\Dane aplikacji\SACore
2009-02-17 09:41 --------- d-----w c:\program files\Common Files\McAfee
2009-02-17 09:41 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\SiteAdvisor
2009-02-17 09:41 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\McAfee
2009-02-17 00:02 --------- d-----w c:\program files\PhotoScape
2009-02-16 18:04 --------- d-----w c:\program files\Foxit Software
2009-02-16 18:04 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\Foxit
2009-02-16 17:58 --------- d-----w c:\program files\Advanced Spyware Remover
2009-02-16 17:16 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-16 17:15 --------- d-----w c:\program files\uTorrent
2009-02-16 16:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2009-02-16 16:50 --------- d-----w c:\program files\Microsoft Works
2009-02-16 16:33 --------- d-----w c:\program files\WapSter
2009-02-16 16:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Last.fm
2009-02-16 16:31 --------- d-----w c:\program files\Winamp
2009-02-16 16:29 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-16 16:29 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-16 16:29 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-16 16:25 --------- d-----w c:\program files\IZArc
2009-02-16 16:19 --------- d-----w c:\program files\Kaspersky Lab
2009-02-16 16:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2009-02-16 16:04 --------- d-----w c:\program files\Realtek
2009-02-16 16:04 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-16 16:04 --------- d-----w c:\documents and settings\Isabell\Dane aplikacji\InstallShield
2009-02-16 16:03 4,716 ----a-w c:\windows\gdrv.sys
2009-02-16 16:02 --------- d-----w c:\program files\Intel
2009-02-16 15:56 --------- d-----w c:\program files\microsoft frontpage
2009-02-16 15:54 --------- d-----w c:\program files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-01-20 1451248]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-16 206088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"h:\\Program Files\\WapSter AQQ\\AQQ.exe"=
"i:\\Program Files\\WapSter AQQ\\AQQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-17 206096]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Zawartość folderu 'Zaplanowane zadania'
2009-03-28 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 19:35]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://google.pl/
uInternet Settings,ProxyOverride = *.local
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Isabell\Dane aplikacji\Mozilla\Firefox\Profiles\m2wi6nlc.default\
FF - prefs.js: browser.startup.homepage - google.pl
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-05 12:30:28
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Czas ukończenia: 2009-04-05 12:32:16 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-04-05 10:32:13
Przed: 3 107 196 928 bajtów wolnych
Po: 3,020,091,392 bajtów wolnych
241
