Logi - Profilaktyka

ComboFix 08-02-22.3 - Komputerek 2008-02-26 19:45:19.3 - NTFSx86Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.682 [GMT 1:00]Running from: C:\Documents and Settings\Komputerek\Pulpit\ComboFix.exe<strong class='bbc'>WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED </strong>.(((((((((((((((((((((((((   Files Created from 2008-01-26 to 2008-02-26  ))))))))))))))))))))))))))))))).2008-02-26 19:33 . 2008-02-26 19:33	<DIR>	d--------	C:\WINDOWS\Sun2008-02-26 17:26 . 2008-02-26 17:26	<DIR>	d--------	C:\Program Files\OpenOffice.ux.pl 2.3.12008-02-25 22:32 . 2008-02-25 22:32	<DIR>	d--------	C:\Program Files\MSXML 4.02008-02-24 22:00 . 2008-02-24 22:00	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP2008-02-24 15:10 . 2004-05-25 17:29	57,344	--a------	C:\WINDOWS\system32\vbame.dll2008-02-23 16:35 . 2008-02-23 16:44	3,888	--a------	C:\WINDOWS\system32\drivers\NTHANDLE.SYS2008-02-23 15:45 . 2008-02-23 15:45	0	--a------	C:\WINDOWS\nsreg.dat2008-02-21 12:04 . 2008-02-21 12:04	<DIR>	d--------	C:\Program Files\Combined Community Codec Pack2008-02-21 11:35 . 2008-02-22 22:01	<DIR>	d--------	C:\WINDOWS\system32\Filt2008-02-21 11:35 . 2007-11-29 18:23	439,232	--a------	C:\WINDOWS\system32\drivers\SandBox.sys2008-02-21 11:35 . 2007-12-03 13:40	199,696	--a------	C:\WINDOWS\system32\drivers\afw.sys2008-02-21 10:16 . 2008-02-21 10:15	512,096	--a------	C:\WINDOWS\system32\drivers\amon.sys2008-02-21 10:16 . 2008-02-21 10:15	298,104	--a------	C:\WINDOWS\system32\imon.dll2008-02-21 10:16 . 2008-02-21 10:15	15,424	--a------	C:\WINDOWS\system32\drivers\nod32drv.sys2008-02-21 09:57 . 2008-02-21 09:57	<DIR>	d--------	C:\GG2008-02-20 22:36 . 2008-02-20 22:36	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft2008-02-20 21:36 . 2008-02-20 21:36	2,543	--a------	C:\WINDOWS\unins000.dat2008-02-20 21:08 . 2008-02-21 09:57	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy2008-02-20 15:26 . 2008-02-20 15:26	<DIR>	d--------	C:\Program Files\Trend Micro2008-02-19 21:01 . 2008-02-19 21:01	<DIR>	d--------	C:\WINDOWS\system32\Kaspersky Lab2008-02-19 20:37 . 2008-02-21 09:57	<DIR>	d--------	C:\Documents and Settings\Komputerek\UserData2008-02-19 18:53 . 2008-02-21 09:57	<DIR>	d--------	C:\Program Files\ESET2008-02-18 20:36 . 2007-10-30 19:55	625,032	--a------	C:\WINDOWS\system32\SymNeti.dll2008-02-18 10:06 . 2008-02-18 10:06	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\Agnitum2008-02-18 10:05 . 2007-10-25 18:17	49	--a------	C:\WINDOWS\transp.gif2008-02-18 10:04 . 2008-02-18 10:04	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Agnitum2008-02-16 23:43 . 2008-02-24 18:43	<DIR>	d--------	C:\Downloads2008-02-16 23:41 . 2008-02-21 10:02	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\GetRight2008-02-15 18:47 . 2008-02-15 18:47	<DIR>	d--h-----	C:\Program Files\Zenographics2008-02-15 18:47 . 2008-02-15 18:48	<DIR>	d--------	C:\Program Files\Hewlett-Packard2008-02-15 18:36 . 2008-02-15 18:41	754	--a------	C:\WINDOWS\WORDPAD.INI2008-02-14 18:06 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\BearShare2008-02-14 18:06 . 2006-11-12 11:39	483,328	--a------	C:\WINDOWS\system32\actskn45.ocx2008-02-14 14:43 . 2008-02-14 14:43	<DIR>	d--h-----	C:\WINDOWS\PIF2008-02-13 18:37 . 2008-02-19 13:36	<DIR>	d--------	C:\WINDOWS\NV11361140.TMP2008-02-13 18:34 . 2007-12-05 01:41	7,435,392	--a------	C:\WINDOWS\system32\drivers\nv4_mini.sys2008-02-13 18:34 . 2007-12-05 01:41	6,901,760	--a------	C:\WINDOWS\system32\nvoglnt.dll2008-02-13 18:34 . 2007-12-05 01:41	5,773,568	--a------	C:\WINDOWS\system32\nv4_disp.dll2008-02-13 18:34 . 2007-12-05 01:41	1,089,536	--a------	C:\WINDOWS\system32\nvcuda.dll2008-02-13 18:34 . 2007-12-05 01:41	385,024	--a------	C:\WINDOWS\system32\nvapi.dll2008-02-13 18:34 . 2007-12-05 01:41	155,716	--a------	C:\WINDOWS\system32\nvsvc32.exe2008-02-13 18:25 . 2008-02-23 16:10	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Ustawienia lokalne2008-02-13 18:25 . 2008-02-11 16:10	<DIR>	d--------	C:\Documents and Settings\Administrator\Ulubione2008-02-13 18:25 . 2008-02-19 13:21	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Szablony2008-02-13 18:25 . 2008-02-11 16:10	<DIR>	d--------	C:\Documents and Settings\Administrator\Pulpit2008-02-13 18:25 . 2008-02-11 16:10	<DIR>	d--------	C:\Documents and Settings\Administrator\Moje dokumenty2008-02-13 18:25 . 2008-02-19 13:21	<DIR>	dr-------	C:\Documents and Settings\Administrator\Menu Start2008-02-13 18:25 . 2008-02-19 13:21	<DIR>	dr-h-----	C:\Documents and Settings\Administrator\Dane aplikacji2008-02-12 19:48 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\Media Player Classic2008-02-12 18:26 . 2008-02-12 18:26	<DIR>	d--------	C:\WINDOWS\system32\AGEIA2008-02-12 18:26 . 2008-02-20 22:36	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard2008-02-12 18:26 . 2008-02-19 13:30	<DIR>	d--------	C:\Program Files\AGEIA Technologies2008-02-12 17:49 . 2008-02-22 13:18	<DIR>	d--h-----	C:\WINDOWS\msdownld.tmp2008-02-12 12:36 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\ldoce42008-02-12 12:36 . 2008-02-24 16:36	54,156	--ah-----	C:\WINDOWS\QTFont.qfn2008-02-12 12:36 . 2008-02-12 12:36	1,409	--a------	C:\WINDOWS\QTFont.for2008-02-12 12:35 . 2008-02-23 22:44	126,976	--a------	C:\WINDOWS\system32\UAService7.exe2008-02-12 12:34 . 2008-02-12 12:34	<DIR>	d--------	C:\Program Files\TEXTware2008-02-12 12:34 . 2008-02-12 12:34	<DIR>	d--------	C:\Program Files\IDM2008-02-12 12:34 . 1998-10-22 05:01	1,888,744	--a------	C:\WINDOWS\system32\VCL40.BPL2008-02-12 12:34 . 2003-04-29 19:09	205,312	--a------	C:\WINDOWS\system32\Illprs.dll2008-02-12 12:34 . 2002-08-01 16:44	160,768	--a------	C:\WINDOWS\system32\ILLKRN.DLL2008-02-12 12:34 . 2004-06-10 11:29	48,128	--a------	C:\WINDOWS\system32\QFClient.ILX2008-02-12 12:33 . 1999-11-10 12:05	86,016	--a------	C:\WINDOWS\unvise32qt.exe2008-02-12 12:32 . 2008-02-19 13:39	<DIR>	d--------	C:\WINDOWS\system32\QuickTime2008-02-12 12:32 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\QuickTime2008-02-12 10:10 . 2008-02-12 10:10	<DIR>	d--------	C:\Media2008-02-12 09:59 . 2008-02-24 19:30	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\Azureus2008-02-12 09:48 . 2004-08-04 01:44	221,184	--a------	C:\WINDOWS\system32\wmpns.dll2008-02-11 22:49 . 2007-09-24 23:31	69,632	--a------	C:\WINDOWS\system32\javacpl.cpl2008-02-11 22:47 . 2008-02-11 22:49	<DIR>	d--------	C:\Program Files\Java2008-02-11 22:44 . 2008-02-11 22:44	<DIR>	d--------	C:\Program Files\Common Files\Java2008-02-11 22:34 . 2008-02-22 12:57	<DIR>	d--------	C:\gry2008-02-11 22:33 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\DAEMON Tools2008-02-11 22:30 . 2008-02-11 22:30	716,272	--a------	C:\WINDOWS\system32\drivers\sptd.sys2008-02-11 21:53 . 2008-02-13 23:43	<DIR>	d--h-----	C:\WINDOWS\$hf_mig$2008-02-11 21:51 . 2008-01-12 18:32	23,904	--a------	C:\WINDOWS\system32\drivers\COH_Mon.sys2008-02-11 21:51 . 2008-01-15 09:54	10,537	--a------	C:\WINDOWS\system32\drivers\COH_Mon.cat2008-02-11 21:51 . 2008-01-15 05:28	706	--a------	C:\WINDOWS\system32\drivers\COH_Mon.inf2008-02-11 19:09 . 2008-02-19 13:21	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\Winamp2008-02-11 18:13 . 2008-02-14 22:11	<DIR>	d--------	C:\Documents and Settings\Komputerek\Gadu-Gadu2008-02-11 18:13 . 2008-02-11 18:13	<DIR>	d--------	C:\Documents and Settings\Komputerek\Dane aplikacji\Gadu-Gadu2008-02-11 18:13 . 2004-08-03 23:08	26,496	--a--c---	C:\WINDOWS\system32\dllcache\usbstor.sys2008-02-11 18:09 . 2008-02-11 18:09	<DIR>	dr-h-----	C:\Documents and Settings\Komputerek\Dane aplikacji\SecuROM2008-02-11 18:09 . 2008-02-11 18:09	108,144	--a------	C:\WINDOWS\system32\CmdLineExt.dll2008-02-11 18:07 . 2008-02-24 22:00	<DIR>	d--------	C:\Programy2008-02-11 17:48 . 2008-02-11 17:48	<DIR>	d--------	C:\WINDOWS\Provisioning2008-02-11 17:48 . 2008-02-19 13:37	<DIR>	d--------	C:\WINDOWS\PeerNet2008-02-11 17:48 . 2008-02-19 13:35	<DIR>	d--------	C:\WINDOWS\ehome2008-02-11 17:46 . 2008-02-21 10:00	<DIR>	d--------	C:\Program Files\Symantec2008-02-11 17:46 . 2008-02-21 10:01	<DIR>	d--------	C:\Program Files\Norton Internet Security2008-02-11 17:46 . 2008-02-11 18:12	123,952	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS2008-02-11 17:46 . 2008-02-11 18:12	60,800	--a------	C:\WINDOWS\system32\S32EVNT1.DLL2008-02-11 17:46 . 2008-02-11 18:12	10,740	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT2008-02-11 17:46 . 2008-02-11 18:12	805	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF2008-02-11 17:45 . 2008-02-21 10:04	<DIR>	d--------	C:\Program Files\Common Files\Symantec Shared2008-02-11 17:45 . 2008-02-21 10:01	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Symantec2008-02-11 17:29 . 2008-02-11 17:29	<DIR>	d--------	C:\Program Files\Thomson2008-02-11 17:29 . 2003-12-08 11:53	70,688	--a------	C:\WINDOWS\system32\drivers\alcaudsl.sys2008-02-11 17:29 . 2003-12-08 11:53	53,600	--a------	C:\WINDOWS\system32\drivers\alcan5wn.sys.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-02-24 14:08	---------	d-----w	C:\Program Files\Common Files\InstallShield2008-02-19 12:32	---------	d-----w	C:\Program Files\Usługi online2008-02-11 16:43	15,600	----a-w	C:\WINDOWS\gdrv.sys2008-02-11 15:20	---------	d-----w	C:\Program Files\microsoft frontpage2007-12-07 01:08	662,016	----a-w	C:\WINDOWS\system32\wininet.dll2007-12-05 01:53	356,352	----a-w	C:\WINDOWS\system32\NVUNINST.EXE2007-12-04 18:42	550,912	----a-w	C:\WINDOWS\system32\oleaut32.dll.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TaskTray"="C:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe" [2001-06-29 01:00 163840][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SoundMan"="SOUNDMAN.EXE" [2006-07-21 09:14 86016 C:\WINDOWS\SOUNDMAN.EXE]"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]"nod32kui"="C:\Programy\Eset\nod32kui.exe" [2008-02-21 10:15 949376]"OutpostMonitor"="C:\Programy\OUTPOS~1\op_mon.exe" [2007-12-08 16:51 1744384]"OutpostFeedBack"="C:\Programy\Outpost Firewall Pro\feedback.exe" [2007-12-04 14:45 405504]"UnlockerAssistant"="C:\Programy\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19 15872][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]--a------ 2006-05-04 09:26 2808832 C:\WINDOWS\ALCWZRD.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]--a------ 2007-01-09 22:59 115816 C:\Program Files\Common Files\Symantec Shared\ccApp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]--a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]--a------ 2008-01-17 17:51 486856 C:\Programy\DAEMON Tools\daemon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]--a------ 2007-11-14 11:54 2131392 C:\Programy\Gadu-Gadu\gg.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]--a------ 2001-11-29 01:00 28672 C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]--a------ 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]--a------ 2007-12-05 01:41 8523776 C:\WINDOWS\system32\NvCpl.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]--a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]--a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]-ra------ 2006-01-30 17:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]--a------ 2007-01-14 00:11 771704 C:\Program Files\Norton Internet Security\osCheck.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]--a------ 2008-02-12 12:33 98304 D:\prgramy\ldoce4v2\qttask.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]--a------ 2007-04-12 10:33 16132608 C:\WINDOWS\RTHDCPL.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]-ra------ 2007-04-13 08:36 1822720 C:\WINDOWS\SkyTel.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]--------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]D:\Prgramy\Winamp\winampa.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]--a------ 2002-07-02 10:56 24576 C:\WINDOWS\system32\CTHELPER.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"UserAccess7"=2 (0x2)"SymAppCore"=2 (0x2)"Symantec Core LC"=3 (0x3)"LiveUpdate"=3 (0x3)"ISPwdSvc"=3 (0x3)"comHost"=3 (0x3)"CLTNetCnService"=2 (0x2)"ccSetMgr"=2 (0x2)"ccEvtMgr"=2 (0x2)"Automatic LiveUpdate Scheduler"=2 (0x2)"Creative Service for CDROM Access"=2 (0x2)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019R1 SandBox;SandBox;C:\WINDOWS\system32\DRIVERS\SandBox.sys [2007-11-29 18:23]R3 afw;Agnitum firewall driver;C:\WINDOWS\system32\DRIVERS\afw.sys [2007-12-03 13:40]S2 acssrv;Agnitum Client Security Service;C:\Programy\OUTPOS~1\acs.exe [2007-12-04 14:47]S3 ASWFilt;ASWFilt;C:\WINDOWS\system32\Filt\ASWFilt.dll [2007-11-29 18:24]S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-02-11 17:43]S3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\@BIOS\markfun.w32 [2007-08-21 11:49]S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2005-07-14 11:39]*Newly Created Service* - COMHOST.**************************************************************************catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]Rootkit scan 2008-02-26 19:47:01Windows 5.1.2600 Dodatek Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... C:\WINDOWS\OP_CACHE.ATR 5160 bytesC:\WINDOWS\OP_CACHE.IDX 2580 bytesC:\WINDOWS\system32\OP_CACHE.ATR 49920 bytesC:\WINDOWS\system32\OP_CACHE.IDX 24960 bytesC:\WINDOWS\system32\drivers\OP_CACHE.ATR 4968 bytesC:\WINDOWS\system32\drivers\OP_CACHE.IDX 2484 bytesscan completed successfully hidden files: 6 **************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]-> C:\Programy\Eset\pr_imon.dllPROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]-> C:\Programy\Unlocker\UnlockerHook.dll-> C:\Program Files\Combined Community Codec Pack\Filters\Haali\mmfinfo.dll-> C:\Program Files\Combined Community Codec Pack\Filters\Haali\mkunicode.dll.Completion time: 2008-02-26 19:47:48ComboFix-quarantined-files.txt  2008-02-26 18:47:45ComboFix2.txt  2008-02-23 15:10:17ComboFix3.txt  2008-02-22 20:27:06.2008-02-25 21:32:53	--- E O F ---