Temat jest zamknięty
LOG:
ComboFix 08-11-11.01 - Konrad 2008-11-12 15:41:29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1134 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Konrad\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-12 do 2008-11-12 )))))))))))))))))))))))))))))))
.
2008-11-11 18:26 . 2008-11-11 18:26 <DIR> d-------- C:\Downloads
2008-11-11 17:07 . 2008-11-11 17:07 <DIR> d-------- c:\program files\MSBuild
2008-11-11 17:03 . 2008-11-11 17:03 <DIR> d-------- c:\windows\system32\XPSViewer
2008-11-11 17:02 . 2008-11-11 17:02 <DIR> d-------- c:\program files\Reference Assemblies
2008-11-11 17:01 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-11-11 16:49 . 2008-11-11 16:49 <DIR> d-------- c:\program files\Real Alternative
2008-11-11 16:49 . 2003-03-19 04:14 499,712 --a------ c:\windows\system32\msvcp71.dll
2008-11-11 16:47 . 2008-11-11 16:47 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-11-11 16:30 . 2008-11-11 16:32 23 --a------ c:\windows\popcinfot.dat
2008-11-07 21:14 . 2008-11-07 21:14 <DIR> d-------- c:\windows\nvidia icons
2008-11-07 21:12 . 2008-11-07 21:12 <DIR> d-------- C:\NVIDIA
2008-11-07 20:36 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-11-07 20:31 . 2002-12-12 00:14 1,294,336 --a--c--- c:\windows\system32\dllcache\dsound3d.dll
2008-11-07 20:25 . 2008-11-07 20:25 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\OpenOffice.org
2008-11-07 20:19 . 2008-11-11 16:24 49 --a------ c:\windows\NeroDigital.ini
2008-11-07 20:18 . 2008-11-07 20:18 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-11-07 20:18 . 2008-11-07 20:18 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\JLC's Software
2008-11-07 19:55 . 2008-11-07 19:55 <DIR> d-------- c:\windows\system32\LogFiles
2008-11-07 19:55 . 2008-11-07 20:17 <DIR> d-------- c:\windows\system32\drivers\UMDF
2008-11-07 19:49 . 2008-11-07 19:49 <DIR> d-------- c:\windows\Downloaded Installations
2008-11-07 19:49 . 2004-08-22 16:31 155,136 --a------ c:\windows\system32\drivers\d347bus.sys
2008-11-07 19:49 . 2004-08-22 16:31 5,248 --a------ c:\windows\system32\drivers\d347prt.sys
2008-11-07 19:05 . 2008-11-07 19:05 <DIR> d-------- c:\windows\l2schemas
2008-11-07 19:04 . 2008-11-07 19:04 <DIR> d-------- c:\windows\system32\pl
2008-11-07 19:04 . 2008-11-07 19:04 <DIR> d-------- c:\windows\system32\bits
2008-11-07 18:57 . 2008-11-07 19:06 <DIR> d-------- c:\windows\ServicePackFiles
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\windows\EHome
2008-11-07 18:33 . 2001-07-06 14:41 569,344 --a------ c:\windows\system32\imagr5.dll
2008-11-07 18:33 . 2001-07-06 12:44 544,768 --a------ c:\windows\system32\imagx5.dll
2008-11-07 18:33 . 2001-07-06 18:24 283,920 --a------ c:\windows\system32\ImagXpr5.dll
2008-11-07 18:33 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll
2008-11-07 18:33 . 2001-06-26 08:15 38,912 --a------ c:\windows\system32\picn20.dll
2008-11-07 18:32 . 2008-11-07 18:33 <DIR> d-------- c:\program files\Common Files\Ahead
2008-11-07 18:32 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe
2008-11-07 18:20 . 2008-11-07 18:20 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\Gadu-Gadu
2008-11-07 18:16 . 2008-11-07 20:54 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\Winamp
2008-11-07 18:13 . 2004-08-03 22:41 1,309,184 --------- c:\windows\system32\drivers\mtlstrm.sys
2008-11-07 18:12 . 2008-11-07 18:12 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\Comodo
2008-11-07 18:12 . 2008-11-07 18:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\comodo
2008-11-07 18:12 . 2004-08-04 00:35 701,440 --------- c:\windows\system32\drivers\ati2mtag.sys
2008-11-07 18:07 . 2008-11-12 15:24 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\skypePM
2008-11-07 18:07 . 2008-11-07 18:07 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-07 18:06 . 2008-11-07 18:06 <DIR> d-------- c:\program files\Skype
2008-11-07 18:06 . 2008-11-07 18:06 <DIR> d-------- c:\program files\Common Files\Skype
2008-11-07 18:06 . 2008-11-12 15:24 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\Skype
2008-11-07 18:06 . 2008-11-07 18:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 14:46 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-12 14:45 4,184 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-12 14:45 294,944 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-12 14:45 24,232 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-12 14:45 2,695,200 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-12 14:35 99,856 ----a-w c:\windows\system32\drivers\cmdguard.sys
2008-11-12 14:35 31,504 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2008-11-12 14:35 143,096 ----a-w c:\windows\system32\guard32.dll
2008-11-07 20:13 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-07 16:27 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-11-07 16:27 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-11-07 16:17 --------- d-----w c:\program files\Kaspersky Lab
2008-11-07 16:15 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-11-07 16:09 --------- d-----w c:\program files\VIA Technologies, Inc
2008-11-07 16:01 --------- d-----w c:\program files\microsoft frontpage
2008-11-07 16:00 --------- d-----w c:\program files\Usługi online
2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-16 00:11 683,520 ----a-w c:\windows\system32\divx.dll
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 13:26 2,190,464 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26 2,067,328 ----a-w c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Gadu-Gadu"="e:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-12 21741864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Firewall Pro"="e:\program files\Comodo\Firewall\cfp.exe" [2008-11-12 1797880]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"COMODO Internet Security"="e:\program files\Comodo\Firewall\cfp.exe" [2008-11-12 1797880]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\GRY\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22705:TCP"= 22705:TCP:BitComet 22705 TCP
"22705:UDP"= 22705:UDP:BitComet 22705 UDP
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2008-11-12 99856]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2008-11-12 31504]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]
.
.
------- Skan uzupełniający -------
.
O8 -: &D&ownload &with BitComet - e:\program files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - e:\program files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - e:\program files\BitComet\BitComet.exe/AddAllLink.htm
O17 -: HKLM\CCS\Interface\{1854689E-D3BB-49D9-9F47-DC53269F3F43}: NameServer = 10.2.0.1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-12 15:46:33
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
e:\program files\Comodo\Firewall\cmdagent.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-12 15:50:56 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-11-12 14:50:35
Przed: 4 097 142 784 bajtów wolnych
Po: 4,059,516,928 bajtów wolnych
153 --- E O F --- 2008-11-11 15:17:26
