1 Temat
2 Temat
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:11:02, on 2008-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\BinarySense\hldasvc.exe C:\Program Files\Common Files\BinarySense\hldasvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\VisualTaskTips\VisualTaskTips.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\rafal\Pulpit\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DriverMagicLogon] "C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" /boot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [VisualTaskTips] C:\Program Files\VisualTaskTips\VisualTaskTips.exe O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\Common Files\BinarySense\hlAPP.dll" (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 9446 bytes
ComboFix 08-10-30.12 - rafal 2008-10-31 16:06:47.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.468 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\rafal\Pulpit\combofix\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\AutoRun.inf C:\WINDOWS\vmreg32.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-31 ))))))))))))))))))))))))))))))) . 2008-10-31 14:42 . 2008-10-31 14:45 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\Nowe Gadu-Gadu 2008-10-31 14:41 . 2008-10-31 14:41 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-10-28 18:36 . 2008-10-28 18:36 <DIR> d-------- C:\Program Files\PowerQuest 2008-10-28 18:22 . 2007-03-07 13:27 13,840 --a------ C:\WINDOWS\system32\wnaspi32.dll 2008-10-27 18:50 . 2008-10-27 18:50 <DIR> d-------- C:\WINDOWS\Sun 2008-10-27 18:49 . 2008-10-27 18:49 <DIR> d-------- C:\Program Files\Java 2008-10-27 18:49 . 2008-10-27 18:49 410,976 --a------ C:\WINDOWS\system32\deploytk.dll 2008-10-27 18:49 . 2008-10-27 18:49 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-27 12:00 . 2008-10-27 12:00 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\Symantec 2008-10-26 17:41 . 2008-10-26 17:41 <DIR> d-------- C:\Program Files\MCS Studios 2008-10-26 17:41 . 2005-12-14 22:17 237,568 --a------ C:\WINDOWS\system32\mcstabs.ocx 2008-10-26 17:41 . 2000-07-15 00:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2008-10-26 17:41 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2008-10-26 13:59 . 2008-10-26 13:59 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-10-25 22:37 . 2008-10-25 22:38 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-10-25 22:10 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe 2008-10-25 22:09 . 2006-11-24 13:47 40,136 --a------ C:\WINDOWS\system32\drivers\ET5Drv.sys 2008-10-25 22:09 . 2008-10-31 14:20 24,944 --a------ C:\WINDOWS\system32\drivers\GVTDrv.sys 2008-10-25 22:06 . 2008-10-25 22:18 <DIR> d-------- C:\Program Files\Gigabyte 2008-10-25 22:06 . 2008-10-25 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-10-25 22:06 . 1998-10-02 18:00 327,168 --a------ C:\WINDOWS\IsUninst.exe 2008-10-25 22:06 . 2005-02-17 06:15 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl 2008-10-25 18:56 . 2008-10-27 16:14 8,059 --a------ C:\WINDOWS\gdrv.sys 2008-10-25 17:04 . 2007-07-30 18:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-10-25 17:04 . 2007-07-30 18:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-10-25 17:04 . 2007-07-30 18:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-10-25 16:37 . 2008-10-25 16:37 <DIR> d--h----- C:\WINDOWS\PIF 2008-10-25 16:23 . 2008-10-27 12:00 <DIR> d-------- C:\Program Files\Norton SystemWorks Premier 2008-10-25 16:23 . 2008-10-25 16:23 109,744 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-25 16:23 . 2008-10-25 16:23 48,824 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-25 16:23 . 2008-10-25 16:23 8,014 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-10-25 16:23 . 2008-10-25 16:23 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-10-25 16:22 . 2008-10-25 16:24 <DIR> d-------- C:\Program Files\Symantec 2008-10-25 16:21 . 2008-10-25 18:50 <DIR> d-------- C:\Program Files\PerformanceTest 2008-10-25 16:21 . 2008-10-25 16:21 <DIR> d-------- C:\Program Files\CheckIt 2008-10-25 15:13 . 2008-10-25 15:13 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-10-25 15:05 . 2008-10-25 15:05 160 --a------ C:\WINDOWS\MyDrivers.ini 2008-10-25 14:55 . 2008-10-25 14:55 <DIR> d-------- C:\Program Files\My Drivers 2008-10-25 14:39 . 2008-10-25 14:42 <DIR> d-------- C:\Program Files\Driver Magician 2008-10-25 14:39 . 2004-09-28 10:13 526,184 --a------ C:\WINDOWS\system32\XceedCry.dll 2008-10-25 14:39 . 2005-01-12 10:19 456,536 --a------ C:\WINDOWS\system32\XCEEDZIP.DLL 2008-10-25 14:39 . 2004-03-08 23:00 224,016 --a------ C:\WINDOWS\system32\Tabctl32.ocx 2008-10-25 14:39 . 2004-08-11 14:55 110,602 --a------ C:\WINDOWS\system32\xcdsfx32.bin 2008-10-24 22:03 . 2008-10-24 22:15 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-10-24 21:29 . 2008-10-27 12:00 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-10-24 21:29 . 2008-10-25 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-10-24 19:20 . 2008-10-24 19:20 <DIR> d-------- C:\WINDOWS\NU_DATA 2008-10-23 22:07 . 2008-10-30 15:08 13 --a------ C:\WINDOWS\popcinfo.dat 2008-10-23 21:22 . 2008-10-24 22:48 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-10-23 21:22 . 2008-10-23 21:22 <DIR> d-------- C:\Program Files\SymplisIT 2008-10-23 21:15 . 2008-10-23 21:15 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-10-23 21:15 . 2008-10-03 18:26 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-10-23 21:15 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-10-23 21:15 . 2007-03-08 06:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-10-23 21:15 . 2008-08-26 09:26 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-10-23 21:15 . 2008-08-26 09:26 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-10-23 21:15 . 2008-08-26 09:26 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-10-23 21:15 . 2008-08-26 09:26 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-10-23 21:15 . 2008-08-26 09:26 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-10-23 21:15 . 2008-08-25 09:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-10-23 20:50 . 2008-10-23 20:50 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-23 20:05 . 2008-10-25 17:34 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-23 20:03 . 2008-06-14 19:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-23 20:03 . 2008-06-14 19:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-10-23 20:02 . 2008-08-14 14:46 2,181,632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-23 20:02 . 2008-08-14 14:46 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-23 20:02 . 2008-08-14 14:46 2,059,008 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-23 20:02 . 2008-08-14 14:46 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-23 19:59 . 2008-10-23 19:59 <DIR> d-------- C:\Wstawione własne 2008-10-23 19:58 . 2008-10-24 22:48 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-10-23 19:47 . 2008-10-23 19:51 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\PlayFirst 2008-10-23 19:47 . 2008-10-23 19:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2008-10-23 19:10 . 2008-10-23 19:11 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\Super-Cow 2008-10-23 19:09 . 2008-10-23 19:11 <DIR> d-------- C:\Program Files\Supercow 2008-10-23 19:09 . 2008-10-23 19:09 <DIR> d-------- C:\Program Files\ReflexiveArcade 2008-10-23 18:01 . 2008-10-23 18:01 <DIR> d-------- C:\Program Files\UltraISO 2008-10-23 18:01 . 2008-10-23 18:01 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2008-10-22 18:19 . 2008-10-30 17:14 <DIR> d--hs---- C:\Boot 2008-10-22 18:19 . 2008-01-18 23:45 333,203 -rahs---- C:\bootmgr 2008-10-22 18:19 . 2008-10-28 19:12 8,192 -ra-s---- C:\BOOTSECT.BAK 2008-10-22 18:18 . 2008-10-22 18:18 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-22 18:10 . 2008-10-22 18:10 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\HP 2008-10-22 17:35 . 2008-10-28 19:24 <DIR> d--hs---- C:\$RECYCLE.BIN 2008-10-22 17:35 . 2007-03-17 12:41 171,136 -rahs---- C:\grldr 2008-10-22 15:41 . 2008-10-28 19:01 1,905 --a------ C:\WINDOWS\diagwrn.xml 2008-10-22 15:41 . 2008-10-28 19:01 1,905 --a------ C:\WINDOWS\diagerr.xml 2008-10-21 20:42 . 2008-10-21 20:42 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\GanymedeNet 2008-10-21 20:42 . 2008-10-21 20:42 1,020 --a------ C:\WINDOWS\mozver.dat 2008-10-21 20:42 . 2008-10-24 14:35 168 --a------ C:\WINDOWS\system32\proc-1037709799.bin 2008-10-21 19:24 . 2008-10-21 19:24 <DIR> d-------- C:\Program Files\VisualTaskTips 2008-10-21 19:17 . 2008-10-21 19:17 <DIR> d-------- C:\Program Files\Unlocker 2008-10-21 19:14 . 2008-10-21 19:14 <DIR> d-------- C:\Program Files\CCleaner 2008-10-21 17:48 . 2008-10-21 17:48 <DIR> d-------- C:\Program Files\Common Files\BinarySense 2008-10-21 17:48 . 2008-10-21 17:48 <DIR> d-------- C:\Program Files\BinarySense 2008-10-21 17:48 . 2008-10-21 17:48 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\BinarySense 2008-10-21 17:48 . 2008-10-31 14:20 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-10-21 17:36 . 2008-10-31 16:00 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\skypePM 2008-10-21 17:36 . 2008-10-21 17:36 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-10-21 17:35 . 2008-10-21 17:35 <DIR> dr------- C:\Program Files\Skype 2008-10-21 17:35 . 2008-10-21 17:35 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-10-21 17:35 . 2008-10-31 15:56 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\Skype 2008-10-21 17:35 . 2008-10-21 17:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-10-21 15:20 . 2008-10-21 15:20 <DIR> d-------- C:\Program Files\<a href="http://www.download.net.pl/219/IrfanView/">IrfanView</a> 2008-10-21 15:18 . 2008-10-21 15:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage 2008-10-21 15:09 . 2008-10-21 15:09 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-10-21 15:09 . 2008-10-21 15:09 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-10-21 15:09 . 2008-10-21 15:09 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-10-21 13:43 . 2008-10-21 13:43 <DIR> d-------- C:\Program Files\Intel 2008-10-21 13:43 . 2008-10-21 13:43 <DIR> d-------- C:\Intel 2008-10-21 13:43 . 2007-07-26 15:15 53,248 --a------ C:\WINDOWS\system32\CSVer.dll 2008-10-21 13:37 . 2008-10-21 13:37 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-10-21 13:37 . 2008-10-25 22:10 <DIR> d-------- C:\Program Files\Realtek 2008-10-21 13:37 . 2007-08-07 10:40 98,944 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-10-21 13:37 . 2008-08-07 10:38 9,728 --a------ C:\WINDOWS\system32\RtNicProp32.dll 2008-10-21 12:23 . 2008-10-21 12:23 <DIR> d-------- C:\Documents and Settings\rafal\Dane aplikacji\Xentient 2008-10-21 08:12 . 2008-10-21 08:13 <DIR> d-------- C:\Documents and Settings\rafal\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-31 13:44 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-28 17:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-25 21:06 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-10-21 20:05 --------- d-----w C:\Program Files\Zylom Games 2008-10-21 14:06 319,488 ----a-w C:\WINDOWS\HideWin.exe 2008-10-21 08:32 --------- d-----w C:\Program Files\HD Tune Pro 2008-10-21 08:16 --------- d-----w C:\Program Files\Xentient 2008-10-21 08:08 --------- d-----w C:\Program Files\Lavalys 2008-10-21 07:58 --------- d-----w C:\Documents and Settings\rafal\Dane aplikacji\Zylom 2008-10-21 07:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2008-10-21 07:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games 2008-10-21 07:17 --------- d-----w C:\Program Files\OpenOffice.org 3 2008-10-21 07:17 --------- d-----w C:\Documents and Settings\rafal\Dane aplikacji\OpenOffice.org 2008-10-21 07:10 --------- d-----w C:\Program Files\Opera 2008-10-21 06:56 --------- d-----w C:\Program Files\Alwil Software 2008-10-21 06:50 --------- d-----w C:\Program Files\SAGEM WiFi manager 2008-10-21 06:50 --------- d-----w C:\Program Files\SAGEM 2008-10-21 06:50 --------- d-----w C:\Documents and Settings\rafal\Dane aplikacji\InstallShield 2008-10-21 06:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2008-10-21 06:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2008-10-21 06:41 --------- d-----w C:\Program Files\HP 2008-10-21 06:41 --------- d-----w C:\Documents and Settings\rafal\Dane aplikacji\HPAppData 2008-10-21 06:41 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2008-10-21 06:40 --------- d-----w C:\Program Files\Hewlett-Packard 2008-10-21 06:40 --------- d-----w C:\Program Files\Common Files\HP 2008-10-21 06:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-10-21 06:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-10-21 06:39 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2008-10-21 06:23 --------- d-----w C:\Program Files\microsoft frontpage 2008-10-21 06:22 --------- d-----w C:\Program Files\Usługi online 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,137,600 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,017,280 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-15 11:58 524,288 ----a-w C:\WINDOWS\RtlExUpd.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 1667584] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-10-10 25795368] "VisualTaskTips"="C:\Program Files\VisualTaskTips\VisualTaskTips.exe" [2008-06-22 65536] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-10-10 6500960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 8466432] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 81920] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "DriverMagicLogon"="C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" [2008-10-23 69632] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-27 107112] "NSRKey"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [2006-11-02 1582744] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "EasyTuneVPro"="C:\Program Files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-27 136600] "nwiz"="nwiz.exe" [2007-06-28 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-06-15 C:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2008-10-21 950272] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\SymplisIT\\DriverMagic\\DriverMagic.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 3744] R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-09 198336] R2 HDDlife HDD Access service;HDDlife HDD Access service;C:\Program Files\Common Files\BinarySense\hldasvc.exe [2008-02-15 832760] R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-27 152984] R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 3904] R2 Norton Save and Restore;Norton Save and Restore;C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe [2006-11-02 2111128] R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 450560] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcad9646-a2c9-11dd-8c16-806d6172696f}] \Shell\AutoRun\command - F:\setup.exe *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-10-27 C:\WINDOWS\Tasks\Funkcja One Button Checkup pakietu Norton SystemWorks.job - C:\Program Files\Norton SystemWorks Premier\OBC.exe [2006-11-30 11:06] 2008-10-21 C:\WINDOWS\Tasks\WebReg Photosmart C4200 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 20:27] . - - - - USUNIĘTO PUSTE WPISY - - - - Notify-WgaLogon - (no file) . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\rafal\Dane aplikacji\Mozilla\Firefox\Profiles\67y2vr6g.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-31 16:07:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-31 16:08:38 ComboFix-quarantined-files.txt 2008-10-31 15:08:35 Przed: 34 353 586 176 bajtów wolnych Po: 34,478,596,096 bajtów wolnych 257 --- E O F --- 2008-10-24 21:48:12
combofix usunoł mi pliki (vmreg32.dll )
Zdziwiło mnie ze konsoli odzyskiwania niema.Ale przecież ją uruchamia się z płyty instalacyjnej.Dobrze myślę.