Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.
HJT scinanie sie kompa
10 Sie 2008, 19:55
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50, on 2008-08-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\Explorer.EXE
C:\WINNT\RTHDCPL.EXE
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\PROGRA~1\HDTUNE~1\HDTune.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINNT\ATKKBService.exe
C:\WINNT\system32\AutoExNT.Exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [HD Tune] C:\PROGRA~1\HDTUNE~1\HDTune.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{66AB01B4-DAE9-4EAF-826A-1E2088835DA3}: NameServer = 80.85.224.2,80.85.224.50
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6672311-D5D0-413C-9725-990ED5EE31D3}: NameServer = 213.172.186.4,213.172.186.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{DDF576BE-F8CD-428F-9DFF-53F8CA645B31}: NameServer = 194.204.152.34,194.204.159.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINNT\ATKKBService.exe
O23 - Service: AutoExNT - Unknown owner - C:\WINNT\system32\AutoExNT.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7621 bytes
Scan saved at 19:50, on 2008-08-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\Explorer.EXE
C:\WINNT\RTHDCPL.EXE
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\PROGRA~1\HDTUNE~1\HDTune.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINNT\ATKKBService.exe
C:\WINNT\system32\AutoExNT.Exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [HD Tune] C:\PROGRA~1\HDTUNE~1\HDTune.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{66AB01B4-DAE9-4EAF-826A-1E2088835DA3}: NameServer = 80.85.224.2,80.85.224.50
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6672311-D5D0-413C-9725-990ED5EE31D3}: NameServer = 213.172.186.4,213.172.186.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{DDF576BE-F8CD-428F-9DFF-53F8CA645B31}: NameServer = 194.204.152.34,194.204.159.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINNT\ATKKBService.exe
O23 - Service: AutoExNT - Unknown owner - C:\WINNT\system32\AutoExNT.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7621 bytes
10 Sie 2008, 20:35
W logu nic nie widzę
Pokaż log z Combofix
Pokaż log z Combofix
11 Sie 2008, 11:17
ComboFix 08-08-10.02 - Rafi 2008-08-11 10:22:48.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1572 [GMT 2:00]
Running from: C:\Documents and Settings\Rafi\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_msdirectx
((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.
2008-08-11 10:21 . 2008-08-11 10:21 <DIR> d-------- C:\WINNT\system32\xircom
2008-08-11 10:21 . 2008-08-11 10:21 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-08-10 21:03 . 2008-08-10 21:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-08-10 20:57 . 2008-08-10 20:57 685,816 --a------ C:\WINNT\system32\drivers\sptd.sys
2008-08-10 20:38 . 2008-08-10 20:39 <DIR> d-------- C:\Program Files\Pisz Szybciej
2008-08-10 19:57 . 2008-08-10 19:57 14,656 --a------ C:\WINNT\gdrv.sys
2008-08-10 14:30 . 2008-08-10 14:30 <DIR> d-------- C:\Program Files\ToniArts
2008-08-10 13:49 . 2008-08-10 13:49 <DIR> dr-h----- C:\Documents and Settings\Rafi\Dane aplikacji\SecuROM
2008-08-10 13:49 . 2008-08-10 13:49 107,888 --a------ C:\WINNT\system32\CmdLineExt.dll
2008-08-09 16:27 . 2008-08-09 16:27 <DIR> d-------- C:\Program Files\A4Tech
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Program Files\Symantec
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-08-09 16:02 . 2008-08-09 16:05 <DIR> d-------- C:\Program Files\yGen
2008-08-09 16:00 . 2008-08-09 16:00 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\zweitgeist
2008-08-07 13:59 . 2008-08-07 13:59 <DIR> d--h----- C:\WINNT\system32\GroupPolicy
2008-08-06 22:12 . 2008-08-06 22:12 <DIR> d-------- C:\Program Files\CodeStuff
2008-08-06 21:29 . 2008-08-06 21:29 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-08-05 21:10 . 2008-08-05 21:10 <DIR> d-------- C:\Program Files\HD Tune
2008-08-05 21:03 . 2008-08-05 21:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-05 20:16 . 2008-08-10 19:11 <DIR> d-------- C:\Program Files\Dual Vibration Gamepad-Macro A
2008-08-05 20:16 . 2005-11-01 21:01 73,052 --a------ C:\WINNT\system32\Gcd3uCpl.dll
2008-08-05 20:16 . 2006-02-22 18:03 61,440 --a------ C:\WINNT\system32\Joy5FF.dll
2008-08-05 20:16 . 2008-08-05 20:16 155 --a------ C:\WINNT\ODBC.INI
2008-08-05 15:58 . 2008-08-05 15:58 <DIR> d-------- C:\Program Files\Alwil Software
2008-08-04 19:15 . 2008-08-04 19:15 <DIR> d-------- C:\Program Files\PowerQuest
2008-08-01 13:32 . 2008-08-01 13:33 <DIR> d-------- C:\Program Files\Sjboy Emulator
2008-08-01 13:32 . 2008-08-01 13:32 <DIR> d-------- C:\Program Files\Kwyshell
2008-07-31 14:21 . 2008-07-31 14:21 <DIR> d-------- C:\Program Files\Damian Pasternak
2008-07-25 21:17 . 2008-07-25 21:18 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Media Player Classic
2008-07-24 14:06 . 2008-07-24 14:06 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-24 13:56 . 2008-08-11 10:33 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-07-24 13:56 . 2008-07-22 10:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-07-24 13:56 . 2008-08-11 10:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-07-24 13:56 . 2008-07-24 13:56 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-24 12:13 . 2008-07-24 12:13 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-24 12:12 . 2008-07-24 12:12 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-23 20:03 . 2008-07-23 20:03 4,096 --a------ C:\WINNT\system32\crash
2008-07-23 19:14 . 2007-07-30 19:19 271,224 --a------ C:\WINNT\system32\mucltui.dll
2008-07-23 19:14 . 2007-07-30 19:19 207,736 --a------ C:\WINNT\system32\muweb.dll
2008-07-23 19:14 . 2007-07-30 19:18 30,072 --a------ C:\WINNT\system32\mucltui.dll.mui
2008-07-23 18:34 . 2008-07-23 18:34 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-07-23 18:33 . 2008-07-23 18:48 <DIR> d-------- C:\Program Files\Logitech
2008-07-23 18:33 . 2008-07-23 18:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Logitech
2008-07-22 21:19 . 2008-08-09 19:56 69 --a------ C:\WINNT\NeroDigital.ini
2008-07-22 21:17 . 2008-07-22 21:17 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Gadu-Gadu
2008-07-22 20:31 . 2008-07-22 21:21 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-07-22 20:23 . 2008-07-22 21:22 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Ahead
2008-07-22 20:22 . 2008-07-22 20:22 <DIR> d-------- C:\Program Files\Winamp Toolbar
2008-07-22 20:22 . 2008-07-22 20:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-07-22 20:21 . 2008-07-22 20:21 <DIR> d-------- C:\Program Files\Nero
2008-07-22 20:21 . 2008-07-22 20:31 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-22 20:21 . 2008-07-22 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-07-22 20:17 . 2008-08-07 12:42 <DIR> d-------- C:\Program Files\Winamp
2008-07-22 20:17 . 2008-07-22 20:43 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Winamp
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Program Files\Skype
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-22 20:14 . 2008-07-24 13:43 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Skype
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-07-22 20:12 . 2008-07-22 20:12 <DIR> d-------- C:\Program Files\ffdshow
2008-07-22 20:12 . 2008-06-08 23:58 60,273 --a------ C:\WINNT\system32\pthreadGC2.dll
2008-07-22 20:12 . 2008-06-12 20:36 7,680 --a------ C:\WINNT\system32\ff_vfw.dll
2008-07-22 20:12 . 2008-06-12 20:37 6,144 --a------ C:\WINNT\system32\ff_acm.acm
2008-07-22 20:12 . 2007-07-10 18:10 547 --a------ C:\WINNT\system32\ff_vfw.dll.manifest
2008-07-22 20:08 . 2008-07-25 21:32 <DIR> d-------- C:\Program Files\Real Alternative
2008-07-22 20:04 . 2008-07-22 21:21 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-07-22 20:01 . 2008-07-22 20:01 0 --a------ C:\WINNT\nsreg.dat
2008-07-22 19:58 . 2008-07-22 19:58 <DIR> d-------- C:\Program Files\Lavalys
2008-07-22 19:05 . 2008-07-22 19:05 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-22 18:58 . 2006-10-26 19:56 32,592 --a------ C:\WINNT\system32\msonpmon.dll
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\MSBuild
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\Microsoft Works
2008-07-22 18:57 . 2008-07-31 14:12 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Hamachi
2008-07-22 18:56 . 2008-07-29 12:02 25,280 --a------ C:\WINNT\system32\drivers\hamachi.sys
2008-07-22 18:55 . 2008-07-22 18:57 <DIR> d-------- C:\WINNT\SHELLNEW
2008-07-22 18:55 . 2008-07-22 18:55 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-07-22 18:55 . 2008-07-24 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-07-22 18:52 . 2008-07-22 18:52 <DIR> d-------- C:\Program Files\MarBit
2008-07-22 18:41 . 2001-08-18 01:52 200,064 --a------ C:\WINNT\system32\drivers\rmcast.sys
2008-07-22 18:40 . 2008-08-10 13:30 <DIR> d-------- C:\Program Files\DC++
2008-07-22 18:38 . 2008-07-24 13:59 <DIR> d-------- C:\WINNT\system32\pl-pl
2008-07-22 18:35 . 2008-07-22 18:35 <DIR> d-------- C:\WINNT\system32\LogFiles
2008-07-22 18:35 . 2008-07-22 18:36 <DIR> d-------- C:\WINNT\system32\drivers\umdf
2008-07-22 18:31 . 2007-04-01 20:20 34,064 --a------ C:\WINNT\system32\Instexnt.exe
2008-07-22 18:31 . 2007-04-01 20:20 5,904 --a------ C:\WINNT\system32\Autoexnt.exe
2008-07-22 18:31 . 2007-04-01 20:20 2,364 --a------ C:\WINNT\system32\1.reg
2008-07-22 18:31 . 2007-04-01 20:20 2,320 --a------ C:\WINNT\system32\Servmess.dll
2008-07-22 18:31 . 2007-04-01 20:20 175 --a------ C:\WINNT\system32\Autoexnt.bat
2008-07-22 18:27 . 2008-07-22 18:27 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\CyberLink
2008-07-22 18:26 . 2008-07-22 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-07-22 18:26 . 2001-03-08 18:30 24,064 --------- C:\WINNT\system32\msxml3a.dll
2008-07-22 18:25 . 2008-07-22 18:26 <DIR> d-------- C:\Program Files\CyberLink
2008-07-22 18:24 . 2008-07-22 18:24 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-07-22 18:24 . 2008-07-22 21:17 <DIR> d-------- C:\Documents and Settings\Rafi\Gadu-Gadu
2008-07-22 12:01 . 2001-08-17 23:59 3,072 --a------ C:\WINNT\system32\drivers\audstub.sys
2008-07-22 12:00 . 2004-08-04 02:44 77,312 --a------ C:\WINNT\system32\usbui.dll
2008-07-22 12:00 . 2004-08-04 02:35 58,624 --a------ C:\WINNT\system32\drivers\redbook.sys
2008-07-22 12:00 . 2001-08-17 23:46 6,400 --a------ C:\WINNT\system32\drivers\enum1394.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 12:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-09 11:30 196,608 ----a-w C:\WINNT\system32\drivers\aAsmedia.bin
2008-08-04 07:42 196,608 ----a-w C:\WINNT\system32\drivers\aStandard.bin
2008-07-23 18:05 --------- d-----w C:\Documents and Settings\Rafi\Dane aplikacji\ATI
2008-07-22 08:38 --------- d-----w C:\Program Files\Alcohol Soft
2008-07-22 08:34 --------- d-----w C:\WINNT\system32\config\systemprofile\Dane aplikacji\ATI
2008-07-22 08:33 --------- d-----w C:\Program Files\D-Link
2008-07-22 08:33 --------- d-----w C:\Program Files\Alpha Networks
2008-07-22 08:28 --------- d-----w C:\Program Files\My Company Name
2008-07-22 08:27 --------- d-----w C:\Program Files\ATI Technologies
2008-07-22 08:26 --------- d-----w C:\Program Files\Common Files\ATI Technologies
2008-07-22 08:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-22 08:21 --------- d-----w C:\Program Files\GIGABYTE
2008-07-22 08:14 --------- d-----w C:\Program Files\Realtek
2008-07-22 08:12 --------- d-----w C:\Program Files\DIFX
2008-07-22 08:05 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link Air Utility"="C:\Program Files\D-Link\Air Utility\AirCFG.exe" [2003-11-04 09:33 2502656]
"ANIWZCSService"="C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 16:12 32768]
"HD Tune"="C:\PROGRA~1\HDTUNE~1\HDTune.exe" [2008-02-09 15:17 401408]
"WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2005-08-29 08:43 204800]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"SkyTel"="SkyTel.EXE" [2006-05-16 04:04 2879488 C:\WINNT\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 05:49 16269312 C:\WINNT\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"E:\\GRY\\INSTALKI GIER\\F1 2008\\F1 CHALLENGE 99-02 Z PATCHEM NA SEZON 2008_UP_BY_HIPEK\\PDK 2008\\PDK 08.EXE"=
"E:\\GRY\\Zainstalowane\\F1 Challenge\\F1Challenge2007.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70782f7b-57d2-11dd-973e-806d6172696f}]
\Shell\AutoRun\command - J:\Run.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Rafi\Dane aplikacji\Mozilla\Firefox\Profiles\bjbnyktr.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 10:38:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-11 11:02:44
ComboFix-quarantined-files.txt 2008-08-11 09:01:01
Pre-Run: 32,981,151,744 bajtów wolnych
Post-Run: 32,967,196,672 bajtów wolnych
197
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1572 [GMT 2:00]
Running from: C:\Documents and Settings\Rafi\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_msdirectx
((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.
2008-08-11 10:21 . 2008-08-11 10:21 <DIR> d-------- C:\WINNT\system32\xircom
2008-08-11 10:21 . 2008-08-11 10:21 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-08-10 21:03 . 2008-08-10 21:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-08-10 20:57 . 2008-08-10 20:57 685,816 --a------ C:\WINNT\system32\drivers\sptd.sys
2008-08-10 20:38 . 2008-08-10 20:39 <DIR> d-------- C:\Program Files\Pisz Szybciej
2008-08-10 19:57 . 2008-08-10 19:57 14,656 --a------ C:\WINNT\gdrv.sys
2008-08-10 14:30 . 2008-08-10 14:30 <DIR> d-------- C:\Program Files\ToniArts
2008-08-10 13:49 . 2008-08-10 13:49 <DIR> dr-h----- C:\Documents and Settings\Rafi\Dane aplikacji\SecuROM
2008-08-10 13:49 . 2008-08-10 13:49 107,888 --a------ C:\WINNT\system32\CmdLineExt.dll
2008-08-09 16:27 . 2008-08-09 16:27 <DIR> d-------- C:\Program Files\A4Tech
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Program Files\Symantec
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-09 16:07 . 2008-08-09 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-08-09 16:02 . 2008-08-09 16:05 <DIR> d-------- C:\Program Files\yGen
2008-08-09 16:00 . 2008-08-09 16:00 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\zweitgeist
2008-08-07 13:59 . 2008-08-07 13:59 <DIR> d--h----- C:\WINNT\system32\GroupPolicy
2008-08-06 22:12 . 2008-08-06 22:12 <DIR> d-------- C:\Program Files\CodeStuff
2008-08-06 21:29 . 2008-08-06 21:29 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-08-05 21:10 . 2008-08-05 21:10 <DIR> d-------- C:\Program Files\HD Tune
2008-08-05 21:03 . 2008-08-05 21:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-05 20:16 . 2008-08-10 19:11 <DIR> d-------- C:\Program Files\Dual Vibration Gamepad-Macro A
2008-08-05 20:16 . 2005-11-01 21:01 73,052 --a------ C:\WINNT\system32\Gcd3uCpl.dll
2008-08-05 20:16 . 2006-02-22 18:03 61,440 --a------ C:\WINNT\system32\Joy5FF.dll
2008-08-05 20:16 . 2008-08-05 20:16 155 --a------ C:\WINNT\ODBC.INI
2008-08-05 15:58 . 2008-08-05 15:58 <DIR> d-------- C:\Program Files\Alwil Software
2008-08-04 19:15 . 2008-08-04 19:15 <DIR> d-------- C:\Program Files\PowerQuest
2008-08-01 13:32 . 2008-08-01 13:33 <DIR> d-------- C:\Program Files\Sjboy Emulator
2008-08-01 13:32 . 2008-08-01 13:32 <DIR> d-------- C:\Program Files\Kwyshell
2008-07-31 14:21 . 2008-07-31 14:21 <DIR> d-------- C:\Program Files\Damian Pasternak
2008-07-25 21:17 . 2008-07-25 21:18 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Media Player Classic
2008-07-24 14:06 . 2008-07-24 14:06 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-24 13:56 . 2008-08-11 10:33 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-07-24 13:56 . 2008-07-22 10:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-07-24 13:56 . 2008-08-11 10:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-07-24 13:56 . 2008-07-22 11:58 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-07-24 13:56 . 2008-07-24 13:56 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-24 12:13 . 2008-07-24 12:13 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-24 12:12 . 2008-07-24 12:12 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-23 20:03 . 2008-07-23 20:03 4,096 --a------ C:\WINNT\system32\crash
2008-07-23 19:14 . 2007-07-30 19:19 271,224 --a------ C:\WINNT\system32\mucltui.dll
2008-07-23 19:14 . 2007-07-30 19:19 207,736 --a------ C:\WINNT\system32\muweb.dll
2008-07-23 19:14 . 2007-07-30 19:18 30,072 --a------ C:\WINNT\system32\mucltui.dll.mui
2008-07-23 18:34 . 2008-07-23 18:34 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-07-23 18:33 . 2008-07-23 18:48 <DIR> d-------- C:\Program Files\Logitech
2008-07-23 18:33 . 2008-07-23 18:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Logitech
2008-07-22 21:19 . 2008-08-09 19:56 69 --a------ C:\WINNT\NeroDigital.ini
2008-07-22 21:17 . 2008-07-22 21:17 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Gadu-Gadu
2008-07-22 20:31 . 2008-07-22 21:21 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-07-22 20:23 . 2008-07-22 21:22 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Ahead
2008-07-22 20:22 . 2008-07-22 20:22 <DIR> d-------- C:\Program Files\Winamp Toolbar
2008-07-22 20:22 . 2008-07-22 20:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-07-22 20:21 . 2008-07-22 20:21 <DIR> d-------- C:\Program Files\Nero
2008-07-22 20:21 . 2008-07-22 20:31 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-22 20:21 . 2008-07-22 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-07-22 20:17 . 2008-08-07 12:42 <DIR> d-------- C:\Program Files\Winamp
2008-07-22 20:17 . 2008-07-22 20:43 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Winamp
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Program Files\Skype
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-22 20:14 . 2008-07-24 13:43 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Skype
2008-07-22 20:14 . 2008-07-22 20:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-07-22 20:12 . 2008-07-22 20:12 <DIR> d-------- C:\Program Files\ffdshow
2008-07-22 20:12 . 2008-06-08 23:58 60,273 --a------ C:\WINNT\system32\pthreadGC2.dll
2008-07-22 20:12 . 2008-06-12 20:36 7,680 --a------ C:\WINNT\system32\ff_vfw.dll
2008-07-22 20:12 . 2008-06-12 20:37 6,144 --a------ C:\WINNT\system32\ff_acm.acm
2008-07-22 20:12 . 2007-07-10 18:10 547 --a------ C:\WINNT\system32\ff_vfw.dll.manifest
2008-07-22 20:08 . 2008-07-25 21:32 <DIR> d-------- C:\Program Files\Real Alternative
2008-07-22 20:04 . 2008-07-22 21:21 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-07-22 20:01 . 2008-07-22 20:01 0 --a------ C:\WINNT\nsreg.dat
2008-07-22 19:58 . 2008-07-22 19:58 <DIR> d-------- C:\Program Files\Lavalys
2008-07-22 19:05 . 2008-07-22 19:05 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-22 18:58 . 2006-10-26 19:56 32,592 --a------ C:\WINNT\system32\msonpmon.dll
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\MSBuild
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-07-22 18:57 . 2008-07-22 18:57 <DIR> d-------- C:\Program Files\Microsoft Works
2008-07-22 18:57 . 2008-07-31 14:12 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\Hamachi
2008-07-22 18:56 . 2008-07-29 12:02 25,280 --a------ C:\WINNT\system32\drivers\hamachi.sys
2008-07-22 18:55 . 2008-07-22 18:57 <DIR> d-------- C:\WINNT\SHELLNEW
2008-07-22 18:55 . 2008-07-22 18:55 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-07-22 18:55 . 2008-07-24 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-07-22 18:52 . 2008-07-22 18:52 <DIR> d-------- C:\Program Files\MarBit
2008-07-22 18:41 . 2001-08-18 01:52 200,064 --a------ C:\WINNT\system32\drivers\rmcast.sys
2008-07-22 18:40 . 2008-08-10 13:30 <DIR> d-------- C:\Program Files\DC++
2008-07-22 18:38 . 2008-07-24 13:59 <DIR> d-------- C:\WINNT\system32\pl-pl
2008-07-22 18:35 . 2008-07-22 18:35 <DIR> d-------- C:\WINNT\system32\LogFiles
2008-07-22 18:35 . 2008-07-22 18:36 <DIR> d-------- C:\WINNT\system32\drivers\umdf
2008-07-22 18:31 . 2007-04-01 20:20 34,064 --a------ C:\WINNT\system32\Instexnt.exe
2008-07-22 18:31 . 2007-04-01 20:20 5,904 --a------ C:\WINNT\system32\Autoexnt.exe
2008-07-22 18:31 . 2007-04-01 20:20 2,364 --a------ C:\WINNT\system32\1.reg
2008-07-22 18:31 . 2007-04-01 20:20 2,320 --a------ C:\WINNT\system32\Servmess.dll
2008-07-22 18:31 . 2007-04-01 20:20 175 --a------ C:\WINNT\system32\Autoexnt.bat
2008-07-22 18:27 . 2008-07-22 18:27 <DIR> d-------- C:\Documents and Settings\Rafi\Dane aplikacji\CyberLink
2008-07-22 18:26 . 2008-07-22 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-07-22 18:26 . 2001-03-08 18:30 24,064 --------- C:\WINNT\system32\msxml3a.dll
2008-07-22 18:25 . 2008-07-22 18:26 <DIR> d-------- C:\Program Files\CyberLink
2008-07-22 18:24 . 2008-07-22 18:24 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-07-22 18:24 . 2008-07-22 21:17 <DIR> d-------- C:\Documents and Settings\Rafi\Gadu-Gadu
2008-07-22 12:01 . 2001-08-17 23:59 3,072 --a------ C:\WINNT\system32\drivers\audstub.sys
2008-07-22 12:00 . 2004-08-04 02:44 77,312 --a------ C:\WINNT\system32\usbui.dll
2008-07-22 12:00 . 2004-08-04 02:35 58,624 --a------ C:\WINNT\system32\drivers\redbook.sys
2008-07-22 12:00 . 2001-08-17 23:46 6,400 --a------ C:\WINNT\system32\drivers\enum1394.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 12:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-09 11:30 196,608 ----a-w C:\WINNT\system32\drivers\aAsmedia.bin
2008-08-04 07:42 196,608 ----a-w C:\WINNT\system32\drivers\aStandard.bin
2008-07-23 18:05 --------- d-----w C:\Documents and Settings\Rafi\Dane aplikacji\ATI
2008-07-22 08:38 --------- d-----w C:\Program Files\Alcohol Soft
2008-07-22 08:34 --------- d-----w C:\WINNT\system32\config\systemprofile\Dane aplikacji\ATI
2008-07-22 08:33 --------- d-----w C:\Program Files\D-Link
2008-07-22 08:33 --------- d-----w C:\Program Files\Alpha Networks
2008-07-22 08:28 --------- d-----w C:\Program Files\My Company Name
2008-07-22 08:27 --------- d-----w C:\Program Files\ATI Technologies
2008-07-22 08:26 --------- d-----w C:\Program Files\Common Files\ATI Technologies
2008-07-22 08:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-22 08:21 --------- d-----w C:\Program Files\GIGABYTE
2008-07-22 08:14 --------- d-----w C:\Program Files\Realtek
2008-07-22 08:12 --------- d-----w C:\Program Files\DIFX
2008-07-22 08:05 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link Air Utility"="C:\Program Files\D-Link\Air Utility\AirCFG.exe" [2003-11-04 09:33 2502656]
"ANIWZCSService"="C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 16:12 32768]
"HD Tune"="C:\PROGRA~1\HDTUNE~1\HDTune.exe" [2008-02-09 15:17 401408]
"WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2005-08-29 08:43 204800]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"SkyTel"="SkyTel.EXE" [2006-05-16 04:04 2879488 C:\WINNT\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 05:49 16269312 C:\WINNT\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"E:\\GRY\\INSTALKI GIER\\F1 2008\\F1 CHALLENGE 99-02 Z PATCHEM NA SEZON 2008_UP_BY_HIPEK\\PDK 2008\\PDK 08.EXE"=
"E:\\GRY\\Zainstalowane\\F1 Challenge\\F1Challenge2007.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70782f7b-57d2-11dd-973e-806d6172696f}]
\Shell\AutoRun\command - J:\Run.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Rafi\Dane aplikacji\Mozilla\Firefox\Profiles\bjbnyktr.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 10:38:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-11 11:02:44
ComboFix-quarantined-files.txt 2008-08-11 09:01:01
Pre-Run: 32,981,151,744 bajtów wolnych
Post-Run: 32,967,196,672 bajtów wolnych
197
11 Sie 2008, 15:07
otwórz notatnik i wklej
Z menu Notatnika
Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg
Uruchom ten plik, uruchom ponownie komputer
usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.
Przeczyść komputer Ccleanerem
Wykonaj optymalizację autostartu
Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum
lub
Dr.WEB CureIt!
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70782f7b-57d2-11dd-973e-806d6172696f}]
Z menu Notatnika
Plik Zapisz jako Zmień rozszerzenie z .txt na wszystkie pliki zapisz pod nazwą Fix.reg
Uruchom ten plik, uruchom ponownie komputer
usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.
Przeczyść komputer Ccleanerem
Wykonaj optymalizację autostartu
Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja
Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum
lub
Dr.WEB CureIt!