- Kod: Zaznacz wszystko
ComboFix 08-06-06.6 - Maciek 2008-06-07 14:25:40.11 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1629 [GMT 2:00]
Running from: C:\Documents and Settings\Maciek\Pulpit\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 )))))))))))))))))))))))))))))))
.
2008-06-05 14:34 . 2008-06-05 14:34 <DIR> d--hs---- C:\FOUND.000
2008-06-03 14:39 . 2008-06-03 14:39 0 -ra------ C:\logwmemory.bin
2008-05-28 20:18 . 2008-05-28 20:18 <DIR> d-------- C:\Documents and Settings\Maciek\Dane aplikacji\skypePM
2008-05-28 20:18 . 2008-05-28 20:18 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-05-28 20:16 . 2008-05-28 20:16 <DIR> d-------- C:\Program Files\Skype
2008-05-28 20:16 . 2008-05-28 20:16 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-05-28 20:16 . 2008-05-28 20:16 <DIR> d-------- C:\Documents and Settings\Maciek\Dane aplikacji\Skype
2008-05-28 20:16 . 2008-05-28 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-27 14:38 . 2008-05-27 14:47 769 --a------ C:\WINDOWS\GMUD32.INI
2008-05-26 22:31 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-24 18:54 . 2008-05-24 18:54 <DIR> d-------- C:\Program Files\Google
2008-05-12 17:58 . 2008-05-12 17:58 <DIR> d-------- C:\Documents and Settings\Maciek\Dane aplikacji\DAEMON Tools
2008-05-12 17:58 . 2008-05-12 17:58 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-09 14:31 . 2008-05-09 14:31 <DIR> d-------- C:\Documents and Settings\Maciek\Dane aplikacji\Ubisoft
2008-05-09 14:31 . 2008-05-09 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 16:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-02 16:59 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-03 09:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-02 15:24 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-05-02 13:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-05-02 13:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-05-02 12:43 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-05-01 14:19 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-04-27 17:11 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-27 17:11 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-04-27 13:53 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-04-25 11:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-25 11:55 --------- d-----w C:\Program Files\AGEIA Technologies
2008-04-23 18:01 22,328 ----a-w C:\Documents and Settings\Maciek\Dane aplikacji\PnkBstrK.sys
2008-04-23 16:36 --------- d-----w C:\Program Files\Java
2008-04-23 16:35 --------- d-----w C:\Program Files\Common Files\Java
2008-04-22 18:58 --------- d-----w C:\Program Files\Ulead Systems
2008-04-22 18:58 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-04-22 18:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-04-22 13:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-04-22 13:26 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-22 12:57 --------- d-----w C:\Program Files\uTorrent
2008-04-22 12:57 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\uTorrent
2008-04-21 15:40 --------- d-----w C:\Program Files\Trend Micro
2008-04-21 13:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-04-21 13:06 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Gadu-Gadu
2008-04-21 12:46 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-21 12:45 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Ahead
2008-04-21 12:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-04-21 12:43 --------- d-----w C:\Program Files\Nero
2008-04-21 12:43 --------- d-----w C:\Program Files\Common Files\Ahead
2008-04-21 12:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-04-21 12:38 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Talkback
2008-04-21 12:31 --------- d-----w C:\Program Files\Lexmark 3300 Series
2008-04-21 12:28 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-04-21 12:27 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-04-21 12:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 12:27 --------- d-----w C:\Program Files\Realtek
2008-04-21 12:26 --------- d-----w C:\Program Files\DIFX
2008-04-21 12:24 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\InstallShield
2008-04-21 12:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-21 12:19 --------- d-----w C:\Program Files\VDOTool
2008-04-21 12:12 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-21 12:11 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="D:\GG\gg.exe" [2008-03-20 12:04 2127296]
"DAEMON Tools Lite"="D:\DAEMON\daemon.exe" [2008-04-01 11:39 486856]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-30 17:17 22058792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-21 15:41 262401]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 19:07 8491008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"WinFast Schedule"="d:\TV\WFWIZ.exe" [2005-03-02 13:21 278528]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
[HKLM\~\startupfolder\C:^Documents and Settings^Maciek^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Maciek\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 D:\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-01 10:21 153136 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward]
--a------ 2007-11-01 13:25 2165272 C:\Program Files\VDOTool\TBPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-07-18 17:55 451872 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-09-16 19:07 81920 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-16 19:07 1626112 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2 (0x2)
"WebClient"=2 (0x2)
"SharedAccess"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Maciek\\COD 4\\iw3mp.exe"=
"C:\\WINDOWS\\System32\\PnkBstrA.exe"=
"C:\\WINDOWS\\System32\\PnkBstrB.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"27050:TCP"= 27050:TCP:*:Disabled:smut
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-10-18 11:25]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-10-18 11:25]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-10-18 11:25]
R3 WFIOCTL;WFIOCTL;d:\TV\WFIOCTL.SYS [2005-01-06 16:55]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-04-21 14:28]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 14:26:21
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 14:26:36
ComboFix-quarantined-files.txt 2008-06-07 12:26:36
Pre-Run: 14,230,142,976 bajtów wolnych
Post-Run: 14,228,160,512 bajtów wolnych
148
Już znalazłem w logu FOUND00 i ja zawsze to mam jak zeskanuje a to jest coś złego. Od czego to może sie brać?? A tak po za tym to sprawdź mi loga .
zapisz jako 
