Witam
niedawno juz o to prosilem, ale juz wiem skad mialem infekcje, wlozylem karte i Avast wykryl zagrozenie, prosze o sprawdzenie czy zdazylo mnie zainfekowac.
Dzieki i pozdrawiam
ComboFix 08-06-03.4 - Anetka&Marek 2008-06-04 19:05:56.3 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.219 [GMT 2:00]
Running from: C:\Documents and Settings\Anetka&Marek\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Anetka&Marek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))
.
2008-06-03 21:28 . 2008-06-03 21:28 <DIR> d-------- C:\Program Files\Google
2008-06-03 21:16 . 2008-06-03 21:16 166 --a------ C:\WINDOWS\wcx_ftp.ini
2008-06-03 21:15 . 2008-06-03 21:18 297 --a------ C:\WINDOWS\WINCMD.INI
2008-05-31 20:18 . 2008-06-01 21:15 527 --a------ C:\hpfr3420.xml
2008-05-31 20:16 . 2008-05-31 20:16 <DIR> d-------- C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Hewlett-Packard
2008-05-31 20:11 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-05-31 20:11 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-05-31 20:11 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-05-31 20:11 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-05-29 21:17 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-29 20:29 . 2008-05-29 20:29 <DIR> d-------- C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Ulead Systems
2008-05-29 20:28 . 2008-05-29 20:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-05-29 20:03 . 2008-05-29 20:03 <DIR> d-------- C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Corel
2008-05-29 19:52 . 2008-05-29 19:52 <DIR> d-------- C:\Program Files\Common Files\Corel
2008-05-29 16:34 . 2008-05-29 16:35 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-05-28 20:26 . 2008-05-28 20:26 16,368 --a------ C:\Documents and Settings\Anetka&Marek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-05-27 21:32 . 2008-05-27 21:32 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-27 19:59 . 2008-05-27 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-05-27 19:58 . 2008-05-27 19:58 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-05-27 19:53 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-05-27 19:52 . 2008-05-27 19:52 <DIR> d-------- C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Nero
2008-05-27 19:49 . 2008-05-27 19:49 <DIR> d-------- C:\Program Files\Nero
2008-05-27 19:49 . 2008-05-27 19:49 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-05-27 19:49 . 2008-05-27 19:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-05-26 21:07 . 2008-05-26 21:07 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-26 21:07 . 2008-05-26 21:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-26 18:56 . 2008-05-26 14:05 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-26 18:56 . 2008-05-26 18:56 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-26 15:06 . 2008-05-26 15:06 <DIR> d---s---- C:\Documents and Settings\Anetka&Marek\UserData
2008-05-26 15:04 . 2008-06-03 22:11 17,428 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000001-00000000-0000000A-00001102-00000002-80671102}.rfx
2008-05-26 15:04 . 2008-06-03 22:11 17,428 --a------ C:\WINDOWS\system32\BMXState-{00000001-00000000-0000000A-00001102-00000002-80671102}.rfx
2008-05-26 15:04 . 2008-06-03 22:11 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-05-26 15:04 . 2008-06-03 22:11 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-05-26 15:04 . 2008-06-03 22:11 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-0000000A-00001102-00000002-80671102}.dat
2008-05-26 15:04 . 2008-06-03 22:11 288 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-0000000A-00001102-00000002-80671102}.dat
2008-05-26 15:02 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-26 15:02 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-05-26 15:02 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-05-26 15:00 . 2008-05-26 15:00 <DIR> d-------- C:\Program Files\Winamp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 12:57 --------- d-----w C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Gadu-Gadu
2008-05-26 12:52 --------- d-----w C:\Program Files\Hewlett-Packard
2008-05-26 12:52 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-05-26 12:51 --------- d-----w C:\Program Files\Kyocera
2008-05-26 12:42 --------- d-----w C:\Documents and Settings\Anetka&Marek\Dane aplikacji\Creative
2008-05-26 12:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-26 12:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-05-26 12:30 --------- d-----w C:\Program Files\Creative
2008-05-26 12:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-26 12:15 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-26 12:14 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2008-05-26 14:58 2127296]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"CTHelper"="CTHELPER.EXE" [2003-06-09 04:07 28672 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"avast!"="d:\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
"Adobe Reader Speed Launcher"="D:\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 13:06 40048]
"CorelDRAW Graphics Suite 11b"="D:\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 13:39 729088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - D:\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12 28672]
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9053954-2db3-11dd-8ae6-00046153d390}]
\Shell\AutoRun\command - I:\jfvkcsy.bat
\Shell\explore\Command - I:\jfvkcsy.bat
\Shell\open\Command - I:\jfvkcsy.bat
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-05-31 18:16:46 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1212257760.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-06-04 19:07:13
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-04 19:07:40
ComboFix-quarantined-files.txt 2008-06-04 17:07:38
Pre-Run: 2,374,029,312 bajtów wolnych
Post-Run: 3,212,341,248 bajtów wolnych
136