Dzięki z góry!
ComboFix 08-07-07.3 - Home 2008-07-08 19:12:09.1 - NTFSx86
Running from: C:\Documents and Settings\Home\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM47558ad2.txt
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bcqaxaof.ini
C:\WINDOWS\system32\blkxwqtd.ini
C:\WINDOWS\system32\bnfltxcc.ini
C:\WINDOWS\system32\bxfsrvlb.dll
C:\WINDOWS\system32\ccxtlfnb.dll
C:\WINDOWS\system32\cumrbrpr.dll
C:\WINDOWS\system32\dvsmebao.ini
C:\WINDOWS\system32\eikghyfd.ini
C:\WINDOWS\system32\euyxgrbb.ini
C:\WINDOWS\system32\FeghkUtv.ini
C:\WINDOWS\system32\FeghkUtv.ini2
C:\WINDOWS\system32\gsyuetif.ini
C:\WINDOWS\system32\hgkkhxpk.dll
C:\WINDOWS\system32\jmhyhboi.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJYrpOe.dll
C:\WINDOWS\system32\mxhdlsaj.ini
C:\WINDOWS\system32\ohjeimip.dll
C:\WINDOWS\system32\oxigjnsg.ini
C:\WINDOWS\system32\pdajyvim.ini
C:\WINDOWS\system32\postvbfp.ini
C:\WINDOWS\system32\qBHkRXyb.ini
C:\WINDOWS\system32\qBHkRXyb.ini2
C:\WINDOWS\system32\qgrxnhos.ini
C:\WINDOWS\system32\rjvvafwi.ini
C:\WINDOWS\system32\rxxwgaif.ini
C:\WINDOWS\system32\sdrmlqpe.ini
C:\WINDOWS\system32\ssaurjtq.dll
C:\WINDOWS\system32\upsbddjp.ini
C:\WINDOWS\system32\vtUkhgeF.dll
C:\WINDOWS\system32\xpskcaha.dll
C:\WINDOWS\system32\ybgwspsa.ini
.
((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 )))))))))))))))))))))))))))))))
.
2008-07-08 19:33 . 2008-07-08 19:33 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-07-08 19:33 . 2008-07-08 19:37 <DIR> d--hs---- C:\WINDOWS\system32\dllcache
2008-07-08 19:33 . 2008-07-08 19:33 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-07-08 17:59 . 2008-07-08 18:00 <DIR> d-------- C:\Program Files\Opera
2008-07-08 16:06 . 2008-07-08 16:06 <DIR> d-------- C:\!KillBox
2008-07-07 23:46 . 2008-07-07 23:46 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-07-04 20:07 . 2008-07-04 20:07 24,576 --a------ C:\WINDOWS\system32\mlJYrpOe.V01dll
2008-07-01 14:39 . 2008-07-01 14:39 24,576 --a------ C:\WINDOWS\system32\mlJYrpOe.V00dll
2008-07-01 08:41 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-01 08:41 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-06-29 22:05 . 2008-06-29 22:05 24,576 --a------ C:\WINDOWS\system32\mljyrpoe.Vdll
2008-06-25 21:18 . 2008-06-25 22:23 <DIR> d-------- C:\Program Files\MIFek
2008-06-25 20:55 . 2008-06-25 22:23 <DIR> d-------- C:\Program Files\Interesik 2005
2008-06-25 20:14 . 2008-06-25 22:24 <DIR> d-------- C:\Documents and Settings\Home\Dane aplikacji\The Bat!
2008-06-21 23:47 . 2008-06-21 23:47 <DIR> d-------- C:\Program Files\InCode Solutions
2008-06-12 23:34 . 2008-07-08 17:54 110,440 --a------ C:\WINDOWS\BM47558ad2.xml
2008-06-12 16:43 . 2008-06-12 16:43 <DIR> d-------- C:\Program Files\Tlen.pl
2008-06-10 12:34 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-06-10 12:29 . 2008-06-10 12:30 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-06-10 12:29 . 2008-06-10 12:30 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-06-10 12:28 . 2008-06-10 12:28 <DIR> d-------- C:\Program Files\DIFX
2008-06-10 12:28 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-06-10 12:27 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-06-10 12:27 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-10 12:27 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-06-10 12:27 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-06-10 12:27 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-06-10 12:27 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-08 17:35 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\Hamachi
2008-07-08 13:46 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\mIRC
2008-06-30 20:03 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\uTorrent
2008-06-27 22:45 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\Tlen.pl
2008-06-12 09:26 --------- d-----w C:\Program Files\Eset
2008-06-10 10:35 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\Nokia
2008-06-10 10:28 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-06-10 10:27 --------- d-----w C:\Program Files\Nokia
2008-06-08 07:12 --------- d-----w C:\Program Files\Common Files\LogiShrd
2008-06-08 07:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Logishrd
2008-06-06 19:05 --------- d-----w C:\Documents and Settings\Home\Dane aplikacji\PC Suite
2008-06-06 19:04 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-06-06 19:04 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-06-06 19:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-06-06 18:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-24 10:00 --------- d-----w C:\Program Files\PowerStrip
2008-05-18 19:14 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-09 15:30 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-05-04 16:01 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1694208]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-07 14:20 917504]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-05-02 02:37 726776]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
C:\Documents and Settings\Home\Menu Start\Programy\Autostart\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-10-07 14:14:05 619048]
Skr˘t do SBCK v0.lnk - C:\Cyfra\SBCK\SBCK v0.4.exe [2007-10-07 12:32:57 297472]
Skr˘t do SBCL v1.1b d˘.lnk - C:\Cyfra\SBCL D˘\SBCL v1.1b d˘.exe [2007-10-07 12:32:57 779264]
Skr˘t do SBCL v1.1b gora.lnk - C:\Cyfra\SBCL G˘ra_T\SBCL v1.1b gora.exe [2007-10-07 12:32:59 779264]
Skr˘t do SBCL v1.1b gora_P.lnk - C:\Cyfra\SBCL G˘ra_P\SBCL v1.1b gora_P.exe [2007-10-07 12:32:58 779264]
Skr˘t do SBCS v0.lnk - C:\Cyfra\serwer\SBCS v0.8i.exe [2007-10-07 12:33:00 339456]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I&F Viewer toolbar]
--a------ 2006-10-27 22:34 65536 C:\Program Files\Photo Toolkit\IvBar\phototoolkitmem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-03-26 18:41 1232896 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-04-16 12:53 1079808 C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Cyfra\\serwer\\SBCSe.exe"=
"C:\\Cyfra\\serwer\\SBCS v0.8i.exe"=
"C:\\Documents and Settings\\Home\\Moje dokumenty\\agata\\mIRC\\mirc.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
R1 P3;Sterownik procesora Intel PentiumIII;C:\WINDOWS\system32\DRIVERS\p3.sys [2006-08-10 16:51]
R2 NVSvc;NVIDIA Display Driver Service;C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 13:22]
R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\pstrip.sys [2007-07-15 03:37]
R3 Ser2pl;Prolific Serial port driver;C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2004-06-28 12:08]
R3 Serport;Tripp Lite Serial port driver;C:\WINDOWS\system32\DRIVERS\serport.sys [2006-01-14 16:25]
S3 NdisIP;Połączenie TV/wideo firmy Microsoft;C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 23:10]
S3 nmwcd;Nokia USB Phone Parent;C:\WINDOWS\system32\drivers\ccdcmb.sys [2007-11-29 10:39]
S3 nmwcdc;Nokia USB Generic;C:\WINDOWS\system32\drivers\ccdcmbo.sys [2007-11-29 10:39]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 PID_0928;Logitech QuickCam Express(PID_0928);C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2007-10-12 03:56]
S3 sermouse;Sterownik myszy szeregowej;C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-10-26 17:05]
S3 ServiceLayer;ServiceLayer;C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 09:17]
S3 SLIP;BDA Slip De-Framer;C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 23:10]
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 usbser;Nokia USB Serial Port;C:\WINDOWS\system32\DRIVERS\usbser.sys [2004-08-03 23:08]
S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 07:22]
.
- - - - ORPHANS REMOVED - - - -
BHO-{6B430242-479F-4364-9493-AD5CEE8D22C5} - C:\WINDOWS\system32\byXRkHBq.dll
HKCU-Run-RemoveIT Pro XT - C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe
HKLM-Run-4466b94e - C:\WINDOWS\system32\ccxtlfnb.dll
HKLM-Run-BM47558ad2 - C:\WINDOWS\system32\ohjeimip.dll
MSConfigStartUp-LogitechQuickCamRibbon - C:\Program Files\Logitech\QuickCam\Quickcam.exe
MSConfigStartUp-Picasa Media Detector - C:\Program Files\Picasa2\PicasaMediaDetector.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-08 19:34:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
C:\Program Files\Eset\pr_imon.dll
PROCESS: C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\nview.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Cyfra\SBCL DóC:\Cyfra\SBCL Góra_T\SBCL v1.1b gora.exe
C:\Cyfra\SBCL Góra_P\SBCL v1.1b gora_P.exe
.
**************************************************************************
.
Completion time: 2008-07-08 19:44:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-08 17:43:39
Pre-Run: 20,334,305,280 bajtów wolnych
Post-Run: 21,060,530,176 bajt˘w wolnych
199 --- E O F --- 2007-11-25 11:20:51
