prosze o sprawdzenie loga z combofix

[mtk69]

http://wklej.eu/index.php?id=867bfa28d5

Kod: Zaznacz wszystko

ComboFix 09-02-12.03 - Player_1 2008-10-13 13:58:03.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.3007.2615 [GMT 2:00]
Uruchomiony z: c:\combofix\ComboFix.exe
AV: System antywirusowy NOD32 2.70 *On-access scanning enabled* (Outdated)
 * Resident AV is active

.

(((((((((((((((((((((((((   Pliki utworzone od 2009-01-12 do 2009-02-12  )))))))))))))))))))))))))))))))
.

2009-02-13 12:48 . 2009-02-13 12:48   <DIR>   d--------   c:\documents and settings\Player_1\Dane aplikacji\DisplayTune
2009-02-13 12:27 . 2009-02-13 12:27   <DIR>   d--------   c:\program files\Common Files\Portrait Displays
2009-02-13 12:23 . 2009-02-13 12:27   <DIR>   d--------   c:\program files\Portrait Displays
2009-02-13 12:23 . 2007-01-26 16:12   62,009   --a------   c:\windows\system32\WPFB.DLL
2009-02-13 12:23 . 2007-01-26 16:12   17,465   --a------   c:\windows\system32\drivers\pivot.sys
2009-02-13 12:23 . 2007-01-26 16:12   11,323   --a------   c:\windows\system32\drivers\pivotmou.sys
2009-02-13 12:23 . 2004-11-22 12:07   2,304   --a------   c:\windows\system32\Machnm32.sys
2009-02-08 22:30 . 2009-02-08 22:30   <DIR>   d--------   c:\documents and settings\Player_1\Dane aplikacji\Media Player Classic
2009-02-01 11:09 . 2009-02-01 11:09   <DIR>   d--------   c:\program files\ASGvis
2009-02-01 00:30 . 2009-02-01 00:30   <DIR>   d--------   c:\program files\Penguin SR3
2009-02-01 00:30 . 2009-02-01 00:30   <DIR>   d--------   c:\documents and settings\Player_1\Dane aplikacji\McNeel
2009-02-01 00:00 . 2009-02-01 00:00   <DIR>   d--------   c:\documents and settings\Player_1\Dane aplikacji\Gadu-Gadu
2009-01-31 23:55 . 2009-02-03 09:03   <DIR>   d--------   c:\documents and settings\Player_1\Gadu-Gadu
2009-01-31 19:10 . 2009-01-31 19:13   <DIR>   d--------   c:\program files\SkanerOnline
2009-01-28 17:51 . 2009-01-28 17:51   <DIR>   d---s----   c:\documents and settings\Player_1\UserData
2009-01-27 23:57 . 2004-08-04 00:44   159,232   --a------   c:\windows\system32\ptpusd.dll
2009-01-27 23:57 . 2001-10-26 17:29   5,632   --a------   c:\windows\system32\ptpusb.dll
2009-01-27 07:54 . 2009-01-27 07:54   151   --a------   c:\windows\PhotoSnapViewer.INI
2009-01-27 07:53 . 2009-01-27 07:53   <DIR>   d--------   c:\documents and settings\Player_2\Dane aplikacji\Corel
2009-01-26 20:54 . 2009-01-26 20:54   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\InstallShield
2009-01-26 20:46 . 2007-04-02 01:16   2,916,438   --a------   c:\windows\system32\rcm.dll
2009-01-26 20:46 . 2007-04-02 01:16   2,777,088   --a------   c:\windows\system32\rhrdk.10.v40.dll
2009-01-26 20:46 . 2007-04-02 01:16   196,608   --a------   c:\windows\system32\BongoSDK.10.v40.dll
2009-01-26 20:46 . 2007-04-02 01:16   192,512   --a------   c:\windows\system32\BongoSDK.dll
2009-01-26 20:46 . 2007-04-02 01:16   96   --a------   c:\windows\system32\vssver.scc
2009-01-26 20:45 . 2009-01-26 20:45   <DIR>   d--------   c:\program files\Common Files\InstallShield Shared
2009-01-26 20:45 . 2007-04-19 10:46   647,872   --a------   c:\windows\system32\Mscomct2.ocx
2009-01-25 13:08 . 2009-01-25 13:08   <DIR>   d--------   c:\documents and settings\Player_1\Dane aplikacji\Corel
2009-01-25 13:07 . 2009-01-25 13:07   <DIR>   d--------   c:\program files\Common Files\Corel
2009-01-25 12:50 . 2009-01-25 12:49   512,096   --a------   c:\windows\system32\drivers\amon.sys
2009-01-25 12:50 . 2009-01-25 12:49   298,104   --a------   c:\windows\system32\imon.dll
2009-01-25 12:50 . 2009-01-25 12:49   15,424   --a------   c:\windows\system32\drivers\nod32drv.sys
2009-01-21 17:11 . 2009-01-21 17:11   473,600   --a------   c:\windows\system32\SkanerOnline.dll
2009-01-19 21:46 . 2009-01-19 21:46   <DIR>   d--------   c:\windows\system32\AGEIA
2009-01-19 21:46 . 2009-01-19 21:46   <DIR>   d--------   c:\program files\AGEIA Technologies
2009-01-19 21:45 . 2009-01-19 21:45   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2009-01-19 21:45 . 2008-10-21 11:12   201,157   --a------   c:\windows\system32\nvapps.nvb
2009-01-19 21:43 . 2009-01-19 21:43   <DIR>   d--------   c:\windows\Logs
2009-01-19 21:43 . 2005-05-26 15:34   2,297,552   --a------   c:\windows\system32\d3dx9_26.dll
2009-01-16 10:38 . 2009-01-16 10:38   <DIR>   d--------   c:\program files\oZone3D
2009-01-16 10:34 . 2004-08-03 23:08   26,496   --a--c---   c:\windows\system32\dllcache\usbstor.sys

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 11:28   ---------   d-----w   c:\program files\Hewlett-Packard
2009-02-13 11:27   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-02-12 19:02   ---------   d-----w   c:\documents and settings\LocalService\Dane aplikacji\WTablet
2009-02-12 13:56   ---------   d-----w   c:\documents and settings\Player_1\Dane aplikacji\Tlen.pl
2009-02-10 17:04   ---------   d-----w   c:\documents and settings\Player_2\Dane aplikacji\WTablet
2009-01-31 23:30   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\McNeel
2009-01-29 17:55   ---------   d-----w   c:\program files\Common Files\LightScribe
2009-01-29 17:27   ---------   d-----w   c:\program files\Common Files\Adobe
2009-01-26 19:46   ---------   d-----w   c:\program files\Common Files\McNeel Shared
2009-01-25 12:07   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-10 16:29   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\FLEXnet
2009-01-10 10:24   ---------   d-----w   c:\program files\DAEMON Tools Toolbar
2009-01-10 10:22   717,296   ----a-w   c:\windows\system32\drivers\sptd.sys
2009-01-10 10:22   ---------   d-----w   c:\documents and settings\Player_1\Dane aplikacji\DAEMON Tools
2009-01-10 10:08   ---------   d-----w   c:\program files\Common Files\Control Panels
2009-01-10 10:06   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\ALM
2009-01-10 10:00   ---------   d-----w   c:\program files\QuickTime
2009-01-10 09:48   ---------   d-----w   c:\program files\Bonjour
2009-01-10 09:46   ---------   d-----w   c:\program files\Common Files\Macrovision Shared
2009-01-09 16:41   ---------   d-----w   c:\documents and settings\Player_2\Dane aplikacji\Gadu-Gadu
2009-01-09 16:19   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Tlen.pl
2009-01-09 15:53   ---------   d-----w   c:\program files\Google
2009-01-09 12:15   ---------   d-----w   c:\program files\Tablet
2009-01-08 16:33   ---------   d-----w   c:\program files\HP
2009-01-08 16:32   ---------   d-----w   c:\documents and settings\Player_1\Dane aplikacji\HP
2009-01-08 16:29   ---------   d-----w   c:\program files\Common Files\Sonic Shared
2009-01-08 16:29   ---------   d-----w   c:\program files\Common Files\HP
2009-01-08 16:29   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Sonic
2009-01-08 16:26   ---------   d-----w   c:\program files\Common Files\Hewlett-Packard
2009-01-08 16:26   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\HP
2009-01-08 16:23   ---------   d-----w   c:\program files\Ahead
2009-01-08 16:22   ---------   d-----w   c:\program files\Common Files\Nero
2009-01-08 16:21   ---------   d-----w   c:\program files\Common Files\Ahead
2009-01-08 16:21   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Ahead
2009-01-08 16:18   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\CyberLink
2009-01-08 16:17   ---------   d-----w   c:\program files\CyberLink
2009-01-08 16:13   ---------   d-----w   c:\program files\muvee Technologies
2009-01-08 16:13   ---------   d-----w   c:\program files\Common Files\muvee Technologies
2009-01-08 16:12   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\muvee Technologies
2009-01-08 16:11   ---------   d-----w   c:\documents and settings\Player_1\Dane aplikacji\InterTrust
2009-01-08 16:02   ---------   d-----w   c:\program files\Realtek
2009-01-08 15:58   ---------   d-----w   c:\program files\Analog Devices
2009-01-08 15:46   ---------   d-----w   c:\program files\Intel
2009-01-08 15:37   ---------   d-----w   c:\program files\microsoft frontpage
2009-01-08 15:36   ---------   d-----w   c:\program files\Usługi online
2006-06-23 06:48   32,768   ----a-r   c:\windows\inf\UpdateUSB.exe
2004-08-03 22:44   169,822   --sha-r   c:\windows\system32\iayzb.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-02-12_13.09.42,34   )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-13 11:51:58   52,900   ----a-w   c:\windows\system32\perfc009.dat
+ 2008-10-13 11:57:30   52,900   ----a-w   c:\windows\system32\perfc009.dat
- 2009-02-13 11:51:58   67,298   ----a-w   c:\windows\system32\perfc015.dat
+ 2008-10-13 11:57:30   67,298   ----a-w   c:\windows\system32\perfc015.dat
- 2009-02-13 11:51:58   380,486   ----a-w   c:\windows\system32\perfh009.dat
+ 2008-10-13 11:57:30   380,486   ----a-w   c:\windows\system32\perfh009.dat
- 2009-02-13 11:51:58   436,322   ----a-w   c:\windows\system32\perfh015.dat
+ 2008-10-13 11:57:30   436,322   ----a-w   c:\windows\system32\perfh015.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Komunikator"="d:\program files\Tlen.pl\tlen.exe" [2008-11-28 5837800]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-02 385024]
"Gainward"="c:\windows\TBPanel.exe" [2006-09-14 2162688]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
"Adobe_ID0EYTHM"="c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"nod32kui"="d:\program files\Eset\nod32kui.exe" [2009-01-25 949376]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-01-26 694008]
"DT HWP"="c:\program files\Portrait Displays\HP Display Assistant\DTHtml.exe" [2007-06-29 277504]
"nwiz"="nwiz.exe" [2008-10-21 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Display LiteSaver Startup.lnk - c:\windows\HPLiteSaver.exe [2004-08-24 65536]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Photosmart Premier - Szybkie uruchomienie.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Photosmart Premier - Szybkie uruchomienie.lnk
backup=c:\windows\pss\HP Photosmart Premier - Szybkie uruchomienie.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 16:02 490952 d:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2008-03-20 11:04 2127296 d:\program files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2006-02-19 02:41 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2005-01-12 03:01 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2009-01-25 12:52 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Tlen.pl\\tlen.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"4704:TCP"= 4704:TCP:owfozw

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-01-25 15424]
S2 vfxrc;Server Support;c:\windows\system32\svchost.exe -k netsvcs [2004-08-03 14336]
S3 bbfyaqlgj;bbfyaqlgj;\??\c:\windows\system32\[u]0[/u]1.tmp --> c:\windows\system32\[u]0[/u]1.tmp [?]
S3 fycyj;fycyj;\??\c:\windows\system32\[u]0[/u]2.tmp --> c:\windows\system32\[u]0[/u]2.tmp [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
vfxrc
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\windows\system32\imon.dll
TCP: {4748244C-56EC-4DF8-B246-13AE3D6DFF31} = 62.61.62.1,62.61.62.2
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-12 13:59:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bbfyaqlgj]
"ImagePath"="\??\c:\windows\system32\[u]0[/u]1.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fycyj]
"ImagePath"="\??\c:\windows\system32\[u]0[/u]2.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vfxrc]
"ServiceDll"="c:\windows\system32\iayzb.dll"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'lsass.exe'(808)
c:\windows\system32\imon.dll
d:\program files\Eset\pr_imon.dll
.
Czas ukończenia: 2009-02-12 13:59:54
ComboFix-quarantined-files.txt  2009-02-12 12:59:52

Przed: 32 187 408 384 bajtów wolnych
Po: 32,178,008,064 bajtów wolnych

217