ComboFix 09-08-10.06 - Mariusz 2009-08-12 0:36.1.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1033.18.1022.462 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Mariusz\Desktop\ComboFixqqqqqq.exe
AV: Norton AntiVirus 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
D:\auq9bor.bat
D:\ljnhwt.bat
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((( Pliki utworzone od 2009-07-11 do 2009-08-11 )))))))))))))))))))))))))))))))
.
2009-08-11 22:31 . 2009-08-11 22:31 -------- d-s---w- C:\ComboFix
2009-08-11 22:25 . 2009-08-11 22:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-08-11 22:25 . 2009-08-11 22:25 -------- d-----w- c:\windows\system32\Kaspersky Lab
2009-08-11 19:18 . 2009-08-11 19:18 -------- d-----w- c:\documents and settings\Mariusz\Gadu-Gadu
2009-08-11 19:18 . 2009-08-11 19:18 -------- d-----w- c:\program files\Gadu-Gadu
2009-08-11 15:31 . 2009-08-11 15:31 -------- d-----w- c:\documents and settings\Mariusz\Application Data\AdobeUM
2009-08-11 15:31 . 2009-08-11 15:31 -------- d-----w- c:\documents and settings\Mariusz\Local Settings\Application Data\Adobe
2009-08-11 14:45 . 2009-08-11 14:45 -------- d-----w- c:\program files\Anti Trojan Elite
2009-08-11 09:56 . 2009-08-11 09:56 -------- d-----w- c:\windows\system32\drivers\NSS
2009-08-11 09:56 . 2009-08-11 09:56 -------- d-----w- c:\program files\Norton Security Scan
2009-08-11 09:55 . 2009-08-11 09:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-08-11 09:55 . 2009-08-11 09:55 -------- d-----w- c:\program files\NortonInstaller
2009-08-11 09:55 . 2009-08-11 09:55 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-08-11 09:48 . 2009-08-11 09:48 -------- d-----w- c:\windows\Sun
2009-08-11 09:47 . 2009-08-11 09:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-11 09:47 . 2009-08-11 09:47 -------- d-----w- c:\program files\Java
2009-08-11 09:47 . 2009-08-11 09:47 152576 ----a-w- c:\documents and settings\Mariusz\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-11 08:49 . 2009-08-11 08:49 -------- d-----w- c:\program files\SkanerOnline
2009-08-11 08:47 . 2009-08-11 08:47 -------- d-s---w- c:\documents and settings\Mariusz\UserData
2009-08-11 08:46 . 2009-08-11 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-08-11 08:39 . 2009-08-11 08:39 -------- d-----w- c:\program files\Yahoo!
2009-08-11 08:39 . 2009-08-11 08:39 -------- d-----w- c:\windows\Acer
2009-08-11 08:36 . 2005-09-26 14:40 258048 ----a-w- c:\windows\system32\Uninstall_eRecovery.exe
2009-08-11 08:35 . 2006-01-23 10:41 78208 ----a-w- c:\windows\system32\drivers\epm-shd.sys
2009-08-11 08:35 . 2006-01-23 10:41 4096 ----a-w- c:\windows\system32\drivers\epm-psd.sys
2009-08-11 08:35 . 2009-08-11 08:35 -------- d-----w- c:\windows\system32\DRVSTORE
2009-08-11 08:35 . 2009-08-11 08:35 21275 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-08-11 08:34 . 2009-08-11 08:35 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2009-08-11 08:34 . 2009-08-11 08:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2009-08-11 08:34 . 2006-04-10 08:09 61440 ----a-w- c:\windows\system32\acerGina.dll
2009-08-11 08:33 . 2009-08-11 08:33 -------- d-----w- c:\program files\Launch Manager
2009-08-11 08:33 . 2004-12-09 10:04 5120 ----a-w- c:\windows\system32\FILTRCOI.DLL
2009-08-11 08:33 . 2004-12-08 12:10 16896 ----a-w- c:\windows\system32\drivers\DKbFltr.SYS
2009-08-11 08:33 . 2009-08-11 08:33 35792 ----a-w- c:\documents and settings\Mariusz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-11 08:33 . 2006-01-20 13:56 53248 ----a-w- c:\windows\system32\acpimof.dll
2009-08-11 08:33 . 2006-01-20 13:56 225350 ----a-w- c:\windows\system32\Epm-Po.dll
2009-08-11 08:32 . 2009-08-11 08:32 -------- d-----w- c:\documents and settings\Mariusz\Bluetooth Software
2009-08-11 08:28 . 2009-08-11 08:29 -------- d-----w- c:\program files\WIDCOMM
2009-08-11 08:28 . 2009-08-11 08:28 -------- d-----w- c:\documents and settings\Mariusz\Application Data\Symantec
2009-08-11 08:26 . 2006-09-06 06:09 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Acer
2009-08-11 08:22 . 2004-08-03 20:58 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-08-11 08:22 . 2004-08-03 21:10 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-08-11 08:22 . 2004-08-10 18:00 15360 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-08-11 08:22 . 2004-08-10 18:00 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-08-11 08:22 . 2004-08-03 21:10 19328 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-08-11 08:22 . 2004-08-03 21:10 85376 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-08-11 08:22 . 2004-08-03 21:10 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-08-11 08:22 . 2004-08-03 22:56 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-08-11 08:21 . 2009-08-11 08:21 -------- d-----w- c:\windows\nview
2009-08-11 08:21 . 2006-07-20 03:58 208896 ----a-w- c:\windows\system32\nvudisp.exe
2009-08-11 08:19 . 2006-09-28 16:43 261627 ----a-w- c:\windows\EMEAWG.EXE
2009-08-11 08:19 . 2006-09-17 17:38 1154584 ----a-w- c:\windows\YTB.EXE
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 22:40 . 2006-09-06 22:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-08-11 10:57 . 2009-08-11 10:57 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-11 10:57 . 2009-08-11 10:57 10635 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-11 10:57 . 2005-09-17 13:20 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-11 10:57 . 2005-09-17 13:20 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-11 08:38 . 2009-08-11 08:38 -------- d-----w- c:\program files\Common Files\Logitech
2009-08-11 08:38 . 2009-08-11 08:38 -------- d-----w- c:\program files\Common Files\Acer
2009-08-11 08:38 . 2009-08-11 08:38 -------- d-----w- c:\program files\Acer
2009-08-11 08:33 . 2009-08-11 08:27 130 ----a-w- c:\documents and settings\Mariusz\Local Settings\Application Data\fusioncache.dat
2009-08-11 08:28 . 2004-09-27 15:15 1003 ----a-w- c:\windows\CLEANUP.CMD
2009-08-11 08:19 . 2004-09-21 12:28 62 ----a-w- c:\windows\HotFix.bat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056]
"ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 52848]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]
"Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2006-06-23 225280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-09-23 61440]
"LogitechCameraAssistant"="c:\program files\Acer\OrbiCam\CameraAssistant.exe" [2006-06-26 331776]
"LogitechVideo[inspector]"="c:\program files\Acer\OrbiCam\InstallHelper.exe" [2006-06-26 13:55 73728]
"LogitechCameraService(E)"="c:\windows\system32\ElkCtrl.exe" [2004-11-01 262144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-11 149280]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Anti Trojan Elite"="c:\program files\Anti Trojan Elite\TJEnder.exe" [2009-06-14 4076544]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-28 16248320]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-20 1519616]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R2 ATE_PROCMON;ATE_PROCMON;c:\program files\Anti Trojan Elite\ATEPMON.sys [2009-08-11 7798]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-08-11 101936]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [2006-06-19 1097728]
.
Zawartość folderu 'Zaplanowane zadania'
2009-08-11 c:\windows\Tasks\Norton Security Scan for Mariusz.job
- c:\program files\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-08-11 09:56]
2009-08-11 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Mariusz.job
- c:\progra~1\NORTON~1\Navw32.exe [2005-10-21 10:13]
.
.
------- Skan uzupełniający -------
.
uStart Page =
hxxp://google.pl/mStart Page =
hxxp://pl.intl.acer.yahoo.comuSearchURL,(Default) =
hxxp://uk.rd.yahoo.com/customize/ycomp/ ... .yahoo.comIE: Wyślij do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: com.pl\mks
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-08-12 00:42
Windows 5.1.2600 Service Pack 2 FAT NTAPI
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(6276)
c:\program files\Common Files\Logitech\LVMVFM\LVPrcInj.dll
c:\windows\system32\MSNChatHook.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\MSVCR71.dll
c:\windows\system32\msi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\acer\Empowering Technology\admServ.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Norton AntiVirus\IWP\NPFMntor.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\dllhost.exe
c:\docume~1\Mariusz\LOCALS~1\Temp\RtkBtMnt.exe
c:\program files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
.
**************************************************************************
.
Czas ukończenia: 2009-08-11 0:43 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-08-11 22:43
Przed: 46 106 935 296 bytes free
Po: 46 151 598 080 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
248