Oto log z ComboFixa. Ktoś oceni?
ComboFix 08-10-17.01 - Dom 2008-10-18 20:37:43.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1474 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dom\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\windows\system32\dbxDgrevCheck.dll
.
((((((((((((((((((((((((( Pliki utworzone od 2008-09-18 do 2008-10-18 )))))))))))))))))))))))))))))))
.
2008-10-18 20:36 . 2008-10-18 20:36
2008-10-10 16:20 . 2008-10-11 11:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-10 16:20 . 2008-10-10 16:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-04 09:48 . 2008-08-02 12:20 453,152 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-10-04 09:46 . 2008-08-02 12:20 8,822,784 --a------ C:\WINDOWS\system32\nvoglnt.dll
2008-10-04 09:46 . 2008-08-02 12:20 3,764,224 --a------ C:\WINDOWS\system32\nvvitvs.dll
2008-10-04 09:46 . 2008-07-29 19:41 3,407,872 --a------ C:\WINDOWS\system32\nvgames.dll
2008-10-04 09:46 . 2008-08-02 12:20 2,686,976 --a------ C:\WINDOWS\system32\nvwss.dll
2008-10-04 09:46 . 2008-08-02 12:20 286,720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2008-10-04 09:46 . 2008-08-02 12:20 229,376 --a------ C:\WINDOWS\system32\nvmccs.dll
2008-10-04 09:46 . 2008-08-02 12:20 188,416 --a------ C:\WINDOWS\system32\nvmccss.dll
2008-10-04 09:46 . 2008-08-02 12:20 86,016 --a------ C:\WINDOWS\system32\nvmctray.dll
2008-10-04 09:46 . 2008-08-02 12:20 81,920 --a------ C:\WINDOWS\system32\nvwddi.dll
2008-10-04 09:45 . 2008-07-29 19:41 8,785,920 --a------ C:\WINDOWS\system32\nvcpl.dll
2008-10-04 09:45 . 2008-06-18 03:54 6,553,600 --a------ C:\WINDOWS\system32\nvdisps.dll
2008-10-04 09:45 . 2008-08-02 12:20 1,368,064 --a------ C:\WINDOWS\system32\nvcuda.dll
2008-10-04 09:45 . 2008-07-26 12:48 471,040 --a------ C:\WINDOWS\system32\nvapi.dll
2008-10-04 09:45 . 2008-08-02 12:20 122,880 --a------ C:\WINDOWS\system32\nvcodins.dll
2008-10-04 09:45 . 2008-08-02 12:20 122,880 --a------ C:\WINDOWS\system32\nvcod.dll
2008-10-02 19:18 . 2008-10-02 19:18 0 --a------ C:\WINDOWS\msicpl.ini
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 16:33 --------- d-----w C:\Program Files\GameSpy Arcade
2008-10-18 12:39 182,928 ----a-w C:\windows\system32\PnkBstrB.exe
2008-10-18 12:39 159,992 ----a-w C:\windows\system32\drivers\PnkBstrK.sys
2008-10-18 09:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TrackMania
2008-10-17 15:58 --------- d-----w C:\Documents and Settings\Dom\Dane aplikacji\uTorrent
2008-10-17 15:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited
2008-10-13 15:41 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-10-11 15:06 --------- d-----w C:\Program Files\SpeedFan
2008-10-10 13:54 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-09-18 11:49 --------- d-----w C:\Program Files\Winamp
2008-09-12 09:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
2008-08-24 15:09 --------- d-----w C:\Program Files\Tunatic
2008-08-23 10:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-08-22 12:45 --------- d-----w C:\Program Files\Sygate
2008-08-19 15:28 --------- d-----w C:\Program Files\Screamer Radio
2008-08-02 10:20 797,216 ----a-w C:\windows\system32\nvcplui.exe
2008-08-02 10:20 6,049,536 ----a-w C:\windows\system32\nv4_disp.dll
2008-08-02 10:20 466,944 ----a-w C:\windows\system32\nvshell.dll
2008-08-02 10:20 453,152 ----a-w C:\windows\system32\nvudisp.exe
2008-08-02 10:20 449,056 ----a-w C:\windows\system32\nvappbar.exe
2008-08-02 10:20 354,919 ----a-w C:\windows\system32\nvwimg.dll
2008-08-02 10:20 1,724,416 ----a-w C:\windows\system32\nvwdmcpl.dll
2008-08-02 10:20 1,657,376 ----a-w C:\windows\system32\nwiz.exe
2008-08-02 10:20 1,499,136 ----a-w C:\windows\system32\nview.dll
2008-08-02 10:20 1,346,080 ----a-w C:\windows\system32\nvdspsch.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\windows\system32\ctfmon.exe” [2006-03-02 15360]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 2111176]
“SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search Destroy\TeaTimer.exe” [2008-07-07 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-07-19 78008]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe” [2008-02-22 144784]
“DAEMON Tools-1033”=“C:\Program Files\D-Tools\daemon.exe” [2004-08-22 81920]
“NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2006-01-12 155648]
“TkBellExe”=“C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe” [2007-08-11 180269]
“HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [2006-02-19 49152]
“SmcService”=“C:\PROGRA~1\Sygate\SPF\smc.exe” [2003-12-24 2344160]
“NvCplDaemon”=“C:\windows\system32\NvCpl.dll” [2008-07-29 8785920]
“NvMediaCenter”=“C:\windows\system32\NvMcTray.dll” [2008-08-02 86016]
“RTHDCPL”=“RTHDCPL.EXE” [2006-08-01 C:\WINDOWS\RTHDCPL.exe]
“nwiz”=“nwiz.exe” [2008-08-02 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2006-03-02 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^E_SPSU01.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\E_SPSU01.lnk
backup=C:\WINDOWS\pss\E_SPSU01.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 01:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-r------- 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Program Files\Gadu-Gadu\gg.exe”=
“C:\Program Files\eMule\emule.exe”=
“C:\Program Files\GameSpy Arcade\Aphex.exe”=
“C:\Program Files\SopCast\SopCast.exe”=
“C:\Documents and Settings\Dom\Dane aplikacji\SopCast\adv\SopAdver.exe”=
“C:\Program Files\NAPI-PROJEKT\napisy.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hposid01.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”=
“C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe”=
“C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”=
“C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe”=
“C:\Program Files\TVAnts\Tvants.exe”=
“C:\Program Files\RV House\rv_house.exe”=
“C:\WINDOWS\system32\dplaysvr.exe”=
“C:\Program Files\SopCast\adv\SopAdver.exe”=
“C:\Documents and Settings\Dom\Pulpit\teewars-0.3.3-win32\teewars-0.3.3-win32\teewars_srv.exe”=
“C:\Documents and Settings\Dom\Application Data\PowerChallenge\PowerSoccer\PowerSoccer.exe”=
R1 aswSP;avast! Self Protection;C:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\windows\TEMP\476.tmp []
S3 CamSpaceBus;CamSpace Virtual Joystick Bus device driver;C:\windows\system32\drivers\CamSpaceBus.sys [2008-06-10 14848]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
*Newly Created Service* - PROCEXP90
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-NWEReboot - (no file)
MSConfigStartUp-CamSpace - C:\Program Files\CamSpace\CamSpaceAgent.exe
MSConfigStartUp-parentalcontrol - C:\Program Files\parentalcontrol\parentalcontrol.exe
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\b1l7iqjp.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.wp.pl/
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPBILLARD8.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npdbplug.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPSNOOKER.dll
FF -: plugin - C:\windows\system32\DNAML\npdbplug.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-18 20:39:08
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
“ImagePath”="??\C:\windows\TEMP\476.tmp"
.
Czas ukończenia: 2008-10-18 20:40:01
ComboFix-quarantined-files.txt 2008-10-18 18:39:59
Przed: 7 969 902 592 bajtów wolnych
Po: 7,970,848,768 bajtów wolnych
169 — E O F — 2008-08-15 19:57:53