Log z combofixa:
ComboFix 09-05-08.03 - Sliniak 2009-05-09 11:44.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.3327.2855 [GMT 2:00]
Uruchomiony z: F:\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((( Pliki utworzone od 2009-04-09 do 2009-05-09 )))))))))))))))))))))))))))))))
.
2009-05-09 09:32 . 2009-05-09 09:32 -------- d-----w c:\winnt\system32\xircom
2009-05-09 09:32 . 2009-05-09 09:32 -------- d-----w c:\program files\microsoft frontpage
2009-05-07 17:45 . 2009-05-07 17:46 -------- d-----w c:\documents and settings\Sliniak\Ustawienia lokalne\Dane aplikacji\Fallout3
2009-05-07 17:30 . 2009-05-07 17:30 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Fallout3
2009-05-07 17:28 . 2009-05-07 17:28 156544 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2009-05-07 17:27 . 2009-05-07 17:27 -------- d-----w c:\winnt\system32\XPSViewer
2009-05-07 17:27 . 2009-05-07 17:27 -------- d-----w c:\program files\Reference Assemblies
2009-05-07 17:26 . 2006-06-29 11:07 14048 ------w c:\winnt\system32\spmsg2.dll
2009-05-03 13:31 . 2009-05-03 13:32 -------- d-----w c:\documents and settings\Sliniak\Dane aplikacji\Nowe Gadu-Gadu
2009-05-03 12:33 . 2009-05-03 12:33 -------- d-----w c:\documents and settings\Sliniak\Ustawienia lokalne\Dane aplikacji\Opera
2009-05-03 09:47 . 2009-05-03 09:47 -------- d-----w c:\winnt\A7E07C2B2220441587E3784D5814BC93.TMP
2009-05-01 22:27 . 2009-05-01 22:27 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI
2009-05-01 22:25 . 2009-03-17 19:05 593920 ------w c:\winnt\system32\ati2sgag.exe
2009-05-01 22:24 . 2009-05-01 22:25 -------- d-----w c:\program files\ATI Technologies
2009-05-01 22:24 . 2009-05-01 22:24 -------- d-----w C:\ATI
2009-05-01 22:14 . 2009-05-01 22:14 472576 ----a-w c:\winnt\Radeon Omega Drivers v4.8.442 Uninstall.exe
2009-04-27 10:07 . 2009-04-27 10:07 -------- d-----w c:\documents and settings\Sliniak\Ustawienia lokalne\Dane aplikacji\ESET
2009-04-23 17:00 . 2009-04-23 17:00 -------- d-----w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2009-04-20 20:11 . 2005-07-26 04:36 60416 -c----w c:\winnt\system32\dllcache\colbact.dll
2009-04-20 20:11 . 2009-03-06 14:01 285696 -c----w c:\winnt\system32\dllcache\pdh.dll
2009-04-20 20:11 . 2009-02-06 09:41 227840 -c----w c:\winnt\system32\dllcache\wmiprvse.exe
2009-04-20 20:11 . 2009-02-09 10:03 401408 -c----w c:\winnt\system32\dllcache\rpcss.dll
2009-04-20 20:11 . 2009-02-09 10:03 473088 -c----w c:\winnt\system32\dllcache\fastprox.dll
2009-04-20 20:11 . 2009-02-06 09:54 35328 -c----w c:\winnt\system32\dllcache\sc.exe
2009-04-20 20:11 . 2009-02-09 09:55 111104 -c----w c:\winnt\system32\dllcache\services.exe
2009-04-20 20:11 . 2009-02-09 10:03 687104 -c----w c:\winnt\system32\dllcache\advapi32.dll
2009-04-20 20:11 . 2009-02-09 10:03 723456 -c----w c:\winnt\system32\dllcache\ntdll.dll
2009-04-20 20:09 . 2008-04-21 21:28 218112 -c----w c:\winnt\system32\dllcache\wordpad.exe
2009-04-18 07:08 . 2009-04-18 07:08 -------- d-----w c:\winnt\74224F8D4A1748169EDB7BB854DE532C.TMP
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 15:49 . 2009-01-07 15:15 -------- d–h--w c:\program files\InstallShield Installation Information
2009-05-07 21:16 . 2009-01-07 15:23 67400 ----a-w c:\documents and settings\Sliniak\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-07 17:28 . 2001-10-26 18:15 85464 ----a-w c:\winnt\system32\perfc015.dat
2009-05-07 17:28 . 2001-10-26 18:15 494500 ----a-w c:\winnt\system32\perfh015.dat
2009-05-07 17:28 . 2009-01-07 19:26 -------- d-----w c:\program files\MSBuild
2009-05-04 10:46 . 2009-01-07 17:05 22328 ----a-w c:\winnt\system32\drivers\PnkBstrK.sys
2009-05-04 10:46 . 2009-01-07 17:05 22328 ----a-w c:\documents and settings\Sliniak\Dane aplikacji\PnkBstrK.sys
2009-05-04 10:46 . 2009-01-07 17:05 103736 ----a-w c:\winnt\system32\PnkBstrB.exe
2009-05-04 10:46 . 2009-01-07 17:05 66872 ----a-w c:\winnt\system32\PnkBstrA.exe
2009-05-04 10:46 . 2009-01-07 17:05 669184 ----a-w c:\winnt\system32\pbsvc.exe
2009-05-03 09:47 . 2009-01-22 16:04 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-04 12:11 . 2009-03-07 17:00 -------- d-----w c:\program files\AGEIA Technologies
2009-04-01 15:06 . 2009-04-01 15:06 3724 ----a-w c:\winnt\system32\ealregsnapshot1.reg
2009-03-30 21:08 . 2009-03-05 18:27 -------- d-----w c:\program files\Common Files\LightScribe
2009-03-30 21:08 . 2009-03-30 21:06 -------- d-----w c:\program files\Common Files\Ahead
2009-03-30 14:57 . 2009-03-30 14:57 -------- d-----w c:\program files\MSXML 4.0
2009-03-21 21:43 . 2009-03-21 21:43 -------- d-----w c:\program files\USB Vibration
2009-03-16 21:33 . 2009-03-16 21:33 3597312 ----a-w c:\winnt\system32\drivers\ati2mtag.sys
2009-03-16 20:27 . 2009-03-16 20:27 442368 ----a-w c:\winnt\system32\ATIDEMGX.dll
2009-03-16 20:26 . 2008-06-24 14:10 328704 ------w c:\winnt\system32\ati2dvag.dll
2009-03-16 20:17 . 2009-03-16 20:17 307200 ----a-w c:\winnt\system32\atiiiexx.dll
2009-03-16 20:17 . 2009-03-16 20:17 204800 ----a-w c:\winnt\system32\atipdlxx.dll
2009-03-16 20:16 . 2009-03-16 20:16 155648 ----a-w c:\winnt\system32\Oemdspif.dll
2009-03-16 20:16 . 2009-03-16 20:16 26112 ----a-w c:\winnt\system32\Ati2mdxx.exe
2009-03-16 20:16 . 2009-03-16 20:16 43520 ----a-w c:\winnt\system32\ati2edxx.dll
2009-03-16 20:16 . 2009-03-16 20:16 155648 ----a-w c:\winnt\system32\ati2evxx.dll
2009-03-16 20:15 . 2009-03-16 20:15 602112 ----a-w c:\winnt\system32\ati2evxx.exe
2009-03-16 20:13 . 2009-03-16 20:13 53248 ----a-w c:\winnt\system32\ATIDDC.DLL
2009-03-16 20:06 . 2008-06-24 13:48 3820736 ------w c:\winnt\system32\ati3duag.dll
2009-03-16 20:04 . 2009-03-16 20:04 11563008 ----a-w c:\winnt\system32\atioglxx.dll
2009-03-16 19:53 . 2008-06-24 13:36 2675328 ------w c:\winnt\system32\ativvaxx.dll
2009-03-16 19:53 . 2009-03-16 19:53 887724 ----a-w c:\winnt\system32\ativva6x.dat
2009-03-16 19:53 . 2009-03-16 19:53 3107788 ----a-w c:\winnt\system32\ativva5x.dat
2009-03-16 19:40 . 2009-03-16 19:40 49664 ----a-w c:\winnt\system32\atimpc32.dll
2009-03-16 19:40 . 2009-03-16 19:40 49664 ----a-w c:\winnt\system32\amdpcom32.dll
2009-03-16 19:36 . 2009-03-16 19:36 475136 ----a-w c:\winnt\system32\atikvmag.dll
2009-03-16 19:35 . 2009-03-16 19:35 303104 ----a-w c:\winnt\system32\atiok3x2.dll
2009-03-16 19:35 . 2009-03-16 19:35 45056 ----a-w c:\winnt\system32\aticalrt.dll
2009-03-16 19:35 . 2009-03-16 19:35 131072 ----a-w c:\winnt\system32\atiadlxx.dll
2009-03-16 19:34 . 2009-03-16 19:34 45056 ----a-w c:\winnt\system32\aticalcl.dll
2009-03-16 19:34 . 2009-03-16 19:34 17408 ----a-w c:\winnt\system32\atitvo32.dll
2009-03-16 19:34 . 2009-03-16 19:34 53248 ----a-w c:\winnt\system32\drivers\ati2erec.dll
2009-03-16 19:33 . 2009-03-16 19:33 3264512 ----a-w c:\winnt\system32\aticaldd.dll
2009-03-16 19:28 . 2008-06-24 13:11 630784 ------w c:\winnt\system32\ati2cqag.dll
2009-03-06 21:06 . 2009-01-22 15:06 444952 ----a-w c:\winnt\system32\wrap_oal.dll
2009-03-06 21:06 . 2009-01-22 15:06 109080 ----a-w c:\winnt\system32\OpenAL32.dll
2009-03-06 14:01 . 2004-08-04 00:44 285696 ----a-w c:\winnt\system32\pdh.dll
2009-03-03 19:56 . 2009-03-03 19:56 118784 ----a-w c:\winnt\system32\atibtmon.exe
2009-02-26 17:05 . 2009-02-26 17:05 279712 ----a-w c:\winnt\system32\drivers\atksgt.sys
2009-02-26 17:05 . 2009-02-26 17:05 25888 ----a-w c:\winnt\system32\drivers\lirsgt.sys
2009-02-23 21:39 . 2009-02-23 21:39 184394 ----a-w c:\winnt\system32\atiicdxx.dat
2009-02-18 17:55 . 2009-02-18 17:55 294912 ----a-w c:\winnt\system32\ATIODE.exe
2009-02-09 13:56 . 2006-05-13 14:23 1847680 ----a-w c:\winnt\system32\win32k.sys
2009-02-09 11:45 . 2004-08-04 00:39 2022400 ----a-w c:\winnt\system32\ntkrnlpa.exe
2009-02-09 11:45 . 2006-05-13 14:21 2144256 ----a-w c:\winnt\system32\ntoskrnl.exe
2009-02-09 10:03 . 2006-05-13 14:25 401408 ----a-w c:\winnt\system32\rpcss.dll
2009-02-09 10:03 . 2006-05-13 14:20 730624 ----a-w c:\winnt\system32\lsasrv.dll
2009-02-09 10:03 . 2004-08-04 00:43 687104 ----a-w c:\winnt\system32\advapi32.dll
2009-02-09 10:03 . 2004-08-04 00:43 723456 ----a-w c:\winnt\system32\ntdll.dll
2009-02-09 09:55 . 2004-08-04 00:44 111104 ----a-w c:\winnt\system32\services.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\winnt\system32\ctfmon.exe” [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“egui”=“f:\programy\nod32\egui.exe” [2008-09-16 1447168]
“GrooveMonitor”=“f:\programy\office 2007\Office12\GrooveMonitor.exe” [2006-10-26 31016]
“Adobe Reader Speed Launcher”=“f:\programy\adobe reader\Reader\Reader_sl.exe” [2008-06-12 34672]
“NeroFilterCheck”=“c:\program files\Common Files\Ahead\Lib\NeroCheck.exe” [2008-02-27 570664]
“StartCCC”=“c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2009-03-17 61440]
“Ai Nap”=“f:\programy\ai suiteeee\AiNap\AiNap.exe” [2009-01-02 1427968]
“QFan Help”=“f:\programy\ai suiteeee\QFan3\QFanHelp.exe” [2009-03-09 598528]
“Cpu Level Up help”=“f:\programy\ai suiteeee\CpuLevelUpHelp.exe” [2007-11-30 881152]
“RivaTunerStartupDaemon”=“f:\programy\riva\RivaTuner v2.24\RivaTuner.exe” [2009-02-25 2781184]
“RTHDCPL”=“RTHDCPL.EXE” - c:\winnt\RTHDCPL.exe [2008-05-16 16862720]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\winnt\system32\CTFMON.EXE” [2004-08-04 15360]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“nlsf”=“move” [X]
“tscuninstall”=“c:\winnt\system32\tscupgrd.exe” [2004-08-04 44544]
c:\documents and settings\Sliniak\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - f:\programy\office 2007\Office12\ONENOTEM.EXE [2006-10-26 98632]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\WINNT\system32\PnkBstrA.exe”=
“c:\WINNT\system32\PnkBstrB.exe”=
“f:\programy\office 2007\Office12\OUTLOOK.EXE”=
“f:\programy\office 2007\Office12\GROOVE.EXE”=
“f:\programy\office 2007\Office12\ONENOTE.EXE”=
“e:\dead space\Dead Space.exe”=
“f:\utorrent.exe”=
“f:\programy\greedy torrent\GreedyTorrent\GTor.exe”=
“f:\gry\colin macre dirt\DiRT.exe”=
“e:\bornout paradise\BurnoutLauncher.exe”=
“e:\bornout paradise\BurnoutConfigTool.exe”=
“e:\bornout paradise\BurnoutParadise.exe”=
“f:\gry\lost planet\LostPlanetColoniesDX9.exe”=
“f:\gry\lost planet\LostPlanetColoniesDX10.exe”=
“f:\programy\x fire\Xfire\Xfire.exe”=
“e:\tom clancy hawx\HAWX.exe”=
“e:\world in conflict\wic.exe”=
“e:\world in conflict\wic_online.exe”=
“e:\world in conflict\wic_ds.exe”=
“e:\brother in arms\Brothers in Arms - Hell’s Highway\Binaries\biahh.exe”=
“f:\gry\comapny\RelicCOH.exe”=
“f:\gry\comapny\RelicDownloader\RelicDownloader.exe”=
“f:\gry\cryssis\Bin32\Crysis.exe”=
“f:\gry\cryssis\Bin32\CrysisDedicatedServer.exe”=
“f:\programy\opera\opera.exe”=
R0 mv61xx;mv61xx;c:\winnt\system32\drivers\mv61xx.sys [2008-06-24 150568]
R1 epfwtdir;epfwtdir;c:\winnt\system32\drivers\epfwtdir.sys [2008-08-18 34312]
R2 ekrn;Eset Service;f:\programy\nod32\ekrn.exe [2008-09-17 468224]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\winnt\system32\drivers\AtiHdmi.sys [2009-01-08 93696]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\winnt\system32\drivers\l1e51x86.sys [2009-01-07 36864]
S1 ntiomin;ntiomin; [x]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\winnt\system32\drivers\s816bus.sys [2009-01-21 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\winnt\system32\drivers\s816mdfl.sys [2009-01-21 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\winnt\system32\drivers\s816mdm.sys [2009-01-21 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\winnt\system32\drivers\s816mgmt.sys [2009-01-21 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\winnt\system32\drivers\s816nd5.sys [2009-01-21 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\winnt\system32\drivers\s816obex.sys [2009-01-21 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\winnt\system32\drivers\s816unic.sys [2009-01-21 97704]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{75bfbe5e-1b0d-11de-9786-0023540d3c70}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
“c:\program files\Common Files\LightScribe\LSRunOnce.exe”
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: E&ksportuj do programu Microsoft Excel - f:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-09 11:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1757981266-1078081533-725345543-1003\Software\SecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]
“??”=hex:ee,2e,d5,5f,10,93,6b,3f,56,65,7e,06,3a,26,47,12,e1,13,97,bd,b8,9e,f1,
7c,f0,67,03,61,be,34,de,44,fe,4e,29,f2,03,74,2f,9b,86,16,26,04,52,00,4f,e4,\
“??”=hex:fe,62,49,91,33,8b,bb,af,b5,b1,89,c9,1d,99,b0,f5
[HKEY_USERS\S-1-5-21-1757981266-1078081533-725345543-1003\Software\SecuROM\License information*]
“datasecu”=hex:ab,f0,ec,77,1d,fa,6f,4f,c9,e3,b2,e4,58,4c,05,2b,b1,5c,b1,fa,d5,
08,24,00,ab,dc,06,f4,fb,46,c6,48,20,69,bc,65,3d,e6,79,65,ad,8f,05,c8,76,42,\
“rkeysecu”=hex:30,54,49,b8,32,5d,43,d0,1c,52,96,87,2c,c2,a4,84
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
c:\winnt\system32\Ati2evxx.dll
c:\winnt\system32\msi.dll
.
Czas ukończenia: 2009-05-09 11:45
ComboFix-quarantined-files.txt 2009-05-09 09:45
Przed: 7 511 318 528 bajtów wolnych
Po: 7 498 665 984 bajtów wolnych
207 — E O F — 2009-04-20 20:18