ComboFix 09-06-26.02 - Administrator 09-06-27 15:16.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1781 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Właściciel\Pulpit\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
c:\program files\AntiSpywareShield
c:\program files\AntiSpywareShield\AntiSpywareShield.lic
c:\program files\AntiSpywareShield\Uninstall.exe
c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe
c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\4.bin\M9FFXTBR.JAR
c:\program files\myglobalsearch\bar\4.bin\M9FFXTBR.MANIFEST
c:\program files\myglobalsearch\bar\4.bin\M9NTSTBR.JAR
c:\program files\myglobalsearch\bar\4.bin\M9NTSTBR.MANIFEST
c:\program files\myglobalsearch\bar\4.bin\M9PLUGIN.DLL
c:\program files\myglobalsearch\bar\4.bin\MGSBAR.DLL
c:\program files\myglobalsearch\bar\4.bin\NPMYGLSH.DLL
c:\program files\myglobalsearch\bar\Cache\00028C19
c:\program files\myglobalsearch\bar\Cache\00846E67.bin
c:\program files\myglobalsearch\bar\Cache\008470F7.bin
c:\program files\myglobalsearch\bar\Cache\00B1A02B.bin
c:\program files\myglobalsearch\bar\Cache\01FEEEC4
c:\program files\myglobalsearch\bar\Cache\files.ini
c:\program files\myglobalsearch\bar\History\search
c:\program files\myglobalsearch\bar\Settings\prevcfg.htm
c:\windows\system32\_000110_.tmp.dll
c:\windows\system32\1037h.exe
c:\windows\system32\drivers\3165225a.sys
c:\windows\system32\msconfig.exe
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MNMSRVCRASMAN
-------\Service_mnmsrvcRasMan
((((((((((((((((((((((((( Pliki utworzone od 2009-05-27 do 2009-06-27 )))))))))))))))))))))))))))))))
.
2009-06-27 13:12 . 2009-06-27 13:12 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-06-27 10:46 . 2009-06-27 10:46 -------- d-----w- c:\program files\Trend Micro
2009-06-27 08:13 . 2009-06-27 08:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Electronic Arts
2009-06-27 08:12 . 2008-09-05 00:22 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2009-06-27 07:52 . 2009-06-27 07:52 -------- d-----w- c:\windows\system32\wbem\Repository
2009-06-27 07:52 . 2009-06-27 07:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Avira
2009-06-27 07:52 . 2009-06-27 07:52 -------- d-----w- c:\program files\BearShare Applications
2009-06-27 07:52 . 2009-06-27 07:52 -------- d-----w- c:\program files\BearShare
2009-06-27 07:52 . 2009-06-27 07:52 -------- d-----w- c:\program files\Avira
2009-06-27 07:50 . 2009-06-27 07:50 -------- d-----w- c:\program files\Avira(2)
2009-06-27 07:50 . 2009-06-27 07:50 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Avira(2)
2009-06-27 07:34 . 2009-06-27 07:52 -------- d-s---w- C:\ComboFix(2)
2009-06-26 19:23 . 2009-06-26 19:23 -------- d-----w- c:\program files\Microsoft WSE
2009-06-03 12:16 . 2009-06-03 16:38 32 --s-a-w- c:\windows\system32\3707680825.dat
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 08:12 . 2008-08-16 18:03 -------- d-----w- c:\program files\Electronic Arts
2009-06-27 08:01 . 2008-06-01 07:21 -------- d-----w- c:\program files\BeClean
2009-06-27 07:52 . 2007-11-03 19:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-27 07:16 . 2008-01-19 16:51 -------- d-----w- c:\program files\ESET
2009-05-28 15:43 . 2009-02-22 11:06 -------- d-----w- c:\program files\Nowe Gadu-Gadu
2009-05-27 05:59 . 2008-08-05 17:34 -------- d-----w- c:\program files\7-Zip
2009-05-15 21:59 . 2009-05-15 20:34 -------- d-----w- c:\program files\Empire Total War
2009-05-15 17:24 . 2008-01-03 21:25 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-05-07 15:34 . 2004-08-03 22:44 347648 ----a-w- c:\windows\system32\localspl.dll
2009-05-03 19:12 . 2008-01-21 17:37 -------- d-----w- c:\program files\Java
2009-05-03 19:11 . 2001-10-30 13:00 80664 ----a-w- c:\windows\system32\perfc015.dat
2009-05-03 19:11 . 2001-10-30 13:00 461370 ----a-w- c:\windows\system32\perfh015.dat
2009-04-28 17:21 . 2009-04-28 17:21 -------- d-----w- c:\program files\Lavalys
2009-04-19 19:51 . 2004-08-03 22:37 1847424 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:54 . 2004-08-03 22:44 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2008-01-30 12:10 . 2008-01-30 12:09 24 --sha-w- c:\windows\SDED97195.tmp
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-04-23 2165536]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-03-20 213936]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"RemoteControl8"="d:\programy\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="d:\programy\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-05-19 91432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-11-14 16270848]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-03-27 1657376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
"nLite"="c:\windows\inf\nlite.cmd" [2005-08-20 385]
c:\documents and settings\Waciciel\Menu Start\Programy\Autostart\
rncsys32.exe [2008-4-14 19456]
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-29 113664]
NCProTray.lnk - c:\program files\SEC\Natural Color Pro\NCProTray.exe [2008-8-5 49220]
updater.jar [2009-4-10 8217]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Corel MEDIA FOLDERS INDEXER 8.LNK]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Corel MEDIA FOLDERS INDEXER 8.LNK
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NOD32krn"=2 (0x2)
"PnkBstrA"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\PROGRAMY\\BearShare.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Ares\\Ares.exe"=
"d:\\PROGRAMY\\PowerDVD8\\PowerDVD8.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\newerwinter\\nwn2main.exe"=
"f:\\newerwinter\\nwn2main_amdxp.exe"=
"f:\\newerwinter\\nwupdate.exe"=
"f:\\newerwinter\\nwn2server.exe"=
"c:\\Documents and Settings\\Właściciel\\Pulpit\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56104:TCP"= 56104:TCP:utorrent4
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [06-07-05 14:46 63352]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};d:\programy\PowerDVD8\000.fcl [08-05-15 13:07 61424]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [08-01-06 17:08 58288]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [08-01-06 17:08 8336]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [08-01-06 17:08 94064]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [08-01-06 17:08 85408]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [08-01-06 17:08 83344]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [08-11-17 12:10 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [08-11-17 12:11 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [08-11-17 12:11 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [08-11-17 12:12 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [08-11-17 12:12 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [08-11-17 12:11 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [08-11-17 12:12 97704]
.
Zawartość folderu 'Zaplanowane zadania'
2009-06-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-ALLUpdate - d:\programy\ALLPlayer\ALLUpdate.exe
HKLM-Run-lsass.exe - c:\windows\lsass.exe
HKLM-Run-Internet Connection Wizard Setup Tool - c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
uInternet Settings,ProxyOverride = *.local
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\ha2ws9f0.default\
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
FF - plugin: d:\programy\Real Alternative\browser\plugins\nppl3260.dll
FF - plugin: d:\programy\Real Alternative\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-27 15:27
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
lsass.exe = c:\windows\lsass.exe?????????????????????????????
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\d:\programy\PowerDVD8\000.fcl"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-436374069-1708537768-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
[HKEY_USERS\S-1-5-21-436374069-1708537768-725345543-1003\SOFTWARE\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:7d,63,a4,1d,17,15,8b,4c,c6,f4,ff,f4,0f,c2,a9,04,3f,cd,35,79,13,5a,44,
e0,19,ba,c1,b4,11,9a,b2,83,3d,d0,c8,54,32,6d,2c,ca,c8,24,ad,75,e3,d1,ff,b1,\
"??"=hex:0e,61,f6,fb,54,00,04,51,10,ce,d1,82,f1,0e,a6,86
[HKEY_USERS\S-1-5-21-436374069-1708537768-725345543-1003\SOFTWARE\SecuROM\License information*]
"datasecu"=hex:82,b1,9a,e5,7f,c5,2a,2c,79,ac,af,c0,1e,c9,e6,8c,98,ba,79,30,07,
52,7a,6a,46,40,29,67,e8,99,ff,2d,1c,48,5b,92,da,23,5d,8c,7c,2c,24,25,ad,48,\
"rkeysecu"=hex:0c,30,bf,52,48,07,d2,8d,74,25,d1,c4,78,62,86,a4
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|˙˙˙˙¤•€|ů•6~*]
"AB141C35E9F4BF344B9FC010BB17F68A"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}\\Registered"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(1532)
c:\windows\system32\WPDShServiceObj.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\dllhost.exe
c:\program files\Canon\IJPLM\ijplmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\progra~1\MICROS~1\rapimgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-27 15:30 - komputer został uruchomiony ponownie [Właściciel]
ComboFix-quarantined-files.txt 2009-06-27 13:29
Przed: 9 134 252 032 bajtów wolnych
Po: 10 929 070 080 bajtów wolnych
244 --- E O F --- 2009-06-27 11:38[/code]
oto log z ComboFix nie wiem czy dobry bo robię to pierwszy raz w życiu. … niestety Hijackthis nie dał się uruchomić nawet w awaryjnym.
– Dodane 27.06.2009 (So) 15:38 –
zauważyłem że po skanowaniu i usunięciu całej masy plików przez ComboFix odblokował się dostęp do rejestru 
nie ma to jak Fachowcy - Wielkie dzięki . =D>