ComboFix 09-04-04.01 - Mapecisko 2009-04-10 14:48:13.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2559.1984 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Mapecisko\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((( Pliki utworzone od 2009-03-10 do 2009-04-10 )))))))))))))))))))))))))))))))
.
2009-04-10 14:29 . 2009-04-10 14:29
2009-04-10 13:54 . 2009-04-10 13:54 25,992 --a------ c:\windows\system32\pgdfgsvc.exe
2009-04-10 11:01 . 2009-04-10 13:58
2009-03-31 00:36 . 2009-03-31 00:33 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-03-31 00:15 . 2009-03-31 00:15
2009-03-31 00:14 . 2009-03-31 00:14
2009-03-31 00:14 . 2009-03-31 00:18
2009-03-30 20:07 . 2009-03-30 20:10
2009-03-29 16:02 . 2009-03-29 16:02
2009-03-26 14:33 . 2009-03-26 14:33
2009-03-26 02:27 . 2009-03-26 02:27
2009-03-26 02:26 . 2009-03-26 02:27
2009-03-22 23:00 . 2009-03-22 23:00
2009-03-22 22:47 . 2009-03-22 22:47
2009-03-21 00:55 . 2009-03-27 04:26 4,958,588 --------- c:\windows{00000002-00000000-00000004-00001102-00000008-10211102}.BAK
2009-03-21 00:55 . 2009-04-10 14:05 32,136 --a------ c:\windows\system32\BMXStateBkp-{00000002-00000000-00000004-00001102-00000008-10211102}.rfx
2009-03-21 00:55 . 2009-04-10 14:05 32,136 --a------ c:\windows\system32\BMXState-{00000002-00000000-00000004-00001102-00000008-10211102}.rfx
2009-03-21 00:55 . 2009-04-10 14:05 30,924 --a------ c:\windows\system32\BMXCtrlState-{00000002-00000000-00000004-00001102-00000008-10211102}.rfx
2009-03-21 00:55 . 2009-04-10 14:05 30,924 --a------ c:\windows\system32\BMXBkpCtrlState-{00000002-00000000-00000004-00001102-00000008-10211102}.rfx
2009-03-21 00:55 . 2009-04-10 14:05 11,564 --a------ c:\windows\system32\DVCState-{00000002-00000000-00000004-00001102-00000008-10211102}.rfx
2009-03-21 00:53 . 2009-03-27 04:26 4,958,588 --a------ c:\windows{00000002-00000000-00000004-00001102-00000008-10211102}.CDF
2009-03-20 14:10 . 2006-08-11 15:56 3,072 --a------ c:\windows\CTXFIRES.DLL
2009-03-20 13:14 . 2008-05-01 17:35 53,248 --a------ c:\windows\system32\CSVer.dll
2009-03-19 22:43 . 2009-03-19 22:43 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2009-03-19 22:04 . 2009-03-19 12:49 23,600 --a------ c:\windows\system32\drivers\TVICHW32.SYS
2009-03-19 13:31 . 2009-03-19 13:31
2009-03-19 13:31 . 2009-02-17 00:17 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-03-19 13:31 . 2009-02-18 15:44 453,152 --a------ c:\windows\system32\nvudisp.exe
2009-03-19 13:31 . 2009-04-10 14:07 212,973 --a------ c:\windows\system32\nvapps.xml
2009-03-19 13:31 . 2009-02-18 15:44 19,021 --a------ c:\windows\system32\nvdisp.nvu
2009-03-17 14:34 . 2009-03-17 14:34
2009-03-17 14:33 . 2009-03-17 14:33
2009-03-16 19:31 . 2009-03-29 15:59
2009-03-15 23:05 . 2009-03-15 23:05
2009-03-13 23:17 . 2009-03-16 20:36 189,784 --a------ c:\windows\system32\PnkBstrB.xtr
2009-03-12 02:36 . 2009-03-12 02:36 409,280 --a------ c:\windows\system32\HDDSvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-10 11:48 --------- d-----w c:\program files\Mozilla Thunderbird
2009-04-10 09:31 --------- d-s—w c:\program files\Xfire
2009-04-10 09:31 --------- d-----w c:\program files\NAPI-PROJEKT
2009-04-10 09:31 --------- d-----w c:\program files\FlashGet
2009-04-10 09:31 --------- d-----w c:\program files\DC++
2009-04-10 09:30 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\uTorrent
2009-03-30 16:10 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-30 16:08 --------- d-----w c:\program files\Sytexis Software
2009-03-29 14:28 --------- d-----w c:\program files\Winamp
2009-03-29 14:23 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-29 14:23 --------- d-----w c:\program files\Java
2009-03-27 15:48 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\Nowe Gadu-Gadu
2009-03-26 12:36 75,064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-03-26 12:36 189,784 ----a-w c:\windows\system32\PnkBstrB.exe
2009-03-26 12:36 138,944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-26 12:34 22,328 ----a-w c:\documents and settings\Mapecisko\Dane aplikacji\PnkBstrK.sys
2009-03-26 12:33 2,246,144 ----a-w c:\windows\system32\pbsvc.exe
2009-03-24 11:03 7,808 ----a-w c:\windows\system32\drivers\psi_mf.sys
2009-03-22 20:48 --------- d-----w c:\program files\HP
2009-03-20 22:54 --------- d–h--w c:\program files\InstallShield Installation Information
2009-03-20 22:53 444,952 ----a-w c:\windows\system32\wrap_oal.dll
2009-03-20 22:53 109,080 ----a-w c:\windows\system32\OpenAL32.dll
2009-03-19 10:57 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\The Creative Assembly
2009-03-16 17:43 --------- d-----w c:\program files\Google
2009-03-16 15:46 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\My Games
2009-03-11 16:22 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2009-03-04 17:25 --------- d-----w c:\program files\Real Alternative
2009-03-02 18:44 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\id Software
2009-02-27 06:04 --------- d-----w c:\program files\NOS
2009-02-27 06:04 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NOS
2009-02-26 14:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro
2009-02-26 11:50 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-21 10:16 --------- d-----w c:\documents and settings\Mapecisko\Dane aplikacji\Sports Interactive
2009-02-12 10:37 --------- d-----w c:\program files\ESET
2009-02-09 14:07 1,847,040 ----a-w c:\windows\system32\win32k.sys
2008-04-17 08:34 1 ----a-w c:\documents and settings\Mapecisko\SI.bin
2008-07-15 18:10 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008071520080716\index.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Steam”=“d:\gry\steam\steam.exe” [2009-03-11 1410296]
“Nowe Gadu-Gadu”=“c:\program files\Nowe Gadu-Gadu\gg.exe” [2009-02-27 9339496]
“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“AudioDrvEmulator”=“c:\program files\Creative\Shared Files\Module Loader\DLLML.exe” [2005-06-16 49152]
“UpdReg”=“c:\windows\UpdReg.EXE” [2000-05-11 90112]
“SSBkgdUpdate”=“c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe” [2003-09-30 155648]
“NvMediaCenter”=“c:\windows\system32\NvMcTray.dll” [2009-02-18 86016]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2009-02-18 13680640]
“egui”=“c:\program files\ESET\ESET NOD32 Antivirus\egui.exe” [2009-02-06 2021400]
“MSConfig”=“c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE” [2008-04-14 171520]
“nwiz”=“nwiz.exe” [2009-02-18 c:\windows\system32\nwiz.exe]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2008-02-21 950272]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
“NoViewOnDrive”= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“vidc.iv31”= c:\windows\system32\ir32_32.dll
“vidc.iv32”= c:\windows\system32\ir32_32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=“Service”
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^MP3 Dancer.lnk]
backup=c:\windows\pss\MP3 Dancer.lnkStartup
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=c:\windows\pss\OpenOffice.org 2.2.lnkStartup
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^Registration Assassin’s Creed.LNK]
path=c:\documents and settings\Mapecisko\Menu Start\Programy\Autostart\Registration Assassin’s Creed.LNK
backup=c:\windows\pss\Registration Assassin’s Creed.LNKStartup
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^Rejestracja FIFA 09.lnk]
path=c:\documents and settings\Mapecisko\Menu Start\Programy\Autostart\Rejestracja FIFA 09.lnk
backup=c:\windows\pss\Rejestracja FIFA 09.lnkStartup
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^Secunia PSI.lnk]
path=c:\documents and settings\Mapecisko\Menu Start\Programy\Autostart\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup
[HKLM~\startupfolder\C:^Documents and Settings^Mapecisko^Menu Start^Programy^Autostart^The Matrix_ Path of Neo Registration.lnk]
backup=c:\windows\pss\The Matrix_ Path of Neo Registration.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABRegmon
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcaCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoConnect
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AvMenu
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
–a------ 2009-03-31 00:23 515416 c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a------ 2009-02-27 18:10 35696 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
–a------ 2008-10-26 12:23 4608 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
--------- 2003-06-18 02:00 45056 c:\program files\Instalki\Creative\SBAudigy4\DVDAudio\CTDVDDET.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
--------- 2005-02-15 17:10 57344 c:\program files\Instalki\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
–a------ 2007-09-06 15:08 136136 c:\program files\DAEMON Tools Pro\DTProAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
–a------ 2009-02-06 20:17 3325952 c:\program files\Electronic Arts\EADM\Core.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a------ 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a------ 2007-05-08 17:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a------ 2004-04-17 13:41 196608 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a------ 2004-04-13 07:07 69632 c:\program files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD]
–a------ 2008-08-16 16:01 264704 c:\program files\Odkurzacz\odk_mcd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF3 Registry Controller]
–a------ 2005-04-12 10:16 106496 c:\program files\ScanSoft\OmniPage15.0\PDFConverter3\registrycontroller.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-06-13 08:16 528384 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
–a------ 2004-04-23 14:28 77824 c:\program files\Logitech\Profiler\LWEMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a------ 2009-03-29 16:23 148888 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
–a------ 2006-09-07 19:19 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a------ 2008-06-27 18:24 19456 c:\windows\system32\CtHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
–a------ 2006-08-11 15:56 18944 c:\windows\system32\CTXFIHLP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
“NBService”=3 (0x3)
“O&O Defrag”=2 (0x2)
“Pml Driver HPZ12”=2 (0x2)
“WMPNetworkSvc”=3 (0x3)
“WLSetupSvc”=3 (0x3)
“Symantec Core LC”=3 (0x3)
“StarWindServiceAE”=2 (0x2)
“Speed Disk service”=2 (0x2)
“rpcapd”=3 (0x3)
“PnkBstrB”=2 (0x2)
“PnkBstrA”=2 (0x2)
“ose”=3 (0x3)
“odserv”=3 (0x3)
“NVSvc”=2 (0x2)
“NProtectService”=2 (0x2)
“NMIndexingService”=3 (0x3)
“Microsoft Office Groove Audit Service”=3 (0x3)
“LiveUpdate”=3 (0x3)
“JavaQuickStarterService”=2 (0x2)
“idsvc”=3 (0x3)
“IDriverT”=3 (0x3)
“gupdate1c985f67b2c458”=2 (0x2)
“CLTNetCnService”=2 (0x2)
“ccSetMgr”=2 (0x2)
“ccEvtMgr”=2 (0x2)
“Automatic LiveUpdate Scheduler”=2 (0x2)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“c:\Program Files\Java\jre1.5.0_11\bin\javaw.exe”=
“c:\Program Files\Instalki\SopCast\SopCast.exe”=
“c:\Documents and Settings\Mapecisko\Dane aplikacji\SopCast\adv\SopAdver.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hposid01.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe”=
“c:\Program Files\DC++\DCPlusPlus.exe”=
“c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”=
“c:\Program Files\Microsoft Office\Office12\GROOVE.EXE”=
“c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”=
“c:\Program Files\Windows Media Player\wmplayer.exe”=
“c:\WINDOWS\system32\PnkBstrA.exe”=
“c:\WINDOWS\system32\PnkBstrB.exe”=
“c:\Program Files\Instalki\SopCast\adv\SopAdver.exe”=
“d:\Gry\Command & Conquer 3\RetailExe\1.9\cnc3game.dat”=
“c:\Program Files\Instalki\uTorrent\utorrent.exe”=
“d:\Gry\Command & Conquer 3 Gniew Kane’a\RetailExe\1.1\cnc3ep1.dat”=
“c:\Program Files\Electronic Arts\EADM\Core.exe”=
“d:\Gry\FIFA 09\FIFA09.exe”=
“c:\Program Files\Java\jre6\bin\java.exe”=
“c:\Program Files\Nowe Gadu-Gadu\gg.exe”=
“c:\Program Files\Mozilla Firefox\firefox.exe”=
“d:\Gry\Steam\Steam.exe”=
“d:\Gry\Steam\steamapps\common\football manager 2009\fm.exe”=
“d:\Gry\Steam\steamapps\common\empire total war\Empire.exe”=
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“11138:TCP”= 11138:TCP:*:Disabled:BitComet 11138 TCP
“11138:UDP”= 11138:UDP:*:Disabled:BitComet 11138 UDP
“54271:TCP”= 54271:TCP:ble
“54271:UDP”= 54271:UDP:ble2
“8461:TCP”= 8461:TCP:GoD High Port
“8462:TCP”= 8462:TCP:GoD Low Port
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-02-06 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2008-06-27 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2008-06-27 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2008-06-27 566296]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2008-02-21 450560]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2008-06-27 99352]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2008-06-27 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2008-06-27 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2008-06-27 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2008-06-27 566296]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 PciCon;PciCon;??\e:\pcicon.sys --> e:\PciCon.sys [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-11-18 7808]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2008-07-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2008-07-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2008-07-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2008-07-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2008-07-23 98568]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2008-07-23 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [2008-07-23 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [2008-07-23 107304]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [2008-07-24 97320]
S4 gupdate1c985f67b2c458;Google Update Service (gupdate1c985f67b2c458);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 133104]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{4f9e85ef-e099-11db-aca1-000e5012c466}]
\Shell\AutoRun\command - F:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{9fbd8b79-1e3d-11de-8587-0060b39c6a97}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Zawartość folderu ‘Zaplanowane zadania’
2009-03-30 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-31 00:24]
2009-02-12 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 13:53]
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-Creative Detector - c:\program files\instalki\Creative\MediaSource\Detector\CTDetect.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
MSConfigStartUp-NSWosCheck - c:\program files\Norton SystemWorks\osCheck.exe
MSConfigStartUp-RivaTunerStartupDaemon - c:\program files\RivaTuner v2.24\RivaTuner.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.windowsxlive.net
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open with Scansoft PDF Converter 3.0 - c:\program files\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /100
FF - ProfilePath - c:\documents and settings\Mapecisko\Dane aplikacji\Mozilla\Firefox\Profiles\zsi28n3x.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (pl)
FF - prefs.js: browser.startup.homepage - www.onet.pl
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-10 14:49:35
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1275210071-329068152-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved{F4665055-F5A6-55F8-E304-CBF57F5419EC}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
“ialplbahommabhibgg”=hex:6b,61,68,69,6e,63,6b,6c,62,64,6b,63,64,64,62,6c,6f,69,
6f,67,61,61,00,00
“habobbeaklejghcp”=hex:6b,61,68,69,6e,63,6b,6c,62,64,6b,63,64,64,62,6c,6f,69,
6f,67,61,61,00,00
[HKEY_USERS\S-1-5-21-1275210071-329068152-725345543-1003\Software\SecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]
“??”=hex:3d,08,19,54,05,2f,9e,67,49,86,7d,61,cf,b8,84,18,47,92,cd,78,13,7d,1c,
23,38,a6,47,08,76,30,b2,ec,bb,6f,55,0d,b4,3c,12,a7,90,f3,48,92,51,64,d2,0e,\
“??”=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa
[HKEY_USERS\S-1-5-21-1275210071-329068152-725345543-1003\Software\SecuROM\License information*]
“datasecu”=hex:77,60,62,17,38,63,0d,1d,d4,93,2c,c5,c0,79,8a,19,4a,28,a5,32,fa,
fa,e5,5f,72,99,20,22,38,a7,72,bc,0b,2d,a6,d0,ae,e2,99,e2,f7,dc,7c,87,cd,82,\
“rkeysecu”=hex:30,52,ae,7f,ce,50,68,72,ce,fd,98,82,04,6e,4c,91
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
“OODEFRAG08.00.00.01WORKSTATION”=“9AC9CF182A839282D3B70CBECE3F01E84CAB0515C8277F3168AC8525B59D2AC4D1825A82EE654A8127A699F103B1304EC1F37BEAC0820B7A86B73BDD53D9DCF8C67F1757E839F261B44BC867EF74F744E583AA61DFCF93D263BD556517F1154C525AD7404125B4CB1DE6FE15D564E15640DDABDB1E4122BE92A939AB528F7BE1AF80745945E57AA0E68A22631CF4B93C3F5A132F9A9D03F70837CF11FC6B7F0D7D35C731624CF371F71D1F2FC9298E6835240125163FC9E99FF5866FB0565359BE0DAFCCAEBC93059E59E44A8CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DFEBC9E127BECC74C8EDD5E5BE2F6E667331BEBBD2FD22B0ADC559D65448669AD0D5C9BAE41B10295BF70831133493EE98171A8C2FE900E266E5F0E2A041EF95403E445E21E71DA5940798B4A651D68CF968DC029CA7815EFA94A2EDE01E83A8C61DF152A3437971CC7611B79917819543A3A77CB2081FBD26DA3FBA56CEE345A3939E6917AB92C9B3B968B339564528EC784C0EBE2A572DF28B8A9084DBAE2E730A2CA0ABD37053A1649E97222ED8B3AAD40462A46641CC9DF1E9F73FEDD3902FD0E82E81DEFFEFD67EE74153B2630366F03668F553F1369AAAA76362F6A1C18F13507680BA76C10CE40235D3BA41F8425A53208EDBD61BA35787D86607963416C1303255227934085BA9B724D822ACD7948EE62C16A085CC167B7FA6BA5DC34E26957A08CBBAE7DD49F3CDEF2DC9A5AAC4B1750D5D3F993229BDA12F98ECA4FDEBB9540A9B66BDF9974941001552A9B90D5D66C850CA04841F951AA0AD75F93FBD186CDECEA6A21C70169D9A09207A30DD110AF7CAAD78419B0B90AEEA9C5A36DB7A67770B2C39D655333704D3D56A81D6D59FA3E4AEDFABA2BE75750301A4BF7BDA2CC9D6A02D90CBD1FEF59822D05509BF98F200929FCC9A0E1A028996E76757860C4B67120F96B520C57681517B94A11F217CA0ABF84000560D5449A47B5523F77B6CC2D92C643ED9007F3AA936842C8729C3E73DFACA894544AC8EA9CBD102FB1E2C786BEB0EB2AF34747FB95588280DF8F4A70A7B324CF5EB8ADC55CE7432810E7E5EAFEC8CF6BB2C006470474EA3B544215AF2B80E677D5BA3BE9E73116CDC6CDB4492144EB547E83224E3ACA6FBD9C6C9963F39979144652909D14B9C5083A7C1A97E67DD34FBA81E6D607109693BBA9A3C1FCAA77F06CE222252A48A30509414B4D06F12C090090EEAAAC197C8AE57A5706B583121DBCB6B44E66C393B181CCD568A944B0739B6B2B16E2E1CE340640A8EF03188C6BDA7865E8F93912C5A7B61869EEB930C28D30E1EB5589D266B7C3E1403D01BFF12438A0C8895BA8B6B277C7D3E83C0A7189E1AB81A152DDBCCD”
.
Czas ukończenia: 2009-04-10 14:51:23
ComboFix-quarantined-files.txt 2009-04-10 12:51:21
Przed: 7 126 491 136 bajtów wolnych
Po: 7,703,166,976 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect
348 — E O F — 2009-03-15 21:00:52