Laptop działa z wielosekundowym opóźnieniem

[TheBhoy (Maciekbum2001)]

Nagle po uruchomieniu lapek zaczął mulić, gry przestały chodzić i zaczęły pojawiać się dziwne problemy, poda skany combofix oraz silent runners:

“Silent Runners.vbs”, revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS.0\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “IgfxTray” = “C:\WINDOWS.0\system32\igfxtray.exe” [“Intel Corporation”] “HotKeysCmds” = “C:\WINDOWS.0\system32\hkcmd.exe” [“Intel Corporation”] “Persistence” = “C:\WINDOWS.0\system32\igfxpers.exe” [“Intel Corporation”] “High Definition Audio Property Page Shortcut” = “HDAShCut.exe” [“Windows ® Server 2003 DDK provider”] “GrooveMonitor” = ““C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe”” [MS] “Adobe Reader Speed Launcher” = ““C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”” [“Adobe Systems Incorporated”] “avgnt” = ““C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min” [“Avira GmbH”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {18DF081C-E8AD-4283-A596-FA578C2EBDC3}(Default) = “AcroIEHelperStub” -> {HKLM…CLSID} = “Adobe PDF Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll” [“Adobe Systems Incorporated”] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}(Default) = (no title provided) -> {HKLM…CLSID} = “Groove GFS Browser Helper” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS.0\system32\hticons.dll” [“Hilgraeve, Inc.”] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS.0\system32\shdocvw.dll” [MS] “{0561EC90-CE54-4f0c-9C55-E226110A740C}” = “Haali Column Provider” -> {HKLM…CLSID} = “Haali Column Provider” \InProcServer32(Default) = “C:\Program Files\Codec\Haali\mmfinfo.dll” [null data] “{5574006C-28F5-4a65-A28C-74DE6BFBE0BB}” = “Haali Matroska Shell Property Page” -> {HKLM…CLSID} = “Haali Matroska Shell Property Page” \InProcServer32(Default) = “C:\Program Files\Codec\Haali\mmfinfo.dll” [null data] “{327669A0-59A7-4be9-B99E-1C9F3A57611A}” = “Haali Matroska Thumbnail Extractor” -> {HKLM…CLSID} = “Haali Matroska Thumbnail Extractor” \InProcServer32(Default) = “C:\Program Files\Codec\Haali\mmfinfo.dll” [null data] “{72853161-30C5-4D22-B7F9-0BBC1D38A37E}” = “Groove GFS Browser Helper” -> {HKLM…CLSID} = “Groove GFS Browser Helper” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}” = “Groove GFS Explorer Bar” -> {HKLM…CLSID} = “Groove Folder Synchronization” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{A449600E-1DC6-4232-B948-9BD794D62056}” = “Groove GFS Stub Icon Handler” -> {HKLM…CLSID} = “Groove GFS Stub Icon Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}” = “Groove GFS Stub Execution Hook” -> {HKLM…CLSID} = “Groove GFS Stub Execution Hook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{6C467336-8281-4E60-8204-430CED96822D}” = “Groove GFS Context Menu Handler” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{387E725D-DC16-4D76-B310-2C93ED4752A0}” = “Groove XML Icon Handler” -> {HKLM…CLSID} = “Groove XML Icon Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{16F3DD56-1AF5-4347-846D-7C10C4192619}” = “Groove Explorer Icon Overlay 3 (GFS Folder)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 3 (GFS Folder)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}” = “Groove Explorer Icon Overlay 2 (GFS Stub)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 2 (GFS Stub)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}” = “Groove Explorer Icon Overlay 4 (GFS Unread Mark)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 4 (GFS Unread Mark)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{99FD978C-D287-4F50-827F-B2C658EDA8E7}” = “Groove Explorer Icon Overlay 1 (GFS Unread Stub)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 1 (GFS Unread Stub)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{920E6DB1-9907-4370-B3A0-BAFC03D81399}” = “Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Outlook File Icon Extension” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL” [MS] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL” [MS] “{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}” = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” -> {HKLM…CLSID} = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office12\msohevi.dll” [MS] “{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}” = “Microsoft Office Metadata Handler” -> {HKLM…CLSID} = “Microsoft Office Metadata Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}” = “Microsoft Office Thumbnail Handler” -> {HKLM…CLSID} = “Microsoft Office Thumbnail Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” = “Shell Extension for Malware scanning” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files\Avira\AntiVir Desktop\shlext.dll” [“Avira GmbH”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}” = “Groove GFS Stub Execution Hook” -> {HKLM…CLSID} = “Groove GFS Stub Execution Hook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS.0\system32\wpdshserviceobj.dll” [MS] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807563E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = “Microsoft Office InfoPath XML Mime Filter” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL” [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {0561EC90-CE54-4f0c-9C55-E226110A740C}(Default) = “Haali Column Provider” -> {HKLM…CLSID} = “Haali Column Provider” \InProcServer32(Default) = “C:\Program Files\Codec\Haali\mmfinfo.dll” [null data] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files\Avira\AntiVir Desktop\shlext.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Program Files\Avira\AntiVir Desktop\shlext.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] Default executables: -------------------- <> HKLM\SOFTWARE\Classes.com(Default) = “ComFile” Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoDrives” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoDrives” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “DisableRegistryTools” = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS.0\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ “Provider” = “Media Player Classic” “InvokeProgID” = “MediaPlayerClassic.Autorun” “InvokeVerb” = “PlayCDAudio” HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command(Default) = ““C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe” %1 /cd” [“Gabest”] MPCPlayDVDMovieOnArrival\ “Provider” = “Media Player Classic” “InvokeProgID” = “MediaPlayerClassic.Autorun” “InvokeVerb” = “PlayDVDMovie” HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command(Default) = ““C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe” %1 /dvd” [“Gabest”] MPCPlayMusicFilesOnArrival\ “Provider” = “Media Player Classic” “InvokeProgID” = “MediaPlayerClassic.Autorun” “InvokeVerb” = “PlayMusicFiles” HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command(Default) = ““C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe” %1” [“Gabest”] MPCPlayVideoFilesOnArrival\ “Provider” = “Media Player Classic” “InvokeProgID” = “MediaPlayerClassic.Autorun” “InvokeVerb” = “PlayVideoFiles” HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command(Default) = ““C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe” %1” [“Gabest”] MSWPDShellNamespaceHandler\ “Provider” = “@%SystemRoot%\System32\WPDShextRes.dll,-501” “CLSID” = “{A55803CC-4D53-404c-8557-FD63DBA95D24}” “InitCmdLine” = " " -> {HKLM…CLSID} = “WPDShextAutoplay” \LocalServer32(Default) = “C:\WINDOWS.0\system32\WPDShextAutoplay.exe” [MS] Picasa2ImportPicturesOnArrival\ “Provider” = “Picasa3” “InvokeProgID” = “picasa2.autoplay” “InvokeVerb” = “import” HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command(Default) = "C:\Program Files\Google\Picasa3\Picasa3.exe “%1"” [“Google Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}(Default) = “Groove Folder Synchronization” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\SOFTWARE\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Poszukaj” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {2670000A-7350-4F3C-8081-5663EE0C6C49}\ “ButtonText” = “Wyślij do programu OneNote” “MenuText” = “Wyślij &do programu OneNote” “CLSIDExtension” = “{48E73304-E1D6-4330-914C-F5F514E3486C}” -> {HKLM…CLSID} = “Send to OneNote from Internet Explorer button” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll” [MS] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Research” {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Avira AntiVir Guard, AntiVirService, ““C:\Program Files\Avira\AntiVir Desktop\avguard.exe”” [“Avira GmbH”] Avira AntiVir Scheduler, AntiVirSchedulerService, ““C:\Program Files\Avira\AntiVir Desktop\sched.exe”” [“Avira GmbH”] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Send To Microsoft OneNote Monitor\Driver = “msonpmon.dll” [MS] ---------- (launch time: 2009-05-26 17:23:53) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 34 seconds. ---------- (total run time: 77 seconds)

ComboFix 09-05-25.A2 - Maciek 2009-05-26 17:18.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1015.676 [GMT 2:00] Uruchomiony z: c:\documents and settings\Maciek.NAROD-851194F75\Pulpit\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2009-04-26 do 2009-05-26 ))))))))))))))))))))))))))))))) . 2009-05-25 21:45 . 2009-05-25 21:46 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\Media Player Classic 2009-05-24 11:40 . 2009-03-30 08:33 96104 ----a-w c:\windows.0\system32\drivers\avipbb.sys 2009-05-24 11:40 . 2009-02-13 10:29 22360 ----a-w c:\windows.0\system32\drivers\avgntmgr.sys 2009-05-24 11:40 . 2009-02-13 10:17 45416 ----a-w c:\windows.0\system32\drivers\avgntdd.sys 2009-05-24 11:38 . 2009-05-24 11:38 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Dane aplikacji\Avira 2009-05-24 00:07 . 2009-05-24 00:07 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\DivX 2009-05-19 18:36 . 2009-05-19 18:37 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\Adobe 2009-05-18 13:22 . 2006-10-26 17:56 32592 ----a-w c:\windows.0\system32\msonpmon.dll 2009-05-18 13:21 . 2009-05-18 13:21 -------- d-----w c:\program files\Microsoft Works 2009-05-18 13:21 . 2009-05-18 13:21 -------- d-----w c:\program files\MSBuild 2009-05-18 13:15 . 2009-05-18 13:20 -------- d-----w c:\windows.0\SHELLNEW 2009-05-18 13:15 . 2009-05-18 13:15 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\Microsoft Help 2009-05-18 13:15 . 2009-05-18 13:23 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Dane aplikacji\Microsoft Help 2009-05-18 13:14 . 2009-05-18 13:14 -------- d–h--r C:\MSOCache 2009-05-18 12:24 . 2009-05-18 12:46 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\gtk-2.0 2009-05-18 12:23 . 2009-05-18 12:23 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75.thumbnails 2009-05-18 12:23 . 2009-05-18 12:50 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75.gimp-2.6 2009-05-18 12:23 . 2009-05-18 12:23 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75.gegl-0.0 2009-05-18 12:21 . 2008-11-20 19:19 9200 ------w c:\windows.0\system32\drivers\cdralw2k.sys 2009-05-18 12:21 . 2008-11-20 19:19 9072 ------w c:\windows.0\system32\drivers\cdr4_xp.sys 2009-05-18 12:21 . 2009-05-18 12:21 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\Google 2009-05-18 12:20 . 2009-05-18 12:20 -------- d-----w c:\windows.0\system32\IOSUBSYS 2009-05-18 12:20 . 2009-05-18 12:20 -------- d-----w c:\program files\Google 2009-05-18 12:19 . 2009-05-18 12:19 -------- d-----w c:\program files\GIMP-2.0 2009-05-17 22:05 . 1996-01-09 08:38 283648 ----a-w c:\windows.0\uninst.exe 2009-05-17 22:03 . 2009-05-17 22:03 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\WINDOWS 2009-05-17 21:59 . 2009-05-17 21:59 107888 ----a-w c:\windows.0\system32\CmdLineExt.dll 2009-05-17 21:59 . 2009-05-17 21:59 -------- d–h--r c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\SecuROM 2009-05-17 21:56 . 2009-05-17 21:58 -------- d–h--w c:\program files\Zero G Registry 2009-05-17 21:56 . 2009-05-17 21:56 -------- d-----w c:\program files\Sports Interactive 2009-05-17 21:56 . 2009-05-17 21:56 -------- d–h--w c:\documents and settings\Maciek.NAROD-851194F75\InstallAnywhere 2009-05-17 21:55 . 2009-05-17 22:07 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\Sports Interactive 2009-05-17 12:23 . 2009-05-17 12:23 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\TVU Networks 2009-05-17 12:23 . 2009-05-17 12:23 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\LocalLow 2009-05-17 12:23 . 2009-05-17 12:23 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Dane aplikacji\TVU Networks 2009-05-17 12:23 . 2009-05-17 12:23 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\LocalLow 2009-05-17 12:23 . 2009-05-17 12:23 -------- d-----w c:\program files\TVUPlayer 2009-05-17 02:25 . 2009-05-17 02:25 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Dane aplikacji\Gadu-Gadu 2009-05-15 21:12 . 2009-05-17 19:15 -------- d-----w c:\documents and settings\Maciek.NAROD-851194F75\Gadu-Gadu 2009-05-15 19:00 . 2001-08-17 21:59 3072 ----a-w c:\windows.0\system32\drivers\audstub.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-25 21:48 . 2009-05-25 21:48 -------- d-----w c:\program files\K-Lite Codec Pack 2009-05-24 17:42 . 2009-05-14 22:09 -------- d–h--w c:\program files\InstallShield Installation Information 2009-05-18 18:04 . 2009-05-15 17:52 69128 ----a-w c:\documents and settings\Maciek.NAROD-851194F75\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-05-17 17:20 . 2009-05-14 22:36 -------- d-----w c:\program files\Gadu-Gadu 2009-05-17 10:35 . 2009-05-15 17:15 86339 ----a-w c:\windows.0\pchealth\helpctr\OfflineCache\index.dat 2009-05-15 18:04 . 2009-05-14 22:15 -------- d-----w c:\program files\Realtek 2009-05-15 17:55 . 2001-10-26 16:15 49910 ----a-w c:\windows.0\system32\perfc015.dat 2009-05-15 17:55 . 2001-10-26 16:15 356068 ----a-w c:\windows.0\system32\perfh015.dat 2009-05-15 17:54 . 2009-05-15 17:54 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Dane aplikacji\Atheros 2009-05-15 17:48 . 2009-05-15 17:48 -------- d-----w c:\program files\Codec 2009-05-15 17:11 . 2009-05-15 17:11 21856 ----a-w c:\windows.0\system32\emptyregdb.dat 2009-05-15 17:10 . 2009-05-15 17:10 -------- d-----w c:\program files\Windows Media Connect 2 2009-05-15 09:56 . 2009-05-15 09:55 -------- d-----w c:\program files\Common Files\Adobe 2009-05-14 23:21 . 2009-05-14 23:21 -------- d-----w c:\documents and settings\Maciek\Dane aplikacji\Gadu-Gadu 2009-05-14 23:20 . 2009-05-14 23:20 -------- d-----w c:\program files\Eidos Interactive 2009-05-14 22:32 . 2009-05-14 22:32 -------- d-----w c:\program files\Avira 2009-05-14 22:14 . 2009-05-14 22:14 -------- d-----w c:\program files\Atheros 2009-05-14 22:14 . 2009-05-14 22:10 -------- d-----w c:\program files\Common Files\InstallShield 2009-05-14 22:09 . 2009-05-14 22:09 -------- d-----w c:\program files\TOSHIBA 2009-05-14 22:08 . 2009-05-14 22:08 -------- d-----w c:\documents and settings\Maciek\Dane aplikacji\InstallShield 2009-05-14 22:08 . 2009-05-14 22:08 -------- d-----w c:\program files\ltmoh 2009-05-14 22:06 . 2009-05-14 22:06 -------- d-----w c:\program files\Intel 2009-05-14 21:55 . 2009-05-14 21:55 -------- d-----w c:\program files\microsoft frontpage 2009-05-14 21:52 . 2009-05-14 21:52 -------- d-----w c:\program files\Usługi online 2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w c:\windows.0\system32\GPhotos.scr 2009-03-24 14:08 . 2009-05-14 22:32 55640 ----a-w c:\windows.0\system32\drivers\avgntflt.sys . ------- Sigcheck ------- [-] 2008-05-08 18:02 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows.0\system32\drivers\tcpip.sys [-] 2008-05-08 18:02 1571840 9F02C1CF7C3100E4AEA7DD8B6A86A01B c:\windows.0\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows.0\system32\ctfmon.exe” [2008-04-14 15360] “Gadu-Gadu”=“c:\program files\Gadu-Gadu\gg.exe” [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IgfxTray”=“c:\windows.0\system32\igfxtray.exe” [2007-08-24 135168] “HotKeysCmds”=“c:\windows.0\system32\hkcmd.exe” [2007-08-24 159744] “Persistence”=“c:\windows.0\system32\igfxpers.exe” [2007-08-24 131072] “GrooveMonitor”=“c:\program files\Microsoft Office\Office12\GrooveMonitor.exe” [2006-10-26 31016] “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2009-02-27 35696] “avgnt”=“c:\program files\Avira\AntiVir Desktop\avgnt.exe” [2009-03-02 209153] “High Definition Audio Property Page Shortcut”=“HDAShCut.exe” - c:\windows.0\system32\HDAShCut.exe [2005-01-08 61952] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows.0\system32\CTFMON.EXE” [2008-04-14 15360] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] “nltide_2”=“shell32” [X] [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\Network Diagnostic\xpnetdiag.exe”= “%windir%\system32\sessmgr.exe”= “c:\Documents and Settings\Maciek.NAROD-851194F75\Pulpit\Call of Duty\CoDMP.exe”= “c:\Program Files\Gadu-Gadu\gg.exe”= “c:\Program Files\TVUPlayer\TVUPlayer.exe”= “c:\Program Files\Sports Interactive\Football Manager 2008\fm.exe”= “c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”= “c:\Program Files\Microsoft Office\Office12\GROOVE.EXE”= “c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-15 108289] . - - - - USUNIĘTO PUSTE WPISY - - - - SafeBoot-procexp90.Sys . ------- Skan uzupełniający ------- . IE: Add to Google Photos Screensa&ver - c:\windows.0\system32\GPhotos.scr/200 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-26 17:20 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-05-26 17:21 ComboFix-quarantined-files.txt 2009-05-26 15:21 Przed: 30 113 763 328 bajtów wolnych Po: 30 280 597 504 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0 [operating systems] c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Home Edition” /noexecute=optin /fastdetect 148