ComboFix 08-11-29.03 - MasterAdmin 2008-11-30 13:24:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2999 [GMT 0:00]
Uruchomiony z: g:\instalki\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\MasterAdmin\Dane aplikacji\inst.exe
c:\documents and settings\MasterAdmin\Moje dokumenty\My Documents.url
c:\program files\Applications\iebtu.exe
c:\program files\Applications\iebu.exe
c:\program files\Applications\myd.ico
c:\program files\Applications\mym.ico
c:\program files\Applications\myp.ico
c:\program files\Applications\myv.ico
c:\program files\Applications\ot.ico
c:\program files\Applications\ts.ico
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-28 do 2008-11-30 )))))))))))))))))))))))))))))))
.
2008-11-30 08:55 .
2008-11-28 21:00 . 2008-11-28 21:01
2008-11-23 20:07 . 2008-11-23 20:07
2008-11-23 05:50 . 2008-11-23 05:50
2008-11-23 05:32 . 2008-11-23 05:47
2008-11-23 05:32 . 2008-11-23 05:47
2008-11-16 11:45 . 2008-11-16 11:45
2008-11-16 11:45 . 2006-10-10 14:11 827,392 --a------ c:\windows\vsnp325.exe
2008-11-16 11:45 . 2006-10-10 15:49 270,336 --a------ c:\windows\tsnp325.exe
2008-11-16 11:45 . 2004-02-27 17:36 15,498 --a------ c:\windows\snp325.ini
2008-11-16 11:45 . 2004-02-27 17:36 13,023 --a------ c:\windows\snp325.src
2008-11-16 11:43 . 2007-04-20 18:51 10,253,056 --a------ c:\windows\system32\drivers\snp325.sys
2008-11-16 11:43 . 2006-04-12 12:11 147,456 --a------ c:\windows\system32\rsnp325.dll
2008-11-16 11:43 . 2007-03-14 11:21 61,440 --a------ c:\windows\system32\vsnpx32.dll
2008-11-13 19:00 . 2008-11-13 19:00
2008-11-13 19:00 . 2000-07-14 23:00 101,888 --a------ c:\windows\system32\VB6STKIT.DLL
2008-11-13 19:00 . 1998-06-17 23:00 89,360 --a------ c:\windows\system32\VB5DB.DLL
2008-11-12 20:44 . 2008-09-04 17:17 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 20:44 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-01 17:58 . 2008-11-01 17:58
2008-11-01 17:57 . 2008-11-01 17:57
2008-10-31 21:14 . 2008-10-31 21:15 217,088 --a------ c:\windows\system32\UAService7.exe
2008-10-30 15:35 . 2008-10-30 15:36
2008-10-26 10:26 . 2008-10-26 10:26 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2008-10-24 07:11 . 2008-10-15 16:36 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-23 21:40 . 2008-10-23 21:40
2008-10-16 18:11 . 2008-10-16 18:11
2008-10-16 18:06 . 2008-10-16 18:06
2008-10-15 15:50 . 2008-08-14 13:26 2,190,464 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 15:50 . 2008-08-14 13:26 2,146,816 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 15:50 . 2008-08-14 13:26 2,067,328 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 15:50 . 2008-08-14 13:26 2,025,472 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 15:18 . 2008-09-15 15:27 1,846,656 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-15 15:03 . 2008-09-08 10:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-01 15:49 . 2008-10-01 15:49
2008-10-01 15:49 . 2008-10-01 15:49
2008-10-01 15:41 . 2004-08-04 02:44 221,184 --a------ c:\windows\system32\wmpns.dll
2008-10-01 15:36 . 2008-10-01 15:36
2008-10-01 15:34 . 2008-04-13 22:53 1,309,184 --------- c:\windows\system32\drivers\mtlstrm.sys
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 13:26 16,608 ----a-w c:\windows\gdrv.sys
2008-11-30 13:24 --------- d-----w c:\program files\Applications
2008-11-30 13:10 --------- d-----w c:\documents and settings\MasterAdmin\Dane aplikacji\Skype
2008-11-30 10:54 --------- d-----w c:\documents and settings\MasterAdmin\Dane aplikacji\skypePM
2008-11-25 15:18 --------- d–h--w c:\program files\InstallShield Installation Information
2008-11-23 05:48 --------- d-----w c:\program files\Common Files\Nero
2008-11-15 01:25 --------- d-----w c:\documents and settings\MasterAdmin\Dane aplikacji\Winamp
2008-11-09 15:01 --------- d-----w c:\program files\Gadu-Gadu
2008-11-09 14:38 --------- d-----w c:\program files\Ubisoft
2008-10-28 18:22 --------- d-----w c:\program files\Common Files\Adobe
2008-10-26 10:23 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-26 10:23 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-26 10:23 22,328 ----a-w c:\documents and settings\MasterAdmin\Dane aplikacji\PnkBstrK.sys
2008-10-26 10:23 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-26 10:23 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-03 17:26 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-10-01 14:00 --------- d-----w c:\program files\Common Files\InstallShield
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-29 21:19 --------- d-----w c:\program files\Winamp
2008-09-29 14:33 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-09-29 14:33 --------- d-----w c:\program files\Java
2008-09-29 14:30 --------- d-----w c:\program files\SRWare Iron
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-27 12:29 47,360 ----a-w c:\documents and settings\MasterAdmin\Dane aplikacji\pcouffin.sys
2008-08-27 09:27 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-26 08:27 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-08-26 08:27 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-08-26 08:27 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-08-26 08:27 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-08-26 08:27 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-08-26 08:27 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-08-26 08:27 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-08-26 08:27 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-08-26 08:27 1,159,680 ------w c:\windows\system32\dllcache\urlmon.dll
2008-08-25 08:42 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 13:26 2,146,816 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26 2,025,472 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-08-14 10:04 138,496 ------w c:\windows\system32\dllcache\afd.sys
2008-07-12 15:29 1 ----a-w c:\program files\MAXXCOM DD-1065 USB CameraBigtop.inf
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]
“IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe” [2008-02-28 1828136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avast!”=“c:\progra~1\ALWILS~1\Avast4\ashDisp.exe” [2008-11-18 81000]
“AcronisTimounterMonitor”=“c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe” [2007-02-16 1945960]
“Acronis Scheduler2 Service”=“c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe” [2007-02-16 149024]
“GEST”=“c:\program files\GIGABYTE\GEST\RUN.exe” [2007-12-14 236040]
“JMB36X IDE Setup”=“c:\windows\RaidTool\xInsIDE.exe” [2007-03-20 36864]
“36X Raid Configurer”=“c:\windows\system32\xRaidSetup.exe” [2007-08-29 1966080]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2007-11-06 8523776]
“SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe” [2008-09-29 144792]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672]
“FixCamera”=“c:\windows\FixCamera.exe” [2007-02-12 20480]
“tsnp325”=“c:\windows\tsnp325.exe” [2006-10-10 270336]
“snp325”=“c:\windows\vsnp325.exe” [2006-10-10 827392]
“NeroFilterCheck”=“c:\program files\Common Files\Nero\Lib\NeroCheck.exe” [2008-02-28 570664]
“NBKeyScan”=“c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” [2008-02-18 2221352]
“RTHDCPL”=“RTHDCPL.EXE” [2007-09-19 c:\windows\RTHDCPL.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“nltide_2”=“shell32” [X]
“nltide_3”=“advpack.dll” [2008-08-26 c:\windows\system32\advpack.dll]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-10-28 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
“DisableStatusMessages”= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
“NoResolveTrack”= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
“NoSMMyPictures”= 1 (0x1)
“NoSMConfigurePrograms”= 1 (0x1)
“NoSMHelp”= 1 (0x1)
[HKEY_USERS.default\software\microsoft\windows\currentversion\policies\explorer]
“NoSMMyPictures”= 1 (0x1)
“NoSMConfigurePrograms”= 1 (0x1)
“NoSMHelp”= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
–a------ 2007-02-12 14:50 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a------ 2007-11-06 09:30 81920 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
–a------ 2007-02-16 16:45 1169776 c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipDiscount]
–a------ 2007-05-31 15:22 7419456 c:\program files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a------ 2007-10-10 05:28 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a------ 2007-11-06 09:30 1626112 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“AntiVirusOverride”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe”=
“c:\Program Files\SopCast\adv\SopAdver.exe”=
“c:\Program Files\SopCast\SopCast.exe”=
“c:\WINDOWS\system32\PnkBstrA.exe”=
“c:\WINDOWS\system32\PnkBstrB.exe”=
“c:\Program Files\Gadu-Gadu\gg.exe”=
“c:\Program Files\Ubisoft\Far Cry 2\bin\FarCry2.exe”=
“c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe”=
“c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Editor.exe”=
“c:\WINDOWS\system32\dpvsetup.exe”=
“e:\CODWOATWAR\CoDWaWmp.exe”=
“e:\CODWOATWAR\CoDWaW.exe”=
“c:\Program Files\Skype\Phone\Skype.exe”=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-12 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-12 20560]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R3 GEST Service;GEST Service for program management.;“c:\program files\GIGABYTE\GEST\GSvr.exe” [2008-07-12 47624]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2008-11-16 10253056]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{1b64a746-5a57-11dd-9570-001d7dd2a8a0}]
\Shell\AutoRun\command - J:\AutoTransfer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{8f441e74-8814-11dd-95f3-001d7dd2a8a0}]
\Shell\AutoRun\command - J:\AutoTransfer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{caf4b2e0-6c84-11dd-95ac-001d7dd2a8a0}]
\Shell\AutoRun\command - setupSNK.exe
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
MSConfigStartUp-!AVG Anti-Spyware - c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
MSConfigStartUp-Comrade - c:\program files\GameSpy\Comrade\Comrade.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 13:26:07
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
-
-
-
-
-
-
- > ‘lsass.exe’(928)
-
-
-
-
-
c:\windows\system32\relog_ap.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\windows\system32\UAService7.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-30 13:27:32 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-11-30 13:27:29
Przed: 5 286 043 648 bajtów wolnych
Po: 5,227,425,792 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect
245 — E O F — 2008-11-29 22:40:12
