ComboFix 08-09-22.04 - kogucik 2008-09-23 20:32:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.906 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\kogucik\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\explore.exe
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINDOWS\system\mmtaskclean.log
C:\WINDOWS\system\svchost.exe
C:\WINDOWS\system\win32in.dll
C:\WINDOWS\system\win32out.dll
C:\WINDOWS\system\wupdmgr.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\explorxp.exe
C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}
C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll
C:\WINDOWS\system32\settings.dll
C:\WINDOWS\temp\perflib_perfdata_1cc.dat
D:\explore.exe
E:\Autorun.inf
E:\explore.exe
F:\Autorun.inf
F:\explore.exe
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CREATEPROCESS
-------\Service_CreateProcess
((((((((((((((((((((((((( Pliki utworzone od 2008-08-23 do 2008-09-23 )))))))))))))))))))))))))))))))
.
2008-08-26 14:18 . 2008-08-26 14:18
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 18:32 --------- d-----w C:\Documents and Settings\kogucik\Dane aplikacji\uTorrent
2008-09-05 14:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-08-25 10:23 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-08-25 10:20 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-08-21 13:37 --------- d-----w C:\Program Files\Metin2_PL
2008-08-19 15:22 --------- d-----w C:\Program Files\Counter-Strike
2008-08-12 10:31 --------- d-----w C:\Program Files\BearShare
2008-08-01 07:48 --------- d-----w C:\Program Files\Google
2008-04-15 21:07 16,384 -csha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-04-15 21:07 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
2008-04-15 21:07 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008041520080416\index.dat
2008-04-15 21:07 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 15360]
“PcSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [2006-06-27 1449984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“GrooveMonitor”=“F:!programFiles\Office2007\Office12\GrooveMonitor.exe” [2006-10-26 31016]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2008-01-11 39792]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-12-04 8523776]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2007-12-04 81920]
“PCSuiteTrayApplication”=“C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE” [2006-06-15 229376]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 155648]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe” [2008-03-25 144784]
“nForce Tray Options”=“sstray.exe” [2002-11-13 C:\WINDOWS\system32\sstray.exe]
“nwiz”=“nwiz.exe” [2007-12-04 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 15360]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“nltide_2”=“shell32” [X]
“nltide_3”=“advpack.dll” [2008-03-01 C:\WINDOWS\system32\advpack.dll]
C:\Documents and Settings\kogucik\Menu Start\Programy\Autostart\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - F:!programFiles\Office2007\Office12\ONENOTEM.EXE [2006-10-26 98632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“vidc.ffds”= ffdshow.ax
“VIDC.ACDV”= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“%windir%\system32\sessmgr.exe”=
“C:\Program Files\uTorrent\uTorrent.exe”=
“F:\!programFiles\Office2007\Office12\OUTLOOK.EXE”=
“F:\!programFiles\Office2007\Office12\GROOVE.EXE”=
“F:\!programFiles\Office2007\Office12\ONENOTE.EXE”=
“C:\Program Files\Gadu-Gadu\gg.exe”=
“F:\!programFiles\3ds max9\3dsmax.exe”=
"E:\instalki\
“C:\Program Files\BearShare\BearShare.exe”=
“D:\cs\hl.exe”=
“C:\Program Files\Counter-Strike\hl.exe”=
R2 ABBYY.Licensing.FineReader.Professional.9.0;Usługa licencjonowania programu ABBYY FineReader 9.0;F:!programFiles\abby find reader9.0\NetworkLicenseServer.exe [2007-09-24 566560]
S0 NVDual;NVDual;C:\WINDOWS\system32\DRIVERS\nvDual.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{17d0d186-13ae-11dd-8657-000c6e89c0f8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{5026566b-3ad0-11dd-8715-000c6e89c0f8}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe
.
.
------- Skan uzupełniający -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.pl/
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: Eksportuj do programu Microsoft Excel - F:!PROGR~1\OFFICE~1\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-23 20:35:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
F:!programFiles\3ds max9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\snmp.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\ComboFix\pv.cfexe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2008-09-23 20:36:36 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-09-23 18:36:33
Przed: 1˙790˙234˙624 bajt˘w wolnych
Po: 1,791,193,088 bajt˘w wolnych
142 — E O F — 2008-04-15 21:01:06
