ComboFix 08-12-01.01 - Właściciel 2008-12-02 14:31:54.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.293 [GMT 1:00]
Uruchomiony z: F:\ComboFix.exe
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA
.
((((((((((((((((((((((((( Pliki utworzone od 2008-11-02 do 2008-12-02 )))))))))))))))))))))))))))))))
.
2008-12-02 12:15 . 2008-12-02 12:15
2008-12-02 11:53 . 2008-12-02 11:54
2008-12-01 21:54 . 2008-12-01 21:54
2008-11-29 14:17 . 2008-11-29 14:17
2008-11-28 16:09 . 2008-11-28 16:09
2008-11-28 16:09 . 2008-11-28 16:09 12,951 --a------ c:\windows\Ascd_tmp.ini
2008-11-28 16:09 . 2004-04-27 08:26 5,824 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS
2008-11-28 16:08 . 2006-06-14 06:56 12,288 -ra------ c:\windows\system32\drivers\EIO.sys
2008-11-28 13:48 . 2008-11-28 16:23
2008-11-28 13:47 . 2008-11-28 13:48 196 --a------ c:\windows\Czerwony_Kapturek_v_3.iix
2008-11-26 16:59 . 2008-11-26 17:04
2008-11-26 16:46 . 2008-11-27 14:17 123 --a------ c:\windows\disney.ini
2008-11-26 16:26 . 2008-11-26 16:26
2008-11-26 16:21 . 2008-11-26 16:27
2008-11-25 16:22 . 2008-11-27 14:13
2008-11-25 15:32 . 2008-11-25 15:35
2008-11-25 15:32 . 2008-11-25 15:32
2008-11-24 18:25 . 2008-11-26 17:38
2008-11-22 18:12 . 2008-11-24 17:44 402 --a------ c:\windows\Three_Worlds_Flipper_Prefs
2008-11-22 11:06 . 1994-12-06 00:00 12,800 --a------ c:\windows\system32\WING32.DLL
2008-11-19 14:30 . 2008-11-20 13:45
2008-11-16 19:04 . 2008-11-16 19:04
2008-11-10 10:27 . 2008-11-10 10:27
2008-11-10 10:27 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe
2008-11-10 10:25 . 2008-11-10 10:28
2008-11-10 10:24 . 2008-11-26 17:38
2008-11-10 10:21 . 2008-12-01 16:30
2008-11-10 10:21 . 2008-11-10 10:21
2008-11-10 10:20 . 2008-11-18 17:04
2008-11-10 10:20 . 2008-11-10 10:20
2008-11-10 10:20 . 2004-08-12 14:26 811,008 --a------ c:\windows\FeedingFrenzy.scr
2008-11-10 10:12 . 2008-11-10 10:12
2008-11-10 10:12 . 2008-11-10 10:12
2008-11-10 10:11 . 2008-11-26 17:30
2008-11-10 10:08 . 2008-11-10 10:08
2008-11-10 10:02 . 2008-11-13 15:34
2008-11-10 09:59 . 2008-11-10 09:59
2008-11-10 09:59 . 2008-11-10 09:59
2008-11-10 09:55 . 2008-11-11 15:25
2008-11-10 09:50 . 2008-11-10 09:50
2008-11-10 09:50 . 2008-11-10 09:50 4,096 --a------ c:\windows\d3dx.dat
2008-11-09 16:40 . 2008-11-09 16:40
2008-11-08 16:57 . 2008-11-08 16:57
2008-11-08 15:28 . 2008-11-08 15:28
2008-11-08 09:29 . 2008-11-08 09:31
2008-11-05 18:11 . 2008-11-05 18:11
2008-11-05 13:10 . 2008-11-05 13:10
2008-11-04 20:03 . 2008-11-26 16:24
2008-11-04 20:03 . 2008-11-04 20:04
2008-11-04 20:02 . 2008-11-04 20:02
2008-11-04 19:59 . 2008-11-26 20:00
2008-11-04 19:55 . 2008-12-01 22:20
2008-11-04 19:54 . 2008-11-04 19:54
2008-11-04 19:49 . 2008-11-04 19:49
2008-11-04 19:47 . 2008-11-08 09:30
2008-11-04 19:47 . 2008-11-15 14:57
2008-11-04 19:47 . 2001-07-01 17:30 112,640 --a------ c:\windows\lsb_un20.exe
2008-11-04 19:44 . 2008-11-07 14:55
2008-11-04 19:44 . 2008-11-04 19:46
2008-11-04 15:53 . 2008-11-04 16:34
2008-11-04 15:51 . 2008-11-04 15:51
2008-11-04 15:48 . 2008-12-01 16:29
2008-11-04 15:45 . 2008-11-04 15:45
2008-11-04 15:36 . 2008-11-18 14:40
2008-11-04 15:35 . 2008-11-18 19:30
2008-11-04 15:35 . 2008-11-04 15:35
2008-11-04 15:35 . 1998-10-07 13:54 327,168 --a------ c:\windows\IsUn0415.exe
2008-11-04 15:30 . 2008-11-04 16:36
2008-11-04 15:29 . 2008-11-09 16:47
2008-11-04 15:23 . 2001-05-11 12:18 420,240 --a------ c:\windows\system32\mpg4c32.dll
2008-11-04 14:28 . 2008-11-04 14:28
2008-11-04 14:28 . 2008-11-04 14:50
2008-11-03 20:24 . 2008-11-16 09:17
2008-11-03 20:24 . 2008-11-16 09:17 3 --a------ c:\windows\cri64a.bin
2008-11-03 20:23 . 2008-11-13 15:01
2008-11-03 20:23 . 2008-11-03 20:23
2008-11-03 20:21 . 2008-11-20 15:48
2008-11-03 20:17 . 2008-11-03 20:18
2008-11-03 20:12 . 2008-11-20 17:16
2008-11-03 20:03 . 2008-11-03 20:03
2008-11-03 19:07 . 2008-11-23 07:32
2008-11-03 19:06 . 2008-11-10 10:34
2008-11-03 19:04 . 2008-11-04 08:36
2008-11-03 19:03 . 2008-11-04 15:46
2008-11-03 19:02 . 2008-11-26 17:38
2008-11-03 19:02 . 2008-11-03 19:02
2008-11-03 19:00 . 2008-11-03 19:00
2008-11-03 18:56 . 2008-11-03 19:00
2008-11-03 18:54 . 2008-11-03 18:54
2008-11-03 18:33 . 2008-11-07 14:51 255 --a------ c:\windows\Flipper_Secrets_Prefs
2008-11-03 18:31 . 2008-11-03 18:31
2008-11-03 18:30 . 2008-11-03 18:30
2008-11-03 18:29 . 2008-11-26 17:40
2008-11-03 18:26 . 2008-11-03 18:26 324 --a------ c:\windows\game.ini
2008-11-03 18:19 . 2008-11-03 18:20
2008-11-03 18:18 . 2008-11-03 18:18
2008-11-03 18:16 . 2008-11-03 18:16
2008-11-03 17:20 . 2008-11-04 15:54
2008-11-03 17:18 . 2008-11-25 16:20
2008-11-03 17:17 . 2008-11-03 17:18
2008-11-03 17:13 . 2008-11-28 13:47
2008-11-03 17:13 . 2008-01-14 12:45 722,192 --a------ c:\windows\system32\vb40032.dll
2008-11-03 17:06 . 2008-11-03 17:06
2008-11-03 16:57 . 2008-11-03 16:58
2008-11-03 16:54 . 2008-11-13 13:02
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-27 13:17 --------- d–h--w c:\program files\InstallShield Installation Information
2008-11-26 15:19 --------- d-----w c:\program files\Common Files\InstallShield
2008-10-28 22:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2008-10-28 22:06 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\skypePM
2008-10-28 21:55 --------- d-----w c:\program files\Google
2008-10-13 20:16 --------- d-----w c:\program files\Windows Media Components
2008-10-13 20:15 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ulead Systems
2008-10-13 13:00 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Media Player Classic
2008-10-13 12:58 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-13 10:13 397,263 ----a-w c:\windows\Help\SET79.tmp
2008-10-03 19:48 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Gadu-Gadu
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avast!”=“c:\progra~1\ALWILS~1\Avast4\ashDisp.exe” [2008-07-19 78008]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE” [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
–a------ 2008-04-14 18:21 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 18:21 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrangeDeamon]
–a------ 2008-05-16 11:33 20336640 c:\program files\Orange\Orange.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a------ 2004-09-28 19:26 32881 c:\program files\Java\j2re1.4.2_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a------ 2006-08-03 04:12 577536 c:\windows\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusOverride”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“c:\Program Files\Ascaron Entertainment\Sacred\Sacred.exe”=
“c:\Program Files\Paris Chase\ParisChase.exe”=
“c:\Program Files\THQ\MotoGP URT 3\motogp.exe”=
“c:\BMW M3 Challenge\BMW.exe”=
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“1987:UDP”= 1987:UDP:Windows Media Format SDK (iexplore.exe)
“1986:UDP”= 1986:UDP:Windows Media Format SDK (iexplore.exe)
“8461:TCP”= 8461:TCP:GoD High Port
“8462:TCP”= 8462:TCP:GoD Low Port
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-28 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-28 20560]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2003-04-16 14336]
S3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\system32\DRIVERS\LV532AV.SYS [2008-10-14 152576]
*Newly Created Service* - PROCEXP90
.
Zawartość folderu ‘Zaplanowane zadania’
2008-11-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 14:21]
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
MSConfigStartUp-Gadu-Gadu - c:\program files\Gadu-Gadu\gg.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-Ulead AutoDetector v2 - c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe
MSConfigStartUp-AdslTaskBar - stmctrl.dll
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 14:32:58
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2008-12-02 14:33:53
ComboFix-quarantined-files.txt 2008-12-02 13:33:30
Przed: 18,675,310,592 bajtów wolnych
Po: 20,507,107,328 bajtów wolnych
196 — E O F — 2008-10-28 22:00:08