ComboFix 08-11-10.01 - Andriu 2008-11-11 12:02:37.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1492 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Andriu\Moje dokumenty\Pobrane pliki\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\k.txt
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-11 do 2008-11-11 )))))))))))))))))))))))))))))))
.
2008-11-11 00:55 . 2008-11-11 00:55 81,920 --a------ c:\windows\system32\qipauzax.dll
2008-11-08 18:00 . 2008-11-08 18:01
2008-11-03 13:58 . 2008-11-03 14:21
2008-11-01 02:06 . 2008-11-01 02:06
2008-10-31 17:20 . 2008-10-31 17:20
2008-10-31 17:20 . 2008-11-04 17:49
2008-10-24 17:07 . 2008-10-15 17:36 337,408 -----c— c:\windows\system32\dllcache\netapi32.dll
2008-10-21 17:37 . 2008-10-21 17:37
2008-10-21 17:37 . 2008-10-21 17:39
2008-10-21 09:46 . 2008-10-21 09:46 24,220 --a------ c:\windows\FontData.fdb
2008-10-21 09:33 . 2008-10-21 17:39
2008-10-21 09:33 . 2008-11-05 23:23 2,828 --ahs---- c:\documents and settings\All Users\Dane aplikacji\KGyGaAvL.sys
2008-10-21 09:33 . 2008-10-21 17:39 88 -r-hs---- c:\documents and settings\All Users\Dane aplikacji\59E7B4B2C9.sys
2008-10-21 09:30 . 2008-10-21 09:30
2008-10-20 20:42 . 2008-10-20 20:42
2008-10-20 14:31 . 2008-10-20 14:31 42 --a------ c:\windows\AlchemyMindworksUpdateList.INI
2008-10-20 14:30 . 2008-10-20 14:30
2008-10-20 14:30 . 1999-03-15 15:39 212,992 --a------ c:\windows\ALCHUNIN.EXE
2008-10-20 14:30 . 2008-11-10 16:21 3,768 --a------ c:\windows\animwork.ini
2008-10-19 20:26 . 2008-10-19 20:26 21 --a------ c:\windows\kit.ini
2008-10-15 18:36 . 2008-08-14 14:26 2,190,464 -----c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 18:36 . 2008-08-14 14:26 2,067,328 -----c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 18:36 . 2008-09-15 16:27 1,846,656 -----c— c:\windows\system32\dllcache\win32k.sys
2008-10-15 11:10 . 2008-11-05 11:10 52,704 --a------ c:\documents and settings\Andriu\Dane aplikacji\GDIPFONTCACHEV1.DAT
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-10 23:53 --------- d-----w c:\program files\eMule
2008-11-09 22:42 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\uTorrent
2008-11-07 01:07 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\Skype
2008-11-06 23:04 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\skypePM
2008-10-19 19:27 --------- d-----w c:\program files\neostrada tp
2008-10-13 17:03 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\XnView
2008-10-06 17:53 --------- d-----w c:\program files\Guitar Pro 5
2008-10-03 21:02 510,464 ----a-w c:\windows\system32\winlogon.exe
2008-09-29 11:02 --------- d-----w c:\program files\Common Files\Autodesk Shared
2008-09-29 11:02 --------- d-----w c:\program files\Autodesk
2008-09-29 11:00 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Autodesk
2008-09-29 10:08 --------- d-----w c:\program files\Common Files\Adobe
2008-09-28 15:53 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\Autodesk
2008-09-27 21:17 --------- d-----w c:\program files\AnswerWorks 4.0
2008-09-21 18:50 --------- d-----w c:\program files\Trend Micro
2008-09-19 18:28 --------- d-----w c:\program files\g3torrent
2008-09-19 11:43 --------- d-----w c:\program files\Acoustica Beatcraft
2008-09-19 11:42 --------- d-----w c:\program files\Acoustica Shared Effects
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
2008-09-13 23:04 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\Winamp
2008-09-13 23:03 --------- d-----w c:\documents and settings\Andriu\Dane aplikacji\IrfanView
2008-09-11 16:11 --------- d-----w c:\program files\XnView
2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 13:26 2,146,816 -c–a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26 2,025,472 -c–a-w c:\windows\system32\ntkrnlpa.exe
2001-09-28 15:00 164,864 ----a-w c:\program files\UNWISE.EXE
.
((((((((((((((((((((((((((((( snapshot_2008-11-11_ 1.06.50,59 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-03 13:29:06 62,678 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-11 00:19:04 62,678 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-03 13:29:07 79,606 ----a-w c:\windows\system32\perfc015.dat
- 2008-11-11 00:19:04 79,606 ----a-w c:\windows\system32\perfc015.dat
- 2008-11-03 13:29:07 401,398 ----a-w c:\windows\system32\perfh009.dat
- 2008-11-11 00:19:04 401,398 ----a-w c:\windows\system32\perfh009.dat
- 2008-11-03 13:29:07 458,260 ----a-w c:\windows\system32\perfh015.dat
- 2008-11-11 00:19:04 458,260 ----a-w c:\windows\system32\perfh015.dat
- 2008-11-03 13:08:46 2,064 -c–a-w c:\windows\system32\Restore\rstrlog.dat
-
2008-11-11 00:09:23 226,616 -c–a-w c:\windows\system32\Restore\rstrlog.dat
-
2008-11-11 10:02:38 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_630.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{156DD78A-CB74-4822-A17C-9CF02B43F72A}]
2008-11-11 00:55 81920 --a------ c:\windows\system32\qipauzax.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]
“swg”=“c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-10-08 68856]
“LightScribe Control Panel”=“c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe” [2007-10-18 455968]
“Google Update”=“c:\documents and settings\Andriu\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe” [2008-09-03 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“hpWirelessAssistant”=“c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe” [2007-10-03 480560]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2007-08-23 8478720]
“NvMediaCenter”=“c:\windows\system32\NvMcTray.dll” [2007-08-23 81920]
“SMSERIAL”=“c:\program files\Motorola\SMSERIAL\sm56hlpr.exe” [2007-01-29 638976]
“AzMixerSel”=“c:\program files\Realtek\InstallShield\AzMixerSel.exe” [2006-07-17 53248]
“HP Software Update”=“c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2003-06-25 49152]
“HP Component Manager”=“c:\program files\HP\hpcoretech\hpcmpmgr.exe” [2004-05-12 241664]
“HPDJ Taskbar Utility”=“c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe” [2003-11-08 188416]
“WinampAgent”=“c:\program files\Winamp\winampa.exe” [2008-08-04 36352]
“SunJavaUpdateSched”=“c:\program files\Java\jre1.6.0_07\bin\jusched.exe” [2008-06-10 144784]
“NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe” [2006-01-12 155648]
“SpeedTouch USB Diagnostics”=“c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 866816]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672]
“nwiz”=“nwiz.exe” [2007-08-23 c:\windows\system32\nwiz.exe]
“RTHDCPL”=“RTHDCPL.EXE” [2008-02-13 c:\windows\RTHDCPL.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-12 581693]
Microsoft Office.lnk - d:\programymicrosoft office\Office10\OSA.EXE [2001-02-13 83360]
Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
“AppInit_DLLs”=nhkyei.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iPMS.exe]
“Debugger”=dummy.dat
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iPMS20.exe]
“Debugger”=dummy.dat
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“e:\Half-Life\hl.exe”=
“c:\WINDOWS\system32\mshta.exe”=
“c:\Program Files\uTorrent\uTorrent.exe”=
“e:\CRYFAR\Bin32\Crysis.exe”=
“c:\Program Files\Veoh Networks\Veoh\VeohClient.exe”=
“c:\Program Files\g3torrent\g3torrent.exe”=
“c:\Program Files\eMule\emule.exe”=
“d:\Programy\Autodesk\3ds Max 9\3dsmax.exe”=
“d:\Programy\Autodesk\Backburner\monitor.exe”=
“d:\Programy\Autodesk\Backburner\manager.exe”=
“d:\Programy\Autodesk\Backburner\server.exe”=
“c:\Program Files\Gadu-Gadu\gg.exe”=
“c:\Program Files\Skype\Phone\Skype.exe”=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 PSI_SVC_2;Protexis Licensing V2;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-11-13 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-11-13 51968]
S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-11-13 8064]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{1fa60876-a028-11dd-a220-001e3772b8e7}]
\Shell\AutoRun\command - G:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{cd4e1ada-9ab6-11dd-a204-001e3772b8e7}]
\Shell\AutoRun\command - WD_Windows_Tools\Setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
“c:\program files\Common Files\LightScribe\LSRunOnce.exe”
.
Zawartość folderu ‘Zaplanowane zadania’
2008-11-11 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Andriu\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-03 10:53]
.
.
------- Skan uzupełniający -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.onet.pl/
O8 -: Wyślij do interfejsu &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 12:03:40
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2008-11-11 12:04:54
ComboFix-quarantined-files.txt 2008-11-11 11:04:32
ComboFix2.txt 2008-11-11 00:17:26
ComboFix3.txt 2008-11-11 00:07:25
ComboFix4.txt 2008-11-03 13:29:39
ComboFix5.txt 2008-11-11 11:01:53
Przed: 758 714 368 bajtów wolnych
Po: 748,228,608 bajtów wolnych
177 — E O F — 2008-10-24 16:55:37
