ComboFix 09-01-17.02 - Ludwik 2009-01-17 23:09:42.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.447.290 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Ludwik\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Ludwik\Pulpit\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Outdated)
FILE ::
d:\windows\SYSTEM32\WinNt32.dll
d:\windows\web\related.htm
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\WinNt32.dll . . . . nie udało się usunąć
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-17 do 2009-01-17 )))))))))))))))))))))))))))))))
.
2009-01-07 22:01 . 2009-01-09 22:16
2009-01-07 21:51 . 2009-01-07 21:51
2009-01-01 21:32 . 2009-01-17 21:08
2009-01-01 21:32 . 2009-01-01 21:32
2009-01-01 21:32 . 2009-01-01 21:32
2009-01-01 21:32 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-01 21:32 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-28 21:12 . 2008-12-28 21:12
2008-12-28 21:06 . 2008-12-28 21:10
2008-12-28 21:06 . 2008-12-28 21:06
2008-12-28 20:39 . 2008-12-30 16:27
2008-12-24 19:01 . 2008-12-24 19:01
2008-12-24 19:01 . 2008-12-24 19:01
2008-12-24 19:01 . 2008-12-24 19:01
2008-12-24 19:01 . 2008-08-26 09:26 18,816 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2008-12-24 18:59 . 2008-12-24 19:01
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-17 22:11 13,312 ------w c:\windows\system32\WinNt32.dll
2009-01-07 20:51 --------- d–h--w c:\program files\InstallShield Installation Information
2009-01-07 20:50 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-31 09:58 --------- d-----w c:\program files\Nowe Gadu-Gadu
2008-12-30 15:31 --------- d-----w c:\program files\Kraina Gier
2008-12-30 15:09 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-30 15:09 --------- d-----w c:\program files\AVSMedia
2008-12-30 15:00 --------- d-----w c:\program files\Photobie
2008-12-30 14:41 --------- d-----w c:\program files\KaraFun
2008-12-30 14:40 --------- d-----w c:\program files\Foxit Software
2008-12-28 20:06 --------- d-----w c:\program files\Nero
2008-12-28 19:55 --------- d-----w c:\program files\Common Files\Ahead
2008-12-28 14:28 --------- d-----w c:\documents and settings\Ludwik\Dane aplikacji\gtk-2.0
2008-12-26 19:02 --------- d-----w c:\program files\Winamp
2008-12-24 21:34 --------- d-----w c:\program files\RALINK
2008-12-24 17:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations
2008-12-24 09:39 --------- d-----w c:\program files\JetAudio
2008-12-21 23:19 --------- d-----w c:\documents and settings\Ludwik\Dane aplikacji\OpenOffice.ux.pl2
2008-12-14 09:29 159,578 ----a-w c:\windows\Marsu-Fix 2.5 Uninstaller.exe
2008-12-14 09:27 --------- d-----w c:\program files\ESET
2008-12-14 09:27 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET
2008-12-14 09:26 --------- d-----w c:\program files\ESETNod32_fix
2008-12-13 12:37 15,781 ----a-w c:\windows\system32\drivers\mdc8021x.sys
2008-12-13 11:12 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-12-13 11:12 76,040 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-12-13 11:12 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2008-12-13 11:11 --------- d-----w c:\program files\AVG
2008-12-13 11:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\avg8
2008-12-13 11:07 --------- d-----w c:\program files\Common Files\Panda Software
2008-12-12 07:32 972,072 ----a-w c:\windows\UNNeroMediaHome.exe
2008-11-28 19:25 --------- d-----w c:\program files\Wesola_Szkola_2
2008-11-23 12:08 --------- d-----w c:\program files\QuickTime
2008-11-23 12:04 --------- d-----w c:\program files\Usługi online
2008-11-22 20:25 --------- d-----w c:\documents and settings\Ludwik\Dane aplikacji\skypePM
2008-11-18 19:56 --------- d-----w c:\documents and settings\Ludwik\Dane aplikacji\Image Zone Express
2008-05-11 17:20 266 —h–w c:\program files\desktop.ini
2008-05-11 17:20 11,079 —h–w c:\program files\folder.htt
2008-04-19 18:31 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
2008-05-25 19:51 1,302 --sha-w c:\windows\Bifrost\klog.dat
2008-07-18 16:38 848 --sha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ares”=“c:\program files\Ares\Ares.exe” [2007-07-16 961536]
“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2004-08-03 15360]
“Gadu-Gadu”=“c:\program files\Gadu-Gadu\gg.exe” [2008-11-09 2127296]
“PC Suite Tray”=“c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe” [2008-12-03 1205760]
“Nowe Gadu-Gadu”=“c:\program files\Nowe Gadu-Gadu\gg.exe” [2008-12-22 8966760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“AVG8_TRAY”=“c:\progra~1\AVG\AVG8\avgtray.exe” [2008-12-13 1261336]
“egui”=“c:\program files\ESET\ESET NOD32 Antivirus\egui.exe” [2008-08-18 1447168]
“TrialReset”=“c:\windows\regx32.exe” [2008-07-03 285327]
“NeroFilterCheck”=“c:\program files\Common Files\Nero\Lib\NeroCheck.exe” [2008-11-06 570664]
“NBKeyScan”=“c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” [2008-12-02 2221352]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sremcon.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fmt41.sys]
@=“Driver”
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ryf31.sys]
@=“Driver”
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^RaConfig.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\RaConfig.lnk
backup=c:\windows\pss\RaConfig.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^Ludwik^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=c:\documents and settings\Ludwik\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasySpeller]
–a------ 2005-03-22 09:40 73728 c:\program files\EasyOffice\EasySpeller.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
–a----t- 2008-09-29 21:59 133104 c:\documents and settings\Ludwik\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a------ 2005-05-11 22:12 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a------ 2006-10-31 07:35 7634944 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrangeDeamon]
–a------ 2008-05-16 11:33 20336640 c:\program files\Orange\Orange.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
–a------ 2008-02-26 02:23 443968 c:\program files\Picasa2\PicasaMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a------ 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdslTaskBar]
–a------ 2008-04-23 09:30 151552 c:\windows\system32\stmctrl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-ra------ 2005-05-03 11:43 69632 c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a------ 2006-10-31 07:35 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a------ 2006-10-31 07:35 1622016 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-ra------ 2006-08-01 12:10 16049664 c:\windows\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-ra------ 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
“ThreatFire”=2 (0x2)
“SpyEmrgSrv”=2 (0x2)
“ServiceLayer”=3 (0x3)
“PSIMSVC”=2 (0x2)
“Pml Driver HPZ12”=2 (0x2)
“PAVSRV”=2 (0x2)
“PavPrSrv”=2 (0x2)
“Panda Software Controller”=2 (0x2)
“NVSvc”=2 (0x2)
“NMIndexingService”=3 (0x3)
“LightScribeService”=2 (0x2)
“IDriverT”=3 (0x3)
“gusvc”=3 (0x3)
“FirebirdServerMAGIXInstance”=3 (0x3)
“AresChatServer”=3 (0x3)
“Adobe LM Service”=3 (0x3)
“aawservice”=2 (0x2)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“c:\Program Files\Gadu-Gadu\gg.exe”=
“c:\WINDOWS\system32\sessmgr.exe”=
“c:\Program Files\Nowe Gadu-Gadu\gg.exe”=
“c:\Program Files\Ares\Ares.exe”=
“c:\Program Files\AVG\AVG8\avgemc.exe”=
“c:\Program Files\AVG\AVG8\avgupd.exe”=
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“8461:TCP”= 8461:TCP:GoD High Port
“8462:TCP”= 8462:TCP:GoD Low Port
R0 Fmt41;Fmt41;c:\windows\system32\drivers\Fmt41.sys [2008-06-11 29184]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-13 97928]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-08-18 34312]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [2008-09-29 60255]
R3 ZY202_XP;ZyXEL 802.11g XG202 1211 Driver;c:\windows\system32\drivers\WlanUZXP.sys [2008-12-15 437760]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-13 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-13 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-13 76040]
R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
S0 Ryf31;Ryf31;c:\windows\system32\Drivers\Ryf31.sys --> c:\windows\system32\Drivers\Ryf31.sys [?]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 k310bus;Sony Ericsson K310 Driver driver (WDM);c:\windows\system32\drivers\k310bus.sys [2008-06-22 60800]
S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;c:\windows\system32\drivers\k310mdfl.sys [2008-06-22 9264]
S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;c:\windows\system32\drivers\k310mdm.sys [2008-06-22 96352]
S3 k310mgmt;Sony Ericsson K310 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k310mgmt.sys [2008-06-22 87824]
S3 k310obex;Sony Ericsson K310 USB WMC OBEX Interface;c:\windows\system32\drivers\k310obex.sys [2008-06-22 85696]
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\ks-959.sys [2005-07-23 19034]
S3 RT2400;RT2400 Wireless Driver;c:\windows\system32\drivers\RT2400.sys [2008-04-19 62848]
S3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [2008-09-29 683791]
S3 TfNetMon;TfNetMon;??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-04-18 1527900]
S4 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service --> c:\program files\ThreatFire\TFService.exe service [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
“c:\program files\Common Files\LightScribe\LSRunOnce.exe”
.
Zawartość folderu ‘Zaplanowane zadania’
2008-11-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
2008-11-22 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Ludwik\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-29 21:59]
2008-04-21 c:\windows\Tasks\WebReg psc 1400 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2005-05-11 23:21]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.onet.pl/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: {2C6CC163-DCF0-45CC-A6E2-3266393407DC} = 192.168.1.100
FF - ProfilePath - c:\documents and settings\Ludwik\Dane aplikacji\Mozilla\Firefox\Profiles\rsvay22e.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli … ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli … pab&query=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 23:12:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\wscntfy.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-01-17 23:16:01 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-01-17 22:15:52
ComboFix2.txt 2009-01-17 21:16:41
Przed: 19 587 993 600 bajtów wolnych
Po: 19,583,594,496 bajtów wolnych
248 — E O F — 2008-04-17 09:38:16
