Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:54, on 2009-02-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Nyki\Pulpit\HijackThis.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM…\Run: [WinampAgent] “C:\Program Files\Winamp\winampa.exe”
O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”
O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray
O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized
O4 - HKCU…\Run: [ALLUpdate] “C:\Program Files\ALLPlayer\ALLUpdate.exe” “sleep”
O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)
O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
ComboFix 09-02-08.01 - Nyki 2009-02-08 22:50:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.191.59 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Nyki\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090208-0] *On-access scanning enabled* (Updated)
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\pthreadGC2.dll
.
((((((((((((((((((((((((( Pliki utworzone od 2009-01-08 do 2009-02-08 )))))))))))))))))))))))))))))))
.
2009-02-08 19:45 . 2009-02-08 19:45
2009-02-08 19:28 . 2009-02-08 22:53
2009-02-08 19:28 . 2009-02-08 12:29
2009-02-08 19:28 . 2009-02-08 11:38
2009-02-08 19:28 . 2009-02-08 12:29
2009-02-08 19:28 . 2009-02-08 12:29
2009-02-08 19:28 . 2009-02-08 12:29
2009-02-08 19:28 . 2009-02-08 12:29
2009-02-08 19:28 . 2009-02-08 19:28
2009-02-08 18:42 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-02-08 18:42 . 2004-08-03 23:01 25,856 --a–c— c:\windows\system32\dllcache\usbprint.sys
2009-02-08 18:39 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-02-08 18:39 . 2004-08-03 23:08 31,616 --a–c— c:\windows\system32\dllcache\usbccgp.sys
2009-02-08 18:10 . 2009-02-08 19:42
2009-02-08 18:05 . 2008-06-14 19:01 273,024 --------- c:\windows\system32\drivers\bthport.sys
2009-02-08 18:05 . 2008-06-14 19:01 273,024 -----c— c:\windows\system32\dllcache\bthport.sys
2009-02-08 18:01 . 2008-08-14 14:46 2,181,632 -----c— c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-08 18:01 . 2008-08-14 14:46 2,137,600 -----c— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-08 18:01 . 2008-08-14 14:46 2,059,008 -----c— c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-08 18:01 . 2008-08-14 14:46 2,017,280 -----c— c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-08 18:00 . 2008-10-24 12:10 453,632 -----c— c:\windows\system32\dllcache\mrxsmb.sys
2009-02-08 17:32 . 2009-02-08 20:11
2009-02-08 17:32 . 2005-02-25 04:36 22,752 --a------ c:\windows\system32\spupdsvc.exe
2009-02-08 14:19 . 2009-02-08 14:19
2009-02-08 14:07 . 2009-02-08 18:37
2009-02-08 14:05 . 2009-02-08 14:07
2009-02-08 14:04 . 2009-02-08 18:03
2009-02-08 13:54 . 2009-02-08 13:55
2009-02-08 13:35 . 2009-02-08 13:35
2009-02-08 13:34 . 2009-02-08 13:34
2009-02-08 13:33 . 2009-02-08 13:33
2009-02-08 13:33 . 2008-12-08 12:53 57,344 --a------ c:\windows\system32\ff_vfw.dll
2009-02-08 13:33 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-08 13:24 . 2009-02-08 13:24 427 --a------ c:\windows\ODBC.INI
2009-02-08 13:21 . 2009-02-08 13:25
2009-02-08 13:21 . 2009-02-08 13:27
2009-02-08 13:20 . 2009-02-08 13:22
2009-02-08 13:13 . 2009-02-08 13:13
2009-02-08 13:11 . 2009-02-08 13:11
2009-02-08 13:05 . 2009-02-08 13:05
2009-02-08 13:05 . 2003-10-14 04:52 2,301,952 --a------ c:\windows\system\cmicnfg.cpl
2009-02-08 13:04 . 2009-02-08 13:04
2009-02-08 13:04 . 2000-03-29 15:17 5,824 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS
2009-02-08 13:04 . 2009-02-08 13:04 2,322 --a------ c:\windows\Ascd_tmp.ini
2009-02-08 13:03 . 2009-02-08 13:28
2009-02-08 13:03 . 2009-02-08 13:31
2009-02-08 13:00 . 2009-02-08 16:06
2009-02-08 13:00 . 2009-02-08 13:00 56 --ah----- c:\windows\system32\ezsidmv.dat
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-08 21:42 --------- d-----w c:\documents and settings\Nyki\Dane aplikacji\Skype
2009-02-08 11:59 --------- d-----w c:\program files\Common Files\Skype
2009-02-08 11:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2009-02-08 11:59 --------- d-----r c:\program files\Skype
2009-02-08 11:50 --------- d-----w c:\program files\Gadu-Gadu
2009-02-08 11:24 --------- d-----w c:\program files\Alwil Software
2009-02-08 10:45 --------- d-----w c:\program files\microsoft frontpage
2009-02-08 10:41 --------- d-----w c:\program files\Usługi online
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2004-08-03 15360]
“Gadu-Gadu”=“c:\program files\Gadu-Gadu\gg.exe” [2008-03-20 2127296]
“Skype”=“c:\program files\Skype\Phone\Skype.exe” [2009-01-29 23975720]
“ALLUpdate”=“c:\program files\ALLPlayer\ALLUpdate.exe” [2008-11-24 869888]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“NeroCheck”=“c:\windows\system32\NeroCheck.exe” [2001-07-09 155648]
“WinampAgent”=“c:\program files\Winamp\winampa.exe” [2008-09-12 36352]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672]
“avast!”=“c:\progra~1\ALWILS~1\Avast4\ashDisp.exe” [2009-02-05 81000]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\Skype\Phone\Skype.exe”=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-08 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-08 20560]
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
HKLM-Run-Cmaudio - cmicnfg.cpl
.
------- Skan uzupełniający -------
.
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Nyki\Dane aplikacji\Mozilla\Firefox\Profiles\e7eutx64.default\
FF - prefs.js: browser.search.selectedEngine - Allegro
FF - prefs.js: network.proxy.ftp - w3cache.tpnet.pl port 8080
FF - prefs.js: network.proxy.gopher - w3cache.tpnet.pl port 8080
FF - prefs.js: network.proxy.http - w3cache.tpnet.pl port 8080
FF - prefs.js: network.proxy.socks - w3cache.tpnet.pl port 8080
FF - prefs.js: network.proxy.ssl - w3cache.tpnet.pl port 8080
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 22:53:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2009-02-08 22:55:09
ComboFix-quarantined-files.txt 2009-02-08 21:55:06
Przed: 17 138 069 504 bajtów wolnych
Po: 17,157,742,592 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect
137 — E O F — 2009-02-08 19:11:16