z jakimi ukośnikami troche jaśniej
ComboFix 08-05-01.3 - xp 2008-05-06 15:42:07.2 - NTFSx86
Running from: C:\Documents and Settings\xp\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Documents and Settings\xp\Menu Start\Programy\Autostart\ctfmon.exe
C:\Recycled\Recycled
C:\Recycled\Recycled\ctfmon.exe
.
((((((((((((((((((((((((( Files Created from 2008-04-06 to 2008-05-06 )))))))))))))))))))))))))))))))
.
2008-05-06 14:28 . 2008-05-06 14:28
2008-05-06 14:28 . 2006-05-27 04:47 16,216,576 --a------ C:\WINDOWS\SET30.tmp
2008-05-06 14:28 . 2006-05-27 04:47 16,208,384 -r------- C:\WINDOWS\RTHDd448.rra
2008-05-06 14:28 . 2005-05-03 12:43 77,824 -r------- C:\WINDOWS\Alcmtr.exe
2008-05-05 19:47 . 2008-05-05 19:47 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-24 19:03 . 2008-04-24 19:03
2008-04-24 19:03 . 2008-04-24 19:08
2008-04-24 09:38 . 2008-04-24 09:38 101,376 --a------ C:\WINDOWS\system32\VT100.EXE
2008-04-23 20:09 . 2008-04-23 20:09
2008-04-23 20:05 . 2008-04-23 20:05
2008-04-23 19:55 . 2006-05-16 10:58 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-04-21 14:53 . 2008-05-06 15:42
2008-04-21 13:06 . 2008-04-21 13:06
2008-04-20 14:12 . 2008-04-20 14:12
2008-04-20 13:17 . 2008-04-20 13:17 712 --a------ C:\WINDOWS\unins000.dat
2008-04-18 15:13 . 2008-04-19 13:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-04-18 15:04 . 2008-04-18 15:04
2008-04-18 15:04 . 2008-04-18 15:04
2008-04-18 15:04 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-04-18 15:04 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-04-18 15:04 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-04-18 15:04 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2008-04-18 15:04 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-04-18 15:04 . 2001-07-09 10:50 163,840 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-04-18 15:04 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-04-18 15:04 . 2008-04-18 15:04 1,024 --ah----- C:\Documents and Settings\Default User\NtUser.dat.LOG
2008-04-18 15:02 . 2008-04-18 15:02
2008-04-18 15:02 . 2008-04-18 15:02
2008-04-18 15:02 . 2008-04-18 15:02
2008-04-18 15:02 . 1998-10-29 15:45 313,856 --a------ C:\WINDOWS\IsUninst.exe
2008-04-18 15:01 . 2008-04-18 15:04
2008-04-18 15:01 . 2004-10-01 15:00 49,152 --a------ C:\Program Files\Uninstall_CDS.exe
2008-04-17 16:23 . 2008-04-17 16:23
2008-04-17 13:39 . 2008-04-17 13:39
2008-04-17 13:39 . 2008-04-17 13:40
2008-04-16 16:19 . 2008-04-16 16:19
2008-04-16 16:16 . 2008-04-20 22:21
2008-04-16 16:16 . 2008-04-16 16:16 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2008-04-16 16:08 . 2008-04-16 16:08 664,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-16 16:08 . 2008-04-16 16:08 96,256 --a------ C:\WINDOWS\system32\drivers\sptd0141.sys
2008-04-16 15:55 . 2008-05-05 21:37
2008-04-16 15:54 . 2008-04-16 15:55
2008-04-16 15:54 . 2008-04-16 20:28 10,578 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-04-16 07:23 . 2000-04-24 15:42 45 --a------ C:\TEST.XML
2008-04-15 15:17 . 2008-04-15 15:17
2008-04-15 15:17 . 2008-04-17 19:22 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-04-15 15:17 . 2008-04-15 15:17 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-04-15 15:17 . 2008-04-17 19:22 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-14 21:09 . 2008-04-14 21:09
2008-04-14 21:09 . 2008-04-14 21:09 45,768 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-04-14 21:09 . 2008-04-14 21:09 32,072 --a------ C:\WINDOWS\system32\drivers\HookCentre.sys
2008-04-14 21:08 . 2008-04-14 21:08
2008-04-14 21:08 . 2008-04-20 23:03
2008-04-14 21:08 . 2005-04-20 21:31 474,624 -----c— C:\WINDOWS\system32\dllcache\wzcsvc.dll
2008-04-14 21:08 . 2006-11-01 09:17 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-04-14 21:08 . 2005-04-20 21:31 52,736 -----c— C:\WINDOWS\system32\dllcache\wzcsapi.dll
2008-04-14 21:08 . 2008-04-14 21:08 41,928 --a------ C:\WINDOWS\system32\drivers\GDTdiIcpt.sys
2008-04-14 21:08 . 2008-04-14 21:08 19,328 --a------ C:\WINDOWS\system32\drivers\GDNdisIc.sys
2008-04-14 21:08 . 2005-04-20 01:54 14,592 -----c— C:\WINDOWS\system32\dllcache\ndisuio.sys
2008-04-14 21:07 . 2008-04-14 21:09
2008-04-14 21:07 . 2008-04-14 21:08
2008-04-14 21:07 . 2008-04-14 21:07
2008-04-14 20:44 . 2008-04-14 20:52
2008-04-14 20:43 . 2008-04-14 20:43
2008-04-14 20:43 . 2008-04-14 20:43
2008-04-14 20:43 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-14 17:38 . 2008-04-18 15:02
2008-04-14 17:38 . 2008-03-19 18:26 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-04-14 17:38 . 2008-03-19 18:29 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-04-13 19:36 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-13 18:59 . 2008-04-13 18:59
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-06 12:28 --------- d-----w C:\Program Files\Realtek
2008-05-05 17:49 65,536 ----a-w C:\WINDOWS\DUMP5563.tmp
2008-04-23 17:55 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-04-23 17:48 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-23 09:09 65,536 ----a-w C:\WINDOWS\DUMP4d06.tmp
2008-04-13 15:41 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-13 14:11 --------- d-----w C:\Program Files\AMD
2008-04-13 14:04 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-13 14:02 --------- d-----w C:\Program Files\Usługi online
.
------- Sigcheck -------
2006-03-02 14:00 21504 6b16ad9c60eea41ee5e70866911047c3 C:\WINDOWS\system32\svchost.exe
2006-03-02 14:00 21504 ecb42e730036bd224951948985c5a068 C:\WINDOWS\system32\dllcache\svchost.exe
2006-03-02 14:00 1040896 61cb8cafa9a47532e7c7b6dff112d217 C:\WINDOWS\explorer.exe
2006-03-02 14:00 1040896 5f16532632d1ee7f27540be9e2067718 C:\WINDOWS\system32\dllcache\explorer.exe
2006-03-02 14:00 22528 f9a79d9cd42a81aad1db56ed8d3685ae C:\WINDOWS\system32\ctfmon.exe
2006-03-02 14:00 22528 077dffcd4d353a5a9c2c007b2fb784fb C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00 22528]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2008-03-20 12:04 2127296]
“STYLEXP”=“C:\Program Files\TGTSoft\StyleXP\StyleXP.exe” [2006-05-24 20:31 1380352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SkyTel”=“SkyTel.EXE” [2006-05-16 12:04 2889728 C:\WINDOWS\SkyTel.exe]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-06-01 11:22 7618560]
“nwiz”=“nwiz.exe” [2006-06-01 11:22 1527808 C:\WINDOWS\system32\nwiz.exe]
“NvMediaCenter”=“NvMCTray.dll” [2006-06-01 11:22 86016 C:\WINDOWS\system32\nvmctray.dll]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe” [2008-02-22 04:25 144784]
“GDFirewallTray”=“C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe” [2007-10-25 12:09 1189552]
“AVKTray”=“C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe” [2007-10-11 12:24 603720]
“DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-11-09 00:00 128920]
“WinampAgent”=“c:\Program Files\Winamp\winampa.exe” [2007-10-10 07:28 43520]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50 163840]
“RTHDCPL”=“RTHDCPL.EXE” [2006-05-27 04:47 16216576 C:\WINDOWS\RTHDCPL.exe]
“SoundMan”=“SOUNDMAN.EXE” [2006-05-04 10:22 94208 C:\WINDOWS\SoundMan.exe]
“AlcWzrd”=“ALCWZRD.EXE” [2006-05-04 10:26 2818048 C:\WINDOWS\alcwzrd.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2006-03-02 14:00 22528]
C:\Documents and Settings\xp\Menu Start\Programy\Autostart\
Hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-04-16 15:54:39 539136]
MoorHunt.lnk - C:\Program Files\MoorHunt\MoorHunt.exe [2008-04-14 20:44:06 3575808]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
G DATA Firewall Tray.lnk - C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe [2008-04-14 21:08:50 1189552]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“C:\WINDOWS\system32\sessmgr.exe”=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - D:\Recycled\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - E:\Recycled\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\Run.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{68d4d483-096f-11dd-b9e5-806d6172696f}]
\Shell\AutoRun\command - F:\Autorun.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-06 15:42:53
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
detected NTDLL code modification:
ZwOpenFile
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-06 15:43:52
ComboFix-quarantined-files.txt 2008-05-06 13:43:24
ComboFix2.txt 2008-05-05 17:48:35
Pre-Run: 9,627,439,104 bajtów wolnych
Post-Run: 9,619,681,280 bajtów wolnych
168