Mam problem z menadzerem zadań i rejestrem.
Podejrzewam,że wskoczył mi wirus.
Log z Combo:
ComboFix 10-03-08.01 - Rad 2010-03-08 21:49:31.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.3070.2681 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Rad\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\ALCMTR.EXE
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ABP470N5
-------\Service_abp470n5
((((((((((((((((((((((((( Pliki utworzone od 2010-02-08 do 2010-03-08 )))))))))))))))))))))))))))))))
.
2010-03-08 20:41 . 2010-03-08 20:46 -------- d-----w- c:\program files\SkanerOnline
2010-03-08 20:39 . 2010-03-08 20:39 -------- d-----w- C:\ERDNT
2010-03-08 20:39 . 2010-03-08 20:39 -------- d-----w- c:\windows\ERUNT
2010-03-08 20:39 . 2010-03-08 20:39 -------- d-----w- C:\!FixIEDef
2010-03-08 20:33 . 2010-03-08 20:33 -------- d-sh--w- c:\documents and settings\Rad\PrivacIE
2010-03-08 20:21 . 2010-02-27 19:46 3691384 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Simply Super Software\Trojan Remover\cic2.exe
2010-03-08 20:19 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-03-08 20:19 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-03-08 20:19 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-03-08 20:19 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-03-08 20:19 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-03-08 20:19 . 2010-03-08 20:19 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Simply Super Software
2010-03-08 20:19 . 2010-03-08 20:19 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Simply Super Software
2010-03-08 20:00 . 2010-03-08 20:00 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\ESET
2010-03-08 19:59 . 2010-03-08 19:59 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ESET
2010-03-08 17:19 . 2010-03-08 20:02 -------- d-----w- c:\program files\DAEMON Tools Pro
2010-03-08 17:19 . 2010-03-08 17:20 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\DAEMON Tools Pro
2010-03-08 17:19 . 2010-03-08 17:19 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro
2010-03-08 16:57 . 2010-03-08 16:57 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\Ahead
2010-03-08 16:48 . 2010-03-08 16:48 -------- d-----w- c:\program files\Common Files\BioWare
2010-03-08 15:45 . 2010-03-08 15:45 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\AliensVsPredator
2010-03-08 15:03 . 2010-03-08 15:03 -------- d-----w- c:\program files\Common Files\Nero
2010-03-08 14:51 . 2000-06-26 10:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2010-03-08 14:51 . 2004-07-26 16:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2010-03-08 14:51 . 2004-07-26 16:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2010-03-08 14:51 . 2004-07-26 16:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2010-03-08 14:51 . 2004-07-26 16:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2010-03-08 14:51 . 2001-07-09 10:50 225280 ----a-w- c:\windows\system32\NeroCheck.exe
2010-03-08 14:51 . 2010-03-08 14:51 -------- d-----w- c:\program files\Common Files\Ahead
2010-03-08 14:51 . 2010-03-08 14:51 -------- d-----w- c:\program files\Ahead
2010-03-07 18:58 . 2010-03-08 20:24 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP
2010-03-07 14:27 . 2010-03-07 14:27 -------- d-sh--w- c:\windows\ftpcache
2010-03-05 13:52 . 2010-03-05 13:52 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Ventrilo
2010-03-04 15:22 . 2010-03-04 15:22 -------- d-----w- c:\program files\Ventrilo
2010-03-03 20:02 . 2008-03-02 04:40 742220 ----a-w- c:\windows\system32\xvidcore.dll
2010-03-03 20:02 . 2004-07-02 16:08 139264 ----a-w- c:\windows\system32\xvidvfw.dll
2010-03-03 20:02 . 2007-03-08 17:37 139264 ----a-w- c:\windows\system32\viscomqtde.dll
2010-03-03 20:02 . 2007-03-08 17:36 81920 ----a-w- c:\windows\system32\viscomwave.dll
2010-03-03 20:02 . 2010-03-03 20:02 -------- d-----w- c:\program files\Plato Video Converter
2010-03-03 20:02 . 2010-03-08 19:42 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\LogMeIn Hamachi
2010-03-03 20:02 . 2010-03-08 20:52 -------- d-----w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\LogMeIn Hamachi
2010-03-03 20:02 . 2010-03-03 20:02 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-03-03 05:30 . 2010-03-08 18:55 60 ----a-w- c:\program files\Common Files\userInit.dll
2010-03-02 18:48 . 2008-04-14 21:50 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-03-02 16:23 . 2010-03-02 16:24 -------- d-----w- c:\program files\The KMPlayer
2010-03-02 15:59 . 2010-03-03 20:00 -------- d-----w- c:\program files\audio-mp3-converter
2010-03-02 15:59 . 2001-08-26 11:20 671744 ----a-w- c:\windows\system32\DGVorbis.dll
2010-03-02 15:59 . 2000-10-03 16:16 765952 ----a-w- c:\windows\system32\tvqenc.dll
2010-03-02 15:59 . 2000-10-02 10:45 573440 ----a-w- c:\windows\system32\tvqdec.dll
2010-03-02 15:59 . 1999-09-17 09:56 118784 ----a-w- c:\windows\system32\mp3dec.dll
2010-03-02 10:48 . 2010-03-02 10:48 -------- d-----w- c:\program files\Grupa IMAGE
2010-03-02 10:26 . 2010-03-08 18:53 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-02 10:26 . 2010-03-08 18:53 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-02 10:26 . 2010-03-02 10:26 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-02 10:26 . 2010-03-02 10:26 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\PunkBuster
2010-03-02 08:45 . 2010-03-02 08:45 27958 ----a-w- c:\program files\Common Files\logonInit.dll
2010-03-02 08:44 . 2010-03-02 08:45 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Tibia
2010-03-01 18:00 . 2010-03-01 18:00 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\HP
2010-03-01 15:13 . 2010-03-01 15:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\WEBREG
2010-03-01 15:12 . 2010-03-01 15:12 -------- d-----w- c:\documents and settings\LocalService\Dane aplikacji\HP
2010-03-01 15:12 . 2010-03-01 15:12 -------- d-----r- c:\documents and settings\LocalService\Ulubione
2010-03-01 15:12 . 2010-03-01 15:12 -------- d-----w- c:\documents and settings\Default User\Ustawienia lokalne\Dane aplikacji\Microsoft
2010-03-01 15:11 . 2010-03-01 15:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\HP
2010-03-01 15:11 . 2010-03-01 15:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\HPSSUPPLY
2010-03-01 15:10 . 2010-03-01 15:12 -------- d-----w- c:\program files\Common Files\HP
2010-03-01 15:10 . 2010-03-01 15:10 -------- d-----w- c:\program files\Hewlett-Packard
2010-03-01 15:10 . 2010-03-01 15:10 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-03-01 15:09 . 2010-03-01 15:12 -------- d-----w- c:\program files\HP
2010-03-01 15:09 . 2008-04-13 23:15 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2010-03-01 15:07 . 2006-12-06 06:02 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2010-03-01 15:07 . 2006-12-06 06:02 49920 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2010-03-01 15:07 . 2010-03-01 15:07 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard
2010-03-01 15:07 . 2010-03-01 15:13 141251 ----a-w- c:\windows\hpoins12.dat
2010-03-01 15:07 . 2007-01-22 16:05 1470 ------w- c:\windows\hpomdl12.dat
2010-03-01 15:07 . 2010-03-01 15:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-01 15:07 . 2006-12-15 16:04 258048 ----a-r- c:\windows\system32\hpzids01.dll
2010-03-01 15:07 . 2006-12-30 14:49 117760 ----a-w- c:\windows\system32\hpzll4v2.dll
2010-03-01 15:07 . 2006-12-29 08:57 273920 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp4v2.dll
2010-03-01 15:07 . 2006-12-06 06:02 21568 ----a-r- c:\windows\system32\drivers\HPZius12.sys
2010-03-01 15:07 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-03-01 15:07 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-03-01 15:06 . 2006-12-06 06:02 364544 ----a-r- c:\windows\system32\hppldcoi.dll
2010-03-01 15:06 . 2006-12-06 06:02 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-03-01 15:06 . 2006-12-06 06:00 294912 ----a-r- c:\windows\system32\hpovst10.dll
2010-03-01 15:06 . 2006-12-06 06:00 675840 ----a-r- c:\windows\system32\hpowiax3.dll
2010-03-01 15:06 . 2006-12-06 06:00 569344 ----a-r- c:\windows\system32\hpotscl3.dll
2010-03-01 15:06 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-03-01 15:06 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-03-01 15:05 . 2008-04-13 23:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-03-01 15:05 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-03-01 15:01 . 2010-03-07 10:07 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\Adobe
2010-02-28 18:10 . 2010-02-28 18:10 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Leadertech
2010-02-28 18:06 . 2010-03-03 20:02 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Hamachi
2010-02-28 18:06 . 2009-09-23 08:41 26176 ---ha-w- c:\windows\system32\drivers\hamachi.sys
2010-02-28 17:58 . 2010-03-08 20:02 -------- d-----w- C:\Fraps
2010-02-28 17:58 . 2010-02-28 17:58 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-28 17:58 . 2010-02-28 18:02 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\DAEMON Tools Lite
2010-02-28 17:58 . 2010-02-28 17:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite
2010-02-28 17:55 . 2010-02-04 09:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-28 17:55 . 2010-02-04 09:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-28 17:55 . 2010-02-04 09:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-28 17:55 . 2010-02-04 09:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-02-28 17:53 . 2010-02-28 17:53 -------- d-----w- c:\windows\Logs
2010-02-28 17:51 . 2010-02-28 17:51 503808 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-578c4920-n\msvcp71.dll
2010-02-28 17:51 . 2010-02-28 17:51 499712 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-578c4920-n\jmc.dll
2010-02-28 17:51 . 2010-02-28 17:51 348160 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-578c4920-n\msvcr71.dll
2010-02-28 17:51 . 2010-02-28 17:51 61440 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1b8e1c20-n\decora-sse.dll
2010-02-28 17:51 . 2010-02-28 17:51 12800 ----a-w- c:\documents and settings\Rad\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1b8e1c20-n\decora-d3d.dll
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\cache
2010-02-28 17:47 . 2010-03-08 19:04 -------- d-----w- c:\program files\Nowe Gadu-Gadu
2010-02-28 17:42 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-02-28 17:42 . 2006-10-26 18:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-02-28 17:42 . 2010-02-28 17:48 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\Nowe Gadu-Gadu
2010-02-28 17:42 . 2010-02-28 17:42 -------- d-----w- c:\program files\Microsoft Works
2010-02-28 17:41 . 2010-02-28 17:41 -------- d-----w- c:\program files\Microsoft.NET
2010-02-28 17:39 . 2010-02-28 17:39 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-28 17:39 . 2010-02-28 17:39 -------- d-----w- c:\windows\SHELLNEW
2010-02-28 17:39 . 2010-02-28 17:39 -------- d-----w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\Microsoft Help
2010-02-28 17:39 . 2010-02-28 17:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2010-02-28 17:38 . 2010-02-28 17:38 -------- d-----r- C:\MSOCache
2010-02-28 17:36 . 2010-02-28 17:36 -------- d-----w- c:\windows\system32\Lang
2010-02-28 17:36 . 2010-02-28 17:36 -------- d-sh--w- c:\documents and settings\Rad\IETldCache
2010-02-28 17:30 . 2010-02-28 17:30 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-28 17:27 . 2010-02-28 17:27 -------- d-----w- c:\documents and settings\NetworkService\Dane aplikacji\Xfire
2010-02-28 17:27 . 2010-02-28 17:27 664 ----a-w- c:\windows\system32\d3d9caps.dat
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-08 20:52 . 2010-02-28 16:07 16608 ----a-w- c:\windows\gdrv.sys
2010-03-08 19:55 . 2010-03-08 19:55 69232 ----a-w- c:\documents and settings\radziu\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-03-07 14:28 . 2010-02-28 16:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-07 10:09 . 2010-02-28 16:29 69232 ----a-w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-02-28 17:36 . 2010-02-28 16:41 -------- d-----w- c:\program files\Windows Desktop Search
2010-02-28 17:10 . 2003-04-16 12:00 88838 ----a-w- c:\windows\system32\perfc015.dat
2010-02-28 17:10 . 2003-04-16 12:00 500302 ----a-w- c:\windows\system32\perfh015.dat
2010-02-28 17:02 . 2010-02-28 17:02 23558 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{83073C45-3003-4671-9A86-243AAADD915A}\_294823.exe
2010-02-28 17:02 . 2010-02-28 17:02 23558 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{83073C45-3003-4671-9A86-243AAADD915A}\_18be6784.exe
2010-02-28 17:02 . 2010-02-28 17:02 -------- d-----w- c:\program files\Microsoft Calculator Plus
2010-02-28 17:02 . 2010-02-28 17:02 912 ----a-w- c:\windows\unins000.dat
2010-02-28 17:02 . 2010-02-28 17:02 635337 ----a-w- c:\windows\unins000.exe
2010-02-28 17:02 . 2010-02-28 17:02 9454 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{B5688129-7595-4E5B-9990-CEF981A31264}\_6FEFF9B68218417F98F549.exe
2010-02-28 17:02 . 2010-02-28 17:02 9454 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{B5688129-7595-4E5B-9990-CEF981A31264}\_137869EA3A73403ED70C47.exe
2010-02-28 17:02 . 2010-02-28 17:02 25214 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{CE378F36-E404-4244-A33F-F50A2A6D31BD}\ARPPRODUCTICON.exe
2010-02-28 17:02 . 2010-02-28 17:02 -------- d-----w- c:\program files\Pro Imaging Powertoys
2010-02-28 17:02 . 2010-02-28 17:02 9062 ----a-r- c:\documents and settings\Rad\Dane aplikacji\Microsoft\Installer\{2E5A5B57-57FC-4C79-A239-9DB280ADEC2A}\ARPPRODUCTICON.exe
2010-02-28 17:02 . 2010-02-28 17:02 128 ----a-w- c:\documents and settings\Rad\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2010-02-28 17:02 . 2010-02-28 17:02 -------- d-----w- c:\program files\Common Files\Nikon
2010-02-28 16:39 . 2010-02-28 16:39 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-28 16:35 . 2010-02-28 16:35 -------- d-----w- c:\program files\MSBuild
2010-02-28 16:35 . 2010-02-28 16:35 -------- d-----w- c:\program files\Reference Assemblies
2010-02-28 16:29 . 2010-02-28 16:29 -------- d-----w- c:\program files\SGJ
2010-02-28 16:25 . 2010-02-28 16:03 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-02-28 16:12 . 2010-02-28 16:10 -------- d-----w- c:\program files\Realtek
2010-02-28 16:12 . 2010-02-28 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-28 16:12 . 2010-02-28 16:12 -------- d-----w- c:\documents and settings\Rad\Dane aplikacji\InstallShield
2010-02-28 16:10 . 2010-02-28 16:10 315392 ----a-w- c:\windows\HideWin.exe
2010-02-28 16:08 . 2010-02-28 16:08 -------- d-----w- c:\program files\Intel
2010-02-28 16:08 . 2010-02-28 16:08 -------- d-----w- c:\program files\Browser Configuration Utility
2010-02-28 16:08 . 2010-02-28 16:08 -------- d-----w- c:\program files\Gigabyte
2010-02-28 16:04 . 2010-02-28 16:04 -------- d-----w- c:\program files\microsoft frontpage
2010-02-28 16:02 . 2010-02-28 16:02 21856 ----a-w- c:\windows\system32\emptyregdb.dat
2010-02-28 16:02 . 2010-02-28 16:02 -------- d-----w- c:\program files\Usługi online
2010-02-11 10:42 . 2010-02-11 10:42 86016 ----a-w- c:\windows\system32\frapsvid.dll
2010-01-12 04:03 . 2010-02-28 16:23 6359168 ----a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-28 16:22 10276768 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-12-31 16:50 . 2003-04-16 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-17 07:42 . 2010-02-28 16:01 345088 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2003-04-16 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2003-04-16 12:00 2146816 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2002-09-20 17:12 2025472 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2009-12-18 505152]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"WinampAgent"="e:\programy\Winamp\winampa.exe" [2009-12-18 39424]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 113584]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 225280]
"TrojanScanner"="d:\trojan remover\Trjscan.exe" [2010-02-27 1165192]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Programy\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Gry\\badcompany2\\BFBC2Updater.exe"=
"c:\\WINDOWS\\system32\\taskswitch.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"e:\\Programy\\fire\\firefox.exe"=
"c:\\Program Files\\Ahead\\Nero StartSmart\\NeroStartSmart.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"d:\\Gry\\fifaa\\FIFA10.exe"=
"c:\\Program Files\\LogMeIn Hamachi\\hamachi-2-ui.exe"=
"c:\\WINDOWS\\system32\\NeroCheck.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2010-02-28 691696]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2010-02-28 80392]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-GEST - (no file)
HKLM-Run-nwiz - nwiz.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 21:52
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spbq.sys >>UNKNOWN [0x8A2FC938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28
\Driver\ACPI -> ACPI.sys @ 0xb7e73cb8
\Driver\atapi -> atapi.sys @ 0xb7e08b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7d11bb0
PacketIndicateHandler -> NDIS.sys @ 0xb7d1ea21
SendHandler -> NDIS.sys @ 0xb7cfc87b
user & kernel MBR OK
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(2096)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Pro Imaging Powertoys\Microsoft RAW Image Thumbnailer and Viewer for Windows XP\CRawViewerExtension.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\WinRAR\rarext.dll
d:\trojan~1\Trshlex.dll
c:\program files\Microsoft Office\Office12\1045\GrooveIntlResource.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Czas ukończenia: 2010-03-08 21:54:00 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2010-03-08 20:53
Przed: 32 336 703 488 bajtów wolnych
Po: 32 362 475 520 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
- - End Of File - - 93F1332F3F74BD07A36DE7389E72AFBC
Jak ktoś się na tym zna i mógłby pomóc, byłbym wdzięczny.
Z góry dzięki.