dziuram utworzono 11 maja 2009 utworzono 11 maja 2009 ComboFix 09-05-11.01 - Gidi 2009-05-11 21:18.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2046.1713 [GMT 2:00]Uruchomiony z: D:\ComboFix.exe.[i] ADS - svchost.exe: deleted 68 bytes in 1 streams. [/i][i] ADS - explorer.exe: deleted 132 bytes in 1 streams. [/i]((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\OPTIONS\CABS\_desktop.ini.((((((((((((((((((((((((( Pliki utworzone od 2009-04-11 do 2009-05-11 ))))))))))))))))))))))))))))))).2009-05-11 18:42 . 2009-05-11 18:42 -------- d-----w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\Identities2009-05-11 13:03 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll2009-05-11 13:03 . 2003-03-18 18:14 499712 ----a-w c:\windows\system32\MSVCP71.dll2009-05-11 13:03 . 2003-02-21 02:42 348160 ----a-w c:\windows\system32\MSVCR71.dll2009-05-11 13:03 . 2009-05-11 13:03 -------- d-----w c:\program files\Alwil Software2009-05-11 12:49 . 2009-05-11 12:49 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\Lavasoft2009-05-11 12:48 . 2009-05-11 12:48 -------- d-----w c:\program files\Lavasoft2009-05-10 13:05 . 2001-10-26 15:29 5632 ----a-w c:\windows\system32\ptpusb.dll2009-05-10 13:05 . 2004-08-03 22:44 159232 ----a-w c:\windows\system32\ptpusd.dll2009-05-10 13:05 . 2004-08-03 20:58 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys2009-05-10 13:05 . 2004-08-03 20:58 15104 ----a-w c:\windows\system32\drivers\usbscan.sys2009-05-09 22:27 . 2009-05-09 22:27 -------- d-----w c:\windows\system32\KB9054742009-05-09 22:27 . 2009-03-10 20:26 1436544 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe2009-05-09 22:27 . 2009-03-10 20:18 455048 ----a-w c:\windows\system32\KB905474\wgasetup.exe2009-05-09 18:14 . 2008-06-14 18:01 273024 -c----w c:\windows\system32\dllcache\bthport.sys2009-05-09 18:14 . 2008-06-14 18:01 273024 ------w c:\windows\system32\drivers\bthport.sys2009-05-09 18:10 . 2009-02-09 11:52 2059008 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe2009-05-09 18:10 . 2009-02-09 11:52 2017280 -c----w c:\windows\system32\dllcache\ntkrpamp.exe2009-05-09 18:10 . 2009-02-09 11:52 2181760 -c----w c:\windows\system32\dllcache\ntoskrnl.exe2009-05-09 18:10 . 2009-02-09 11:52 2137600 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe2009-05-09 18:01 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys2009-05-09 15:01 . 2009-05-09 17:51 -------- d-----w c:\windows\system32\CatRoot_bak2009-05-08 23:43 . 2009-05-09 22:27 -------- d--h--w c:\windows\$hf_mig$2009-05-08 16:40 . 2003-06-18 23:31 17920 ----a-w c:\windows\system32\mdimon.dll2009-05-08 16:39 . 2009-05-08 16:39 -------- d-----w c:\windows\SHELLNEW2009-05-08 15:48 . 2009-05-08 15:48 -------- d-----w c:\program files\IrfanView2009-05-08 15:43 . 2006-07-30 17:00 143360 ----a-r c:\windows\apptune1018.exe2009-05-08 15:43 . 2006-07-30 17:00 86016 ----a-r c:\windows\system32\ZSPOOL.DLL2009-05-08 15:43 . 2006-07-30 17:00 24576 ----a-r c:\windows\system32\ZTAG32.DLL2009-05-08 15:43 . 2006-07-30 17:00 28672 ----a-r c:\windows\system32\IMF32.DLL2009-05-08 15:43 . 2006-07-30 17:00 102400 ----a-r c:\windows\system32\zlhp1018.dll2009-05-08 15:43 . 2006-07-30 17:00 28672 ----a-r c:\windows\system32\zlm.dll2009-05-08 15:43 . 2006-07-30 17:00 106496 ----a-r c:\windows\system32\vshp1018.dll2009-05-08 15:43 . 2006-07-30 17:00 442368 ----a-r c:\windows\system32\zshp1018.exe2009-05-08 15:43 . 2009-05-08 15:43 -------- d-----w c:\program files\Hewlett-Packard2009-05-08 15:43 . 2009-05-08 15:43 -------- d--h--w c:\program files\Zenographics2009-05-08 15:42 . 2009-05-08 15:42 -------- d-----w c:\windows\system32\Munins2009-05-08 15:40 . 2009-05-08 15:40 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\AdobeUM2009-05-08 15:40 . 2009-05-08 15:40 -------- d-----w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\Adobe2009-05-08 15:40 . 2009-05-08 15:40 -------- d-----w c:\program files\Common Files\Adobe2009-05-08 15:31 . 2009-05-08 15:31 -------- d-----w c:\program files\NAPI-PROJEKT2009-05-08 15:31 . 2009-05-08 15:31 -------- d-----w c:\program files\ALLPlayer2009-05-08 13:00 . 2009-05-08 13:00 -------- d-----w c:\program files\Common Files\Ulead Systems2009-05-08 12:59 . 2009-05-08 12:59 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ulead Systems2009-05-08 12:59 . 2001-12-19 13:47 49152 ----a-w c:\windows\system32\TempDel.EXE2009-05-08 12:59 . 2009-05-08 13:00 -------- d-----w C:\WFDB2009-05-08 12:59 . 2005-01-06 14:55 9446 ----a-w c:\windows\system32\drivers\WFIOCTL.sys2009-05-08 12:59 . 2009-05-08 12:59 -------- d-----w c:\program files\WinFast2009-05-08 12:01 . 2004-08-03 20:58 5504 -c--a-w c:\windows\system32\dllcache\mstee.sys2009-05-08 12:01 . 2004-08-03 20:58 5504 ----a-w c:\windows\system32\drivers\MSTEE.sys2009-05-08 12:01 . 2004-08-03 21:10 10880 -c--a-w c:\windows\system32\dllcache\ndisip.sys2009-05-08 12:01 . 2004-08-03 21:10 10880 ----a-w c:\windows\system32\drivers\NdisIP.sys2009-05-08 12:00 . 2004-08-03 21:10 15360 -c--a-w c:\windows\system32\dllcache\streamip.sys2009-05-08 12:00 . 2004-08-03 21:10 15360 ----a-w c:\windows\system32\drivers\StreamIP.sys2009-05-08 12:00 . 2004-08-03 21:10 11136 -c--a-w c:\windows\system32\dllcache\slip.sys2009-05-08 12:00 . 2004-08-03 21:10 11136 ----a-w c:\windows\system32\drivers\SLIP.sys2009-05-08 12:00 . 2004-08-03 21:10 19328 -c--a-w c:\windows\system32\dllcache\wstcodec.sys2009-05-08 12:00 . 2004-08-03 21:10 19328 ----a-w c:\windows\system32\drivers\WSTCODEC.SYS2009-05-08 12:00 . 2004-08-03 21:10 85376 -c--a-w c:\windows\system32\dllcache\nabtsfec.sys2009-05-08 12:00 . 2004-08-03 21:10 85376 ----a-w c:\windows\system32\drivers\NABTSFEC.sys2009-05-08 12:00 . 2004-08-03 21:10 17024 -c--a-w c:\windows\system32\dllcache\ccdecode.sys2009-05-08 12:00 . 2004-08-03 21:10 17024 ----a-w c:\windows\system32\drivers\CCDECODE.sys2009-05-08 11:59 . 2004-08-03 22:44 54784 -c--a-w c:\windows\system32\dllcache\vfwwdm32.dll2009-05-08 11:59 . 2004-08-03 22:44 54784 ----a-w c:\windows\system32\vfwwdm32.dll2009-05-08 11:59 . 2006-04-20 12:49 9600 ----a-w c:\windows\system32\drivers\wf2kXbar.sys2009-05-08 11:59 . 2006-04-20 12:50 59776 ----a-w c:\windows\system32\drivers\wf2kvcap.sys2009-05-08 11:59 . 2006-04-20 13:20 19456 ----a-w c:\windows\system32\drivers\wf2ktunr.sys2009-05-08 11:59 . 2009-05-08 11:59 -------- d-----w c:\windows\system32\DX92009-05-08 11:58 . 2009-05-08 11:59 -------- d-----w c:\windows\system32\WinFast2009-05-08 11:58 . 2009-05-08 11:58 -------- d-----w c:\windows\system32\WinFox2009-05-08 11:58 . 2005-03-25 16:24 9600 ----a-w c:\windows\system32\drivers\WINFOXIO.sys2009-05-08 07:41 . 2009-05-08 07:41 -------- d-----w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\ESET2009-05-08 07:41 . 2009-05-08 07:41 -------- d-----w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET2009-05-08 07:40 . 2004-08-03 21:08 26496 -c--a-w c:\windows\system32\dllcache\usbstor.sys2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\LHA.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\NOCLOSE.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\PKUNZIP.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\PKZIP.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\RAR.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\UC.PIF2009-05-07 23:02 . 2008-07-29 05:04 545 ----a-w c:\windows\ARJ.PIF2009-05-07 23:02 . 2009-05-08 11:31 -------- d-----w C:\totalcmd2009-05-07 22:54 . 2009-05-07 22:54 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\Gadu-Gadu2009-05-07 22:53 . 2009-05-07 22:54 -------- d-----w c:\documents and settings\Gidi\Gadu-Gadu2009-05-07 22:53 . 2009-05-07 22:53 -------- d-----w c:\program files\Gadu-Gadu2009-05-07 22:07 . 2009-05-07 22:07 -------- d-----w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\Ahead2009-05-07 21:56 . 2009-05-07 21:56 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\OpenFM2009-05-07 21:45 . 2009-05-07 21:55 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\Nowe Gadu-Gadu2009-05-07 21:45 . 2009-05-07 21:45 -------- d-----w c:\program files\Nowe Gadu-Gadu2009-05-07 21:31 . 2009-05-07 21:31 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET2009-05-07 21:06 . 2009-05-07 21:06 0 ----a-w c:\windows\nsreg.dat2009-05-07 21:06 . 2009-05-07 21:06 -------- d-----w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\Mozilla2009-05-07 21:06 . 2009-05-11 19:02 -------- d-----w c:\program files\Mozilla Firefox 3.5 Beta 42009-05-07 21:04 . 2009-05-07 21:04 -------- d-----w c:\program files\Common Files\LightScribe2009-05-07 21:02 . 2009-05-07 21:02 -------- d-----w c:\documents and settings\Gidi\Dane aplikacji\Ahead2009-05-07 21:00 . 2009-05-07 21:00 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero2009-05-07 21:00 . 2009-05-07 21:00 -------- d-----w c:\program files\Nero2009-05-07 21:00 . 2009-05-07 21:04 -------- d-----w c:\program files\Common Files\Ahead2009-05-07 20:50 . 2009-05-11 18:33 17464 ----a-w c:\documents and settings\Gidi\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT2009-05-07 20:41 . 2009-05-07 20:41 -------- d-----w c:\windows\nview2009-05-07 20:41 . 2007-06-28 16:43 356352 ----a-w c:\windows\system32\nvudisp.exe2009-05-07 20:40 . 2007-06-28 23:54 356352 ----a-w c:\windows\system32\NVUNINST.EXE.(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-05-10 08:27 . 2001-10-26 17:15 49492 ----a-w c:\windows\system32\perfc015.dat2009-05-10 08:27 . 2001-10-26 17:15 355486 ----a-w c:\windows\system32\perfh015.dat2009-05-08 15:32 . 2009-05-08 15:32 -------- d-----w c:\program files\Winamp2009-05-08 13:00 . 2009-05-07 19:48 -------- d--h--w c:\program files\InstallShield Installation Information2009-05-08 11:58 . 2009-05-07 19:48 -------- d-----w c:\program files\Common Files\InstallShield2009-05-07 19:52 . 2009-05-07 19:52 -------- d-----w c:\program files\Kaspersky Lab2009-05-07 19:51 . 2009-05-07 19:45 15600 ----a-w c:\windows\gdrv.sys2009-05-07 19:49 . 2009-05-07 19:48 -------- d-----w c:\program files\Realtek2009-05-07 19:48 . 2009-05-07 19:48 315392 ----a-w c:\windows\HideWin.exe2009-05-07 19:46 . 2009-05-07 19:46 -------- d-----w c:\program files\Intel2009-05-07 19:40 . 2009-05-07 19:40 -------- d-----w c:\program files\microsoft frontpage2009-05-07 19:39 . 2001-07-21 23:36 67 --sha-w c:\windows\Fonts\desktop.ini2009-05-07 19:39 . 2009-05-07 19:39 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat2009-05-07 19:39 . 2009-05-07 19:39 -------- d-----w c:\program files\Usługi online2009-05-07 19:37 . 2009-05-07 19:37 21856 ----a-w c:\windows\system32\emptyregdb.dat2009-03-06 14:47 . 2004-08-03 22:44 285184 ----a-w c:\windows\system32\pdh.dll2009-02-20 08:32 . 2004-08-03 22:44 662016 ----a-w c:\windows\system32\wininet.dll2009-02-20 08:32 . 2004-08-03 22:44 81920 ----a-w c:\windows\system32\ieencode.dll.((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))..*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]"ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2006-10-24 368640]"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-04-12 16132608]"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-06-28 1626112][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360][HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\totalcmd\\TOTALCMD.EXE"=R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [2009-05-08 59776]R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [2009-05-08 19456]R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [2009-05-08 9600]R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [2009-05-08 9446][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4af8b14b-3d63-11de-a3bf-001a4d572ccd}]\Shell\AutoRun\command - F:\ysep1.exe\Shell\open\Command - F:\ysep1.exe.Zawartość folderu 'Zaplanowane zadania'2009-05-11 c:\windows\Tasks\WGASetup.job- c:\windows\system32\KB905474\wgasetup.exe [2009-05-09 20:18]..------- Skan uzupełniający -------.IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000FF - ProfilePath - c:\documents and settings\Gidi\Dane aplikacji\Mozilla\Firefox\Profiles\bsv8gs3u.default\---- FIREFOX - SPOSÓB POSTĘPOWANIA ----c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("media.enforce_same_site_origin", false);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("media.cache_size", 51200);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("media.ogg.enabled", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("media.wave.enabled", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("media.autoplay.enabled", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("dom.storage.default_quota", 5120);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("gestures.enable_single_finger_input", true);c:\program files\Mozilla Firefox 3.5 Beta 4\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);c:\program files\Mozilla Firefox 3.5 Beta 4\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-05-11 21:19Windows 5.1.2600 Dodatek Service Pack 2 NTFSskanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończoneukryte pliki: 0**************************************************************************.Czas ukończenia: 2009-05-11 21:20ComboFix-quarantined-files.txt 2009-05-11 19:20Przed: 47 008 174 080 bajtów wolnychPo: 47 010 099 200 bajtów wolnychWindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect218 --- E O F --- 2009-05-09 22:27
Gość komentarz 12 maja 2009 komentarz 12 maja 2009 1. Do Notatnika wklej: Windows Registry Editor Version 5.00[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4af8b14b-3d63-11de-a3bf-001a4d572ccd}] Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>> plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru). Zrestartuj komputer. 2. Posprzątaj po ComboFixie i różnych narzędziach >>> OTCleanIt. I to wszystko. .
Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!
Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.