ComboFix 11-08-27.01 - Aga 2011-08-28 13:49:14.4.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.958.639 [GMT 2:00] Uruchomiony z: c:\documents and settings\Aga\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Aga\Pulpit\CFScript.txt AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393} . UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . . ((((((((((((((((((((((((( Pliki utworzone od 2011-07-28 do 2011-08-28 ))))))))))))))))))))))))))))))) . . 2011-08-27 23:54 . 2011-08-27 23:52 89088 ----a-w- C:\mbr.exe 2011-08-27 21:36 . 2011-08-28 08:14 43408 --sha-w- c:\windows\system32\c_34894.nl_ 2011-08-21 19:40 . 2011-08-21 19:59 -------- d-----w- c:\documents and settings\Aga\Dane aplikacji\PhotoScape 2011-08-21 19:39 . 2011-08-21 19:40 -------- d-----w- c:\program files\PhotoScape 2011-08-18 18:42 . 2011-08-18 18:42 0 ----a-w- c:\windows\system32\SETA7.tmp 2011-08-18 18:09 . 2011-08-18 18:09 49152 ----a-r- c:\documents and settings\Aga\Dane aplikacji\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe 2011-08-18 18:08 . 2011-08-18 18:08 335872 ----a-r- c:\documents and settings\Aga\Dane aplikacji\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe 2011-08-18 18:07 . 2011-08-18 18:07 57344 ----a-r- c:\documents and settings\Aga\Dane aplikacji\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe 2011-08-18 18:06 . 2011-08-18 18:06 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Internet Services 2011-08-18 18:05 . 2011-08-18 18:05 -------- d-----w- c:\program files\Common Files\muvee Technologies 2011-08-18 18:05 . 2011-08-18 18:08 -------- d-----w- c:\program files\Common Files\Nikon 2011-08-18 18:05 . 2011-08-18 18:05 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nikon 2011-08-18 18:05 . 2011-08-18 18:06 -------- d-----w- c:\program files\Nikon 2011-08-18 18:05 . 2011-08-18 18:06 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Ultima_T15 2011-08-18 18:05 . 2011-08-18 18:06 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\EnterNHelp 2011-08-18 18:05 . 2011-08-18 18:05 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Hybrid Chords 2011-08-11 10:56 . 2011-08-11 10:56 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\lP00000ChObN00000 . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-08-28 08:40 . 2005-02-22 02:28 58880 ----a-w- c:\windows\system32\drivers\redbook.sys 2011-08-28 00:03 . 2005-02-22 02:28 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2011-08-27 23:35 . 2005-02-22 02:28 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-08-27 21:46 . 2005-02-22 02:28 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys 2011-07-06 17:52 . 2011-03-25 01:56 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-07-06 17:52 . 2011-03-25 01:56 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-08-21 15:42 . 2011-05-12 19:26 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon] @="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}" [HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}] 2010-12-16 17:18 320832 ----a-w- c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon] @="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}" [HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}] 2010-12-16 17:18 320832 ----a-w- c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2011-02-25 2127296] "Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2011-06-15 13361760] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "Ashampoo FireWall"="c:\program files\Ashampoo\Ashampoo FireWall FREE\FireWall.exe" [2008-06-02 3251800] "PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2011-02-24 423232] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate] 2010-12-03 20:06 233936 ----a-w- c:\windows\system32\Macromed\Flash\FlashUtil10l_Plugin.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDD Regenerator] 2010-10-19 12:48 2425104 ----a-w- c:\program files\HDD Regenerator\HDD Regenerator.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hjame] 2008-04-14 17:20 106496 ----a-w- c:\windows\nsgX32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor] 2008-12-16 14:44 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftAuto.exe] 2008-08-13 03:49 405504 ----a-w- c:\program files\Creative\Software Update 3\SoftAuto.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] 2005-10-04 13:12 90112 ----a-w- c:\windows\SOUNDMAN.EXE . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . R1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [2010-12-16 130376] R2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-12-16 140608] R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2010-12-16 141768] R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2010-12-16 97352] R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2010-12-16 111944] R2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2010-12-16 113096] R3 EKBfltr;ENE Keyboard Controller;c:\windows\system32\drivers\EKBfltr.sys [2005-11-25 5504] S3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2009-12-07 36608] S3 iMSPQMn;iMSPQMn;\??\c:\docume~1\Aga\USTAWI~1\Temp\iMSPQMn.sys --> c:\docume~1\Aga\USTAWI~1\Temp\iMSPQMn.sys [?] S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://wyborcza.biz/biznes/0,0.html?p=005 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: c:\program files\Ashampoo\Ashampoo FireWall FREE\spi.dll TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\documents and settings\Aga\Dane aplikacji\Mozilla\Firefox\Profiles\diszdf60.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - hxxp://google.pl/ . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-08-28 13:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide] "ImagePath"="\??\c:\docume~1\Aga\USTAWI~1\Temp\ASFWHide" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'lsass.exe'(932) c:\program files\Ashampoo\Ashampoo FireWall FREE\spi.dll . - - - - - - - > 'explorer.exe'(1788) c:\windows\system32\WININET.dll c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.DLL c:\program files\Panda Security\Panda Cloud Antivirus\PSNCGP.dll c:\program files\Panda Security\Panda Cloud Antivirus\PSNCIPC.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Czas ukończenia: 2011-08-28 13:57:39 ComboFix-quarantined-files.txt 2011-08-28 11:57 ComboFix2.txt 2011-08-28 09:15 . Przed: 21 728 018 432 bajtów wolnych Po: 21 716 365 312 bajtów wolnych . - - End Of File - - 9EF9D1EB3BDD0E46CB28FB4B20553C15