ComboFix 12-07-24.01 - Administrator 2012-07-24 0:36.1.2 - x86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.3067.2773 [GMT 2:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\All Users\Dane aplikacji\haxiitcfowwflcv c:\documents and settings\All Users\Dane aplikacji\jrhjhxws.exe c:\documents and settings\Władek\0.4431123761241633.exe c:\windows\system32\5e2ad389.exe c:\windows\system32\roboot.exe c:\windows\system32\SET16D.tmp c:\windows\system32\SET172.tmp c:\windows\system32\SET179.tmp c:\windows\system32\SET182.tmp c:\windows\system32\SET183.tmp c:\windows\system32\SET184.tmp c:\windows\system32\SET187.tmp . . ((((((((((((((((((((((((( Pliki utworzone od 2012-06-23 do 2012-07-23 ))))))))))))))))))))))))))))))) . . 2012-07-23 22:31 . 2012-07-23 22:31 -------- d-----w- c:\documents and settings\Administrator 2012-07-23 22:24 . 2012-07-23 22:24 56200 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Microsoft\Microsoft Antimalware\Definition Updates\{47F2AE5B-BD3B-40BE-AB63-2F3CC5335C75}\offreg.dll 2012-07-23 22:08 . 2012-06-29 08:44 6891424 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Microsoft\Microsoft Antimalware\Definition Updates\{47F2AE5B-BD3B-40BE-AB63-2F3CC5335C75}\mpengine.dll 2012-07-23 15:21 . 2012-07-23 15:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\eebnpoeasfneqbn 2012-07-20 17:20 . 2012-07-20 17:20 -------- d-----w- C:\audio 2012-07-17 09:40 . 2012-07-17 09:40 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-07-03 21:31 . 2012-07-12 20:44 -------- d-----w- c:\program files\Tibia . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-17 09:40 . 2011-11-04 15:49 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-29 08:44 . 2012-04-06 11:17 6891424 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-07-18 15:47 . 2011-11-04 15:05 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BisonMnt"="c:\windows\BisonC07\BisonM07.exe" [2008-10-14 32768] "EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-06-12 4464640] "Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-06-10 1282048] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-02-23 111208] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-02-23 13880424] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=c:\windows\pss\BTTray.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^Władek^Menu Start^Programy^Autostart^OpenOffice.org 3.3.lnk] path=c:\documents and settings\Władek\Menu Start\Programy\Autostart\OpenOffice.org 3.3.lnk backup=c:\windows\pss\OpenOffice.org 3.3.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2011-08-02 07:33 4910912 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2011-05-10 01:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 14:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"= "c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"= "c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"= "c:\\Program Files\\Gadu-Gadu 10\\gg.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2011-11-04 9472] R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-11-08 232512] S2 AxiomAudioDevMon;Axiom Audio Device Monitor;c:\program files\M-Audio\Axiom\AudioDevMon.exe [2010-02-19 1632776] S2 emaudsv;E-MU Audio Service;c:\windows\system32\emaudsv.exe [2007-11-26 20992] S3 AXIOM;Service for M-Audio Axiom;c:\windows\system32\drivers\MAudioAxiom.sys [2011-11-08 115336] S3 emusba10;E-MU USB-Audio 1.0 Driver;c:\windows\system32\drivers\emusba10.sys [2007-11-26 163352] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-25 113120] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-05-12 100456] S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [2011-11-04 160256] S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?] . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - PARPORT . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Zawartość folderu 'Zaplanowane zadania' . 2012-07-23 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 13:39] . . ------- Skan uzupełniający ------- . mStart Page = hxxp://startsear.ch/?aff=1&cf=1f5cb370-07cb-11e1-a136-002622d06635 TCP: DhcpNameServer = 95.160.170.92 88.156.222.92 82.139.8.40 FF - ProfilePath - . - - - - USUNIĘTO PUSTE WPISY - - - - . HKLM-Run-jrhjhxwsskufjfs - c:\documents and settings\All Users\Dane aplikacji\jrhjhxws.exe AddRemove-5e2ad389 - c:\windows\system32\5e2ad389.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-07-24 00:44 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . HKLM\Software\Microsoft\Windows\CurrentVersion\Run BisonMnt = c:\windows\BisonC07\BisonM07.exe?????????????????????????????????????????????????????????????????????????????????`?????????????????????????????????????????????????????? ????v?|????????????????????????8????x?|????0???????????L??????|????????????`????X?w??? . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . Czas ukończenia: 2012-07-24 00:45:52 ComboFix-quarantined-files.txt 2012-07-23 22:45 . Przed: 1 970 720 768 bajtów wolnych Po: 1 934 118 912 bajtów wolnych . - - End Of File - - 2099AF362CB753752B1378E3471C6A71