Wštki
mateusz455 - Nie Sie 17, 2008 7:36 am
ComboFix 08-08-14.05 - Mateusz 2008-08-16 0:45:49.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.660 [GMT 2:00]
Running from: C:\Downloads\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mateusz\Cookies\mateusz@ad.yieldmanager[1].txt
C:\Documents and Settings\Mateusz\Cookies\mateusz@surfsidemailorder[2].txt
D:\kdxdweli.cmd
.
((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.
2008-08-16 00:43 . 2008-08-16 00:44 <DIR> d-------- C:\Downloads
2008-08-13 23:48 . 2008-05-01 16:33 331,776 -----c--- C:\WINNT\system32\dllcache\msadce.dll
2008-08-07 10:50 . 2008-08-07 10:50 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-08-07 10:50 . 2008-08-07 10:50 1,409 --a------ C:\WINNT\QTFont.for
2008-07-18 22:07 . 2008-08-07 09:31 <DIR> d-------- C:\WINNT\SxsCaPendDel
2008-07-17 22:26 . 2008-07-17 22:26 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Salling Software AB
2008-07-17 22:25 . 2008-07-17 22:25 360,580 --a------ C:\WINNT\eSellerateEngine.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 22:44 --------- d-----w C:\Program Files\FlashGet
2008-08-15 22:25 --------- d-----w C:\Program Files\Opera
2008-08-10 18:06 --------- d-----w C:\Documents and Settings\Mateusz\Dane aplikacji\uTorrent
2008-07-17 20:36 --------- d-----w C:\Program Files\Winamp
2008-07-08 22:38 --------- d-----w C:\Program Files\NAPI-PROJEKT
2008-07-07 20:19 253,952 ----a-w C:\WINNT\system32\es.dll
2008-06-24 16:30 74,240 ----a-w C:\WINNT\system32\mscms.dll
2008-06-23 16:16 669,696 ----a-w C:\WINNT\system32\wininet.dll
2008-06-20 17:37 246,784 ----a-w C:\WINNT\system32\mswsock.dll
2008-06-20 10:44 360,960 ----a-w C:\WINNT\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINNT\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINNT\system32\drivers\tcpip6.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-30 16:09 737370]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [2005-12-15 11:42 7331840]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2006-04-26 11:37 331776]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624]
"Samsung Common SM"="C:\WINNT\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 09:20 372736]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-03 10:43 61952 C:\WINNT\system32\CHDAudPropShortcut.exe]
"nwiz"="nwiz.exe" [2005-12-15 11:42 1519616 C:\WINNT\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINNT\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-04 04:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-05 14:43:54 11000]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-25 21:00:57 692224]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
backup=C:\WINNT\pss\BTTray.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 16:57 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"btwdins"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TC PowerPack\\TOTALCMD.EXE"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows
"3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINNT\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 p2psvc;Sieć równorzędna;C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);C:\WINNT\system32\svchost.exe [2004-08-04 04:44]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
2008-08-09 C:\WINNT\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 15:21]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-WinClicker.exe - C:\Program Files\Salling Software AB\Salling Clicker\WinClicker.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://google.bearshare.com/pl
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyServer = 192.168.0.1:3128
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 -: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O17 -: HKLM\CCS\Interface\{7A5CD072-6E49-4DB5-8260-A291ECC75C52}: NameServer = 192.168.0.1
O16 -: Microsoft XML Parser for Java - file://C:\WINNT\Java\classes\xmldso.cab
C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-16 00:47:49
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-16 0:49:14
ComboFix-quarantined-files.txt 2008-08-15 22:48:57
Pre-Run: 7,174,037,504 bajtów wolnych
Post-Run: 7,165,718,528 bajtów wolnych
137 --- E O F --- 2008-08-13 21:53:58
huber2t - Nie Sie 17, 2008 11:34 am
otwórz notatnik i wklej
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"=-
mateusz455 - Nie Sie 17, 2008 11:43 am
Chyba sie nie powiadło do końca, najpierw miałem wrażenie że combofix coś ciąga z internetu z jakiegoś serwera spyware czy coś takiego a potem wyskoczyło że chyba chce otworzyć jakiś plik CFS czy cos takiego i ze nie moze go znaleźc. i się wyłaczył combofix ja nacisnąłem OK
huber2t - Nie Sie 17, 2008 12:06 pm
Log jest dobrze wykonany, czy są problemy?
mateusz455 - Nie Sie 17, 2008 12:09 pm
nie ma problemów, jest OK
huber2t - Śro Sie 20, 2008 10:33 am
Przeczyść komputer Ccleanerem
Wykonaj optymalizację autostartu
Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja