"CRITICAL ERROR
Attention, prywatny! Some dangerous viruses detected in your system. MNicrosoft Windows XP files corrupted.This may lead to the destruction of important files in C:/WINDOWS. Download protection software now!"
prosze o sprawdzenie logów:
hijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:16, on 2008-07-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Lexmark 3100 Series\lxbrcmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Styler\Styler.exe
C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CodecPlugin Class - {098716A9-0310-4CBE-BD64-B790A9761158} - C:\WINDOWS\system32\RichVideoCodec.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O2 - BHO: toolbar.search - {19B8572F-894F-41E0-9309-00091B688905} - C:\WINDOWS\system32\TOOLBA~1.DLL
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BHO.Filter - {4AD3A71E-8ED4-40F5-9A81-69245BDCBB75} - C:\WINDOWS\system32\ie_f.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: scvhost.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAD38524-E6AB-4C50-A7D7-968849F2850C}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
--
End of file - 9164 bytes
combofix:
ComboFix 08-07-18.1 - Administrator 2008-07-19 11:22:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1286 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Administrator\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Uninst.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\richvideocodec.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 )))))))))))))))))))))))))))))))
.
2008-07-19 11:15 . 2008-07-19 11:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-19 10:42 . 2008-07-19 10:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-07-19 10:40 . 2008-07-19 10:40 <DIR> d-------- C:\WINDOWS\LastGood
2008-07-19 10:40 . 2008-07-19 10:40 <DIR> d-------- C:\Program Files\ESET
2008-07-19 10:24 . 2008-07-19 10:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-07-18 18:10 . 2008-07-18 18:10 <DIR> d-------- C:\VideoOutput1
2008-07-18 18:07 . 2008-07-18 18:10 <DIR> d-------- C:\Program Files\MOV to AVI MPEG WMV Converter
2008-07-18 18:07 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll
2008-07-18 18:01 . 2008-07-18 18:01 19,968 --a------ C:\WINDOWS\system32\toolbarsrch.dll
2008-07-18 18:00 . 2008-07-19 11:07 <DIR> d-------- C:\Program Files\RichVideoCodec
2008-07-18 17:46 . 2008-07-18 17:48 <DIR> d-------- C:\VideoOutput
2008-07-18 11:19 . 2008-07-18 11:19 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-07-15 09:53 . 2004-01-29 01:49 10,240 --a------ C:\WINDOWS\system32\forcelibrary.dll
2008-07-14 14:24 . 2008-07-14 14:24 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-07-13 21:40 . 2008-07-13 21:40 <DIR> d-------- C:\Program Files\FM Modifier 2.2
2008-07-10 18:02 . 2008-07-10 18:31 <DIR> d-------- C:\Program Files\VirtualDJ
2008-07-08 22:45 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-07-08 22:45 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-07-08 22:45 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2008-07-08 22:45 . 2008-07-08 22:45 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-07-08 22:45 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-07-08 22:45 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2008-07-08 22:45 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-07-08 22:45 . 2008-07-08 22:45 22,328 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\PnkBstrK.sys
2008-07-08 22:30 . 2007-11-11 09:48 6,479,353,856 --a------ C:\rzr-crys.iso
2008-07-08 22:20 . 2008-07-08 22:20 <DIR> d--h----- C:\WINDOWS\PIF
2008-07-08 14:58 . 2008-07-08 14:58 <DIR> d-------- C:\WINDOWS\OpenOffice.org2
2008-07-06 13:08 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-05 12:16 . 2008-07-05 12:16 203 --a------ C:\WINDOWS\GSdx9 sse2.INI
2008-07-05 11:56 . 2008-07-05 11:56 <DIR> d-------- C:\Program Files\RealVNC
2008-07-04 21:48 . 2008-07-04 21:48 <DIR> d-------- C:\Program Files\Hamachi
2008-07-04 21:48 . 2008-07-08 19:28 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Hamachi
2008-07-04 21:48 . 2008-07-04 21:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-04 14:26 . 2008-07-04 14:26 <DIR> d-------- C:\Program Files\AV VCS 3.0
2008-07-03 18:07 . 2002-12-10 09:11 6,852 --a------ C:\WINDOWS\system32\drivers\Vcs.sys
2008-07-03 17:51 . 2008-07-03 17:51 <DIR> d-------- C:\Program Files\Blaze Audio
2008-06-30 11:37 . 2008-06-30 11:37 <DIR> d-------- C:\GG PassBrute 3.1
2008-06-29 17:38 . 2008-06-29 17:38 <DIR> d-------- C:\Program Files\Konnekt
2008-06-29 17:38 . 2008-06-29 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-06-29 09:23 . 2008-06-29 09:23 <DIR> d-------- C:\Program Files\FM Modifier 2.1
2008-06-28 11:42 . 2008-06-28 11:42 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Sports Interactive
2008-06-27 19:31 . 2008-06-27 19:31 <DIR> d-------- C:\Program Files\Peter
2008-06-24 19:40 . 2008-06-24 19:40 0 --a------ C:\TP13AF60.$$$
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-19 08:52 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2008-07-19 08:33 --------- d-----w C:\Program Files\AutoConnect
2008-07-19 08:33 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\OpenOffice.org2
2008-07-19 08:14 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\skypePM
2008-07-14 12:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-12 17:24 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-07-10 20:42 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-08 20:45 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-07-08 20:20 2,855 ----a-w C:\WINDOWS\PIF\setup.PIF
2008-06-17 07:17 --------- d-----w C:\Program Files\Java
2008-06-15 20:50 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-15 19:58 --------- d-----w C:\Program Files\SopCast
2008-06-14 09:27 --------- d-----w C:\Program Files\SlySoft
2008-06-13 20:36 --------- d-----w C:\Program Files\free-downloads.net
2008-06-13 20:36 --------- d-----w C:\Program Files\Alcohol Soft
2008-06-13 17:28 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\fltk.org
2008-06-13 16:40 --------- d-----w C:\Program Files\7-Zip
2008-06-11 12:00 --------- d-----w C:\Program Files\Radmin
2008-06-10 16:56 34,312 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys
2008-06-10 16:48 53,256 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2008-06-10 16:47 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2008-06-10 10:15 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-06-09 19:58 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Dev-Cpp
2008-06-09 11:53 --------- d-----w C:\Program Files\Common Files\DirectX
2008-06-06 12:43 --------- d-----w C:\Program Files\CDex_150
2008-06-05 12:29 53,312 ----a-w C:\WINDOWS\system32\drivers\pssdklbf.sys
2008-06-05 12:29 36,928 ----a-w C:\WINDOWS\system32\drivers\pssdk41.sys
2008-06-02 19:07 --------- d-----w C:\Program Files\Vplayer
2008-06-01 14:29 --------- d-----w C:\Program Files\Styler
2008-06-01 10:38 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-05-31 15:05 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Styler
2008-05-31 14:39 --------- d-----w C:\Program Files\Auslogics
2008-05-31 14:16 --------- d-----w C:\Program Files\Stardock
2008-05-31 13:34 --------- d-----w C:\Program Files\zhypermu small s3 ep2
2008-05-30 08:57 --------- d-----w C:\Program Files\ZhyperMU
2008-05-29 12:36 3,523 ----a-w C:\Program Files\KOMI.PAS
2008-05-29 12:33 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-29 12:28 --------- d-----w C:\Program Files\TP
2008-05-28 15:04 --------- d-----w C:\Program Files\BitComet
2008-05-28 14:43 --------- d-----w C:\Program Files\Ares
2008-05-28 14:10 --------- d-----w C:\Program Files\Common Files\Ahead
2008-05-28 14:10 --------- d-----w C:\Program Files\Ahead
2008-05-28 14:01 --------- d-----w C:\Program Files\Przeglądarka migawek
2008-05-28 14:01 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft Web Folders
2008-05-28 12:18 --------- d-----w C:\Program Files\Lexmark 3100 Series
2008-05-28 12:17 --------- d-----w C:\Program Files\ABBYY FineReader 6.0
2008-05-28 12:17 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2008-05-28 12:16 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-05-28 12:13 --------- d-----w C:\Program Files\Lavalys
2008-05-28 12:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3
2008-05-28 12:10 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\atitray
2008-05-28 12:08 --------- d-----w C:\Program Files\Ray Adams
2008-05-28 11:59 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-28 11:59 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools
2008-05-28 11:51 --------- d-----w C:\Program Files\Skype
2008-05-28 11:51 --------- d-----w C:\Program Files\Common Files\Skype
2008-05-28 11:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-05-28 11:40 --------- d-----w C:\Program Files\Real
2008-05-28 11:40 --------- d-----w C:\Program Files\Common Files\xing shared
2008-05-28 11:40 --------- d-----w C:\Program Files\Common Files\Real
2008-05-28 11:39 --------- d-----w C:\Program Files\Winamp
2008-05-28 11:34 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-05-28 11:34 --------- d-----w C:\Program Files\AVSMedia
2008-05-28 11:29 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-05-28 11:29 --------- d-----w C:\Program Files\SAGEM
2008-05-28 11:28 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-28 11:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-28 11:20 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-28 11:20 --------- d-----w C:\Program Files\Realtek
2008-05-28 11:20 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield
2008-05-28 11:19 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-05-28 11:17 --------- d-----w C:\Program Files\Intel
2008-05-28 11:12 --------- d-----w C:\Program Files\Real Alternative
2008-05-28 11:12 --------- d-----w C:\Program Files\QuickTime Alternative
2008-05-28 11:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-05-28 11:11 --------- d-----w C:\Program Files\Common Files\Java
2008-05-28 11:09 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-26 14:14 42,672 ----a-w C:\WINDOWS\system32\wbsys.dll
2003-06-13 15:34 50,176 ----a-w C:\Documents and Settings\Administrator\onuninst.dll
.
- Kod: Zaznacz wszystko
<pre>
----a-w 0 2008-06-03 15:06:11 C:\Documents and Settings\Administrator\Moje dokumenty\Max +plus 10.2 .exe
----a-w 503,808 2008-07-10 20:10:00 C:\Documents and Settings\Administrator\Pulpit\sPolszczEnie COD4 .exe
</pre>
------- Sigcheck -------
2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll
2007-07-14 00:56 814592 ce7193c5f7c01b19768e066087c1c919 C:\WINDOWS\system32\wininet.dll
2007-07-28 03:15 360576 0fb6743e937c7bb248b2530a5a77abc6 C:\WINDOWS\system32\drivers\tcpip.sys
2007-07-26 19:30 2145792 316acc3ac43fc855204ce5e775f66b91 C:\WINDOWS\system32\ntoskrnl.exe
2007-07-14 00:42 974848 32f67215c57df2c401bf93b7ee65987f C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19B8572F-894F-41E0-9309-00091B688905}]
2008-07-18 18:01 19968 --a------ C:\WINDOWS\system32\TOOLBA~1.DLL
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2007-12-04 13:53 1502232 --a------ C:\Program Files\free-downloads.net\tbfree.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2007-12-04 13:53 1502232]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2007-12-04 13:53 1502232]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27 295424]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12 1849032]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04 521128]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 02:32 961024]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:27 219520]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41 503808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-28 13:40 180269]
"Lexmark 3100 Series"="C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe" [2003-09-04 05:07 106496]
"LXBRKsk"="C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe" [2003-06-13 17:01 282624]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21 57344]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]
Styler.lnk - C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2008-05-31 17:04:37 15086]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-05-28 13:29:30 962661]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 11:15:54 65588]
scvhost.exe [2008-07-10 22:10:00 503808]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-06-10 12:15:45 69632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-04-29 21:58 210168 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"F:\\Pro Evolution Soccer 2008\\PES2008.exe"=
"F:\\Warcraft III\\Warcraft III.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Program Files\\bear\\BearShare.exe"=
"D:\\MuServer\\DataServer2\\Dataserver.exe"=
"D:\\MuServer\\DataServer1\\Dataserver.exe"=
"D:\\MuServer\\CS\\CS.exe"=
"D:\\MuServer\\JoinServer\\JoinServer.exe"=
"D:\\MuServer\\MU2003_EVENT_SERVER\\WZ_MU2003_EVENT_SERVER.exe"=
"D:\\MuServer\\RankingServer\\DevilSqure_EventServer.exe"=
"D:\\MuServer\\ExDB\\Exdb.exe"=
"D:\\MuServer\\GameServer\\GameServer.exe"=
"F:\\Program Files\\Tony Hawk's Pro Skater 3\\Skate3.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"F:\\Tony2\\Tony2\\Tony2\\Tony2\\THawk2.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"F:\\Program Files\\MotoRacer3\\MotoRacer3.exe"=
"F:\\Crysis\\Bin32\\Crysis.exe"=
"F:\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"F:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 11:04]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-10 09:11]
R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 01:08]
S3 PsSdk41;PsSdk41;C:\WINDOWS\system32\Drivers\pssdk41.sys [2008-06-05 14:29]
S3 PsSdkLBF;PsSdkLBF;C:\WINDOWS\system32\Drivers\pssdklbf.sys [2008-06-05 14:29]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc6dc58e-54a6-11dd-aaf4-4d6564696130}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - EASDRV
*Newly Created Service* - EKRN
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-19 11:23:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-19 11:23:35
ComboFix-quarantined-files.txt 2008-07-19 09:23:33
Pre-Run: 2,949,758,976 bajtów wolnych
Post-Run: 3,635,945,472 bajtów wolnych
293
prosze o pomoc
