ComboFix 11-11-18.02 - HLTV.proxy 2011-11-18 22:10:35.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1023.249 [GMT 1:00] Uruchomiony z: c:\documents and settings\HLTV.proxy\Pulpit\ComboFix.exe AV: BitDefender Antywirus *Enabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB} FW: BitDefender Zapora Sieciowa *Enabled* {4055920F-2E99-48A8-A270-4243D2B8F242} . UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\msmqinst.log c:\windows\regopt.log . . ((((((((((((((((((((((((( Pliki utworzone od 2011-10-18 do 2011-11-18 ))))))))))))))))))))))))))))))) . . 2011-11-18 15:39 . 2011-11-18 15:39 -------- d-----w- c:\windows\Sun 2011-11-18 13:33 . 2011-11-18 13:33 -------- d-----w- C:\plop 2011-11-16 14:21 . 2005-05-03 02:43 69632 ------r- c:\windows\Alcmtr.exe 2011-11-16 14:18 . 2011-11-16 14:18 14656 ----a-w- c:\windows\gdrv.sys 2011-11-16 14:06 . 2011-11-16 14:06 -------- d-----w- c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP 2011-11-16 14:04 . 2011-11-16 14:04 -------- d-----w- C:\DRIVERS 2011-11-16 14:02 . 2011-11-16 14:02 -------- d-----w- c:\windows\Sounddrv 2011-11-16 13:57 . 2009-08-18 12:48 348160 ----a-w- c:\windows\vncutil.exe 2011-11-16 13:57 . 2009-03-17 13:07 122880 ----a-w- c:\windows\RtkAudioService.exe 2011-11-16 13:56 . 2011-11-16 13:56 -------- d-----w- c:\windows\UninSRS 2011-11-16 13:56 . 2011-11-16 13:56 -------- d-----w- c:\windows\SRS 2011-11-15 16:01 . 2011-11-15 16:01 -------- d-----w- c:\windows\Options 2011-11-15 16:01 . 2003-10-13 16:37 217088 ----a-w- c:\windows\select3a.exe 2011-11-15 16:01 . 2003-06-03 13:35 40960 ------w- c:\windows\CleanDev.exe . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-16 20:21 . 2010-05-13 15:52 106456 ----a-w- c:\windows\system32\drivers\bdhv.sys 2011-11-16 20:19 . 2010-06-18 15:11 111696 ----a-w- c:\windows\system32\drivers\bdfndisf.sys 2010-07-08 09:37 . 2010-07-08 09:37 101544 ----a-w- c:\program files\Common Files\LinkInstaller.exe 2011-11-05 07:31 . 2011-11-15 15:20 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256] "NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072] "nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312] "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\ieshow.exe" [2011-11-16 71216] "BDAgent"="c:\program files\BitDefender\BitDefender 2011\bdagent.exe" [2011-11-16 1449368] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-06-06 11:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] 2011-11-09 12:24 10032128 ----a-w- c:\progra~1\WapSter\WAPSTE~1\AQQ.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu 10] 2011-07-04 17:45 13374048 ----a-w- c:\program files\Gadu-Gadu 10\gg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2011-11-16 17:50 1242448 ------w- d:\gry\Steam\Steam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2011-06-09 12:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu 10\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "d:\\gry\\Steam\\steamapps\\proactive0\\counter-strike\\hl.exe"= . R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2011-11-17 691696] R1 BdRawPr;BdRawPr;c:\windows\system32\drivers\bdrawpr.sys [2011-11-16 12960] R1 Bdvedisk;BDVEDISK;c:\windows\system32\drivers\bdvedisk.sys [2010-01-19 85128] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-11-15 2253120] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2011-06-14 1524544] R2 Updatesrv;BitDefender Desktop Update Service;c:\program files\BitDefender\BitDefender 2011\updatesrv.exe [2010-08-10 43936] R3 BDFM;BDFM;c:\windows\system32\drivers\bdfm.sys [2010-04-22 149520] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfndisf.sys [2010-06-18 111696] R3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\drivers\pfc027.sys [2011-11-15 112380] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-11-29 10064] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-11-16 1684736] S3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2010-07-23 307544] S4 avc3;avc3;c:\windows\system32\drivers\avc3.sys [2010-06-28 633424] S4 avckf;avckf;c:\windows\system32\drivers\avckf.sys [2010-06-28 970320] . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - KWLDRPOW *Deregistered* - kwldrpow . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . . ------- Skan uzupełniający ------- . uStart Page = about:blank mStart Page = about:blank uInternet Connection Wizard,ShellNext = hxxp://www.nvidia.pl/object/winxp-285.58-whql-driver-pl.html?nvidiaupdate=1 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.100 213.241.79.38 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\HLTV.proxy\Dane aplikacji\Mozilla\Firefox\Profiles\7kqrcweh.default\ FF - prefs.js: browser.startup.homepage - www.google.pl FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - USUNIĘTO PUSTE WPISY - - - - . MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\DTLite.exe MSConfigStartUp-NeroCheck - c:\windows\system32\NeroCheck.exe MSConfigStartUp-Tlen - c:\program files\Tlen7\tlen7.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-18 22:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . Czas ukończenia: 2011-11-18 22:19:04 ComboFix-quarantined-files.txt 2011-11-18 21:19 . Przed: 36 727 357 440 bajtów wolnych Po: 38 525 411 328 bajtów wolnych . - - End Of File - - 705B9D8375305A613BA66AE1D80A1C49