ComboFix 11-11-26.04 - Wojtek 2011-11-26 22:53:27.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.894.525 [GMT 1:00] Uruchomiony z: c:\documents and settings\Wojtek\Pulpit\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\IsUn0415.exe . . ((((((((((((((((((((((((( Pliki utworzone od 2011-10-26 do 2011-11-26 ))))))))))))))))))))))))))))))) . . 2011-11-26 20:00 . 2011-11-26 20:06 -------- d-----w- c:\program files\Odkurzacz 2011-11-26 19:42 . 2011-11-26 19:42 -------- d-----w- c:\windows\NU_DATA 2011-11-26 18:26 . 2011-11-26 18:26 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2011-11-21 01:13 . 2011-11-21 01:13 -------- d-sh--w- c:\documents and settings\Wojtek\IECompatCache 2011-11-21 01:11 . 2011-11-21 01:11 -------- d-sh--w- c:\documents and settings\Wojtek\PrivacIE 2011-11-21 01:08 . 2011-11-21 01:08 -------- d-sh--w- c:\documents and settings\Wojtek\IETldCache 2011-11-21 00:52 . 2011-11-21 00:56 -------- dc-h--w- c:\windows\ie8 2011-11-21 00:48 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll 2011-11-21 00:48 . 2011-08-22 23:40 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2011-11-21 00:48 . 2011-08-22 23:40 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2011-11-21 00:48 . 2011-08-22 23:40 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll 2011-11-18 16:34 . 2011-11-21 15:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-11-18 06:48 . 2011-11-18 06:49 -------- d-----w- c:\documents and settings\Wojtek\Dane aplikacji\MfcEmbed 2011-11-18 06:48 . 2011-11-18 06:49 -------- d-----w- c:\documents and settings\Wojtek\Dane aplikacji\OpenOfficeT72 2011-11-15 11:55 . 2011-11-15 11:55 -------- d-----w- c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple 2011-11-11 11:32 . 2011-11-11 11:32 -------- d-----w- c:\documents and settings\LocalService\Dane aplikacji\McAfee 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin7.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin6.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin5.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin4.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin3.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin2.dll 2011-11-10 22:40 . 2011-11-10 22:40 159744 ----a-w- c:\program files\Internet Explorer\Wtyczki\npqtplugin.dll 2011-11-10 22:38 . 2011-11-10 22:40 -------- d-----w- c:\program files\QuickTime 2011-11-10 22:37 . 2011-11-10 22:37 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2011-11-10 22:32 . 2011-11-10 22:32 -------- d-----w- c:\documents and settings\Wojtek\Ustawienia lokalne\Dane aplikacji\Apple 2011-11-10 22:31 . 2011-11-10 22:31 -------- d-----w- c:\program files\Apple Software Update 2011-11-10 22:31 . 2011-11-10 22:31 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Apple 2011-11-06 11:31 . 2011-11-06 11:31 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\McAfee 2011-11-06 11:31 . 2011-11-06 11:31 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\McAfee Security Scan 2011-11-06 11:31 . 2011-11-11 11:31 -------- d-----w- c:\program files\McAfee Security Scan . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-24 13:29 . 2011-10-24 13:29 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2011-10-24 13:29 . 2011-10-24 13:29 69632 ----a-w- c:\windows\system32\QuickTime.qts 2011-10-10 14:22 . 2008-03-13 11:30 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-09-28 07:06 . 2004-08-04 10:00 602624 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 09:41 . 2008-07-29 17:59 614400 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 09:41 . 2004-08-04 10:00 23040 ----a-w- c:\windows\system32\oleaccrc.dll 2011-09-26 09:41 . 2004-08-04 10:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-06 21:45 . 2010-07-28 16:14 41184 ----a-w- c:\windows\avastSS.scr 2011-09-06 21:45 . 2008-03-13 12:55 199304 ----a-w- c:\windows\system32\aswBoot.exe 2011-09-06 21:38 . 2011-07-21 17:41 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-09-06 21:37 . 2008-04-12 08:52 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-09-06 21:36 . 2008-03-13 12:55 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-09-06 21:36 . 2008-03-13 12:55 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-09-06 21:36 . 2008-03-13 12:55 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2011-09-06 21:36 . 2008-03-13 12:55 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys 2011-09-06 21:36 . 2008-04-12 08:52 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-09-06 21:33 . 2008-03-13 12:55 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2011-09-06 14:10 . 2004-08-04 10:00 1859200 ----a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 21:45 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-15 68856] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2011-02-20 370688] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\All Users\Menu Start\Programy\Autostart\ McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] 2006-05-10 10:12 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] 2007-03-16 17:10 1392640 ----a-w- c:\windows\system32\WLTRAY.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] 2009-12-30 16:47 523408 ----a-w- c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2008-04-14 17:21 15360 ----a-w- c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet] 2007-05-14 13:23 1191936 ----a-w- c:\program files\Dell\QuickSet\quickset.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu 10] 2009-12-21 13:49 11850344 ----a-w- c:\program files\Gadu-Gadu 10\gg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2007-05-10 09:22 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Standby] 2010-01-07 11:09 105632 ----a-w- c:\program files\Common Files\Corel\Standby\Standby.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2008-10-15 06:53 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] 2006-03-08 10:48 761947 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu 10\\gg.exe"= "c:\\Documents and Settings\\Wojtek\\Ustawienia lokalne\\Dane aplikacji\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-07-21 442200] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-04-12 320856] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-12 20568] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - UWAOYAOB *Deregistered* - uwaoyaob . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] getPlusHelper REG_MULTI_SZ getPlusHelper . Zawartość folderu 'Zaplanowane zadania' . 2011-11-22 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57] . 2011-11-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-879983540-839522115-1004Core.job - c:\documents and settings\Wojtek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-11-10 14:03] . 2011-11-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-879983540-839522115-1004UA.job - c:\documents and settings\Wojtek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-11-10 14:03] . 2011-10-07 c:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-07-25 17:44] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ig?hl=pl IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 10.0.0.1 . - - - - USUNIĘTO PUSTE WPISY - - - - . HKLM-Run-dellsupportcenter - c:\program files\Dell Support Center\bin\sprtcmd.exe MSConfigStartUp-Corel File Shell Monitor - c:\program files\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe MSConfigStartUp-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe MSConfigStartUp-dscactivate - c:\program files\Dell Support Center\gs_agent\custom\dsca.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-26 23:05 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'winlogon.exe'(836) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll . Czas ukończenia: 2011-11-26 23:10:17 ComboFix-quarantined-files.txt 2011-11-26 22:09 . Przed: 50 081 972 224 bajtów wolnych Po: 51 346 649 088 bajtów wolnych . WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect . - - End Of File - - 19F4F7F41229CD31548B4C6367C52B3A