ComboFix 12-09-27.03 - szeffel 2012-09-29  19:33:00.53.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.511.273 [GMT 2:00]
Uruchomiony z: G:\ComboFix.exe
FW: Sygate Personal Firewall *Enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Dane aplikacji\ecokzifw.exe
c:\documents and settings\szeffel\0.22441482621982656.exe
c:\windows\$NtUninstallKB4244$\1013283135
c:\windows\$NtUninstallKB4244$\3518742831\@
c:\windows\$NtUninstallKB4244$\3518742831\cfg.ini
c:\windows\$NtUninstallKB4244$\3518742831\Desktop.ini
c:\windows\$NtUninstallKB4244$\3518742831\L\00000004.@
c:\windows\$NtUninstallKB4244$\3518742831\L\201d3dde
c:\windows\$NtUninstallKB4244$\3518742831\L\bajuakpz
c:\windows\$NtUninstallKB4244$\3518742831\U\00000001.@
c:\windows\$NtUninstallKB4244$\3518742831\U\00000002.@
c:\windows\$NtUninstallKB4244$\3518742831\U\00000004.@
c:\windows\$NtUninstallKB4244$\3518742831\U\80000000.@
c:\windows\$NtUninstallKB4244$\3518742831\U\80000004.@
c:\windows\$NtUninstallKB4244$\3518742831\U\80000032.@
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\scfbpnt3.dll
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\$NtUninstallKB4244$ . . . . nie udało się usunąć
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2012-08-28 do 2012-09-29  )))))))))))))))))))))))))))))))
.
.
2012-09-29 16:46 . 2012-09-29 16:46	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\brmcrftcehinhtd
2012-09-29 16:46 . 2012-09-29 16:46	72704	----a-w-	c:\windows\ecokzifw.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 13:58 . 2003-04-16 12:00	78336	----a-w-	c:\windows\system32\browser.dll
2012-07-04 14:05 . 2005-07-27 18:05	139784	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:22 . 2003-04-16 12:00	1866368	----a-w-	c:\windows\system32\win32k.sys
2012-07-02 17:38 . 2003-04-16 12:00	916992	----a-w-	c:\windows\system32\wininet.dll
2012-07-02 17:38 . 2003-04-16 12:00	43520	------w-	c:\windows\system32\licmgr10.dll
2012-07-02 17:38 . 2003-04-16 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2005-07-27 18:46	385024	------w-	c:\windows\system32\html.iec
2012-07-18 20:23 . 2011-08-23 19:57	136672	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InstantTray"="c:\program files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2004-05-06 772096]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"NVRTCLK"="c:\windows\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 24576]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2012-05-04 296056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^szeffel^Menu Start^Programy^Autostart^Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk]
path=c:\documents and settings\szeffel\Menu Start\Programy\Autostart\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk
backup=c:\windows\pss\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Gadu-Gadu 10\\gg.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6005:TCP"= 6005:TCP:ibhakvma
.
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [2004-07-06 188416]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [2004-08-03 62976]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S0 VOBID;VOBID;c:\windows\system32\DRIVERS\vobid.sys --> c:\windows\system32\DRIVERS\vobid.sys [?]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 fpjojfbda;Universal Image;c:\windows\system32\svchost.exe -k netsvcs [2003-04-16 14336]
S2 gupdate;Usługa Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-11-19 136176]
S3 cpuz134;cpuz134;\??\c:\docume~1\szeffel\USTAWI~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\szeffel\USTAWI~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 gupdatem;Usługa Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-11-19 136176]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2010-07-01 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2010-07-01 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2010-07-01 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2010-07-01 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2010-07-01 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2010-07-01 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2010-07-01 117672]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2008-03-02 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2008-03-02 85696]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2006-09-18 717296]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
vproeventmonitor
fpjojfbda
.
Zawartość folderu 'Zaplanowane zadania'
.
2012-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-19 18:40]
.
2012-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-19 18:40]
.
2012-09-29 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-515967899-1532298954-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
.
2012-09-29 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-515967899-1532298954-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 16:21]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://startsear.ch/?aff=2&cf=8a099fa0-ed3d-11e1-8397-003005bfb55e
mStart Page = hxxp://startsear.ch/?aff=2&cf=8a099fa0-ed3d-11e1-8397-003005bfb55e
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 212.76.34.49 212.76.34.50
FF - ProfilePath - c:\documents and settings\szeffel\Dane aplikacji\Mozilla\Firefox\Profiles\nrkore1j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=110000&tt=060612_7_&babsrc=KW_ss&mntrId=74a2dd37000000000000003005bfb55e&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-29 19:53
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fpjojfbda]
"ServiceDll"="c:\windows\system32\lvvtnutg.dll"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'explorer.exe'(3628)
c:\windows\system32\WININET.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\msi.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
.
**************************************************************************
.
Czas ukończenia: 2012-09-29  20:02:32 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2012-09-29 18:02
.
Przed: 53 812 080 640 bajtów wolnych
Po: 55 605 366 784 bajtów wolnych
.
- - End Of File - - E21B0B091D1C8C23AFCC0EA5A259EE78