ComboFix 11-03-19.06 - dom 2011-03-21  12:33:09.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.639.213 [GMT 1:00]
Uruchomiony z: d:\documents and settings\dom\Moje dokumenty\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Outdated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\program files\Internet Explorer\SET186D.tmp
d:\program files\Internet Explorer\SET1871.tmp
d:\program files\Internet Explorer\SET1872.tmp
d:\windows\system32\config\systemprofile\_inst1.exe
d:\windows\system32\config\systemprofile\_inst2.exe
d:\windows\system32\config\systemprofile\_inst3.exe
d:\windows\system32\config\systemprofile\_inst4.exe
d:\windows\system32\config\systemprofile\_inst5.exe
d:\windows\system32\config\systemprofile\_inst6.exe
d:\windows\system32\config\systemprofile\_inst7.exe
d:\windows\system32\msconfig.exe
d:\windows\system32\Paint.exe
.
d:\windows\regedit.exe . . . jest zainfekowany!!
.
d:\windows\system32\midimap.dll . . . jest zainfekowany!!
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2011-02-21 do 2011-03-21  )))))))))))))))))))))))))))))))
.
.
2011-03-21 08:39 . 2011-03-21 09:12	--------	d-----w-	d:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2011-03-21 08:39 . 2011-03-21 08:39	--------	d-----w-	d:\program files\Spybot - Search & Destroy
2011-03-21 07:41 . 2011-03-21 07:41	--------	d-----w-	d:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\PCHealth
2011-03-20 14:56 . 2011-03-20 14:56	--------	d-----w-	d:\program files\ATI Stream
2011-03-20 14:56 . 2011-03-20 14:56	--------	d-----w-	d:\program files\ATI
2011-03-20 14:55 . 2011-03-20 14:55	--------	d-----w-	d:\program files\ATI Technologies
2011-03-20 14:53 . 2011-03-20 14:53	--------	d-----w-	D:\ATI
2011-03-20 14:41 . 2011-03-20 14:41	--------	d-----w-	d:\program files\Microsoft Security Client
2011-03-20 14:29 . 2011-03-20 14:29	--------	d-----w-	d:\documents and settings\dom\Dane aplikacji\Uniblue
2011-03-20 14:28 . 2011-03-20 14:28	--------	d-----w-	d:\documents and settings\dom\Ustawienia lokalne\Dane aplikacji\PackageAware
2011-03-19 23:15 . 2011-03-19 23:15	--------	d-----w-	d:\program files\Veetle
2011-03-19 22:30 . 2011-03-19 22:30	--------	d-----w-	d:\documents and settings\dom\Dane aplikacji\vShare
2011-03-19 22:30 . 2011-03-19 22:30	--------	d-----w-	d:\program files\vShare
2011-03-19 14:47 . 2011-03-19 14:47	--------	d-----w-	d:\program files\Common Files\DigiDesign
2011-03-19 14:47 . 2011-03-19 14:47	--------	d-----w-	d:\program files\IK Multimedia
2011-03-19 14:47 . 2002-12-05 13:10	155648	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-03-19 14:47 . 2002-12-02 12:33	32768	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-03-19 14:47 . 2002-12-02 14:22	5632	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-03-19 14:47 . 2002-12-02 12:33	57344	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-03-19 14:47 . 2002-12-02 12:33	237568	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-03-19 14:47 . 2011-03-19 14:47	163972	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-03-19 14:47 . 2003-02-27 15:12	696320	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-03-19 14:47 . 2011-03-19 14:47	282756	----a-w-	d:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-03-19 14:45 . 2011-03-19 14:45	--------	d-----w-	d:\program files\Common Files\Adobe Systems Shared
2011-03-19 14:44 . 2011-03-19 14:44	--------	d-----w-	d:\program files\Common Files\Adobe
2011-03-19 14:04 . 2011-03-19 14:05	--------	d-----w-	d:\program files\Pro-53
2011-03-19 14:02 . 2011-03-19 14:02	--------	d-----w-	d:\program files\Native Instruments
2011-03-19 13:04 . 2011-03-19 13:04	--------	d-----w-	d:\program files\kX Audio Driver
2011-03-19 12:32 . 2011-03-19 12:32	--------	d-----w-	d:\documents and settings\dom\Dane aplikacji\TeamViewer
2011-03-19 12:32 . 2011-03-19 12:32	--------	d-----w-	d:\program files\TeamViewer
2011-02-27 14:01 . 2011-02-27 14:01	--------	d-----w-	d:\program files\Common Files\Borland Shared
2011-02-27 14:01 . 2011-02-27 14:01	--------	d-----w-	d:\program files\Hetoss
2011-02-27 14:00 . 1999-03-23 08:12	299520	----a-w-	d:\windows\uninst.exe
2011-02-27 14:00 . 2011-02-27 14:00	--------	d-----w-	d:\documents and settings\dom\WINDOWS
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
------- Sigcheck -------
.
[-] 2009-07-24 . 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3 . 361600 . . [5.1.2600.5625] . . d:\windows\system32\drivers\tcpip.sys
.
[-] 2009-03-05 10:06 . 4678172D19476FA7D539682FCA42C942 . 1420800 . . [2001.12.4414.700] . . d:\windows\system32\comres.dll
.
[-] 2009-03-05 . 335813EACD16E84F3047A3326F6E5473 . 549888 . . [5.1.2600.5512] . . d:\windows\system32\winlogon.exe
.
[-] 2009-03-05 . E6C1811BA05F4E4BD4DA437778630489 . 724992 . . [5.82] . . d:\windows\system32\comctl32.dll
[7] 2008-04-14 . 737739FACEAD60683AA8D7FF7602FD14 . 1054208 . . [6.0] . . d:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[7] 2001-08-18 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . d:\windows\WinSxS\InstallTemp\19629\comctl32.dll
[7] 2001-08-18 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . d:\windows\WinSxS\InstallTemp\21318\comctl32.dll
[7] 2001-08-18 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . d:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
.
[-] 2009-06-26 . 946665FA0CC98F57E1023CD21F149D8B . 642560 . . [5.1.2600.3099] . . d:\windows\system32\user32.dll
.
[-] 2009-12-09 . A9BD5F368966EA709A4BFF992F583F07 . 1705984 . . [6.00.2900.5512] . . d:\windows\explorer.exe
.
[-] 2009-03-05 . EB3B4771498DD3FFD97E123643A26D91 . 1312256 . . [5.1.2600.5512] . . d:\windows\system32\ole32.dll
.
[-] 2009-04-02 . D9792BC366FDD8D3DABA7EB20BE114BB . 1571840 . . [5.1.2600.5512] . . d:\windows\system32\sfcfiles.dll
.
.
.
[-] 2009-03-05 . 572B0A653990AFE6B71D38D7DD2F202D . 370688 . . [5.1.2600.5512] . . d:\windows\system32\hnetcfg.dll
.
[-] 2009-09-12 . 86B4670A6A03CFB1C6FFE1EE66ADF123 . 2207232 . . [5.1.2600.5755] . . d:\windows\system32\ntkrnlpa.exe
.
[-] 2009-09-12 . 27910B589CE6BFDDD3A6796923E3746B . 2330240 . . [5.1.2600.5755] . . d:\windows\system32\ntoskrnl.exe
.
d:\windows\System32\ctfmon.exe ...  - brak elementu !!
d:\windows\System32\regsvc.dll ...  - brak elementu !!
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"="d:\program files\UberIcon\UberIcon.exe" [2006-05-21 180224]
"Google Update"="d:\documents and settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2002-11-14 136176]
"SetDefaultMIDI"="MIDIDef.exe" [2002-01-14 61440]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="d:\windows\READREG" [X]
"DrvIcon"="d:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"UpdReg"="d:\windows\UpdReg.EXE" [2000-05-10 90112]
"Jet Detection"="d:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-28 28672]
"kX Mixer"="d:\windows\system32\kxmixer.exe" [2007-08-24 500224]
"MSC"="d:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="d:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" [2009-03-08 128512]
.
d:\windows\system32\config\systemprofile\Menu Start\Programy\Autostart\
Styler.lnk - d:\documents and settings\dom\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2002-11-14 15086]
.
d:\documents and settings\Default User\Menu Start\Programy\Autostart\
Styler.lnk - d:\documents and settings\dom\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2002-11-14 15086]
.
d:\documents and settings\dom\Menu Start\Programy\Autostart\
Styler.lnk - d:\documents and settings\dom\Dane aplikacji\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2002-11-14 15086]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8424:TCP"= 8424:TCP:cfyufqa
"9132:TCP"= 9132:TCP:Liga typerów
.
R3 kxwdmdrv;kX WDM Driver Service;d:\windows\system32\drivers\kx.sys [2007-08-24 564864]
S1 atitray;atitray;\??\d:\program files\Radeon Omega Drivers\v3.8.221\ATI Tray Tools\atitray.sys --> d:\program files\Radeon Omega Drivers\v3.8.221\ATI Tray Tools\atitray.sys [?]
S2 qqhyhpzux;Shell Config;d:\windows\system32\svchost.exe -k netsvcs [2008-04-14 14336]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
qqhyhpzux
.
Zawartość folderu 'Zaplanowane zadania'
.
2011-03-20 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-920026266-839522115-1001Core.job
- d:\documents and settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2002-11-14 05:25]
.
2011-03-21 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-920026266-839522115-1001UA.job
- d:\documents and settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2002-11-14 05:25]
.
2011-03-21 d:\windows\Tasks\MP Scheduled Scan.job
- d:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 11:26]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://vshare.toolbarhome.com/?hp=df
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
TCP: {006C8E37-D77B-40BC-B126-81244A8945DD} = 217.30.129.149 217.30.137.200
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-21 12:40
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\qqhyhpzux]
"ServiceDll"="d:\windows\system32\jhcmxp.dll"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|˙˙˙˙Ŕ•€|é•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(640)
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(696)
d:\windows\system32\setupapi.dll
d:\windows\system32\scecli.dll
d:\windows\system32\psbase.dll
.
Czas ukończenia: 2011-03-21  12:44:00
ComboFix-quarantined-files.txt  2011-03-21 11:43
.
Przed: 2 310 537 216 bajtów wolnych
Po: 2 482 315 264 bajtów wolnych
.
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Black Edition v8" /noexecute=optin /fastdetect
.
Current=7 Default=7 Failed=6 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
- - End Of File - - 4A1AD2F48BD44CB2630F8C9AF0EE158B