ComboFix 11-05-26.02 - BW_KIOSK 2011-05-27   9:44.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1250.48.1045.18.1023.743 [GMT 2:00]
Uruchomiony z: c:\documents and settings\BW_KIOSK\Moje dokumenty\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
 * Utworzono nowy punkt przywracania
 * Rezydentny antywirus jest aktywny
.
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2011-04-27 do 2011-05-27  )))))))))))))))))))))))))))))))
.
.
2011-05-06 07:30 . 2011-05-06 07:30	--------	d-----w-	c:\program files\ESET
2011-05-06 07:30 . 2011-05-06 07:30	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\ESET
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 11:08 . 2011-04-05 11:08	249856	------w-	c:\windows\Setup1.exe
2011-04-05 11:08 . 2011-04-05 11:08	73216	----a-w-	c:\windows\ST6UNST.EXE
2011-03-30 14:49 . 2011-03-30 14:47	16384	----a-w-	c:\windows\system32\lgfwunis.exe
2011-03-07 05:33 . 2011-03-30 12:01	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:36 . 2004-08-04 12:00	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:53 . 2004-08-04 12:00	1858176	----a-w-	c:\windows\system32\win32k.sys
2011-05-04 07:41 . 2011-04-08 08:08	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - c:\program files\D-Link\Bluetooth Software\BTTray.exe [2006-4-12 643133]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NVSvc"=2 (0x2)
"LightScribeService"=2 (0x2)
"InCDsrv"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"idsvc"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-12-21 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-12-21 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-01-12 810144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 08:39	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Zawartość folderu 'Zaplanowane zadania'
.
2011-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-963894560-725345543-1004Core.job
- c:\documents and settings\BW_KIOSK\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-03-30 13:00]
.
2011-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-963894560-725345543-1004UA.job
- c:\documents and settings\BW_KIOSK\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2011-03-30 13:00]
.
2011-04-27 c:\windows\Tasks\User_Feed_Synchronization-{D92ADF85-470A-4665-A122-935563E802CB}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: Wyślij do urządzenia &Bluetooth... - c:\program files\D-Link\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 192.168.1.1 0.0.0.0
FF - ProfilePath - c:\documents and settings\BW_KIOSK\Dane aplikacji\Mozilla\Firefox\Profiles\iino3wj6.default\
FF - prefs.js: browser.startup.homepage - wp.pl
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-27 09:52
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Czas ukończenia: 2011-05-27  09:54:22
ComboFix-quarantined-files.txt  2011-05-27 07:54
.
Przed: 12 897 259 520 bajtów wolnych
Po: 12 889 780 224 bajtów wolnych
.
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 32F710EF6E4A8B8B01D23030F2465D14