ComboFix 09-06-11.05 - Micha 2009-06-12  0:57.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.1022.603 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Micha\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
 * Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-05-11 do 2009-06-11  )))))))))))))))))))))))))))))))
.

2009-05-16 20:35 . 2005-04-25 08:43	159616	----a-w-	c:\windows\system32\drivers\Vax347ba.sys
2009-05-16 20:35 . 2004-04-30 07:33	5248	----a-w-	c:\windows\system32\drivers\Vax347sa.sys
2009-05-16 20:27 . 2005-04-25 08:43	159616	----a-w-	c:\windows\system32\drivers\Vax347b.sys
2009-05-16 20:27 . 2004-04-30 07:33	5248	----a-w-	c:\windows\system32\drivers\Vax347s.sys
2009-05-16 20:27 . 2009-05-16 20:27	--------	d-----w-	c:\program files\Alcohol Soft
2009-05-16 13:43 . 2009-05-16 13:43	1700352	----a-w-	c:\windows\system32\gdiplus.dll

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-11 22:56 . 2008-01-02 13:03	--------	d-----w-	c:\program files\Neostrada TP
2009-05-31 20:52 . 2009-01-17 15:00	--------	d-----w-	c:\program files\Serious Sam 2
2009-05-17 20:10 . 2008-01-02 12:51	--------	d-----w-	c:\program files\foobar2000
2009-05-16 20:29 . 2008-01-02 12:36	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-05-16 13:43 . 2008-11-14 20:57	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\ipla
2009-05-09 19:33 . 2001-10-26 17:15	558944	----a-w-	c:\windows\system32\perfh015.dat
2009-05-09 19:33 . 2001-10-26 17:15	109318	----a-w-	c:\windows\system32\perfc015.dat
2009-05-09 19:25 . 2008-01-02 12:12	23016	----a-w-	c:\windows\system32\emptyregdb.dat
2009-05-04 13:17 . 2008-04-08 17:33	--------	d-----w-	c:\program files\SpeedFan
2009-04-24 22:30 . 2008-10-19 13:52	--------	d-----w-	c:\program files\Notepad++
2009-04-17 22:30 . 2009-04-17 22:21	560	---ha-w-	c:\windows\Fonts\SWFont9.fnt
2009-04-17 22:30 . 2009-04-17 22:21	560	----a-w-	c:\program files\Global.sw
2009-04-17 22:21 . 2009-04-17 22:21	--------	d-----w-	c:\program files\SoftwrapLicense
2009-04-17 21:57 . 2009-04-17 21:57	--------	d-----w-	c:\program files\Pontifex
2007-02-08 09:48 . 2007-02-08 09:48	133920	----a-w-	c:\program files\internet explorer\plugins\LV82ActiveXControl.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domylne, prawidowe wpisy nie s pokazane  
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"CnxDslTaskBar"="c:\program files\ZTE Corporation\ZXDSL852\CnxDslTb.exe" [2005-07-21 278528]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2005-07-21 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\TaskbarIcon.exe" [2005-07-21 53248]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"TrialReset"="c:\windows\regx32.exe" [2008-07-03 285327]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

c:\documents and settings\Micha\Menu Start\Programy\Autostart\
Neostrada TP.lnk - c:\program files\Neostrada TP\NeostradaTP.exe [2008-1-2 626688]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2008-1-2 1711304]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Orbit.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"aawservice"=2 (0x2)
"StarWindService"=2 (0x2)
"niSvcLoc"=2 (0x2)
"NILM License Manager"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NIDomainService"=2 (0x2)
"NBService"=3 (0x3)
"lkTimeSync"=2 (0x2)
"lkClassAds"=2 (0x2)
"LkCitadelServer"=2 (0x2)
"matlabserver"=2 (0x2)
"MDM"=2 (0x2)
"idsvc"=3 (0x3)
"SQLWriter"=2 (0x2)
"MSSQL$SQLEXPRESS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"=
"c:\\Program Files\\Wierszownik\\data\\bin\\mysqld-nt.exe"=
"c:\\Program Files\\kicad\\winexe\\eeschema.exe"=
"d:\\Format\\z dysku C\\Inne\\Hairy Harry\\harry.exe"=
"c:\\Program Files\\kicad\\winexe\\pcbnew.exe"=
"c:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Real Alternative\\Media Player Classic\\mplayerc.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica Player\\7.0\\MathematicaPlayer.exe"=
"c:\\Program Files\\Wolfram Research\\Mathematica Player\\7.0\\math.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Vax347ba;Vax347ba;c:\windows\system32\drivers\Vax347ba.sys [2009-05-16 159616]
R0 Vax347sa;Vax347sa;c:\windows\system32\drivers\Vax347sa.sys [2009-05-16 5248]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-08-18 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [2008-01-02 131072]
R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [2008-01-02 618112]
R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;c:\windows\system32\drivers\CnxTgNW.sys [2008-01-02 52736]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-07-11 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-07-10 242712]
S4 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-09-06 356920]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
.
.
------- Skan uzupeniajcy -------
.
uStart Page = hxxp://www.neostrada.pl
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: &NeoTrace It! - c:\progra~1\NEOTRA~1\NTXcontext.htm
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - 
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-12 00:59
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesw ...  

skanowanie ukrytych wpisw autostartu ... 

skanowanie ukrytych plikw ...  

skanowanie pomylnie ukoczone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-725345543-1085031214-2147145749-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Pliki DLL adowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3928)
c:\program files\Gadu-Gadu\ggwhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Czas ukoczenia: 2009-06-11  1:00
ComboFix-quarantined-files.txt  2009-06-11 23:00
ComboFix2.txt  2009-02-28 16:05
ComboFix3.txt  2009-02-18 13:02
ComboFix4.txt  2009-02-18 11:05

Przed: 1169293312 bajtw wolnych
Po: 1155190784 bajtw wolnych

167
