dziwny wpis w autostarcie hattric smss.exe

[p!otr@$]

jak w temacie scieżka do programu smss.exe nigdy czegoś takiego niebyło

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:52, on 2009-04-28
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\RivaTuner v2.24\RivaTuner.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\PROGRA~1\FASTDE~1\FAST2.EXE
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\cFosSpeed\spd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Opera 10 Preview\opera.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

[Aby zobaczyć linki, zarejestruj się tutaj]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

[Aby zobaczyć linki, zarejestruj się tutaj]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

[Aby zobaczyć linki, zarejestruj się tutaj]

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [CTxfiHlp]CTXFIHLP.EXE
O4 - HKLM\..\Run: [@OnlineArmor GUI]"C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [NvCplDaemon]RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt]"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RivaTuner]"C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /T
O4 - HKLM\..\Run: [RivaTunerStartupDaemon]"C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /S
O4 - HKLM\..\Run: [cFosSpeed]C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [WheelMouse]C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKCU\..\Run: [FAST Defrag]C:\PROGRA~1\FASTDE~1\FAST2.EXE -tray
O4 - HKCU\..\Run: [Hattric]C:\WINDOWS\system32\hattric\smss.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Pobierz w Free Download Manager -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\Program Files\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra ''Tools'' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ''Tools'' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: mSejfService - Ux Systems - C:\Program Files\Ux Systems\mSejf\mSejfService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

-- keyloger jest poprzedzony nagłówkiem hattric


prawdziwy smss.exe znajduje sie w system32natomiast ten ma folder hattric w systemie32

[p!otr@$]

ComboFix 09-04-28.02 - p!otr@$ 2009-04-29 11:56.1 - NTFSx86
Microsoft Windows XP Professional5.1.2600.3.1250.48.1045.18.2047.1444 [GMT 2:00]
Uruchomiony z: c:\program files\combofix\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated)
FW: Online Armor Firewall *enabled*
* Utworzono nowy punkt przywracania
.

((((((((((((((((((((((((( Pliki utworzone od 2009-05-28 do 2009-4-29)))))))))))))))))))))))))))))))
.

2009-04-29 09:42 . 2009-04-29 09:42 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Media Player Classic
2009-04-29 09:41 . 2009-04-29 09:41 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-04-29 09:39 . 2009-04-29 09:39 -------- d-----w c:\windows\LastGood
2009-04-29 09:04 . 2009-04-29 09:04 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\Adobe
2009-04-29 08:51 . 2009-04-29 08:52 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-29 07:01 . 2009-04-29 07:01 -------- d-----w c:\program files\combofix
2009-04-29 07:00 . 2009-04-29 07:00 -------- d-----w c:\program files\gmer
2009-04-29 06:45 . 2009-04-29 06:59 -------- d-----w c:\program files\WIEM2004
2009-04-29 06:45 . 2009-04-29 06:45 -------- d-----w c:\program files\Common Files\Onet.pl
2009-04-28 10:07 . 2009-04-28 10:10 -------- d-----w c:\documents and settings\p!otr@$\.gimp-2.6
2009-04-28 10:07 . 2009-04-28 10:07 -------- d-----w c:\documents and settings\p!otr@$\.gegl-0.0
2009-04-28 10:02 . 2009-04-28 10:02 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\OpenOffice.ux.pl
2009-04-28 10:01 . 2009-04-28 10:01 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\Apple Computer
2009-04-28 09:37 . 2009-04-28 09:37 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Ponys
2009-04-28 09:28 . 2009-04-28 09:31 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\VirtualFarm
2009-04-28 09:12 . 2009-04-28 09:12 664 ----a-w c:\windows\system32\d3d9caps.dat
2009-04-28 08:29 . 2009-04-28 08:32 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Ventrilo
2009-04-28 08:28 . 2009-04-28 08:28 -------- d-----w c:\program files\Ventrilo
2009-04-28 08:23 . 2009-04-28 08:23 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\teamspeak2
2009-04-28 08:23 . 2009-04-28 08:23 -------- d-----w c:\program files\Teamspeak2_RC2
2009-04-28 08:21 . 2005-05-25 12:49 20992 ----a-w c:\windows\system32\sfdrvrem.exe
2009-04-28 08:20 . 2009-04-28 08:20 -------- d-----w c:\program files\OniGames
2009-04-28 08:12 . 2009-04-28 08:12 -------- d-----w c:\program files\Eidos
2009-04-28 07:38 . 2009-04-28 07:38 -------- d-----w c:\program files\Novalogic
2009-04-28 07:22 . 2009-04-28 07:28 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Xfire
2009-04-28 07:22 . 2009-04-28 07:23 -------- d-----w c:\program files\Xfire
2009-04-28 07:13 . 2009-04-29 09:34 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Hamachi
2009-04-28 07:13 . 2009-04-28 07:13 25280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-04-28 07:13 . 2009-04-28 07:13 -------- d-----w c:\program files\Hamachi
2009-04-28 07:06 . 2009-04-29 09:59 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Free Download Manager
2009-04-28 07:05 . 2009-04-28 07:05 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\FreeDownloadManager.ORG
2009-04-28 07:05 . 2009-04-28 07:06 -------- d-----w c:\program files\Free Download Manager
2009-04-28 06:41 . 2009-04-28 06:41 132 ----a-w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2009-04-28 06:41 . 2009-04-28 06:47 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\ApplicationHistory
2009-04-28 06:35 . 2009-04-28 06:35 -------- d-----w c:\program files\MRU-Blaster
2009-04-28 06:27 . 2009-04-28 06:27 -------- d-----w c:\program files\Kolekcja Klasyki
2009-04-28 06:15 . 2009-04-28 06:15 -------- d-----w c:\program files\Adibu
2009-04-28 06:06 . 2009-04-28 06:06 -------- d-----w c:\program files\Common Files\Activision
2009-04-28 06:01 . 2009-04-28 06:06 -------- d-----w c:\program files\Barbie™
2009-04-28 05:55 . 2009-04-28 05:55 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Leadertech
2009-04-28 05:21 . 2009-04-28 05:21 -------- d-----w c:\program files\EA Sports
2009-04-28 05:20 . 2009-04-28 05:20 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-04-27 19:15 . 2009-04-27 19:22 -------- d-----w c:\program files\Wise Disk Cleaner
2009-04-27 19:14 . 2009-04-27 20:28 -------- d-----w c:\program files\Wise Registry Cleaner
2009-04-27 19:08 . 2009-04-27 19:12 -------- d-----w c:\program files\English Translator 3
2009-04-27 19:03 . 2009-04-27 19:05 -------- d-----w c:\program files\Deutsch Translator 2
2009-04-27 18:58 . 2001-07-01 15:30 112640 ----a-w c:\windows\lsb_un20.exe
2009-04-27 18:58 . 2009-04-28 09:45 -------- d-----w c:\program files\FOX Jones
2009-04-27 18:58 . 2009-04-28 09:37 -------- d-----w c:\program files\ICE-Land2
2009-04-27 18:57 . 2009-04-27 18:57 -------- d-----w c:\program files\Play
2009-04-27 18:43 . 2009-04-27 18:45 -------- d-----w c:\program files\bakoma
2009-04-27 18:40 . 2009-04-27 18:40 -------- d-----w c:\program files\Treasure Machine
2009-04-27 18:39 . 2009-04-27 18:39 -------- d-----w c:\program files\Super Farmer
2009-04-27 18:19 . 2009-04-27 18:19 -------- d-----w c:\program files\WWDC
2009-04-27 18:19 . 2009-04-27 18:19 -------- d-----w c:\program files\SeconfigXP
2009-04-27 18:17 . 2009-04-27 18:17 -------- d-----w c:\program files\HostsXpert
2009-04-27 17:47 . 2009-04-27 17:47 -------- d-----w c:\program files\Dir2File
2009-04-27 17:44 . 2009-04-27 17:44 -------- d-----w c:\program files\VID_0E8F&PID_0003
2009-04-27 17:35 . 2009-04-27 17:35 -------- d-----w c:\program files\A4Tech
2009-04-27 17:30 . 2003-03-19 03:14 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-27 17:30 . 2009-04-27 17:30 -------- d-----w c:\program files\Real Alternative
2009-04-27 17:30 . 2009-04-27 17:30 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\Real
2009-04-27 17:30 . 2009-04-27 17:30 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-04-27 17:30 . 2009-04-27 17:30 -------- d-----w c:\program files\QuickTime Alternative
2009-04-27 17:29 . 2009-04-29 09:44 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\MediaMonkey
2009-04-27 17:29 . 2009-04-27 17:29 -------- d-----w c:\program files\MediaMonkey
2009-04-27 17:29 . 2009-04-27 17:29 -------- d-----w c:\program files\DVD Flick
2009-04-27 17:27 . 2009-04-27 17:27 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Ashampoo
2009-04-27 17:24 . 2009-04-27 17:24 -------- d-----w c:\program files\Common Files\MAGIX Shared
2009-04-27 17:24 . 2002-09-20 22:33 1089536 ----a-w c:\windows\system32\ROBOEX32.DLL
2009-04-27 17:24 . 1999-01-28 12:44 49152 ----a-w c:\windows\system32\INETWH32.dll
2009-04-27 17:24 . 1998-10-15 15:28 85504 ----a-w c:\windows\system32\HtmlWH.dll
2009-04-27 17:24 . 2009-04-27 17:24 -------- d-----w c:\program files\photo clinic
2009-04-27 17:23 . 2009-04-27 17:23 -------- d-----w c:\windows\system32\MAGIX
2009-04-27 17:23 . 2006-07-12 13:46 638976 ----a-w c:\windows\system32\mgxoschk.dll
2009-04-27 17:23 . 2009-04-27 17:23 -------- d-----w c:\program files\GIMP-2.0
2009-04-27 17:22 . 2009-04-27 17:22 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Artweaver
2009-04-27 17:22 . 2009-04-27 17:22 -------- d-----w c:\program files\Artweaver 0.5
2009-04-27 17:20 . 2009-04-27 17:20 -------- d-----w c:\program files\Ux Systems
2009-04-27 17:16 . 2009-04-27 17:16 -------- d-----w c:\program files\JRE
2009-04-27 17:16 . 2009-04-27 17:16 -------- d-----w c:\program files\OpenOffice.ux.pl 3
2009-04-27 17:16 . 2009-04-27 17:16 -------- d-----w c:\program files\Java
2009-04-27 17:16 . 2009-04-27 17:16 -------- d-----w c:\program files\Common Files\Java
2009-04-27 17:14 . 2009-04-27 17:15 -------- d-----w c:\program files\GPU Z
2009-04-27 17:13 . 2009-04-27 17:14 -------- d-----w c:\program files\CPU Z
2009-04-27 17:10 . 2002-03-06 16:13 293888 ----a-w c:\windows\system32\midas.dll
2009-04-27 17:10 . 2009-04-27 17:10 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\Byngo
2009-04-27 17:10 . 2009-04-27 17:10 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\CCPublisher
2009-04-27 17:10 . 2009-04-27 17:10 -------- d-----w c:\documents and settings\p!otr@$\Dane aplikacji\CodedColor
2009-04-27 17:10 . 2009-04-27 17:14 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\CodedColor
2009-04-27 17:10 . 2009-04-27 17:10 -------- d-----w c:\program files\CodedColor
2009-04-27 17:08 . 2009-04-27 17:08 -------- d-----w c:\program files\Common Files\Raxco
2009-04-27 17:08 . 2009-04-27 17:08 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Raxco
2009-04-27 17:07 . 2009-04-27 17:08 -------- d-----w c:\program files\RAXCO
2009-04-27 17:04 . 2009-04-27 17:04 -------- d-----w c:\program files\Smart PC Solutions
2009-04-27 17:02 . 2007-03-29 22:46 32352 ----a-w c:\windows\system32\drivers\UimBus.sys
2009-04-27 17:02 . 2007-03-29 22:46 11840 ----a-w c:\windows\system32\drivers\UimFIO.sys
2009-04-27 17:02 . 2007-03-29 22:46 131456 ----a-w c:\windows\system32\drivers\Uim_IM.sys
2009-04-27 17:02 . 2007-03-29 22:46 38448 ----a-w c:\windows\system32\drivers\hotcore3.sys
2009-04-27 17:02 . 2007-03-29 22:46 247824 ----a-w c:\windows\system32\prgiso.dll
2009-04-27 17:02 . 2007-03-29 22:46 4245008 ----a-w c:\windows\system32\qtp-mt334.dll
2009-04-27 17:02 . 2007-03-29 22:46 13840 ----a-w c:\windows\system32\wnaspi32.dll
2009-04-27 17:01 . 2009-04-27 17:01 -------- d-----w c:\program files\Paragon Software
2009-04-27 16:58 . 2009-04-27 16:58 -------- d-----w C:\Paragon DB płyta ratunkowa
2009-04-27 16:53 . 2004-06-22 13:44 5632 ----a-w c:\windows\system32\drivers\Entech64.sys
2009-04-27 16:53 . 2001-11-19 17:05 3972 ----a-w c:\windows\system32\drivers\PciBus.sys
2009-04-27 16:53 . 2004-10-25 18:02 21664 ----a-w c:\windows\system32\drivers\Entech.sys
2009-04-27 16:53 . 2009-04-27 16:53 -------- d-----w c:\windows\system32\Futuremark
2009-04-27 16:53 . 2009-04-27 17:37 -------- d-----w c:\program files\Futuremark
2009-04-27 16:39 . 2009-04-27 16:43 -------- d-----w c:\program files\projekty domów
2009-04-27 16:32 . 2009-04-29 09:44 -------- d-----w c:\program files\prawojazdy
2009-04-27 16:25 . 2009-02-13 09:31 787672 ----a-w c:\windows\system32\drivers\cfosspeed.sys
2009-04-27 16:25 . 2009-02-13 09:31 290008 ----a-w c:\windows\system32\cfosspeed.dll
2009-04-27 16:25 . 2009-04-29 10:01 -------- d-----w c:\program files\cFosSpeed
2009-04-27 16:18 . 2009-04-27 16:26 -------- d-----w c:\program files\Multimedialny Atlas Świata 2006
2009-04-27 15:50 . 2009-04-29 08:35 138016 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-04-27 15:50 . 2009-04-29 08:36 189392 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-27 15:49 . 2009-04-27 15:49 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-04-27 15:49 . 2009-04-27 15:49 -------- d-----w c:\documents and settings\p!otr@$\Ustawienia lokalne\Dane aplikacji\PunkBuster
2009-04-27 15:08 . 2009-04-29 09:41 -------- d-----w c:\program files\JkDefrag-3.36
2009-04-27 15:05 . 2009-04-27 15:05 -------- d-----w c:\program files\FAST Defrag
2009-04-27 15:00 . 2009-04-27 15:00 -------- d-----w c:\program files\affinity
2009-04-27 14:59 . 2009-04-27 14:59 -------- d-----w c:\program files\Edgard
2009-04-27 14:54 . 2009-04-27 14:54 -------- d-----w c:\program files\xp-AntiSpy
2009-04-27 14:52 . 2006-05-03 20:53 174592 ----a-w c:\windows\system32\framedyn.dll

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-29 08:21 . 2009-04-27 13:51 -------- d-----w c:\program files\Kubus3D
2009-04-29 06:45 . 2009-04-27 12:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-28 08:28 . 2009-04-27 12:42 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-27 17:40 . 2009-04-27 12:24 86016 ----a-w c:\windows\system32\OpenAL32.dll
2009-04-27 17:40 . 2009-04-27 13:58 -------- d-----w c:\program files\uTorrent
2009-04-27 17:31 . 2009-04-27 17:31 -------- d-----w c:\program files\Winamp
2009-04-27 17:28 . 2009-04-27 14:48 -------- d-----w c:\program files\Ashampoo
2009-04-27 16:58 . 2009-04-27 12:22 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-27 14:58 . 2004-08-03 21:14 361600 ----a-w c:\windows\system32\drivers\tcpip.sys
2009-04-27 14:10 . 2001-10-26 14:15 86968 ----a-w c:\windows\system32\perfc015.dat
2009-04-27 14:10 . 2001-10-26 14:15 494308 ----a-w c:\windows\system32\perfh015.dat
2009-04-27 13:58 . 2009-04-27 13:58 -------- d-----w c:\program files\VideoLAN
2009-04-27 13:56 . 2009-04-27 13:56 -------- d-----w c:\program files\CoreTemp
2009-04-27 13:55 . 2009-04-27 13:55 -------- d-----w c:\program files\m.player classic
2009-04-27 13:55 . 2009-04-27 13:55 -------- d-----w c:\program files\TesterM
2009-04-27 13:55 . 2009-04-27 13:55 -------- d-----w c:\program files\ProcessExplorer
2009-04-27 13:55 . 2009-04-27 13:55 -------- d-----w c:\program files\pi
2009-04-27 13:55 . 2009-04-27 13:55 -------- d-----w c:\program files\orthos
2009-04-27 13:48 . 2009-04-27 13:33 -------- d-----w c:\program files\America''s Army
2009-04-27 13:16 . 2009-04-27 13:16 -------- d-----w c:\program files\Avira
2009-04-27 12:42 . 2009-04-27 12:42 -------- d-----w c:\program files\AGEIA Technologies
2009-04-27 12:36 . 2009-04-27 11:52 -------- d-----w c:\program files\Microsoft Works
2009-04-27 12:29 . 2009-04-27 12:29 -------- d-----w c:\program files\Tall Emu
2009-04-27 12:29 . 2009-04-27 12:29 -------- d-----w c:\program files\Opera 10 Preview
2009-04-27 12:26 . 2009-04-27 12:22 -------- d-----w c:\program files\Creative
2009-04-27 12:24 . 2009-04-27 12:24 444952 ----a-w c:\windows\system32\wrap_oal.dll
2009-04-27 12:24 . 2009-04-27 12:24 -------- d-----w c:\program files\OpenAL
2009-04-27 12:23 . 2009-04-27 12:23 -------- d-----w c:\program files\Common Files\Creative Labs Shared
2009-04-27 12:20 . 2009-04-27 12:20 -------- d-----w c:\program files\Intel
2009-04-27 12:14 . 2009-04-27 11:42 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-27 12:04 . 2009-04-27 12:04 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-27 12:02 . 2009-04-27 12:02 -------- d-----w c:\program files\MSBuild
2009-04-27 12:00 . 2009-04-27 12:00 -------- d-----w c:\program files\Reference Assemblies
2009-04-27 11:56 . 2009-04-27 11:55 -------- d-----w c:\program files\AutoPatcher
2009-04-27 11:52 . 2009-04-27 11:52 -------- d-----w c:\program files\Microsoft.NET
2009-04-27 11:43 . 2009-04-27 11:43 -------- d-----w c:\program files\microsoft frontpage
2009-04-27 11:42 . 2001-07-21 20:36 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-27 11:42 . 2009-04-27 11:42 -------- d-----w c:\program files\Usługi online
2009-04-27 11:39 . 2009-04-27 11:39 21856 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-14 18:18 . 2009-04-14 18:18 41808 ----a-w c:\windows\system32\xfcodec.dll
2009-04-04 04:35 . 2009-04-27 12:29 30288 ----a-w c:\windows\system32\drivers\OAnet.sys
2009-04-04 03:47 . 2009-04-27 12:29 31824 ----a-w c:\windows\system32\drivers\OAmon.sys
2009-04-04 03:46 . 2009-04-27 12:29 196688 ----a-w c:\windows\system32\drivers\OADriver.sys
2009-03-27 06:14 . 2009-04-27 12:42 453152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-03-24 14:08 . 2009-04-27 13:16 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-03-16 12:18 . 2009-04-27 14:48 69448 ----a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 12:18 . 2009-04-27 14:48 517448 ----a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 12:18 . 2009-04-27 14:48 235352 ----a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 12:18 . 2009-04-27 14:48 22360 ----a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-09 13:27 . 2009-04-27 14:48 453456 ----a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 13:27 . 2009-04-27 14:48 4178264 ----a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 13:27 . 2009-04-27 14:48 1846632 ----a-w c:\windows\system32\D3DCompiler_41.dll
2009-03-06 14:22 . 2004-08-03 22:44 285696 ----a-w c:\windows\system32\pdh.dll
2009-02-09 14:07 . 2004-08-03 22:37 1847040 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-04 00:39 2025472 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2004-08-03 22:38 2146816 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-03 22:44 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:53 . 2004-08-03 22:44 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2004-08-03 22:44 731136 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2004-08-03 22:43 686592 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2004-08-03 22:43 722944 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2001-10-26 15:30 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-03 22:44 56832 ----a-w c:\windows\system32\secur32.dll
.

------- Sigcheck -------

[7]2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-]2009-04-27 14:58 361344 8E036EEC565910417EA020CE0962AA24 c:\windows\ServicePackFiles\i386\tcpip.sys
[-]2009-04-27 14:58 361600 D24EA301E2B36C4E975FD216CA85D8E7 c:\windows\system32\dllcache\tcpip.sys
[-]2009-04-27 14:58 361600 D24EA301E2B36C4E975FD216CA85D8E7 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FAST Defrag"="c:\progra~1\FASTDE~1\FAST2.EXE" [2003-11-06 62464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-04-04 2046664]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RivaTuner"="c:\program files\RivaTuner v2.24\RivaTuner.exe" [2009-02-25 2781184]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTuner.exe" [2009-02-25 2781184]
"cFosSpeed"="c:\program files\cFosSpeed\cFosSpeed.exe" [2009-02-13 876760]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2005-12-14 176128]
"RTSS"="c:\program files\RivaTuner v2.24\Tools\RTSS\RTSS.exe" [2009-02-25 106496]
"CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\Ctxfihlp.exe [2008-10-07 23552]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-04-04 334536]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\ 0 autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-04-27 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2008-10-07 171032]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2008-10-07 1324056]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2008-10-07 72728]
R3 mSejfService;mSejfService;c:\program files\Ux Systems\mSejf\mSejfService.exe [2008-09-23 32768]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
S0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2007-03-29 38448]
S1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2009-04-04 196688]
S1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2009-04-04 31824]
S1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2009-04-04 30288]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-28 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-22 55024]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
S2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\OAcat.exe [2009-04-04 361160]
S2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2009-04-04 3046088]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2008-10-07 171032]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2008-10-07 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2008-10-07 72728]
S3 V0260VID;Live! Cam Vista IM;c:\windows\system32\DRIVERS\V0260Vid.sys [2006-11-04 178913]


--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - AUJASNKJ
*NewlyCreated* - EECTRL
*NewlyCreated* - PNKBSTRB
*NewlyCreated* - PNKBSTRK
*Deregistered* - aujasnkj
*Deregistered* - PROCEXP111
.
.
------- Skan uzupełniający -------
.
uStart Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- Skojarzenia plików -------
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

[Aby zobaczyć linki, zarejestruj się tutaj]

Rootkit scan 2009-04-29 12:01
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
FAST Defrag = c:\progra~1\FASTDE~1\FAST2.EXE -tray?S\SYSTEM.INI?6~????`???Z?6~ ???*?6~??????g???g??,?|?-?|q-?|x-?|L?????%?????????0???????????????????????x-?|????????????`???????d???????????????????d??? ??|`??|????] ??|???|?????????=[????????|?=[?''????M?|???????????????

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > ''explorer.exe''(2400)
c:\program files\Tall Emu\Online Armor\OAwatch.dll
c:\program files\RivaTuner v2.24\Tools\RTSS\RTSSHooks.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Czas ukończenia: 2009-04-29 12:03
ComboFix-quarantined-files.txt2009-04-29 10:03

Przed: 45 516 390 400 bajtów wolnych
Po: 45 514 698 752 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect

311 --- E O F --- 2009-04-27 14:05

[Serafin]

O4 - HKCU\..\Run: [Hattric]C:\WINDOWS\system32\hattric\ smss.exe

Usuń wpis oraz zaznaczony pliki, w trybie awaryjnym i wyłączonym przywracaniem systemu.
Przeskanuj system za pomocą

[Aby zobaczyć linki, zarejestruj się tutaj]

[p!otr@$]

już usunołem na virustotal tylko DR WEB wykrywał tu trojana, nawet wiem kiedy to się przyplontało mam gre oryginalną CRASHDAYS taka samochodówka dobiłem do serwera w rosji, aby grać trzeba było sciągnąć mape teo wyscigowy i zainstalować, a to że ustawiłem firewalla i HIPS w tryb uczenia to moja wina i sie poinstalowało:rolleyes:. Naszczęscie często zagladam do programu hijackthis i coś mi niespasowało, jak na ten wpis.