ComboFix 07-11-01.1 - jasiu 2007-11-03 21:16:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.408 [GMT 1:00]
Running from: C:\Documents and Settings\jasiu\Pulpit\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\Config.xml
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\jasiu\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
C:\Program Files\ShoppingReport\Uninst.exe
.
((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.
2007-11-03 21:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-03 20:59 <DIR> d-------- C:\Documents and Settings\jasiu\Dane aplikacji\HP
2007-11-03 20:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP
2007-11-03 20:48 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2007-11-03 20:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sonic
2007-11-03 20:47 <DIR> d-------- C:\Program Files\Common Files\HP
2007-11-03 20:44 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-11-03 20:44 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-11-03 20:43 827,392 -ra------ C:\WINDOWS\system32\hpotiop2.dll
2007-11-03 20:43 659,456 -ra------ C:\WINDOWS\system32\hpowiax2.dll
2007-11-03 20:43 254,026 -ra------ C:\WINDOWS\system32\hpovst09.dll
2007-11-03 20:43 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2007-11-03 20:43 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2007-11-03 20:43 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys
2007-11-03 20:43 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys
2007-11-03 20:38 <DIR> d-------- C:\TEMP
2007-11-03 20:38 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-11-03 20:38 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-11-03 20:38 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-11-03 20:38 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-11-03 20:38 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-11-03 20:38 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-11-03 20:37 <DIR> d-------- C:\Program Files\HP
2007-11-03 20:36 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-11-03 20:36 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-11-03 20:35 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-03 20:35 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-11-03 20:33 119,977 --a------ C:\WINDOWS\hpoins11.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-03 11:35 --------- d-----w C:\Program Files\eMule
2007-09-22 14:10 --------- d-----w C:\Program Files\Secured_eMule
2007-09-04 15:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\BufferZone
2007-07-23 23:51 9,679,815 ----a-w C:\Program Files\vlc-0.8.6c-win32.exe
2006-11-30 19:39 461 ----a-w C:\Program Files\INSTALL.LOG
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1d1b60fd-b21f-4b9a-8a5f-64e8544828d7}]
2007-09-22 15:10 1453080 --a------ C:\Program Files\Secured_eMule\tbSec1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1d1b60fd-b21f-4b9a-8a5f-64e8544828d7}"= C:\Program Files\Secured_eMule\tbSec1.dll [2007-09-22 15:10 1453080]
[HKEY_CLASSES_ROOT\CLSID\{1d1b60fd-b21f-4b9a-8a5f-64e8544828d7}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{1D1B60FD-B21F-4B9A-8A5F-64E8544828D7}"= C:\Program Files\Secured_eMule\tbSec1.dll [2007-09-22 15:10 1453080]
[HKEY_CLASSES_ROOT\CLSID\{1D1B60FD-B21F-4B9A-8A5F-64E8544828D7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDMCon"="C:\Program Files\Softwin\BitDefender9\bdmcon.exe" [2006-11-30 20:38]
"BDOESRV"="C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 18:53]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 11:28]
"BDSwitchAgent"="C:\Program Files\Softwin\BitDefender9\bdswitch.exe" [2005-04-06 14:09]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk
backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Photosmart Premier - Szybkie uruchomienie.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Photosmart Premier - Szybkie uruchomienie.lnk
backup=C:\WINDOWS\pss\HP Photosmart Premier - Szybkie uruchomienie.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"C:\Program Files\Windows Defender\MSASCui.exe" -hide
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\taskbaricon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
C:\PROGRA~1\Wanadoo\Watch.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-10-31 16:19:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-03 01:21:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 21:20:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-03 21:21:30 - machine was rebooted
.
--- E O F ---