UA:
UA:
UA:
UA:
UA:
UA:
UA:
UA:
UA:
UA:
ComboFix 08-04-18.3 - Maaciek 2008-04-19 12:08:48.3 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1635 [GMT 2:00]
Running from: C:\Documents and Settings\Maaciek\Pulpit\Combo-Fix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))
.
2008-04-19 12:06 . 2008-04-19 12:06 <DIR> d-------- C:\ComboFix
2008-04-19 10:23 . 2008-04-19 10:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-04-19 10:22 . 2008-04-19 10:22 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-19 09:25 . 2008-04-19 12:08 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-04-18 21:02 . 2008-04-18 21:02 <DIR> d--hs---- C:\FOUND.005
2008-04-18 20:17 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-04-17 07:09 . 2008-04-17 07:09 <DIR> d---s---- C:\Documents and Settings\Maaciek\UserData
2008-04-16 18:40 . 2008-04-16 18:40 <DIR> d--hs---- C:\FOUND.004
2008-04-16 18:35 . 2008-04-16 18:35 <DIR> d--hs---- C:\FOUND.003
2008-04-16 14:50 . 2008-04-16 14:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-04-16 07:57 . 2008-04-16 07:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-04-15 18:15 . 2008-04-15 18:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-04-15 17:22 . 2008-04-15 17:22 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-15 14:05 . 2008-04-15 14:05 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-13 10:04 . 2008-04-13 10:04 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ubisoft
2008-04-13 10:04 . 2008-04-13 10:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-04-12 21:05 . 2008-04-12 21:05 <DIR> d-------- C:\Program Files\Common Files\EZB Systems
2008-04-12 20:06 . 2008-04-12 20:06 <DIR> d--hs---- C:\FOUND.002
2008-04-11 18:02 . 2008-04-11 18:02 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-11 16:33 . 2008-04-11 16:33 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-04-11 16:19 . 2008-04-11 16:19 41 ---hs---- C:\Documents and Settings\All Users\Dane aplikacji\.zreglib
2008-04-11 16:18 . 2008-04-11 16:18 24 --ahs---- C:\WINDOWS\SBA8959D4.tmp
2008-04-11 14:13 . 2008-04-18 18:04 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-04-11 14:13 . 2008-04-11 16:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-04-11 14:13 . 2008-04-18 18:04 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-10 15:38 . 2008-03-19 18:26 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-04-10 15:38 . 2008-03-19 18:29 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-04-10 15:37 . 2008-04-10 15:37 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-04-06 17:00 . 2008-04-06 17:00 <DIR> d--hs---- C:\FOUND.001
2008-04-05 09:23 . 2008-04-11 16:44 674,600 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-04-04 13:53 . 2008-04-04 13:53 <DIR> d--hs---- C:\FOUND.000
2008-04-03 17:49 . 2008-04-03 17:49 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\DAEMON Tools
2008-04-03 17:49 . 2008-04-03 17:49 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-02 21:55 . 2008-04-02 21:55 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ulead Systems
2008-04-02 21:54 . 2008-04-02 21:54 <DIR> d-------- C:\WINDOWS\system32\windows media
2008-04-02 21:54 . 2008-04-02 21:54 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-04-02 21:53 . 2008-04-02 21:53 <DIR> d-------- C:\Program Files\Windows Media Components
2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Program Files\Ulead Systems
2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
2008-04-01 20:09 . 2001-12-19 15:47 49,152 --------- C:\WINDOWS\system32\TempDel.EXE
2008-04-01 20:09 . 2005-01-06 16:55 9,446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys
2008-04-01 20:09 . 2002-06-03 23:01 8,734 --a------ C:\WINDOWS\system32\WFSch.ICO
2008-04-01 20:05 . 2008-04-01 20:05 <DIR> d-------- C:\WINDOWS\system32\DX9
2008-04-01 20:04 . 2008-04-01 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFox
2008-04-01 20:04 . 2008-04-01 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFast
2008-04-01 20:04 . 2003-09-05 09:57 9,469 --a------ C:\WINDOWS\system32\drivers\WINFOXIO.sys
2008-04-01 12:12 . 2008-04-01 12:12 <DIR> d-------- C:\Program Files\uTorrent
2008-04-01 12:12 . 2008-04-01 12:12 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\uTorrent
2008-04-01 12:03 . 2008-04-11 16:45 22,328 --a------ C:\Documents and Settings\Maaciek\Dane aplikacji\PnkBstrK.sys
2008-04-01 12:02 . 2008-04-01 12:02 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-01 12:02 . 2008-04-01 12:02 275 --a------ C:\WINDOWS\game.ini
2008-04-01 11:47 . 2008-04-01 11:47 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-04-01 08:03 . 2008-04-01 08:03 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Winamp
2008-04-01 07:58 . 2008-04-01 07:58 1,229 --a------ C:\WINDOWS\mozver.dat
2008-04-01 07:56 . 2008-04-01 07:56 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Talkback
2008-04-01 07:56 . 2008-04-01 07:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-01 07:50 . 2008-04-01 07:50 <DIR> d-------- C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
2008-04-01 07:50 . 2008-04-01 07:50 <DIR> d-------- C:\Program Files\Lexmark 3300 Series
2008-04-01 07:48 . 2008-04-01 07:48 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-04-01 07:48 . 2008-04-01 07:48 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ahead
2008-04-01 07:47 . 2008-04-01 07:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-04-01 07:45 . 2008-04-01 07:45 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-04-01 07:45 . 2008-04-01 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-04-01 07:38 . 2007-03-23 13:19 9,715,200 -r------- C:\WINDOWS\RTLCPL.exe
2008-04-01 07:38 . 2007-07-18 13:26 4,547,584 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-04-01 07:38 . 2007-06-15 10:45 1,826,816 -r------- C:\WINDOWS\SkyTel.exe
2008-04-01 07:38 . 2007-01-16 04:39 1,191,936 -r------- C:\WINDOWS\RtlUpd.exe
2008-04-01 07:38 . 2006-08-18 00:58 282,624 -r------- C:\WINDOWS\system32\RTSndMgr.cpl
2008-04-01 07:38 . 2006-07-21 10:14 86,016 -r------- C:\WINDOWS\SoundMan.exe
2008-04-01 07:38 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-04-01 07:37 . 2008-04-01 07:37 <DIR> d-------- C:\Program Files\Realtek
2008-04-01 07:37 . 2008-04-01 07:37 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-04-01 07:37 . 2007-07-05 10:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe
2008-04-01 07:37 . 2006-05-04 10:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2008-04-01 07:37 . 2007-06-28 10:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2008-04-01 07:37 . 2007-01-12 10:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2008-04-01 07:37 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2008-04-01 07:37 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-04-01 07:37 . 2006-06-18 23:51 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-04-01 07:36 . 2006-11-07 14:58 356,352 --a------ C:\WINDOWS\system32\nvunrm.exe
2008-04-01 07:36 . 2006-10-05 16:35 356,352 --------- C:\WINDOWS\system32\nvuide.exe
2008-04-01 07:36 . 2006-10-19 09:36 3,903 --a------ C:\WINDOWS\system32\nvnrm.nvu
2008-04-01 07:36 . 2006-10-24 13:13 1,732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin
2008-04-01 07:36 . 2006-09-11 15:14 1,570 --------- C:\WINDOWS\system32\nvide.nvu
2008-04-01 07:35 . 2008-04-01 07:35 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\InstallShield
2008-04-01 07:33 . 2008-04-01 07:33 <DIR> d-------- C:\WINDOWS\nview
2008-04-01 07:33 . 2007-09-16 19:07 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-01 07:33 . 2008-04-01 07:34 138,893 --a------ C:\WINDOWS\system32\nvapps.xml
2008-04-01 07:33 . 2007-09-16 19:07 17,525 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-03-31 22:08 . 2008-03-31 22:08 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-03-31 22:08 . 2008-03-31 22:08 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-03-31 22:08 . 2008-03-31 22:08 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-03-31 22:06 . 2008-03-31 22:06 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2008-03-31 22:06 . 2008-03-31 22:06 <DIR> d-------- C:\Program Files\DIFX
2008-03-31 22:06 . 2008-03-31 22:06 315,392 --a------ C:\WINDOWS\HideWin.exe
2008-03-31 22:06 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-03-31 21:44 . 2008-04-15 16:23 15,600 --a------ C:\WINDOWS\gdrv.sys
2008-03-31 21:44 . 2008-03-31 21:44 1,024 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT.LOG
2008-03-31 19:15 . 2008-03-31 19:15 <DIR> d--hs---- C:\Recycled
2008-03-31 19:13 . 2008-03-31 19:13 <DIR> d-------- C:\Documents and Settings\Maaciek\Gadu-Gadu
2008-03-31 19:13 . 2008-03-31 19:13 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Gadu-Gadu
2008-03-31 19:09 . 2008-04-19 12:08 558 --a------ C:\WINDOWS\DFC.INI
2008-03-31 19:07 . 2008-03-31 19:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-03-31 19:07 . 2007-09-16 19:07 6,853,088 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-03-31 19:07 . 2007-09-16 19:07 6,853,088 --a------ C:\WINDOWS\system32\dllcache\nv4_mini.sys
2008-03-31 19:07 . 2007-09-16 19:07 5,783,040 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-03-31 19:07 . 2007-09-16 19:07 5,783,040 --a------ C:\WINDOWS\system32\dllcache\nv4_disp.dll
2008-03-31 19:06 . 2008-03-31 19:06 <DIR> d-------- C:\Program Files\VDOTool
2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d--h----- C:\Documents and Settings\Maaciek\Ustawienia lokalne
2008-03-31 19:02 . 2008-03-31 19:02 <DIR> dr------- C:\Documents and Settings\Maaciek\Ulubione
2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d--h----- C:\Documents and Settings\Maaciek\Szablony
2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d-------- C:\Documents and Settings\Maaciek\Pulpit
2008-03-31 19:02 . 2008-03-31 19:02 <DIR> dr------- C:\Documents and Settings\Maaciek\Moje dokumenty
2008-03-31 19:02 . 2008-03-31 18:40 <DIR> dr------- C:\Documents and Settings\Maaciek\Menu Start
2008-03-31 19:02 . 2008-03-31 18:40 <DIR> dr-h----- C:\Documents and Settings\Maaciek\Dane aplikacji
2008-03-31 19:02 . 2008-03-31 19:02 <DIR> d-------- C:\Documents and Settings\Maaciek
2008-03-31 19:02 . 2008-04-19 12:08 466,944 --ah----- C:\Documents and Settings\Maaciek\ntuser.dat.LOG
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--h----- C:\Documents and Settings\NetworkService\Ustawienia lokalne
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--hs---- C:\Documents and Settings\NetworkService
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--h----- C:\Documents and Settings\LocalService\Ustawienia lokalne
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji
2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--hs---- C:\Documents and Settings\LocalService
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-31 16:57 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-31 16:55 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136]
"Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 17:55 451872]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-01 13:25 2165272]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 19:07 8491008]
"nwiz"="nwiz.exe" [2007-09-16 19:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 19:07 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"WinFast Schedule"="D:\TV\WFWIZ.exe" [2005-03-02 13:21 278528]
"WinampAgent"="D:\Winamp\winampa.exe" [2008-03-27 08:35 36352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\System32\\PnkBstrA.exe"=
"C:\\WINDOWS\\System32\\PnkBstrB.exe"=
"D:\\Maciek\\cs\\hl.exe"=
"D:\\Maciek\\COD 4\\iw3mp.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-10-18 11:25]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-10-18 11:25]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-10-18 11:25]
R3 WFIOCTL;WFIOCTL;D:\TV\WFIOCTL.SYS [2005-01-06 16:55]
S3 ddsxeiservice;ddsxeiservice2;D:\Maciek\cs\sXe Injected\ddsxei.sys [2008-04-04 12:03]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-04-15 16:23]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-19 12:09:20
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-19 12:09:32
ComboFix-quarantined-files.txt 2008-04-19 10:09:32
Pre-Run: 18,480,644,096 bajtów wolnych
Post-Run: 18,543,591,424 bajtów wolnych
197
UA:
File::
C:\WINDOWS\system32\MFC71.dll
C:\WINDOWS\SBA8959D4.tmp
Folder::
C:\FOUND.005
C:\FOUND.004
C:\FOUND.003
C:\FOUND.002
C:\FOUND.001
C:\FOUND.000
C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
Zarejestrowani użytkownicy: Bing [Bot]