ComboFix 08-03-03.15 - Jarek 2008-03-03 20:11:27.2 - NTFSx86
Running from: C:\Documents and Settings\Jarek\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 )))))))))))))))))))))))))))))))
.
2008-03-02 19:12 . 2008-03-02 19:11 106,994 -r-hs---- C:\x6.bat
2008-02-27 17:59 . 2008-02-27 15:06 108,099 -r-hs---- C:\fppg1.exe
2008-02-26 13:28 . 2008-02-27 09:30 107,489 -r-hs---- C:\u2.cmd
2008-02-22 13:22 . 2008-02-25 01:47 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-02-21 16:30 . 2008-02-25 17:22 107,959 -r-hs---- C:\oufddh.exe
2008-02-20 20:06 . 2008-02-20 20:06 <DIR> d-------- C:\Documents and Settings\Jarek\Dane aplikacji\gtk-2.0
2008-02-20 19:57 . 2008-02-20 19:57 <DIR> d-------- C:\Documents and Settings\Jarek\.thumbnails
2008-02-20 19:56 . 2008-02-25 23:05 <DIR> d-------- C:\Documents and Settings\Jarek\.gimp-2.4
2008-02-20 19:55 . 2008-02-20 19:55 <DIR> d-------- C:\Program Files\GIMP-2.0
2008-02-20 17:14 . 2008-02-21 17:14 <DIR> d-------- C:\Program Files\Mistrz Klawiatury II
2008-02-19 00:35 . 2008-02-19 08:56 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-19 00:35 . 2008-02-19 00:35 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-18 08:04 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-18 08:04 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-18 08:04 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-18 08:04 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-18 08:04 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-18 08:04 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-18 08:04 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-18 08:04 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-18 08:03 . 2008-02-18 08:03 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-13 20:24 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-13 20:24 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-13 20:21 . 2008-02-13 20:21 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-02-13 20:19 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-02-13 20:19 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-02-13 20:19 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-02-13 20:19 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-02-13 20:19 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-02-13 20:19 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-02-13 20:18 . 2008-02-13 20:19 <DIR> d-------- C:\Program Files\HP
2008-02-13 20:18 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-13 20:18 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-13 20:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-13 20:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-13 20:16 . 2008-02-13 20:23 102,787 --a------ C:\WINDOWS\hpoins05.dat
2008-02-13 20:16 . 2005-06-22 06:50 17,505 --------- C:\WINDOWS\hpomdl07.dat
2008-02-13 20:15 . 2008-02-13 20:16 <DIR> d-------- C:\temp\HP_WebRelease
2008-02-13 20:15 . 2008-02-13 20:15 <DIR> d-------- C:\temp
2008-02-13 00:13 . 2008-02-13 14:27 102,211 -r-hs---- C:\x.com
2008-02-08 16:22 . 2008-02-08 16:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-08 16:22 . 2008-02-08 16:22 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 15:53 --------- d-----w C:\Documents and Settings\Jarek\Dane aplikacji\Tlen.pl
2008-02-29 18:47 --------- d-----w C:\Program Files\Warcraft III
2008-02-18 07:04 --------- d-----w C:\Program Files\Symantec
2008-02-18 07:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-18 07:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-16 14:25 --------- d-----w C:\Program Files\Java
2008-01-16 14:24 --------- d-----w C:\Program Files\Common Files\Java
2008-01-14 11:09 --------- d-----w C:\Documents and Settings\Jarek\Dane aplikacji\Winamp
2008-01-13 17:51 --------- d-----w C:\Program Files\CDex_150
2008-01-10 19:43 --------- d-----w C:\Documents and Settings\Jarek\Dane aplikacji\Skype
2008-01-10 19:02 --------- d-----w C:\Documents and Settings\Jarek\Dane aplikacji\skypePM
2008-01-09 22:35 --------- d-----w C:\Program Files\ASUS
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-12-23 21:58 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-09 17:40 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-07 14:38 3,080,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2007-12-07 11:16 6254592]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-02-22 21:40 106496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-21 08:51 7335936]
"nwiz"="nwiz.exe" [2005-11-21 08:51 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-06 05:39 14850560 C:\WINDOWS\RTHDCPL.EXE]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-20 23:26 761945]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 17:09 987136]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-04-14 11:51 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 11:52 602182]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2006-04-14 11:56 569413]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 17:13 86016]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 15:20 180224]
"ABLKSR"="C:\WINDOWS\ABLKSR\ABLKSR.exe" [2006-01-02 19:14 61440]
"Zshutdown"="c:\sysprep\patch\sysprep.cmd" [ ]
"SMSERIAL"="sm56hlpr.exe" [2005-05-26 16:12 544768 C:\WINDOWS\sm56hlpr.exe]
"RemoteControl"="C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe" [2005-01-12 03:01 32768]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-02-13 19:29 35328]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-12-18 15:19:11 962661]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Dc++\\StrongDC.exe"=
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 10:26]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 10:26]
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d02c9f-a67c-11dc-883c-001302dc6445}]
\Shell\AutoRun\command - G:\xo8wr9.exe
\Shell\explore\Command - G:\xo8wr9.exe
\Shell\open\Command - G:\xo8wr9.exe
*Newly Created Service* - DERTYHJUISHWKYOZDEWGE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 20:13:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-03 20:13:38
ComboFix-quarantined-files.txt 2008-03-03 19:13:34
ComboFix2.txt 2008-03-03 19:01:52
.
2008-02-13 16:02:56 --- E O F ---



