Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.227 [GMT 1:00]
Running from: C:\Documents and Settings\pusia\Pulpit\do nagrania na płytę 2\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 )))))))))))))))))))))))))))))))
.
2008-03-06 18:09 . 2008-03-06 18:09 <DIR> d-------- C:\Documents and Settings\pusia\DoctorWeb
2008-03-06 17:45 . 2008-03-06 17:50 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-06 17:45 . 2008-03-06 17:45 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\PC Tools
2008-03-06 17:45 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-06 17:45 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-06 17:45 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-06 17:45 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-06 16:11 . 2008-03-06 21:49 <DIR> d-------- C:\Program Files\MacroVirus
2008-03-06 16:11 . 2008-03-06 21:49 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\MacroVirus
2008-02-29 11:10 . 2008-03-06 21:07 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\OpenOfficeT72
2008-02-29 11:10 . 2008-02-29 11:10 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\MfcEmbed
2008-02-29 11:04 . 2008-02-29 11:04 <DIR> d-------- C:\Program Files\OpenOfficeT7 2.3.1
2008-02-25 17:07 . 2008-02-25 17:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-02-25 17:04 . 2008-02-25 17:07 <DIR> d-------- C:\Program Files\Winamp Remote
2008-02-25 16:59 . 2008-02-25 17:07 <DIR> d-------- C:\Program Files\Winamp
2008-02-25 16:59 . 2008-02-25 17:10 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\Winamp
2008-02-24 22:59 . 2008-02-24 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-02-22 19:01 . 2008-02-22 19:04 <DIR> d-------- C:\Program Files\DivX
2008-02-22 15:12 . 2008-02-22 15:12 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-21 03:05 . 2008-02-21 03:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-02-21 03:05 . 2008-02-21 03:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-02-15 23:41 . 2008-02-15 23:41 <DIR> d-------- C:\Program Files\Ganymede
2008-02-13 12:29 . 2008-02-20 16:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-02-13 11:42 . 2008-02-13 11:42 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-02-13 11:42 . 2008-02-13 11:42 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-02-13 11:42 . 2008-02-13 11:42 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-02-13 09:31 . 2008-02-13 09:31 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-02-13 09:30 . 2008-02-13 09:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-02-12 17:30 . 2008-03-06 21:39 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\Spamihilator
2008-02-12 17:29 . 2008-02-13 17:32 <DIR> d-------- C:\Program Files\Spamihilator
2008-02-10 15:02 . 2008-02-10 15:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\sentinel
2008-02-10 14:59 . 2008-02-13 09:27 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-02-08 19:39 . 2008-02-13 12:30 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-06 21:33 . 2008-02-06 21:33 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\Qualcomm
2008-02-06 21:32 . 2008-02-06 21:32 <DIR> d-------- C:\Program Files\Qualcomm
2008-02-06 21:32 . 2006-08-17 14:57 1,712,128 -ra------ C:\WINDOWS\system32\gdiplus.dll
2008-02-06 21:32 . 2006-08-17 14:57 317,952 -ra------ C:\WINDOWS\system32\Roboex32.dll
2008-02-06 21:32 . 2006-08-17 14:57 48,640 -ra------ C:\WINDOWS\system32\INETWH32.DLL
2008-02-06 21:19 . 2008-02-06 21:20 <DIR> d-------- C:\Documents and Settings\pusia\Dane aplikacji\The Bat!
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 20:48 --------- d-----w C:\Program Files\a-squared Free
2008-03-06 20:39 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-03-06 20:32 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-03-06 15:53 --------- d-----w C:\Program Files\Broadcom
2008-02-20 19:50 --------- d-----w C:\Program Files\Gadu-Gadu
2008-02-20 15:45 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-02-15 22:46 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\GanymedeNet
2008-02-15 10:51 --------- d-----w C:\Program Files\Eset
2008-02-13 11:30 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\Lavasoft
2008-02-13 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-12 19:10 --------- d-----w C:\Program Files\Ashampoo
2008-02-10 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-08 21:09 --------- d-----w C:\Program Files\Cosmopolitan
2008-02-08 21:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-05 14:05 --------- d-----w C:\Program Files\BitSpirit
2008-02-05 13:01 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\BitSpirit
2008-02-01 18:45 --------- d-----w C:\Program Files\WIDCOMM
2008-01-28 18:57 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\Ahead
2008-01-24 15:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-01-24 15:22 --------- d-----w C:\Program Files\THQ
2008-01-23 14:18 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\Skype
2008-01-23 14:12 --------- d-----w C:\Documents and Settings\pusia\Dane aplikacji\skypePM
2008-01-17 11:00 --------- d-----w C:\Program Files\MyPortal
2008-01-17 11:00 --------- d-----w C:\Program Files\DiskInternals
2008-01-06 11:11 679,936 ----a-w C:\WINDOWS\system32\spsplib1.dll
2007-12-28 19:31 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-15 17:05 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-27 17:28 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06 167368]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 22:18 443968]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 07:49 16126464 C:\WINDOWS\RTHDCPL.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 04:00 815104]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-04-02 14:49 813840]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-04-21 04:57 142104]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-04-21 04:57 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-04-21 04:57 138008]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 23:54 37376]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Spamihilator"="C:\Program Files\Spamihilator\spamihilator.exe" [2008-01-06 12:20 1003520]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-13 11:42 949376]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
C:\Documents and Settings\pusia\Menu Start\Programy\Autostart\
OpenOfficeT7 2.3.1.lnk - C:\Program Files\OpenOfficeT7 2.3.1\program\quickstart.exe [2007-12-08 01:06:24 393216]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"D:\\bit comet\\BitComet.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"=
"C:\\Documents and Settings\\pusia\\Ustawienia lokalne\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Spamihilator\\dccproc.exe"=
"C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\Polish\\setup.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7039:TCP"= 7039:TCP:BitComet 7039 TCP
"7039:UDP"= 7039:UDP:BitComet 7039 UDP
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;"C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service []
R2 XAudio;XAudio;C:\WINDOWS\system32\DRIVERS\xaudio.sys [2006-11-28 09:44]
S3 autorun;autorun;C:\huadio.tmp []
S3 igfx;igfx;C:\WINDOWS\system32\DRIVERS\igdkmd32.sys [2007-03-06 05:24]
*Newly Created Service* - A2FREE
.
Contents of the 'Scheduled Tasks' folder
"2008-03-06 20:08:47 C:\WINDOWS\Tasks\MacroVirus Scheduled Scan.job"
- C:\Program Files\MacroVirus\MacroVirus.ex
- C:\Program Files\MacroVirus
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 21:55:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\DOCUME~1\pusia\USTAWI~1\Temp\ASFWHide"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-03-06 21:56:10
ComboFix-quarantined-files.txt 2008-03-06 20:56:06
