log z combofix
ComboFix 08-06-19.1 - ZbiG 2008-06-19 22:57:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1656 [GMT 2:00]
Running from: C:\Documents and Settings\ZbiG\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\Downloaded Program Files\setup.inf
.
((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.
2008-06-19 18:19 . 2008-06-19 18:33 <DIR> d-------- C:\Program Files\SkanerOnline
2008-06-19 17:43 . 2008-06-19 17:44 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-06-19 17:43 . 2008-06-19 17:43 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-11 07:59 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 07:59 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 08:05 . 2008-06-10 08:06 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-06-10 08:05 . 2008-04-28 15:08 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-06-10 08:05 . 2008-04-28 13:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-06-10 08:05 . 2008-04-28 15:08 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-06-10 08:05 . 2008-04-28 15:08 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-06-10 08:05 . 2008-04-28 15:08 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-06-10 08:05 . 2008-04-28 15:08 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-06-10 08:05 . 2008-06-10 08:05 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-04 16:56 . 2008-06-15 14:45 <DIR> d-------- C:\Documents and Settings\ZbiG\Dane aplikacji\skypePM
2008-06-04 16:56 . 2008-06-04 16:56 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-04 16:54 . 2008-06-17 18:44 <DIR> d-------- C:\Documents and Settings\ZbiG\Dane aplikacji\Skype
2008-06-04 16:53 . 2008-06-04 16:53 <DIR> d-------- C:\Program Files\Skype
2008-06-04 16:53 . 2008-06-04 16:53 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-04 16:53 . 2008-06-04 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-04 09:45 . 2008-06-04 09:45 <DIR> d-------- C:\Documents and Settings\ZbiG\imapa
2008-05-25 12:39 . 2008-02-07 17:10 <DIR> d--h----- C:\ckis
2008-05-25 12:32 . 2008-05-29 11:23 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-25 12:32 . 2008-05-29 20:28 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-25 12:31 . 2008-05-25 12:31 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-05-25 12:31 . 2008-06-19 23:15 13,556,512 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-25 12:31 . 2008-06-19 23:14 291,616 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-25 12:31 . 2008-06-19 23:12 187,808 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-25 12:31 . 2008-06-19 23:12 31,496 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-21 11:14 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-19 20:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-19 16:55 --------- d-----w C:\Program Files\Everest Ultimate Edition 2006 3.01.708
2008-06-18 20:36 --------- d-----w C:\Program Files\StrongDC++
2008-06-18 07:00 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\uTorrent
2008-06-10 06:15 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-05 10:41 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\U3
2008-06-03 18:48 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-29 09:23 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-05-25 10:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-18 17:06 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\Autodesk
2008-05-16 13:32 --------- d-----w C:\Program Files\Delphi7SE
2008-05-13 20:54 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\Ansys
2008-05-13 20:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-05-13 20:25 --------- d-----w C:\Program Files\Autodesk
2008-05-13 20:24 --------- d-----w C:\Program Files\Common Files\Autodesk
2008-05-13 20:21 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-05-13 20:21 --------- d-----w C:\Program Files\AnswerWorks 4.0
2008-05-13 20:06 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-05-13 20:05 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-13 20:04 --------- d-----w C:\Program Files\Microsoft WSE
2008-05-13 16:48 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\IrfanView
2008-05-10 17:46 --------- d-----w C:\Program Files\Winamp
2008-05-09 22:02 --------- d-----w C:\Program Files\Java
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-06 17:25 --------- d-----w C:\Program Files\Axis Communications
2008-05-04 22:11 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-04 22:00 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\AdobeUM
2008-05-04 16:10 --------- d-----w C:\Program Files\Common Files\NSV
2008-04-29 18:38 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\Winamp
2008-04-28 21:19 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\Ahead
2008-04-28 21:16 --------- d-----w C:\Program Files\Common Files\Ahead
2008-04-28 21:14 --------- d-----w C:\Program Files\Nero
2008-04-28 20:59 --------- d-----w C:\Program Files\SubEdit-Player
2008-04-28 20:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-04-28 20:47 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-04-28 20:42 --------- d-----w C:\Program Files\uTorrent
2008-04-28 20:34 --------- d-----w C:\Program Files\DAP
2008-04-28 20:16 155,995 ----a-w C:\WINDOWS\java\Packages\UIV3PJJ5.ZIP
2008-04-28 20:13 --------- d-----w C:\Program Files\Common Files\Java
2008-04-28 20:11 --------- d-----w C:\Program Files\INTERIAPL
2008-04-28 20:04 --------- d-----w C:\Program Files\Opera
2008-04-28 19:24 --------- d-----w C:\Program Files\Google
2008-04-28 18:52 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-04-28 15:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-04-28 15:27 --------- d-----w C:\Program Files\IrfanView
2008-04-28 14:57 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-28 13:06 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-04-28 12:25 --------- d-----w C:\Documents and Settings\ZbiG\Dane aplikacji\Gadu-Gadu
2008-04-28 12:12 --------- d-----w C:\Program Files\Synaptics
2008-04-28 12:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 12:03 --------- d-----w C:\Program Files\NetWaiting
2008-04-28 12:03 --------- d-----w C:\Program Files\CONEXANT
2008-04-28 12:03 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-28 11:58 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-28 11:45 --------- d-----w C:\Program Files\WIDCOMM
2008-04-28 11:41 --------- d-----w C:\Program Files\Intel
2008-04-28 11:21 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-28 11:19 --------- d-----w C:\Program Files\Usługi online
2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-14 20:51 7,680 ----a-w C:\WINDOWS\system32\spdwnwxp.exe
2008-04-10 15:07 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
.
- Kod: Zaznacz wszystko
<pre>
----a-w 325,204 2006-12-21 18:56:28 C:\swsetup\SP34746\WCAMC\FW_210_Silence Install .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-28 09:47 7573504]
"nwiz"="nwiz.exe" [2006-04-28 09:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 14:36 827392]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-28 09:47 86016]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-12 13:33:22 581693]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk
backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-10-09 11:28 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DHzpColorBoost]
C:\Windows\System32\DHzpColor.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-26 22:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2007-01-12 14:36 827392 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\StrongDC++\\StrongDC.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT []
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;C:\WINDOWS\system32\Drivers\R5U870FLx86.sys [2006-10-18 01:09]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;C:\WINDOWS\system32\Drivers\R5U870FUx86.sys [2006-10-18 01:09]
S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{acf2db43-1b55-11dd-8e87-001636fd3c1d}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 23:13:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-06-19 23:18:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-19 21:18:09
Pre-Run: 6,761,672,704 bajtów wolnych
Post-Run: 7,818,014,720 bajt˘w wolnych
202 --- E O F --- 2008-06-19 20:38:14
Narzędzia Adm.
