Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.260 [GMT 1:00]
Running from: C:\Documents and Settings\Pablo\Pulpit\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 )))))))))))))))))))))))))))))))
.
2008-01-03 22:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-12-29 16:53 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-29 16:53 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-29 16:53 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-29 16:53 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-29 16:53 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-29 16:53 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-29 16:53 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-29 16:53 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-26 21:51 . 2007-12-26 21:51 <DIR> d-------- C:\WINDOWS\Sun
2007-12-25 12:44 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-25 12:44 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll
2007-12-25 12:44 . 2007-03-10 12:51 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-12-25 12:44 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-12-25 12:44 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2007-12-25 12:44 . 2007-12-07 18:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-25 12:44 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-12-25 11:07 . 2007-12-25 11:07 <DIR> d-------- C:\Program Files\Media Key
2007-12-25 11:02 . 2006-09-13 18:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-12-25 11:02 . 2006-09-13 18:19 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-12-25 11:02 . 2006-09-13 18:18 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-24 17:56 . 2007-12-25 12:40 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-24 17:53 . 2007-12-30 18:43 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\WinAmp
2007-12-24 16:15 . 2007-12-24 16:40 <DIR> d-------- C:\TEMP
2007-12-24 16:14 . 2007-12-24 16:14 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-16 19:27 . 2007-12-16 19:27 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\Gadu-Gadu
2007-12-15 20:43 . 2007-12-24 16:05 <DIR> d-------- C:\Program Files\BearShare
2007-12-15 20:40 . 2007-12-15 20:40 <DIR> d-------- C:\Program Files\BearShare Applications
2007-12-15 20:40 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2007-12-15 20:38 . 2007-12-15 20:53 <DIR> d-------- C:\Program Files\BitLord
2007-12-15 19:55 . 2007-12-15 19:55 1,158 --a------ C:\WINDOWS\mozver.dat
2007-12-15 19:53 . 2007-12-15 19:53 0 --a------ C:\WINDOWS\nsreg.dat
2007-12-15 19:51 . 2007-12-15 20:58 <DIR> d-------- C:\Program Files\Google
2007-12-15 19:41 . 2007-12-15 19:41 <DIR> d---s---- C:\Documents and Settings\Pablo\UserData
2007-12-14 10:06 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-25 10:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-27 21:38 --------- d-----w C:\Program Files\WexTech
2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Wextech Shared
2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\LHSPF
2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-11-27 21:36 --------- d-----w C:\Program Files\Volo View Express
2007-07-14 10:44 1,049,719 ----a-w C:\Program Files\wrar361pl.exe
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-09-13 18:20 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208]
"wsctf.exe"="wsctf.exe" []
"EXPLORER.EXE"="EXPLORER.EXE" [2004-08-04 01:44 1033728 C:\WINDOWS\explorer.exe]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-17 17:42 68856]
"ares"="D:\PROGRAMY\Ares\Ares.exe" [ ]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRTCLK"="C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe" [2003-12-30 10:44 24576]
"PathNvidiaTV"="C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [ ]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-01-10 08:32 5513216]
"nwiz"="nwiz.exe" [2005-01-10 08:32 1490944 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe" [2003-09-16 19:01 32881]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 C:\WINDOWS\soundman.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-01-10 08:32 86016]
"Anti-Blaxx Manager"="D:\PROGRAMY\Anti-Blaxx\Anti-Blaxx.exe" [2005-05-18 15:08 208896]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" [ ]
"WinampAgent"="D:\PROGRAMY\WinAmp\winampa.exe" [2007-12-20 16:16 37376]
"MagicKey"="C:\PROGRA~1\MEDIAK~1\MagicKey.exe" [2004-03-15 13:27 45056]
"Ashampoo FireWall"="D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57 3251800]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlpo_01"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe]
"nlpo_02"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll]
"nlpo_03"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe]
"nlpo_04"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe]
"nlpo_05"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll]
"nlpo_06"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:33 44544]
R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 18:19]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47fbc164-80bf-11dc-a063-0011d8861c33}]
\Shell\AutoRun\command - H:\EXPLORER.EXE
\Shell\explore\Command - H:\EXPLORER.EXE
\Shell\open\Command - H:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6b4c67b-685e-11dc-a033-0011d8861c33}]
\Shell\AutoRun\command - I:\EXPLORER.EXE
\Shell\explore\Command - I:\EXPLORER.EXE
\Shell\open\Command - I:\EXPLORER.EXE
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-03 22:43:59
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\spi.dll
.
Completion time: 2008-01-03 22:44:21
