Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.518 [GMT 2:00]
Running from: C:\Documents and Settings\artur\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.
2008-06-18 13:43 . 2008-06-18 20:50 <DIR> d-------- C:\Program Files\Football Generation
2008-06-18 13:38 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-06-18 13:34 . 2008-06-18 13:34 <DIR> d-------- C:\Program Files\phenomedia
2008-06-18 13:34 . 2008-06-18 13:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\phenomedia
2008-06-18 13:19 . 2008-06-18 13:19 <DIR> d-------- C:\Documents and Settings\Hubert\Dane aplikacji\InstallShield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-18 11:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-18 11:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-27 16:12 --------- d-----w C:\Program Files\livetvbar
2008-04-27 16:12 --------- d-----w C:\Program Files\Conduit
2008-03-14 08:07 588 ----a-w C:\Program Files\INSTALL.LOG
1999-06-25 09:55 149,504 ----a-w C:\Program Files\UNWISE.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ad55c869-668e-457c-b270-0cfb2f61116f}]
2008-03-13 11:30 1524248 --a------ C:\Program Files\livetvbar\tblive.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AD55C869-668E-457C-B270-0CFB2F61116F}"= "C:\Program Files\livetvbar\tblive.dll" [2008-03-13 11:30 1524248]
[HKEY_CLASSES_ROOT\clsid\{ad55c869-668e-457c-b270-0cfb2f61116f}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{AD55C869-668E-457C-B270-0CFB2F61116F}"= C:\Program Files\livetvbar\tblive.dll [2008-03-13 11:30 1524248]
[HKEY_CLASSES_ROOT\clsid\{ad55c869-668e-457c-b270-0cfb2f61116f}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29 13312]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2002-05-02 10:57 98304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 16:46 172032]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55 49152]
"Ashampoo FireWall"="C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 15:57 3251800]
"AtiPTA"="atiptaxx.exe" [2002-06-12 05:09 286720 C:\WINDOWS\system32\atiptaxx.exe]
"HydarVisionDesktopManager"="" []
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-14 12:34 655360]
"SoundMan"="SOUNDMAN.EXE" [2002-08-02 13:00 46592 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2008-03-02 17:32 36972]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 19:29 13312]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-29 14:56:17 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.uyvy"= C:\WINDOWS\System32\msyuv.DLL
"vidc.yuy2"= ATIVYUY.DLL
"VIDC.VCR2"= ATIVCR2.DLL
"VIDC.DRAW"= DVIDEO.DLL
"VIDC.VCR1"= ATIVCR1.DLL
"VIDC.YV12"= ATIYUV12.DLL
R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-16 01:20]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2004-07-14 01:05]
R3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);C:\WINDOWS\System32\DRIVERS\adusbmdm65.sys [2005-05-02 13:55]
R3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);C:\WINDOWS\System32\DRIVERS\adusbser65.sys [2005-05-02 13:55]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2004-07-14 01:05]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 08:26:28
Windows 5.1.2600 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\DOCUME~1\artur\USTAWI~1\Temp\ASFWHide"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
C:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll
.
Completion time: 2008-06-19 8:28:01
ComboFix-quarantined-files.txt 2008-06-19 06:27:44
Pre-Run: 30,104,444,928 bajtów wolnych
Post-Run: 30,263,992,320 bajtów wolnych
90
