ComboFix 08-04-18.3 - Małgosia 2008-04-19 14:22:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.69 [GMT 2:00]
Running from: C:\Documents and Settings\Małgosia\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\MS32DLL.dll.vbs
C:\WINDOWS\MS32DLL.dll.vbs
D:\Autorun.inf
D:\MS32DLL.dll.vbs
H:\Autorun.inf
H:\MS32DLL.dll.vbs
I:\Autorun.inf
I:\MS32DLL.dll.vbs
J:\autorun.inf
J:\MS32DLL.dll.vbs
.
((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))
.
2008-04-14 20:30 . 2008-04-19 12:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-14 20:30 . 2008-04-14 20:30 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-14 20:29 . 2008-04-14 20:29 <DIR> d-------- C:\Program Files\iTunes
2008-04-14 20:29 . 2008-04-14 20:29 <DIR> d-------- C:\Program Files\iPod
2008-04-14 20:29 . 2008-04-14 20:34 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Apple Computer
2008-04-14 20:29 . 2008-04-14 20:34 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Apple Computer
2008-04-14 20:29 . 2008-04-14 20:34 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Apple Computer
2008-04-14 20:28 . 2008-04-14 20:28 <DIR> d-------- C:\Program Files\Bonjour
2008-04-14 20:27 . 2008-04-14 20:28 <DIR> d-------- C:\Program Files\QuickTime
2008-04-14 20:27 . 2008-04-14 20:27 <DIR> d-------- C:\Program Files\Apple Software Update
2008-04-14 20:27 . 2008-04-14 20:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-04-14 20:26 . 2008-04-14 20:26 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-14 20:26 . 2008-04-14 20:26 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-04-14 20:26 . 2008-04-14 20:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-04-05 13:23 . 2008-04-05 13:23 <DIR> d-------- C:\Program Files\VSO
2008-04-05 13:23 . 2008-04-16 21:50 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Vso
2008-04-05 13:23 . 2008-04-16 21:50 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Vso
2008-04-05 13:23 . 2008-04-16 21:50 <DIR> d-------- C:\Documents and Settings\Małgosia\Dane aplikacji\Vso
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-19 11:48 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\Skype
2008-04-19 11:48 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\Skype
2008-04-19 11:48 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\Skype
2008-04-19 10:38 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\skypePM
2008-04-19 10:38 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\skypePM
2008-04-19 10:38 --------- d-----w C:\Documents and Settings\Małgosia\Dane aplikacji\skypePM
2008-04-05 11:09 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 16:34 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-29 10:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
2007-11-19 17:02 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2004-08-04 13:00 98,304 --sha-r C:\WINDOWS\system32\mstmdm.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-22 13:17 68856]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41 33792]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-05-14 08:35 188416]
"NVRTCLK"="C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 11:44 24576]
"PathNvidiaTV"="C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [ ]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UpdateCheck"= {7E9AAFE5-9417-4051-80A2-E724B7A2F08F} - C:\WINDOWS\system32\mstmdm.dll [2004-08-04 15:00 98304]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1463:UDP"= 1463:UDP:Windows Media Format SDK (iexplore.exe)
"1462:UDP"= 1462:UDP:Windows Media Format SDK (iexplore.exe)
"1465:UDP"= 1465:UDP:Windows Media Format SDK (iexplore.exe)
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{011fee31-8b08-11dc-b445-0017ee820ebf}]
\Shell\AutoRun\command - J:\
\Shell\open\Command - rundll32.exe .\desktop.dll,InstallM
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74ebca43-a42d-11dc-9ff8-0017ee820ebf}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74ebca44-a42d-11dc-9ff8-0017ee820ebf}]
\Shell\AutoRun\command - K:\
\Shell\open\Command - rundll32.exe .\desktop.dll,InstallM
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab42c6a0-8e47-11dc-b450-0017ee820ebf}]
\Shell\AutoRun\command - J:\
\Shell\open\Command - rundll32.exe .\desktop.dll,InstallM
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f47e4291-a4db-11dc-9ffa-0017ee820ebf}]
\Shell\AutoRun\command - K:\USBNB.exe
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-14 18:27:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-04-19 14:27:33
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
PathNvidiaTV = C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~???? ??? ??? & ! ??0 `?9 Z?d?}?y???? ? ? ? " ? ? ??"!a?: [?e?~?z???????A?
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-19 14:31:14
ComboFix-quarantined-files.txt 2008-04-19 12:31:03
Pre-Run: 1,852,137,472 bajtów wolnych
Post-Run: 2,120,134,656 bajtów wolnych
138 --- E O F --- 2008-04-09 09:06:54