Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.835 [GMT 2:00]
Running from: C:\Documents and Settings\mjaskula\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\Cfx32.lic
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\cpuinf32.dll
C:\WINDOWS\system32\DivXsm.exe
C:\WINDOWS\system32\iconv.dll
C:\WINDOWS\system32\mplvpx.dll
C:\WINDOWS\system32\ogg.dll
C:\WINDOWS\system32\OggDS.dll
C:\WINDOWS\system32\vorbis.dll
C:\WINDOWS\system32\vorbisenc.dll
C:\WINDOWS\system32\WMV9VCM.dll
.
((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.
2008-05-27 17:19 . 2008-05-27 17:19 <DIR> d-------- C:\Program Files\MSECache
2008-05-27 16:43 . 2008-05-27 16:43 <DIR> d-------- C:\Program Files\PCB123 V2
2008-05-26 17:21 . 2008-05-26 17:21 <DIR> d-------- C:\MATLAB7
2008-05-24 16:57 . 2008-05-24 16:57 <DIR> d-------- C:\Four Rooms
2008-05-21 19:43 . 2008-05-21 20:14 1,086 --a------ C:\WINDOWS\APDFPRP.INI
2008-05-21 15:03 . 2008-05-21 15:03 <DIR> d-------- C:\Program Files\ElcomSoft
2008-05-18 11:23 . 2008-05-18 11:32 2,593 --a------ C:\WINDOWS\SE.INI
2008-05-09 09:02 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-07 00:25 . 2008-05-07 00:25 333,727 --a------ C:\WINDOWS\tap_bas_czb.jpg
2008-05-07 00:24 . 2008-05-07 00:25 373,685 --a------ C:\WINDOWS\tap_bas_kol.jpg
2008-05-06 23:53 . 2008-05-06 23:53 <DIR> d-------- C:\Documents and Settings\mjaskula\Dane aplikacji\IrfanView
2008-05-06 18:36 . 2008-05-06 18:37 <DIR> d-------- C:\Documents and Settings\mjaskula\Dane aplikacji\MySQL
2008-05-06 18:19 . 2008-05-06 18:19 <DIR> d-------- C:\Program Files\MySQL
2008-04-29 20:54 . 2008-04-29 20:55 <DIR> d-------- C:\Documents and Settings\mjaskula\Dane aplikacji\SopCast
2008-04-29 18:59 . 2008-04-29 18:59 <DIR> d-------- C:\Program Files\SopCast
2008-04-28 22:09 . 2008-05-07 10:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-28 22:09 . 2008-04-28 22:09 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-28 12:07 . 2008-04-28 12:07 <DIR> d-------- C:\Program Files\Tlen.pl
2008-04-28 12:07 . 2008-04-28 12:07 <DIR> d-------- C:\Documents and Settings\mjaskula\Dane aplikacji\Tlen.pl
2008-04-28 07:37 . 2008-04-28 07:37 <DIR> d-------- C:\Program Files\MyPortal
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-09 07:02 155,995 ----a-w C:\WINDOWS\java\Packages\6V53JZPR.ZIP
2008-04-26 18:56 --------- d-----w C:\Program Files\Thomson
2008-04-25 13:55 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\AdobeUM
2008-04-25 07:59 --------- d-----w C:\Program Files\Gadu-Gadu
2008-04-24 12:43 --------- d-----w C:\Program Files\QuickTime Alternative
2008-04-24 12:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-04-24 12:42 --------- d-----w C:\Program Files\Real Alternative
2008-04-24 12:40 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-04-24 12:24 --------- d-----w C:\Program Files\Java
2008-04-24 12:22 --------- d-----w C:\Program Files\Common Files\Java
2008-04-24 10:56 --------- d-----w C:\Program Files\Common Files\Bcgsoft
2008-04-24 10:52 --------- d-----w C:\Program Files\National Instruments
2008-04-24 10:49 --------- d-----w C:\Program Files\Electronics Workbench
2008-04-24 10:40 --------- d-----w C:\Program Files\Winamp
2008-04-24 10:40 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\Winamp
2008-04-24 10:20 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-04-24 10:18 --------- d-----w C:\Program Files\Borland
2008-04-24 09:50 --------- d-----w C:\Program Files\IrfanView
2008-04-24 09:45 --------- d-----w C:\Program Files\MarBit
2008-04-24 09:35 --------- d-----w C:\Program Files\Skype
2008-04-24 09:35 --------- d-----w C:\Program Files\Common Files\Skype
2008-04-24 09:35 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\Skype
2008-04-24 09:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-04-24 09:19 --------- d-----w C:\Program Files\PDFCreator
2008-04-24 09:14 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\Gadu-Gadu
2008-04-24 09:11 --------- d-----w C:\Program Files\DAEMON Tools
2008-04-24 09:10 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-24 08:59 --------- d-----w C:\Program Files\Microsoft Works
2008-04-24 08:40 --------- d--h--w C:\Program Files\Zenographics
2008-04-24 08:40 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-24 08:31 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-04-24 08:31 270,336 ----a-w C:\WINDOWS\system32\imon.dll
2008-04-24 08:23 --------- d-----w C:\Program Files\Common Files\Ahead
2008-04-24 08:22 --------- d-----w C:\Program Files\ESET
2008-04-24 08:22 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\ESET
2008-04-24 08:05 --------- d-----w C:\Program Files\Norton Internet Security
2008-04-24 08:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-23 23:07 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-23 23:03 --------- d-----w C:\Program Files\Ahead
2008-04-23 23:01 --------- d-----w C:\Program Files\ASUSTeK
2008-04-23 22:17 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\Talkback
2008-04-23 21:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-23 21:26 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-04-23 21:26 503,808 ----a-w C:\WINDOWS\Asus_A_Series_ScreenSaver.scr
2008-04-23 21:26 5,516,371 ----a-w C:\WINDOWS\A-series Demo.exe
2008-04-23 21:26 266,240 ----a-w C:\WINDOWS\ASUS A Series ScreenSaver Uninstaller.exe
2008-04-23 21:26 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-04-23 21:24 --------- d-----w C:\Program Files\ATI Technologies
2008-04-23 21:19 --------- d-----w C:\Documents and Settings\mjaskula\Dane aplikacji\Symantec
2008-04-23 21:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-04-23 21:18 15,781 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys
2008-04-23 21:15 --------- d-----w C:\Program Files\Synaptics
2008-04-23 21:13 --------- d-----w C:\Program Files\Asus
2008-04-23 21:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-23 21:11 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-23 21:11 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-23 21:11 --------- d-----w C:\Program Files\Analog Devices
2008-04-23 21:05 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-23 21:03 --------- d-----w C:\Program Files\Usługi online
2008-04-23 20:57 --------- d-----w C:\Program Files\CONEXANT
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2005-10-12 14:04 131,072 ----a-w C:\Program Files\internet explorer\plugins\LV80ActiveXControl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"Net4Switch"="C:\Program Files\ASUS\Net4Switch\Net4Switch.exe" [ ]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2008-01-15 17:09 6290944]
"updateMgr"="c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2005-07-28 06:29 102400]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 10:11 1388544]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2005-06-16 15:48 86016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-05-11 06:03 708697]
"Control Center"="C:\Program Files\ASUS\WLAN Card Utilities\Center.exe" [2005-09-13 21:55 1668096]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-31 21:05 344064]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-24 10:31 921600]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 19:00 98304]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
ASUS ChkMail.lnk - C:\Program Files\Asus\Asus ChkMail\ChkMail.exe [2008-04-23 23:13:39 32768]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-24 14:13:59 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2005-06-10 10:01]
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 19:54]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-05-22 19:30]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 13:00]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 20:05:46
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-05-27 20:06:12
ComboFix-quarantined-files.txt 2008-05-27 18:06:10
Pre-Run: 38,032,113,664 bajtów wolnych
Post-Run: 38,493,487,104 bajtów wolnych
186 --- E O F --- 2008-05-17 07:04:00
