logi
Sdfix
SDFix: Version 1.201
Run by Administrator on 08-07-05 at 19:54
Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 19:56:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="avgrsstx.dll"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\sdfh\\l2asrv.exe"="C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\sdfh\\l2asrv.exe:*:Enabled:l2asrv"
"C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\l2walker1[1].79\\sdfh\\l2asrv.exe"="C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\l2walker1[1].79\\sdfh\\l2asrv.exe:*:Enabled:l2asrv"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
Files with Hidden Attributes :
Fri 4 Jul 2008 9,249,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c583e569e1f1773d32894dc0975498a1\BIT7F.tmp"
Finished!
combo fix
ComboFix 08-07-04.6 - Kamil 2008-07-05 19:46:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.602 [GMT 2:00]
Running from: C:\Documents and Settings\Kamil\Moje dokumenty\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.
2008-07-05 19:30 . 2008-07-05 02:05 <DIR> d-------- C:\SDFix
2008-07-05 18:09 . 2005-07-29 11:44 340,992 --a------ C:\WINDOWS\system32\drivers\rt61.sys
2008-07-05 18:09 . 2005-05-17 16:24 311,296 --a------ C:\WINDOWS\system32\AegisI5.exe
2008-07-05 18:09 . 2005-06-17 19:19 242,048 --a------ C:\WINDOWS\system32\drivers\RT2500.sys
2008-07-05 18:09 . 2005-08-25 11:15 81,920 --a------ C:\WINDOWS\system32\Install6x.dll
2008-07-05 18:09 . 2008-07-05 18:09 20,747 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2008-07-05 18:09 . 2005-07-29 11:43 8,192 --a------ C:\WINDOWS\system32\drivers\RT2661.bin
2008-07-05 18:09 . 2005-07-29 11:43 8,192 --a------ C:\WINDOWS\system32\drivers\RT2561s.bin
2008-07-05 18:09 . 2005-07-29 11:43 8,192 --a------ C:\WINDOWS\system32\drivers\RT2561.bin
2008-07-05 18:09 . 2005-06-16 00:30 162 --a------ C:\WINDOWS\filespec6x
2008-07-04 00:24 . 2008-07-04 00:24 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2008-07-04 00:19 . 2006-08-21 11:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-07-04 00:19 . 2006-08-21 11:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-07-04 00:19 . 2006-08-21 14:28 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-07-04 00:16 . 2008-07-04 00:16 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-03 18:09 . 2008-04-23 09:20 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-07-03 18:09 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-07-03 18:09 . 2007-03-08 07:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-07-03 18:09 . 2008-04-23 09:20 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-07-03 18:09 . 2008-04-23 09:20 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-07-03 18:09 . 2008-04-23 09:20 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-07-03 18:09 . 2008-04-23 09:20 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-07-03 18:09 . 2008-04-23 09:20 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-07-03 18:09 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-07-03 15:43 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-03 15:25 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-07-02 19:57 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-02 19:57 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-02 19:57 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-01 22:13 . 2008-07-01 22:13 <DIR> d-------- C:\Program Files\DIFX
2008-07-01 22:13 . 2006-07-01 23:32 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-07-01 22:08 . 2007-06-29 14:47 34,304 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-07-01 21:39 . 2008-07-01 21:39 <DIR> d-------- C:\Documents and Settings\Kamil\Contacts
2008-07-01 21:37 . 2008-07-01 22:13 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-07-01 19:12 . 2008-07-01 19:12 <DIR> d-------- C:\WINDOWS\NV30963104.TMP
2008-07-01 19:10 . 2008-07-01 19:10 <DIR> d-------- C:\Program Files\GIGABYTE
2008-07-01 19:10 . 2006-04-20 17:27 61,440 --a------ C:\WINDOWS\system32\ycc.dll
2008-07-01 18:24 . 2008-07-01 22:12 <DIR> d-------- C:\Program Files\AMD
2008-07-01 18:23 . 2008-07-01 18:23 <DIR> d-------- C:\WINDOWS\NV16683264.TMP
2008-07-01 09:51 . 2008-07-01 09:51 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-01 09:51 . 2008-07-01 09:51 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\AdobeUM
2008-07-01 09:46 . 2008-07-01 09:46 <DIR> d-------- C:\WINDOWS\Cache
2008-06-30 12:59 . 2008-06-30 12:59 <DIR> d-------- C:\Program Files\Real Alternative
2008-06-30 11:46 . 2008-06-30 11:46 319 --a------ C:\WINDOWS\game.ini
2008-06-30 11:31 . 2008-06-30 11:31 <DIR> d-------- C:\Program Files\Activision
2008-06-30 10:29 . 2008-07-01 21:36 <DIR> d-------- C:\Program Files\Windows Live
2008-06-30 10:29 . 2008-07-01 21:36 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-30 10:29 . 2008-07-01 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller
2008-06-30 10:25 . 2006-02-04 04:50 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-06-30 10:25 . 2006-02-04 04:50 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-06-30 10:19 . 2008-07-01 17:52 <DIR> d-------- C:\Program Files\Lineage II
2008-06-30 10:19 . 2008-06-30 10:19 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\InstallShield
2008-06-29 23:24 . 2000-05-22 22:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx
2008-06-29 23:23 . 2008-06-29 23:24 <DIR> d-------- C:\Program Files\Total Video Converter
2008-06-29 23:18 . 2008-07-04 00:24 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-06-29 23:08 . 2008-06-29 23:08 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-29 23:00 . 2008-07-05 18:31 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-29 23:00 . 2008-06-29 23:00 <DIR> d-------- C:\Program Files\AVG
2008-06-29 23:00 . 2008-06-30 10:18 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\AVGTOOLBAR
2008-06-29 23:00 . 2008-06-29 23:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg8
2008-06-29 23:00 . 2008-07-05 10:51 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-29 23:00 . 2008-07-05 10:52 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-29 23:00 . 2008-07-05 10:51 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-29 22:58 . 2008-06-29 22:58 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2008-06-29 22:46 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-29 22:46 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002435_.tmp
2008-06-29 18:11 . 2008-06-29 18:11 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-06-28 21:01 . 2008-06-28 21:01 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Corel
2008-06-28 19:32 . 2008-07-02 15:24 1,073,299,456 --a------ C:\WINDOWS\MEMORY.DMP
2008-06-28 19:22 . 2008-06-28 19:22 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Gadu-Gadu
2008-06-28 18:51 . 2008-06-28 18:51 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-06-28 18:51 . 2008-06-28 18:51 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-06-28 18:48 . 2006-05-27 04:47 16,208,384 -r------- C:\WINDOWS\RTHDCPL.exe
2008-06-28 18:48 . 2006-05-04 10:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2008-06-28 18:48 . 2006-03-10 13:32 2,158,592 -r------- C:\WINDOWS\MicCal.exe
2008-06-28 18:48 . 2005-04-16 16:20 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2008-06-28 18:48 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.Cpl
2008-06-28 18:48 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-06-28 18:39 . 2008-06-28 18:39 <DIR> d-------- C:\Program Files\Microsoft Online Seminars
2008-06-28 18:36 . 2008-06-28 18:36 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
2008-06-28 18:36 . 2008-06-28 18:39 <DIR> d-------- C:\Program Files\MSECACHE
2008-06-28 18:10 . 2002-06-14 18:46 19,274 --a------ C:\WINDOWS\000001_.tmp
2008-06-28 17:55 . 2001-10-26 19:28 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-06-28 17:54 . 2001-10-26 17:29 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll
2008-06-28 17:53 . 2001-10-26 19:29 73,728 --a--c--- C:\WINDOWS\system32\dllcache\icwtutor.exe
2008-06-28 17:53 . 2004-08-04 00:39 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2008-06-28 17:53 . 2001-10-26 19:28 65,536 --a--c--- C:\WINDOWS\system32\dllcache\icwres.dll
2008-06-28 17:53 . 2001-10-26 19:29 40,960 --a--c--- C:\WINDOWS\system32\dllcache\trialoc.dll
2008-06-28 17:53 . 2008-06-28 17:53 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-06-28 17:53 . 2008-06-28 17:53 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-06-28 17:53 . 2008-06-28 17:53 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-06-28 17:53 . 2008-06-28 17:53 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-06-28 17:53 . 2008-06-28 17:53 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-06-28 17:53 . 2008-06-28 17:53 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-06-28 17:52 . 2004-08-04 00:44 141,824 --a------ C:\WINDOWS\system32\sessmgr.exe
2008-06-28 17:52 . 2005-06-10 06:11 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2008-06-28 17:49 . 2004-08-04 00:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-06-28 17:49 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-06-28 17:49 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-28 17:39 . 2004-08-03 23:01 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2008-06-28 17:39 . 2004-08-04 00:44 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> d--h----- C:\Documents and Settings\Administrator.TTTTT.000\Ustawienia lokalne
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT.000\Ulubione
2008-06-28 17:21 . 2008-06-28 13:43 <DIR> d--h----- C:\Documents and Settings\Administrator.TTTTT.000\Szablony
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT.000\Pulpit
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT.000\Moje dokumenty
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> dr------- C:\Documents and Settings\Administrator.TTTTT.000\Menu Start
2008-06-28 17:21 . 2008-06-28 14:37 <DIR> dr-h----- C:\Documents and Settings\Administrator.TTTTT.000\Dane aplikacji
2008-06-28 17:21 . 2008-06-28 17:21 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT.000
2008-06-28 17:06 . 2008-07-05 19:47 <DIR> d--h----- C:\Documents and Settings\Administrator.TTTTT\Ustawienia lokalne
2008-06-28 17:06 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT\Ulubione
2008-06-28 17:06 . 2008-06-28 13:43 <DIR> d--h----- C:\Documents and Settings\Administrator.TTTTT\Szablony
2008-06-28 17:06 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT\Pulpit
2008-06-28 17:06 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT\Moje dokumenty
2008-06-28 17:06 . 2008-06-28 14:37 <DIR> dr------- C:\Documents and Settings\Administrator.TTTTT\Menu Start
2008-06-28 17:06 . 2008-06-28 14:37 <DIR> dr-h----- C:\Documents and Settings\Administrator.TTTTT\Dane aplikacji
2008-06-28 17:06 . 2008-06-28 17:06 <DIR> d-------- C:\Documents and Settings\Administrator.TTTTT
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-06-28 17:03 . 2008-06-28 13:43 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-06-28 17:03 . 2008-06-28 14:37 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-06-28 17:03 . 2008-06-28 17:03 <DIR> d-------- C:\Documents and Settings\Administrator
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-28 14:55 155,995 ----a-w C:\WINDOWS\java\Packages\EX3HR3B9.ZIP
2008-06-28 13:57 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\Winamp
2008-06-28 13:14 --------- d-----w C:\Program Files\Winamp
2008-06-28 13:11 --------- d-----w C:\Program Files\Gadu-Gadu
2008-06-28 12:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-28 11:52 --------- d-----w C:\Program Files\VDOTool
2008-06-28 11:47 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-28 11:44 --------- d-----w C:\Program Files\Usługi online
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2006-08-30 17:13 2154496]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-08-31 09:23 7630848]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-08-31 09:23 86016]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-05 10:52 1232152]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824]
"nwiz"="nwiz.exe" [2006-08-31 09:23 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-27 04:47 16208384 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Photosmart Premier - Szybkie uruchomienie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2008-06-28 14:43:39 598016]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\sdfh\\l2asrv.exe"=
"C:\\Documents and Settings\\Kamil\\Pulpit\\Walker\\l2walker1[1].79\\sdfh\\l2asrv.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-05 10:51]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-05 10:51]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-05 10:51]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-05 10:52]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 19:47:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-05 19:48:26
ComboFix-quarantined-files.txt 2008-07-05 17:48:11
Pre-Run: 17,735,323,648 bajtów wolnych
Post-Run: 17,811,337,216 bajtów wolnych
211 --- E O F --- 2008-07-04 07:52:04
hijack this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:50:14, on 2008-07-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VDOTool\TBPanel.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BE845B1-A4F2-4979-902B-D92B50665FC3}: NameServer = 192.168.30.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BE845B1-A4F2-4979-902B-D92B50665FC3}: NameServer = 192.168.30.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BE845B1-A4F2-4979-902B-D92B50665FC3}: NameServer = 192.168.30.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
--
End of file - 5167 bytes
