przez Meggi 23 Cze 2008, 12:03
przez Dzi@dek 23 Cze 2008, 12:27
przez Meggi 02 Lip 2008, 11:46
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:03, on 2008-07-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt64.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FVNPIUSKUOG - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\FVNPIUSKUOG.exe
O23 - Service: GJBTIKTSDJMAKECEN - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\GJBTIKTSDJMAKECEN.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WEBNO - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\WEBNO.exe
--
End of file - 5501 bytes
przez Magik 02 Lip 2008, 12:16
Meggi napisał(a):Niestety Combofix nie chce ruszyć wogóle..
O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt64.dll
Unknown
O23 - Service: FVNPIUSKUOG - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\FVNPIUSKUOG.exe
O23 - Service: GJBTIKTSDJMAKECEN - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\GJBTIKTSDJMAKECEN.exe
Unknown
O23 - Service: WEBNO - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\WEBNO.exe
przez Magik 02 Lip 2008, 13:06
Gdzie znaje ten program DSS
Meggi napisał(a):co to za kod na fix?
O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt64.dll
Unknown
O23 - Service: FVNPIUSKUOG - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\FVNPIUSKUOG.exe
O23 - Service: GJBTIKTSDJMAKECEN - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\GJBTIKTSDJMAKECEN.exe
Unknown
O23 - Service: WEBNO - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Megg\LOCALS~1\Temp\WEBNO.exe
przez Meggi 02 Lip 2008, 14:11
Deckard's System Scanner v20071014.68
Run by Megg on 2008-07-02 14:04:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Failed to create restore point; System Restore is disabled (service is not running).
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as Megg.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:06:25, on 2008-07-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programy\dss.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Megg.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1214992804312
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt64.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FVNPIUSKUOG - Unknown owner - C:\DOCUME~1\Megg\LOCALS~1\Temp\FVNPIUSKUOG.exe (file missing)
O23 - Service: GJBTIKTSDJMAKECEN - Unknown owner - C:\DOCUME~1\Megg\LOCALS~1\Temp\GJBTIKTSDJMAKECEN.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WEBNO - Unknown owner - C:\DOCUME~1\Megg\LOCALS~1\Temp\WEBNO.exe (file missing)
--
End of file - 5777 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 Ksc87 - c:\windows\system32\drivers\ksc87.sys
R0 UBHelper - c:\windows\system32\drivers\ubhelper.sys
R2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.1500>
R2 DritekPortIO (Dritek General Port I/O) - c:\program files\launch manager\dportio.sys <Not Verified; Dritek System Inc.; DPortIO>
R2 int15 - c:\windows\system32\drivers\int15.sys
R2 tvicport - c:\windows\system32\drivers\tvicport.sys <Not Verified; EnTech Taiwan; TVicPort Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64>
R2 zntport - c:\windows\system32\drivers\zntport.sys <Not Verified; Zeal SoftStudio; NTPort Library>
R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >
S2 eLock2BurnerLockDriver - c:\windows\system32\elock2burnerlockdriver.sys (file missing)
S2 eLock2FSCTLDriver - c:\windows\system32\elock2fsctldriver.sys (file missing)
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780} - c:\windows\temp\4e.tmp (file missing)
S3 btwmodem (Modem Bluetooth) - c:\windows\system32\drivers\btwmodem.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.1500>
S3 MEMSWEEP2 - c:\windows\system32\f.tmp (file missing)
S3 tcpsr - c:\windows\system32\drivers\tcpsr.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 AcerMemUsageCheckService (Memory Check Service) - c:\acer\empowering technology\eperformance\memcheck.exe <Not Verified; Acer Inc.; >
S3 FVNPIUSKUOG - c:\docume~1\megg\locals~1\temp\fvnpiuskuog.exe (file missing)
S3 GJBTIKTSDJMAKECEN - c:\docume~1\megg\locals~1\temp\gjbtiktsdjmakecen.exe (file missing)
S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>
S3 WEBNO - c:\docume~1\megg\locals~1\temp\webno.exe (file missing)
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Karta sieciowa Broadcom 802.11g
Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_03121468&REV_02\4&FCF0450&0&10A4
Manufacturer: Broadcom
Name: Karta sieciowa Broadcom 802.11g
PNP Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_03121468&REV_02\4&FCF0450&0&10A4
Service: BCM43XX
-- Files created between 2008-06-02 and 2008-07-02 -----------------------------
2008-07-02 12:03:18 0 d-------- C:\Program Files\Microsoft Silverlight
2008-07-02 11:38:43 0 d-------- C:\Program Files\Trend Micro
2008-06-21 13:19:16 0 d-------- C:\Program Files\Sophos
2008-06-18 17:08:52 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-06-17 11:52:45 0 d-------- C:\Program Files\eMule
2008-06-15 18:37:34 0 d-------- C:\Program Files\ProgMan
2008-06-15 12:53:43 0 d-------- C:\Documents and Settings\Megg\Application Data\Opera
2008-06-15 12:53:34 0 d-------- C:\Program Files\Opera
2008-06-12 16:02:36 0 d-------- C:\Documents and Settings\Megg\Application Data\CyberLink
2008-06-12 16:02:20 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-10 22:38:55 0 d-------- C:\Program Files\Common Files\Adobe
2008-06-10 22:31:24 13824 --a------ C:\WINDOWS\system32\WinNt64.dll
2008-06-10 22:29:59 0 --a------ C:\WINDOWS\system32\WinNt32.dll
2008-06-10 22:29:59 29696 --a------ C:\WINDOWS\system32\drivers\Ksc87.sys
2008-06-10 22:29:59 0 --a------ C:\Documents and Settings\Megg\53811.exe
2008-06-10 22:29:59 0 --a------ C:\Documents and Settings\Megg\21315.exe
2008-06-10 22:17:32 0 d-------- C:\Documents and Settings\Megg\Application Data\U3
-- Find3M Report ---------------------------------------------------------------
2008-07-02 01:42:24 12 --a------ C:\WINDOWS\bthservsdp.dat
2008-06-18 17:11:40 2528 --a------ C:\Documents and Settings\Megg\Application Data\$_hpcst$.hpc
2008-05-25 15:08:20 0 d-------- C:\Documents and Settings\Megg\Application Data\Nokia
2008-05-25 15:08:00 0 d-------- C:\Program Files\Common Files\PCSuite
2008-05-25 15:07:58 0 d-------- C:\Program Files\Common Files\Nokia
2008-05-25 15:07:46 0 d-------- C:\Documents and Settings\Megg\Application Data\PC Suite
2008-05-25 15:07:38 0 d-------- C:\Program Files\PC Connectivity Solution
2008-05-25 15:07:30 0 d-------- C:\Program Files\Nokia
2008-05-24 11:32:14 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-05-24 11:32:12 0 d-------- C:\Documents and Settings\Megg\Application Data\skypePM
2008-05-24 11:31:48 0 d-------- C:\Program Files\Common Files\Skype
2008-05-22 13:03:18 0 d-------- C:\Program Files\Alwil Software
2008-05-22 12:49:52 0 d-------- C:\Documents and Settings\Megg\Application Data\Adobe
2008-05-22 11:44:28 0 d-------- C:\Program Files\MarBit
2008-05-22 11:42:08 0 d-------- C:\Documents and Settings\Megg\Application Data\Skype
2008-05-22 11:41:10 0 d-------- C:\Program Files\Winamp
2008-05-22 11:41:10 0 d-------- C:\Documents and Settings\Megg\Application Data\Winamp
2008-05-22 11:40:38 0 d-------- C:\Program Files\Skype
2008-05-22 10:29:36 0 d-------- C:\Documents and Settings\Megg\Application Data\Gadu-Gadu
2008-05-22 10:28:02 0 d--hs---- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-22 10:27:54 0 d-------- C:\Program Files\Windows Live
2008-05-22 10:23:30 0 d-------- C:\Program Files\Gadu-Gadu
2008-05-22 10:19:52 0 d-------- C:\Program Files\Hewlett-Packard
2008-05-22 10:19:50 0 d--h----- C:\Program Files\Zenographics
2008-05-21 23:19:14 0 d-------- C:\Program Files\WIDCOMM
2008-05-21 23:18:16 0 d-------- C:\Program Files\Launch Manager
2008-05-21 23:17:06 0 d-------- C:\Program Files\Synaptics
2008-05-21 23:11:00 0 d-------- C:\Documents and Settings\Megg\Application Data\Macromedia
2008-05-21 22:59:40 903 --a------ C:\WINDOWS\HotFix.bat
2008-05-21 22:59:38 991 --a------ C:\WINDOWS\CLEANUP.CMD
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:57]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ksc87.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer Empowering Technology.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acer Empowering Technology.lnk
backup=C:\WINDOWS\pss\Acer Empowering Technology.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
C:\Acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\PROGRA~1\LAUNCH~1\LManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
SkyTel.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
%systemroot%\system32\dumprep 0 -u
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c6b75d4-372a-11dd-bbfa-0016d415112e}]
AutoRun\command- F:\LaunchU3.exe -a
-- End of Deckard's System Scanner: finished at 2008-07-02 14:07:55 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: AMD Turion(tm) 64 X2 Mobile Technology TL-50
CPU 1: AMD Turion(tm) 64 X2 Mobile Technology TL-50
Percentage of Memory in Use: 52%
Physical Memory (total/avail): 766.1 MiB / 366.03 MiB
Pagefile Memory (total/avail): 1873.26 MiB / 1384.13 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1925.55 MiB
C: is Fixed (FAT32) - 53.2 GiB total, 41.21 GiB free.
D: is Fixed (FAT32) - 53.69 GiB total, 41.72 GiB free.
E: is CDROM (No Media)
\\.\PHYSICALDRIVE0 - Hitachi HTS541212H9AT00 - 111.79 GiB - 3 partitions
\PARTITION0 - Unknown - 4.88 GiB
\PARTITION1 (bootable) - Unknown - 53.21 GiB - C:
\PARTITION2 - Unknown - 53.7 GiB - D:
-- Security Center -------------------------------------------------------------
AUOptions is disabled.
Windows Internal Firewall is enabled.
FirstRunDisabled is set.
AV: avast! antivirus 4.8.1201 [VPS 080701-0] v4.8.1201 (ALWIL Software)
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Megg\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ACER-D96B3E782B
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Megg
LOGONSERVER=\\ACER-D96B3E782B
NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 72 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=4802
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Megg\LOCALS~1\Temp
TMP=C:\DOCUME~1\Megg\LOCALS~1\Temp
USERDOMAIN=ACER-D96B3E782B
USERNAME=Megg
USERPROFILE=C:\Documents and Settings\Megg
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
Megg (admin)
Administrator (admin)
-- Add/Remove Programs ---------------------------------------------------------
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Acer Inc.\Acer English Online Help Creator\Uninst.isu"
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acer Empowering Technology --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x9 -removeonly
Acer ePerformance Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7057702F-6D71-4F30-8000-9E72BC771887}\setup.exe" -l0x9 -removeonly
Acer ePower Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\Setup.exe" -l0x15
Acer ePresentation Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\Setup.exe" -l0x9
Acer eSettings Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F2C8256-2773-46C7-9ABA-3E39C24ABB51}\setup.exe" -l0x9 -removeonly
Acer GridVista --> C:\WINDOWS\UnInst32.exe GridV.UNI
Acer OrbiCam --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4A57592C-FF92-4083-97A9-92783BD5AFB4}\Setup.EXE" -l0x9
Acer Screensaver --> MsiExec.exe /I{D458BBDC-0363-42E0-8FF9-4736E3CB3CA2}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Reader 8.1.2 Security Update 1 (KB403742) -->
ALLPlayer V3.X --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe"
ATI Catalyst Control Center --> MsiExec.exe /I{14C8B4D9-E917-4319-83E0-5A42EC6CBB7D}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder --> MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
ATI Parental Control & Encoder --> MsiExec.exe /I{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}
avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AVG Anti-Rootkit Free --> C:\Program Files\GRISOFT\AVG Anti-Rootkit Free\Uninstall.exe
eMule --> "C:\Program Files\eMule\Uninstall.exe"
Gadu-Gadu 7.7 --> C:\Program Files\Gadu-Gadu\Setup.exe
GemMaster Mystic --> "C:\Program Files\GemMaster\uninstallgemmaster.exe"
High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP OrderReminder --> "C:\Program Files\Hewlett-Packard\OrderReminder\uninstall\hpuninstaller.exe" hp_LaserJet_1018
LaserJet 1018 --> C:\Program Files\Zenographics\{A1129136-88BB-44CD-8096-76428E22FEF4}\setup.exe -u "HPLJInstaller.dll=Hplj1018.inf"
Launch Manager --> C:\WINDOWS\UnInst32.exe LManager.UNI
Localization Pack for Microsoft Windows XP Media Center Edition --> MsiExec.exe /I{D9ECBC61-0D76-4EDD-8D46-BB2BB0A02108}
Microsoft ActiveSync --> MsiExec.exe /I{99052DB7-9592-4522-A558-5417BBAD48EE}
Microsoft Office XP Media Content --> MsiExec.exe /I{90300415-6000-11D3-8CFE-0050048383C9}
Microsoft Office XP Small Business --> MsiExec.exe /I{91130415-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Narzędzie Software Uninstall Utility firmy ATI --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
Nokia Connectivity Cable Driver --> MsiExec.exe /X{11964613-805F-432D-A12B-169554B793E7}
Nokia PC Suite --> C:\Documents and Settings\All Users\Application Data\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_PC_Suite_6_84_10_3_pol_web.exe
Nokia PC Suite --> MsiExec.exe /I{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}
NTI Backup NOW! 4 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{385979FE-DC4F-4140-8EAD-A59625000D72} /l1033 BUN4
NTI CD & DVD-Maker --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
Opera 9.50 --> MsiExec.exe /X{7472B5B4-3FB7-446F-BC78-6BBA506EC473}
Otto --> "C:\Program Files\EnglishOtto\uninstallotto.exe"
Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor (04/28/2006 1.3.1.0) --> C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPINST.EXE /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_1DD56D2122DDFA3E4C3B165E3A5CFA613B48BDC7\amdk8.inf
Pakiet sterowników systemu Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_044C8712DB44F83D9DE6C376991EE9254E0A69E4\pccswpddriver.inf
Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293B\pccs_bluetooth.inf
Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_F12A08B6F776984A95553486F64C541356F86E38\pccs_bluetooth.inf
Pakiet sterowników systemu Windows - Nokia Modem (05/24/2007 6.84.0.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_5E1541AFF1E1EA3554CE566743CCAD323ED1C108\nokbtmdm.inf
PC Connectivity Solution --> MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
Poczta systemu Windows Live --> MsiExec.exe /I{6039C740-40B3-456C-8DDC-D63D29F634C8}
PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.EXE" -uninstall
PowerProducer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.exe" -l0x15 -removeonly
Skype™ 3.8 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SMSC IrCC V5.1.3600.7 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}\setup.exe" -l0x15 UNINSTALL
Soft Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2BFA&SUBSYS_1025009F\HXFSETUP.EXE -U -IAcrS09Fp.inf
Sonic Encoders --> MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Sophos Anti-Rootkit 1.3.1 --> C:\Program Files\Sophos\Sophos Anti-Rootkit\helper.exe remove
Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Update Rollup 2 for Windows XP Media Center Edition 2005 --> C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
WIDCOMM Bluetooth Software --> MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Live installer --> MsiExec.exe /X{D659C084-24CE-477A-BC76-6BE150355C26}
Windows XP Media Center Edition 2005 KB912067 --> "C:\WINDOWS\$NtUninstallKB912067$\spuninst\spuninst.exe"
-- Application Event Log -------------------------------------------------------
Event Record #/Type4213 / Error
Event Submitted/Written: 07/02/2008 02:03:46 PM
Event ID/Source: 2004 / PerfNet
Event Description:
Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną
zwrócone. Zwrócony kod stanu to dane DWORD 0.
Event Record #/Type4065 / Error
Event Submitted/Written: 07/01/2008 03:16:29 PM
Event ID/Source: 2004 / PerfNet
Event Description:
Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną
zwrócone. Zwrócony kod stanu to dane DWORD 0.
Event Record #/Type3991 / Error
Event Submitted/Written: 06/30/2008 11:42:50 AM
Event ID/Source: 2004 / PerfNet
Event Description:
Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną
zwrócone. Zwrócony kod stanu to dane DWORD 0.
Event Record #/Type3982 / Error
Event Submitted/Written: 06/30/2008 08:37:31 AM
Event ID/Source: 2004 / PerfNet
Event Description:
Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną
zwrócone. Zwrócony kod stanu to dane DWORD 0.
Event Record #/Type3972 / Error
Event Submitted/Written: 06/30/2008 07:48:44 AM
Event ID/Source: 2004 / PerfNet
Event Description:
Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną
zwrócone. Zwrócony kod stanu to dane DWORD 0.
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type4135 / Error
Event Submitted/Written: 07/02/2008 02:03:54 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Usługa System Restore Service zakończyła działanie; wystąpił następujący błąd:
%%2
Event Record #/Type4134 / Error
Event Submitted/Written: 07/02/2008 02:03:54 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
Nie można uruchomić usługi eLock2FSCTLDriver z powodu następującego błędu:
%%2
Event Record #/Type4133 / Error
Event Submitted/Written: 07/02/2008 02:03:54 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
Nie można uruchomić usługi eLock2BurnerLockDriver z powodu następującego błędu:
%%2
Event Record #/Type4132 / Error
Event Submitted/Written: 07/02/2008 02:03:50 PM
Event ID/Source: 104 / SRService
Event Description:
Proces inicjalizacji Przywracania systemu nie powiódł się.
Event Record #/Type4129 / Warning
Event Submitted/Written: 07/02/2008 01:39:06 PM
Event ID/Source: 1073 / USER32
Event Description:
Próba ponowny rozruch ACER-D96B3E782B nie powiodła się
-- End of Deckard's System Scanner: finished at 2008-07-02 14:07:55 ------------
przez Magik 02 Lip 2008, 14:26
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c6b75d4-372a-11dd-bbfa-0016d415112e}]
Files to delete:
C:\WINDOWS\system32\WinNt64.dll
przez Meggi 05 Lip 2008, 00:01
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:57:54, on 2008-07-04
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\WapSter\AQQ\AQQ.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215171230125
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
--
End of file - 4892 bytesComboFix 08-07-04.2 - Meggi 2008-07-05 0:02:14.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1033.18.342 [GMT 2:00]
Running from: D:\Programy\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 )))))))))))))))))))))))))))))))
.
2008-07-04 23:56 . 2008-07-04 23:56 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-04 23:46 . 2007-08-13 18:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-07-04 23:46 . 2008-07-04 23:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-07-04 23:41 . 2008-07-04 23:41 418 --a------ C:\WINDOWS\ODBC.INI
2008-07-04 23:39 . 2008-07-04 23:39 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d--h----- C:\Program Files\Zenographics
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-07-04 23:15 . 2006-07-30 19:00 442,368 -ra------ C:\WINDOWS\system32\zshp1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 143,360 -ra------ C:\WINDOWS\apptune1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 129,092 -ra------ C:\WINDOWS\system32\hp1018.img
2008-07-04 23:15 . 2006-07-30 19:00 106,496 -ra------ C:\WINDOWS\system32\vshp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 102,400 -ra------ C:\WINDOWS\system32\zlhp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\zlm.dll
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 7,564 -ra------ C:\WINDOWS\system32\ZSHP1018.HLP
2008-07-04 18:39 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-04 18:39 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-04 18:08 . 2007-08-13 18:40 991,232 --a------ C:\WINDOWS\system32\ieframe.dll.mui
2008-07-04 15:34 . 2008-07-04 15:34 8,840 --a------ C:\WINDOWS\SEC1549.PNF
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\en
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\bits
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-04 15:28 . 2008-07-04 15:28 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-04 15:24 . 2008-07-04 15:24 2,948 --a------ C:\WINDOWS\SEC20.PNF
2008-07-04 13:53 . 2008-04-14 02:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-07-04 13:52 . 2004-08-03 22:29 1,897,408 --------- C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-07-04 13:33 . 2008-07-04 13:33 <DIR> d---s---- C:\Documents and Settings\Meggi\UserData
2008-07-04 13:27 . 2008-07-04 13:27 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Program Files\WapSter
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Documents and Settings\Meggi\WapSter
2008-07-04 10:21 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-04 09:50 . 2008-06-13 13:05 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-04 01:36 . 2008-07-04 01:36 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-04 01:30 . 2008-07-04 01:30 <DIR> d--hs---- C:\Recycled
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\Winamp
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\MarBit
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Winamp
2008-07-04 01:18 . 2008-07-04 01:18 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Documents and Settings\Meggi\Gadu-Gadu
2008-07-04 01:13 . 2008-07-04 01:13 <DIR> d-------- C:\Program Files\Opera
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Windows Live
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d--hs---- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-04 01:11 . 2008-07-04 01:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-04 01:08 . 2008-07-04 01:08 92 --a------ C:\WINDOWS\GridV.UNI
2008-07-04 01:06 . 2008-07-04 23:47 12 --a------ C:\WINDOWS\bthservsdp.dat
2008-07-04 01:05 . 2008-07-04 01:05 <DIR> d-------- C:\Documents and Settings\Meggi\Bluetooth Software
2008-07-04 01:05 . 2008-06-13 13:05 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2008-07-04 01:05 . 2008-04-13 20:51 101,120 --a------ C:\WINDOWS\system32\drivers\bthpan.sys
2008-07-04 01:05 . 2008-04-13 20:46 59,136 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys
2008-07-04 01:05 . 2008-04-13 20:46 18,944 --a------ C:\WINDOWS\system32\drivers\bthusb.sys
2008-07-04 01:05 . 2008-04-13 20:46 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys
2008-07-04 01:03 . 2006-06-13 14:42 602,112 --a------ C:\WINDOWS\system32\Acer.Empowering.Windows.Forms_v820.dll
2008-07-04 01:02 . 2006-06-01 20:47 1,168,896 --a------ C:\WINDOWS\system32\ERUpdateHidden.EXE
2008-07-04 01:02 . 2006-03-23 12:02 258,048 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe
2008-07-04 01:02 . 2006-03-30 13:06 258,048 --a------ C:\WINDOWS\system32\CheckD2DSystem.exe
2008-07-04 01:02 . 2004-11-03 09:06 159,744 --a------ C:\WINDOWS\system32\CloseProcessWindow.dll
2008-07-04 01:02 . 2005-12-09 09:12 16,384 --a------ C:\WINDOWS\system32\ClearEvent.exe
2008-07-04 01:02 . 2006-02-24 11:28 552 --a------ C:\WINDOWS\system32\setup.iss
2008-07-04 01:01 . 2008-07-04 01:01 <DIR> d-------- C:\WINDOWS\Options
2008-07-04 00:43 . 2008-07-04 00:43 <DIR> d-------- C:\Program Files\WIDCOMM
2008-07-04 00:42 . 2008-07-04 00:42 <DIR> d-------- C:\Program Files\Launch Manager
2008-07-04 00:42 . 2008-07-04 00:42 83 --a------ C:\WINDOWS\LManager.UNI
2008-07-04 00:41 . 2008-07-04 00:41 <DIR> d-------- C:\Program Files\Synaptics
2008-07-04 00:41 . 2006-03-03 12:52 192,672 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2008-07-04 00:41 . 2006-03-03 12:55 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2008-07-04 00:41 . 2006-03-03 12:55 94,298 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2008-07-04 00:41 . 2006-03-03 12:55 82,013 --a------ C:\WINDOWS\system32\SynCOM.dll
2008-07-04 00:41 . 2006-03-03 13:10 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2008-07-04 00:41 . 2006-03-03 13:08 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2008-07-04 00:37 . 2005-09-14 17:03 53,248 --a------ C:\WINDOWS\system32\acpimof.dll
2008-07-04 00:37 . 2006-02-16 15:39 45,056 --a------ C:\WINDOWS\system32\Epm-Po.dll
2008-07-04 00:36 . 2006-05-16 03:04 2,879,488 --a------ C:\WINDOWS\SkyTel.exe
2008-07-04 00:36 . 2005-10-31 03:17 135,168 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2008-07-04 00:36 . 2005-05-03 03:43 69,632 --a------ C:\WINDOWS\Alcmtr.exe
2008-07-04 00:35 . 2008-07-04 00:35 <DIR> d-------- C:\WINDOWS\Acer
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\ATI
2008-07-04 00:34 . 2008-07-04 00:34 <DIR> d-------- C:\Documents and Settings\Meggi
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-04-21 06:44 3,066,880 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-14 03:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 03:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 03:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll
2008-04-14 00:10 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
2008-04-14 00:10 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\dllcache\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-14 00:10 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
2008-04-14 00:10 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
2008-04-14 00:10 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe
2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:43 70,144 ----a-w C:\WINDOWS\system32\dllcache\pintlphr.exe
2008-04-13 16:26 56,832 ----a-w C:\WINDOWS\system32\mshtmler.dll
2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 02:12 169984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:12 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-03-27 11:37:58 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
=
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
[X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
--a------ 2006-03-31 16:39 204800 C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-05-10 11:12 90112 C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2006-04-14 22:35 53248 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
--a------ 2006-03-15 22:12 579584 C:\Acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 02:12 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 13:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
--a------ 2006-05-30 12:11 421888 C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
--a------ 2006-06-01 14:40 413696 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-10 20:00 208952 C:\WINDOWS\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
--a------ 2006-06-23 06:59 602112 C:\PROGRA~1\LAUNCH~1\LManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-10 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
--a------ 2005-05-11 17:15 45056 C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra------ 2006-07-30 19:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2006-03-03 13:07 761946 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 2008-04-14 02:12 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys []
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys []
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 00:04:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-05 0:05:51
ComboFix-quarantined-files.txt 2008-07-04 22:05:44
Pre-Run: 41,932,718,080 bytes free
Post-Run: 41,955,262,464 bajtów wolnych
254 --- E O F --- 2008-07-04 16:19:54ComboFix 08-07-04.2 - Meggi 2008-07-05 0:02:14.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1033.18.342 [GMT 2:00]
Running from: D:\Programy\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 )))))))))))))))))))))))))))))))
.
2008-07-04 23:56 . 2008-07-04 23:56 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-04 23:46 . 2007-08-13 18:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-07-04 23:46 . 2008-07-04 23:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-07-04 23:41 . 2008-07-04 23:41 418 --a------ C:\WINDOWS\ODBC.INI
2008-07-04 23:39 . 2008-07-04 23:39 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d--h----- C:\Program Files\Zenographics
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-07-04 23:15 . 2006-07-30 19:00 442,368 -ra------ C:\WINDOWS\system32\zshp1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 143,360 -ra------ C:\WINDOWS\apptune1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 129,092 -ra------ C:\WINDOWS\system32\hp1018.img
2008-07-04 23:15 . 2006-07-30 19:00 106,496 -ra------ C:\WINDOWS\system32\vshp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 102,400 -ra------ C:\WINDOWS\system32\zlhp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\zlm.dll
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 7,564 -ra------ C:\WINDOWS\system32\ZSHP1018.HLP
2008-07-04 18:39 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-04 18:39 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-04 18:08 . 2007-08-13 18:40 991,232 --a------ C:\WINDOWS\system32\ieframe.dll.mui
2008-07-04 15:34 . 2008-07-04 15:34 8,840 --a------ C:\WINDOWS\SEC1549.PNF
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\en
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\bits
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-04 15:28 . 2008-07-04 15:28 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-04 15:24 . 2008-07-04 15:24 2,948 --a------ C:\WINDOWS\SEC20.PNF
2008-07-04 13:53 . 2008-04-14 02:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-07-04 13:52 . 2004-08-03 22:29 1,897,408 --------- C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-07-04 13:33 . 2008-07-04 13:33 <DIR> d---s---- C:\Documents and Settings\Meggi\UserData
2008-07-04 13:27 . 2008-07-04 13:27 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Program Files\WapSter
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Documents and Settings\Meggi\WapSter
2008-07-04 10:21 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-04 09:50 . 2008-06-13 13:05 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-04 01:36 . 2008-07-04 01:36 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-04 01:30 . 2008-07-04 01:30 <DIR> d--hs---- C:\Recycled
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\Winamp
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\MarBit
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Winamp
2008-07-04 01:18 . 2008-07-04 01:18 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Documents and Settings\Meggi\Gadu-Gadu
2008-07-04 01:13 . 2008-07-04 01:13 <DIR> d-------- C:\Program Files\Opera
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Windows Live
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d--hs---- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-04 01:11 . 2008-07-04 01:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-04 01:08 . 2008-07-04 01:08 92 --a------ C:\WINDOWS\GridV.UNI
2008-07-04 01:06 . 2008-07-04 23:47 12 --a------ C:\WINDOWS\bthservsdp.dat
2008-07-04 01:05 . 2008-07-04 01:05 <DIR> d-------- C:\Documents and Settings\Meggi\Bluetooth Software
2008-07-04 01:05 . 2008-06-13 13:05 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2008-07-04 01:05 . 2008-04-13 20:51 101,120 --a------ C:\WINDOWS\system32\drivers\bthpan.sys
2008-07-04 01:05 . 2008-04-13 20:46 59,136 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys
2008-07-04 01:05 . 2008-04-13 20:46 18,944 --a------ C:\WINDOWS\system32\drivers\bthusb.sys
2008-07-04 01:05 . 2008-04-13 20:46 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys
2008-07-04 01:03 . 2006-06-13 14:42 602,112 --a------ C:\WINDOWS\system32\Acer.Empowering.Windows.Forms_v820.dll
2008-07-04 01:02 . 2006-06-01 20:47 1,168,896 --a------ C:\WINDOWS\system32\ERUpdateHidden.EXE
2008-07-04 01:02 . 2006-03-23 12:02 258,048 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe
2008-07-04 01:02 . 2006-03-30 13:06 258,048 --a------ C:\WINDOWS\system32\CheckD2DSystem.exe
2008-07-04 01:02 . 2004-11-03 09:06 159,744 --a------ C:\WINDOWS\system32\CloseProcessWindow.dll
2008-07-04 01:02 . 2005-12-09 09:12 16,384 --a------ C:\WINDOWS\system32\ClearEvent.exe
2008-07-04 01:02 . 2006-02-24 11:28 552 --a------ C:\WINDOWS\system32\setup.iss
2008-07-04 01:01 . 2008-07-04 01:01 <DIR> d-------- C:\WINDOWS\Options
2008-07-04 00:43 . 2008-07-04 00:43 <DIR> d-------- C:\Program Files\WIDCOMM
2008-07-04 00:42 . 2008-07-04 00:42 <DIR> d-------- C:\Program Files\Launch Manager
2008-07-04 00:42 . 2008-07-04 00:42 83 --a------ C:\WINDOWS\LManager.UNI
2008-07-04 00:41 . 2008-07-04 00:41 <DIR> d-------- C:\Program Files\Synaptics
2008-07-04 00:41 . 2006-03-03 12:52 192,672 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2008-07-04 00:41 . 2006-03-03 12:55 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2008-07-04 00:41 . 2006-03-03 12:55 94,298 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2008-07-04 00:41 . 2006-03-03 12:55 82,013 --a------ C:\WINDOWS\system32\SynCOM.dll
2008-07-04 00:41 . 2006-03-03 13:10 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2008-07-04 00:41 . 2006-03-03 13:08 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2008-07-04 00:37 . 2005-09-14 17:03 53,248 --a------ C:\WINDOWS\system32\acpimof.dll
2008-07-04 00:37 . 2006-02-16 15:39 45,056 --a------ C:\WINDOWS\system32\Epm-Po.dll
2008-07-04 00:36 . 2006-05-16 03:04 2,879,488 --a------ C:\WINDOWS\SkyTel.exe
2008-07-04 00:36 . 2005-10-31 03:17 135,168 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2008-07-04 00:36 . 2005-05-03 03:43 69,632 --a------ C:\WINDOWS\Alcmtr.exe
2008-07-04 00:35 . 2008-07-04 00:35 <DIR> d-------- C:\WINDOWS\Acer
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\ATI
2008-07-04 00:34 . 2008-07-04 00:34 <DIR> d-------- C:\Documents and Settings\Meggi
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-04-21 06:44 3,066,880 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-14 03:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 03:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 03:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll
2008-04-14 00:10 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
2008-04-14 00:10 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\dllcache\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-14 00:10 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
2008-04-14 00:10 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
2008-04-14 00:10 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe
2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:43 70,144 ----a-w C:\WINDOWS\system32\dllcache\pintlphr.exe
2008-04-13 16:26 56,832 ----a-w C:\WINDOWS\system32\mshtmler.dll
2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 02:12 169984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:12 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-03-27 11:37:58 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
=
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
[X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
--a------ 2006-03-31 16:39 204800 C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-05-10 11:12 90112 C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2006-04-14 22:35 53248 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
--a------ 2006-03-15 22:12 579584 C:\Acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 02:12 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 13:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
--a------ 2006-05-30 12:11 421888 C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
--a------ 2006-06-01 14:40 413696 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-10 20:00 208952 C:\WINDOWS\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
--a------ 2006-06-23 06:59 602112 C:\PROGRA~1\LAUNCH~1\LManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-10 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
--a------ 2005-05-11 17:15 45056 C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra------ 2006-07-30 19:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2006-03-03 13:07 761946 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 2008-04-14 02:12 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys []
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys []
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 00:04:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-05 0:05:51
ComboFix-quarantined-files.txt 2008-07-04 22:05:44
Pre-Run: 41,932,718,080 bytes free
Post-Run: 41,955,262,464 bajtów wolnych
254 --- E O F --- 2008-07-04 16:19:54przez Dzi@dek 05 Lip 2008, 00:07
przez Meggi 05 Lip 2008, 00:08
ComboFix 08-07-04.2 - Meggi 2008-07-05 0:02:14.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1033.18.342 [GMT 2:00]
Running from: D:\Programy\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 )))))))))))))))))))))))))))))))
.
2008-07-04 23:56 . 2008-07-04 23:56 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-04 23:46 . 2007-08-13 18:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-07-04 23:46 . 2008-07-04 23:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-07-04 23:41 . 2008-07-04 23:41 418 --a------ C:\WINDOWS\ODBC.INI
2008-07-04 23:39 . 2008-07-04 23:39 <DIR> d-------- C:\WINDOWS\ShellNew
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-04 23:16 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d--h----- C:\Program Files\Zenographics
2008-07-04 23:15 . 2008-07-04 23:15 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-07-04 23:15 . 2006-07-30 19:00 442,368 -ra------ C:\WINDOWS\system32\zshp1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 143,360 -ra------ C:\WINDOWS\apptune1018.exe
2008-07-04 23:15 . 2006-07-30 19:00 129,092 -ra------ C:\WINDOWS\system32\hp1018.img
2008-07-04 23:15 . 2006-07-30 19:00 106,496 -ra------ C:\WINDOWS\system32\vshp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 102,400 -ra------ C:\WINDOWS\system32\zlhp1018.dll
2008-07-04 23:15 . 2006-07-30 19:00 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\zlm.dll
2008-07-04 23:15 . 2006-07-30 19:00 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL
2008-07-04 23:15 . 2006-07-30 19:00 7,564 -ra------ C:\WINDOWS\system32\ZSHP1018.HLP
2008-07-04 18:39 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-04 18:39 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-04 18:08 . 2007-08-13 18:40 991,232 --a------ C:\WINDOWS\system32\ieframe.dll.mui
2008-07-04 15:34 . 2008-07-04 15:34 8,840 --a------ C:\WINDOWS\SEC1549.PNF
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\en
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\system32\bits
2008-07-04 15:30 . 2008-07-04 15:30 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-04 15:28 . 2008-07-04 15:28 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-04 15:24 . 2008-07-04 15:24 2,948 --a------ C:\WINDOWS\SEC20.PNF
2008-07-04 13:53 . 2008-04-14 02:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-07-04 13:52 . 2004-08-03 22:29 1,897,408 --------- C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-07-04 13:33 . 2008-07-04 13:33 <DIR> d---s---- C:\Documents and Settings\Meggi\UserData
2008-07-04 13:27 . 2008-07-04 13:27 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-07-04 13:26 . 2008-07-04 13:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Program Files\WapSter
2008-07-04 13:09 . 2008-07-04 13:09 <DIR> d-------- C:\Documents and Settings\Meggi\WapSter
2008-07-04 10:21 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-04 09:50 . 2008-06-13 13:05 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-04 01:36 . 2008-07-04 01:36 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-04 01:30 . 2008-07-04 01:30 <DIR> d--hs---- C:\Recycled
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\Winamp
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Program Files\MarBit
2008-07-04 01:29 . 2008-07-04 01:29 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Winamp
2008-07-04 01:18 . 2008-07-04 01:18 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-07-04 01:16 . 2008-07-04 01:16 <DIR> d-------- C:\Documents and Settings\Meggi\Gadu-Gadu
2008-07-04 01:13 . 2008-07-04 01:13 <DIR> d-------- C:\Program Files\Opera
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Windows Live
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d--hs---- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-04 01:12 . 2008-07-04 01:12 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-04 01:11 . 2008-07-04 01:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-04 01:08 . 2008-07-04 01:08 92 --a------ C:\WINDOWS\GridV.UNI
2008-07-04 01:06 . 2008-07-04 23:47 12 --a------ C:\WINDOWS\bthservsdp.dat
2008-07-04 01:05 . 2008-07-04 01:05 <DIR> d-------- C:\Documents and Settings\Meggi\Bluetooth Software
2008-07-04 01:05 . 2008-06-13 13:05 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2008-07-04 01:05 . 2008-04-13 20:51 101,120 --a------ C:\WINDOWS\system32\drivers\bthpan.sys
2008-07-04 01:05 . 2008-04-13 20:46 59,136 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys
2008-07-04 01:05 . 2008-04-13 20:46 18,944 --a------ C:\WINDOWS\system32\drivers\bthusb.sys
2008-07-04 01:05 . 2008-04-13 20:46 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys
2008-07-04 01:03 . 2006-06-13 14:42 602,112 --a------ C:\WINDOWS\system32\Acer.Empowering.Windows.Forms_v820.dll
2008-07-04 01:02 . 2006-06-01 20:47 1,168,896 --a------ C:\WINDOWS\system32\ERUpdateHidden.EXE
2008-07-04 01:02 . 2006-03-23 12:02 258,048 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe
2008-07-04 01:02 . 2006-03-30 13:06 258,048 --a------ C:\WINDOWS\system32\CheckD2DSystem.exe
2008-07-04 01:02 . 2004-11-03 09:06 159,744 --a------ C:\WINDOWS\system32\CloseProcessWindow.dll
2008-07-04 01:02 . 2005-12-09 09:12 16,384 --a------ C:\WINDOWS\system32\ClearEvent.exe
2008-07-04 01:02 . 2006-02-24 11:28 552 --a------ C:\WINDOWS\system32\setup.iss
2008-07-04 01:01 . 2008-07-04 01:01 <DIR> d-------- C:\WINDOWS\Options
2008-07-04 00:43 . 2008-07-04 00:43 <DIR> d-------- C:\Program Files\WIDCOMM
2008-07-04 00:42 . 2008-07-04 00:42 <DIR> d-------- C:\Program Files\Launch Manager
2008-07-04 00:42 . 2008-07-04 00:42 83 --a------ C:\WINDOWS\LManager.UNI
2008-07-04 00:41 . 2008-07-04 00:41 <DIR> d-------- C:\Program Files\Synaptics
2008-07-04 00:41 . 2006-03-03 12:52 192,672 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2008-07-04 00:41 . 2006-03-03 12:55 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2008-07-04 00:41 . 2006-03-03 12:55 94,298 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2008-07-04 00:41 . 2006-03-03 12:55 82,013 --a------ C:\WINDOWS\system32\SynCOM.dll
2008-07-04 00:41 . 2006-03-03 13:10 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2008-07-04 00:41 . 2006-03-03 13:08 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2008-07-04 00:37 . 2005-09-14 17:03 53,248 --a------ C:\WINDOWS\system32\acpimof.dll
2008-07-04 00:37 . 2006-02-16 15:39 45,056 --a------ C:\WINDOWS\system32\Epm-Po.dll
2008-07-04 00:36 . 2006-05-16 03:04 2,879,488 --a------ C:\WINDOWS\SkyTel.exe
2008-07-04 00:36 . 2005-10-31 03:17 135,168 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2008-07-04 00:36 . 2005-05-03 03:43 69,632 --a------ C:\WINDOWS\Alcmtr.exe
2008-07-04 00:35 . 2008-07-04 00:35 <DIR> d-------- C:\WINDOWS\Acer
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-07-04 00:34 . 2006-08-16 12:32 <DIR> d-------- C:\Documents and Settings\Meggi\Application Data\ATI
2008-07-04 00:34 . 2008-07-04 00:34 <DIR> d-------- C:\Documents and Settings\Meggi
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-21 06:44 666,112 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-04-21 06:44 3,066,880 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-14 03:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 03:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 03:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll
2008-04-14 00:10 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
2008-04-14 00:10 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\dllcache\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-14 00:10 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
2008-04-14 00:10 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
2008-04-14 00:10 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe
2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:27 79,872 ------w C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dLL
2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 16:43 70,144 ----a-w C:\WINDOWS\system32\dllcache\pintlphr.exe
2008-04-13 16:26 56,832 ----a-w C:\WINDOWS\system32\mshtmler.dll
2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18 2351864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 02:12 169984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:12 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-03-27 11:37:58 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
=
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
[X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
--a------ 2006-03-31 16:39 204800 C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-05-10 11:12 90112 C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2006-04-14 22:35 53248 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
--a------ 2006-03-15 22:12 579584 C:\Acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 02:12 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 13:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
--a------ 2006-05-30 12:11 421888 C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
--a------ 2006-06-01 14:40 413696 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-10 20:00 208952 C:\WINDOWS\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
--a------ 2006-06-23 06:59 602112 C:\PROGRA~1\LAUNCH~1\LManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-10 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
--a------ 2005-05-11 17:15 45056 C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra------ 2006-07-30 19:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-10 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2006-03-03 13:07 761946 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 03:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 2008-04-14 02:12 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
"C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys []
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys []
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 00:04:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-05 0:05:51
ComboFix-quarantined-files.txt 2008-07-04 22:05:44
Pre-Run: 41,932,718,080 bytes free
Post-Run: 41,955,262,464 bajtów wolnych
254 --- E O F --- 2008-07-04 16:19:54
przez Magik 05 Lip 2008, 00:12
przez Meggi 05 Lip 2008, 00:13
HKU\.DEFAULT\Control Panel\International 2008-07-05 00:05 0 bytes Security mismatch.
HKU\.DEFAULT\Control Panel\International\Geo 2008-07-05 00:05 0 bytes Security mismatch.
HKU\S-1-5-21-516213439-2539429798-2792306350-1005\Control Panel\International 2008-07-05 00:15 0 bytes Security mismatch.
HKU\S-1-5-21-516213439-2539429798-2792306350-1005\Control Panel\International\Geo 2008-07-05 00:05 0 bytes Security mismatch.
HKU\S-1-5-18\Control Panel\International 2008-07-05 00:05 0 bytes Security mismatch.
HKU\S-1-5-18\Control Panel\International\Geo 2008-07-05 00:05 0 bytes Security mismatch.
HKLM\SECURITY\Policy\Secrets\SAC* 2006-08-16 16:29 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 2006-08-16 16:29 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 2008-07-05 00:14 80 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-516213439-2539429798-2792306350-1005\RefCount 2008-07-05 00:14 4 bytes Data mismatch between Windows API and raw hive data.
przez Magik 05 Lip 2008, 00:53
Meggi napisał(a):Rootkit Revealer odnalazł takie pliki:
Meggi napisał(a):HKLM\SECURITY\Policy\Secrets\SAC*
HKLM\SECURITY\Policy\Secrets\SAI*
Meggi napisał(a):atomiast nie chodzą przeglądarki internetowe
Rootkit >>> Szukaj >>> Kopiuj >>> CTRL+V do Notatnika
Rootkit >>> zaznaczyć tylko Usługi >>> zaznaczyć Pokaż wszystko >>> Szukaj >>> Kopiuj >>> CTRL+V do Notatnika
przez Meggi 05 Lip 2008, 00:56
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-07-05 01:37:23
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAA5CA588]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAA5CA444]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAA5CA922]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAA5CA01C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAA5CA51E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAA5C9F5C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAA5C9FC0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAA5CA63E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAA5CA5FE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAA5CA77E]
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2DAC 80504638 2 Bytes [ 5C, 9F ]
.text ntkrnlpa.exe!ZwCallbackReturn + 2DC4 80504650 2 Bytes [ C0, 9F ]
---- User IAT/EAT - GMER 1.0.14 ----
IAT C:\WINDOWS\system32\services.exe[780] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00600002
IAT C:\WINDOWS\system32\services.exe[780] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00600000
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016cee4c9ad
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016cee4c9ad
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016cee4c9ad
---- EOF - GMER 1.0.14 ----
przez Magik 05 Lip 2008, 01:43
Meggi napisał(a):sprawdzałam już połączenie z internetem i na drugim komputerze wszystko chodzi pięknie, natomiast w tym nie...
to ja poproszę bardzo jasno o wyjaśnienie co mam zrobić gdzie(rozumiem że do GMERA) i jak to powklejać??
przez Meggi 05 Lip 2008, 01:45
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 12 gości
