ComboFix 08-03-14.4 - kolokolo 2008-03-17 20:55:37.1 - NTFSx86
Running from: C:\Documents and Settings\kolokolo\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-17 to 2008-03-17 )))))))))))))))))))))))))))))))
.
2008-03-17 20:06 . 2008-03-17 20:06 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-17 18:28 . 2008-03-17 19:56 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-03-17 18:28 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-17 18:28 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-17 18:28 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-17 18:28 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-17 18:27 . 2008-03-17 19:34 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-17 18:27 . 2008-03-17 18:27 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\PC Tools
2008-03-16 19:47 . 2008-03-16 19:47 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\Media Player Classic
2008-03-16 18:09 . 2008-03-16 18:09 <DIR> d-------- C:\Rozliczenie Roczne 2007
2008-03-13 17:14 . 2008-03-13 17:14 <DIR> d-------- C:\Program Files\SEGA
2008-03-13 17:14 . 2008-03-13 17:14 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\InstallShield
2008-03-10 07:26 . 2008-03-10 07:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-03-09 14:53 . 2008-03-10 06:44 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\Teleca
2008-03-09 14:52 . 2008-03-09 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Documents
2008-03-09 14:52 . 2008-03-09 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2008-03-09 14:51 . 2008-03-09 14:51 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-03-09 14:51 . 2008-03-09 14:52 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-03-09 14:51 . 2008-03-09 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2008-03-09 14:47 . 2008-03-09 14:49 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-03-09 14:46 . 2008-03-09 14:46 5,744 --a------ C:\WINDOWS\system32\drivers\k750whnt.sys
2008-03-09 14:46 . 2008-03-09 14:46 5,744 --a------ C:\WINDOWS\system32\drivers\k750wh.sys
2008-03-09 14:45 . 2008-03-09 14:45 89,872 --a------ C:\WINDOWS\system32\drivers\k750mdm.sys
2008-03-09 14:45 . 2008-03-09 14:45 81,728 --a------ C:\WINDOWS\system32\drivers\k750mgmt.sys
2008-03-09 14:45 . 2008-03-09 14:46 79,488 --a------ C:\WINDOWS\system32\drivers\k750obex.sys
2008-03-09 14:45 . 2008-03-09 14:45 55,216 --a------ C:\WINDOWS\system32\drivers\k750bus.sys
2008-03-09 14:45 . 2008-03-09 14:45 6,576 --a------ C:\WINDOWS\system32\drivers\k750mdfl.sys
2008-03-09 14:45 . 2008-03-09 14:45 6,144 --a------ C:\WINDOWS\system32\drivers\k750cmnt.sys
2008-03-09 14:45 . 2008-03-09 14:45 6,144 --a------ C:\WINDOWS\system32\drivers\k750cm.sys
2008-03-09 14:44 . 2008-03-09 14:46 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-03-08 14:31 . 2007-02-21 21:00 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-03-08 14:31 . 2005-02-24 18:56 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-03-08 14:12 . 2008-03-08 14:16 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\Winamp
2008-03-08 14:12 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-03-08 14:12 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-03-08 14:12 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-03-06 11:25 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-05 20:06 . 2008-03-05 20:06 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\vlc
2008-03-05 19:57 . 2008-03-05 19:57 <DIR> d-------- C:\Program Files\VideoLAN
2008-03-04 23:34 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-03-04 23:33 . 2008-03-05 19:01 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-03-04 23:26 . 2008-03-04 23:26 <DIR> d---s---- C:\Documents and Settings\kolokolo\UserData
2008-03-04 23:16 . 2008-03-04 23:16 <DIR> d-------- C:\Program Files\MarBit
2008-03-04 23:08 . 2008-03-04 23:08 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-04 23:08 . 2008-03-04 23:08 <DIR> d-------- C:\Program Files\Media Player Classic
2008-03-04 22:54 . 2004-08-03 23:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-03-04 20:44 . 2008-03-04 23:10 <DIR> d-------- C:\Program Files\SopCast
2008-03-03 23:30 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-03 23:29 . 2008-03-03 23:30 <DIR> d-------- C:\Program Files\Java
2008-03-03 23:23 . 2008-03-03 23:23 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-03 19:23 . 2008-03-03 19:23 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\Gadu-Gadu
2008-03-03 19:21 . 2008-03-03 19:22 <DIR> d-------- C:\Documents and Settings\kolokolo\Gadu-Gadu
2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-03-03 19:18 . 2008-03-15 14:06 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\skypePM
2008-03-03 19:18 . 2008-03-03 19:18 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-03 19:16 . 2008-03-15 14:38 <DIR> d-------- C:\Documents and Settings\kolokolo\Dane aplikacji\Skype
2008-03-03 19:15 . 2008-03-03 22:45 <DIR> d-------- C:\Program Files\Skype
2008-03-03 19:15 . 2008-03-03 19:15 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-03 19:15 . 2008-03-03 19:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-03-03 19:08 . 2008-03-06 20:59 1,289 --a------ C:\WINDOWS\mozver.dat
2008-03-03 19:05 . 2008-03-03 19:05 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-02 21:19 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-02 21:19 . 2008-03-02 21:19 421 --a------ C:\WINDOWS\ODBC.INI
2008-03-02 21:16 . 2008-03-02 21:18 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-02 21:16 . 2008-03-02 21:16 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-02 21:13 . 2008-03-02 21:13 <DIR> dr-h----- C:\MSOCache
2008-03-02 21:03 . 2008-03-08 14:19 <DIR> d-------- C:\Program Files\Winamp
2008-03-02 21:03 . 2007-03-08 00:51 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-03-02 21:00 . 2008-03-03 19:00 <DIR> d-------- C:\Program Files\DAEMON Tools
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-13 16:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-09 08:36 --------- d-----w C:\Program Files\Creative
2008-03-08 18:14 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-08 13:31 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-03-02 20:29 --------- d-----w C:\Program Files\SubEdit-Player
2008-03-02 19:57 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-02 19:55 --------- d-----w C:\Program Files\Free iPod Video Converter
2008-03-02 19:30 --------- d-----w C:\Program Files\Alwil Software
2008-03-02 19:20 --------- d-----w C:\Program Files\Common Files\EPSON
2008-03-02 19:19 --------- d-----w C:\Program Files\EPSON
2008-03-02 19:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-02 19:16 --------- d-----w C:\Documents and Settings\kolokolo\Dane aplikacji\InterTrust
2008-03-02 19:01 --------- d-----w C:\Documents and Settings\kolokolo\Dane aplikacji\ATI
2008-03-02 18:58 --------- d-----w C:\Program Files\ATI Technologies
2008-03-02 18:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-02 18:39 --------- d-----w C:\Program Files\Usługi online
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-06 01:07 61440]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
ATI CATALYST - pasek zadaä.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-08-06 01:07:30 61440]
EPSON Status Monitor 3 Environment Check(3).lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE [2008-03-02 20:19:37 131584]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbc45e6a-eddf-11dc-b20b-000e2e299860}]
\Shell\AutoRun\command - G:\b.com
\Shell\explore\Command - G:\b.com
\Shell\open\Command - G:\b.com
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-17 20:58:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-17 20:59:45
.
2008-03-12 08:08:56 --- E O F ---
HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:01:14, on 2008-03-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
--
End of file - 4718 bytes
