Log z HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:43:18, on 2008-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RaConfig.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Hmonitor\hmonitor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe
O4 - Global Startup: FF.lnk = C:\Program Files\Hmonitor\hmonitor.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: http://www.mks.com.pl
O15 - Trusted Zone: http://www.systemrequirementslab.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208020165375
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205503347203
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5908 bytes
Log z ComboFix
ComboFix 08-04-20.2 - mEgGaBaSs 2008-04-21 9:44:51.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.197 [GMT 2:00]
Running from: C:\Documents and Settings\All Users\Menu Start\Programy\HijackThis\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.
2015-03-03 08:10 . 2015-03-03 08:10 <DIR> d-------- C:\Program Files\Alcohol Soft
2015-03-03 08:08 . 2015-03-03 08:08 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-19 15:56 . 2008-04-19 15:56 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-04-19 15:56 . 2008-04-19 15:56 16,479 --a------ C:\WINDOWS\War3Unin.dat
2008-04-19 15:56 . 2008-04-19 15:56 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-04-16 16:48 . 2008-04-16 16:48 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-04-16 16:25 . 2008-04-16 16:25 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\InstallShield
2008-04-15 22:40 . 2008-04-15 22:40 <DIR> d-------- C:\Program Files\MP3 2 Ogg Lab 2004
2008-04-15 19:29 . 2008-04-15 19:29 <DIR> d-------- C:\Program Files\SkanerOnline
2008-04-14 21:21 . 2008-04-14 21:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-14 17:22 . 2008-04-14 17:50 29,254,550 --a------ C:\Set.mp3
2008-04-14 17:18 . 2008-04-14 17:19 6,050,444 --a------ C:\4.mp3
2008-04-14 15:53 . 2008-04-14 15:55 11,083,779 --a------ C:\3.mp3
2008-04-14 15:46 . 2008-04-14 15:46 9,025,171 --a------ C:\2.mp3
2008-04-14 15:46 . 2008-04-14 15:46 3,143,625 --a------ C:\1.mp3
2008-04-14 15:45 . 2008-04-14 15:45 <DIR> d-------- C:\Program Files\MGrenda
2008-04-14 08:06 . 2008-04-14 08:06 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-04-13 21:52 . 2008-04-13 21:52 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Vidalia
2008-04-13 21:52 . 2008-04-13 21:52 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\tor
2008-04-13 19:19 . 2008-04-13 19:19 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\DivX
2008-04-13 15:00 . 2008-04-13 15:00 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Orbit
2008-04-13 14:55 . 2008-04-18 09:55 105,241 ---h----- C:\treeinfo.wc
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF
2008-04-13 13:32 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF
2008-04-13 00:03 . 2008-04-13 00:03 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire
2008-04-12 23:56 . 2008-04-12 23:56 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Xfire
2008-04-12 23:45 . 2005-07-28 16:57 152,848 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-04-12 23:30 . 2008-04-12 23:31 18 --a------ C:\WINDOWS\sys.dat
2008-04-12 22:34 . 2008-04-12 22:34 <DIR> d-------- C:\Program Files\JAP
2008-04-12 20:47 . 2008-04-12 20:46 225,280 --a------ C:\Program Files\Uninstall My Global Search Bar.dll
2008-04-12 20:46 . 2008-04-12 20:46 <DIR> d-------- C:\Program Files\BearShare
2008-04-12 20:24 . 2008-04-12 20:24 <DIR> d-------- C:\Program Files\Windows Defender
2008-04-12 19:10 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-04-12 16:41 . 2008-04-12 16:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2008-04-12 15:51 . 2008-04-12 15:51 <DIR> d-------- C:\Program Files\GameSpy Arcade
2008-04-12 15:47 . 2008-04-12 15:47 684 --a------ C:\WINDOWS\Sof.INI
2008-04-12 14:12 . 2008-04-12 14:12 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-04-12 14:10 . 2008-04-12 14:10 <DIR> d-------- C:\Program Files\PowerMenu
2008-04-12 14:05 . 2008-04-12 14:05 <DIR> d-------- C:\WINDOWS\system32\DRM
2008-04-12 14:05 . 2008-04-12 14:05 <DIR> d-------- C:\WINDOWS\l2schemas
2008-04-12 14:05 . 2006-11-01 09:17 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-04-12 14:05 . 2006-11-08 10:51 62,336 --------- C:\WINDOWS\system32\drivers\rspndr.sys
2008-04-12 14:05 . 2006-11-08 10:51 10,752 --------- C:\WINDOWS\system32\rspndr.exe
2008-04-12 14:04 . 2006-08-18 14:39 476,160 --------- C:\WINDOWS\system32\dllcache\wzcsvc.dll
2008-04-12 14:04 . 2006-08-18 14:39 52,736 --------- C:\WINDOWS\system32\dllcache\wzcsapi.dll
2008-04-12 14:04 . 2006-10-23 13:14 20,608 --------- C:\WINDOWS\system32\dllcache\usbuhci.sys
2008-04-12 14:04 . 2006-08-18 11:36 14,592 --------- C:\WINDOWS\system32\dllcache\ndisuio.sys
2008-04-12 14:03 . 2008-04-12 14:03 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-04-12 14:02 . 2006-05-12 06:03 6,144 --------- C:\WINDOWS\system32\kbdpash.dll
2008-04-12 14:02 . 2006-05-12 06:03 6,144 --------- C:\WINDOWS\system32\kbdnepr.dll
2008-04-12 14:02 . 2006-05-12 06:03 6,144 --------- C:\WINDOWS\system32\kbdiultn.dll
2008-04-12 14:02 . 2006-05-12 06:03 6,144 --------- C:\WINDOWS\system32\kbdbhc.dll
2008-04-12 13:59 . 2008-04-12 13:59 <DIR> d-------- C:\Program Files\MSBuild
2008-04-12 13:57 . 2008-04-12 13:57 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-04-12 13:56 . 2008-04-12 13:56 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-04-12 13:55 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-04-12 13:51 . 2008-04-12 13:51 <DIR> d--h----- C:\WINDOWS\$SQLUninstallMSXML2SP6-KB887606-x86-PLK$
2008-04-12 13:50 . 2008-04-12 13:50 <DIR> d-------- C:\Program Files\Microsoft Bootvis
2008-04-12 13:48 . 2008-04-12 13:48 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-04-12 13:48 . 2008-04-12 13:48 <DIR> d-------- C:\Program Files\HighMAT CD Writing Wizard
2008-04-12 13:47 . 2008-04-12 13:47 <DIR> d-------- C:\Program Files\Microsoft CopyProfile
2008-04-12 13:47 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe
2008-04-12 13:43 . 2005-04-15 20:58 1,351,392 --a------ C:\WINDOWS\system32\COMCTL32.OCX
2008-04-12 13:43 . 2004-03-09 02:00 212,240 --a------ C:\WINDOWS\system32\RICHTX32.OCX
2008-04-12 13:43 . 2003-01-27 01:41 40,960 --a------ C:\WINDOWS\system32\SSUBTMR6.DLL
2008-04-12 13:43 . 2007-05-27 15:33 10,752 --a------ C:\WINDOWS\system32\aamd532.dll
2008-04-11 21:31 . 2008-04-11 21:31 <DIR> d-------- C:\Program Files\ACR
2008-04-09 08:20 . 2008-04-09 08:20 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\.BitTornado
2008-04-07 13:15 . 2008-04-07 13:15 <DIR> d-------- C:\WINDOWS\nview
2008-04-07 13:15 . 2005-02-24 07:32 176,128 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-07 13:15 . 2005-02-24 07:32 14,435 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-07 12:44 . 2007-12-05 07:41 1,089,536 --a------ C:\WINDOWS\system32\nvcuda.dll
2008-04-07 12:39 . 2008-04-07 12:40 2,250 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-04-07 12:38 . 2000-03-29 16:17 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-04-07 12:25 . 2008-04-07 12:25 472,576 --a------ C:\WINDOWS\Nvidia Omega Drivers v2.169.21 Uninstall.exe
2008-04-07 10:53 . 2008-04-07 10:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Uniblue
2008-04-07 09:10 . 2008-04-07 16:13 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-07 09:00 . 2003-08-26 09:54 930,980 --a------ C:\WINDOWS\PUNKBUSTER.RTP
2008-04-07 08:43 . 2004-03-16 10:57 1,996,134 --a------ C:\WINDOWS\RVS_1.55_1.56_US.RTP
2008-04-07 08:40 . 2004-03-04 11:27 278,183 --a------ C:\WINDOWS\RVS_1.54_1.55_US.RTP
2008-04-07 08:39 . 2004-02-13 11:58 2,571,562 --a------ C:\WINDOWS\RVS_1.53_1.54_US.RTP
2008-04-07 08:36 . 2004-01-30 12:11 919,989 --a------ C:\WINDOWS\RVS_1.52_1.53_US.RTP
2008-04-06 22:45 . 2004-01-20 15:17 26,910,482 --a------ C:\WINDOWS\RVS_1.0_1.52_US.RTP
2008-04-06 22:45 . 2003-11-04 13:30 49,152 --a------ C:\WINDOWS\Iniexpander.exe
2008-04-06 22:45 . 2003-11-04 19:24 1,185 --a------ C:\WINDOWS\1.31.add
2008-04-06 22:45 . 2003-11-04 19:27 216 --a------ C:\WINDOWS\1.50.add
2008-04-06 22:22 . 2008-04-06 22:23 0 --a------ C:\WINDOWS\PowerReg.dat
2008-04-06 16:39 . 2008-04-06 16:39 <DIR> d-------- C:\Program Files\Uniblue
2008-04-06 16:39 . 2008-04-06 16:39 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Uniblue
2008-04-06 15:30 . 2008-04-06 15:43 114 --a------ C:\WINDOWS\wininit.ini
2008-04-06 15:23 . 2008-04-06 15:23 529 --a------ C:\WINDOWS\eReg.dat
2008-04-05 13:59 . 2008-04-05 13:59 <DIR> d-------- C:\Program Files\Real Alternative
2008-04-04 23:31 . 2008-04-04 23:31 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-02 20:20 . 2008-04-02 20:20 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-03-30 20:33 . 2008-03-30 20:33 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Hamachi
2008-03-30 20:32 . 2008-03-30 20:32 <DIR> d-------- C:\Program Files\Hamachi
2008-03-30 20:32 . 2008-03-31 21:59 17,480 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-03-30 19:46 . 2008-03-30 19:46 1 --a------ C:\WINDOWS\system32\SI.bin
2008-03-30 19:45 . 2008-03-30 19:45 <DIR> d-------- C:\Documents and Settings\mEgGaBaSs\SystemRequirementsLab
2008-03-30 15:18 . 2008-03-30 15:18 766 --a------ C:\WINDOWS\OS_SHP_BUILDER0.ico
2008-03-26 18:39 . 2008-03-26 18:39 421 --a------ C:\WINDOWS\ODBC.INI
2008-03-26 18:38 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-26 18:35 . 2008-03-26 18:35 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-26 18:34 . 2008-03-26 18:34 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-22 17:10 . 2008-03-22 17:10 <DIR> d-------- C:\Casino
2008-03-21 18:08 . 2008-03-21 18:08 <DIR> d-------- C:\Program Files\Microsoft Internet Gaming Zone
2008-03-21 18:08 . 1998-12-17 11:57 7,952 --a------ C:\WINDOWS\system32\zloginrc.dll
2008-03-21 18:06 . 2008-03-21 18:08 216 --a------ C:\WINDOWS\MPPAGER.INI
2008-03-21 18:05 . 2008-03-21 18:05 <DIR> d-------- C:\WINDOWS\wb
2008-03-21 18:05 . 1996-08-16 14:44 87,552 -ra------ C:\WINDOWS\system\url.dll
2008-03-21 18:05 . 1996-09-30 13:32 9,728 -ra------ C:\WINDOWS\system\rnaph.dll
2008-03-21 17:54 . 1998-06-01 01:00 1,056,768 --------- C:\WINDOWS\system32\Msjet35.dll
2008-03-21 17:54 . 1998-06-01 00:00 417,792 --a------ C:\WINDOWS\system32\MSREPL35.DLL
2008-03-21 17:54 . 1997-07-11 01:00 385,024 --------- C:\WINDOWS\system32\Vbar332.dll
2008-03-21 17:54 . 1998-06-01 00:00 294,912 --a------ C:\WINDOWS\system32\MSXBSE35.DLL
2008-03-21 17:54 . 1998-06-01 00:00 262,144 --a------ C:\WINDOWS\system32\MSRD2X35.DLL
2008-03-21 17:54 . 1998-06-01 00:00 262,144 --a------ C:\WINDOWS\system32\MSEXCL35.DLL
2008-03-21 17:54 . 1998-06-01 00:00 176,128 --a------ C:\WINDOWS\system32\MSTEXT35.DLL
2008-03-21 17:54 . 1998-06-01 00:00 139,264 --a------ C:\WINDOWS\system32\MSJINT35.DLL
2008-03-21 17:54 . 1998-06-18 01:00 89,360 --------- C:\WINDOWS\system32\Vb5db.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 21:56 59,384 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-20 21:56 589,600 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-20 21:56 197,948 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-20 21:56 14,253,600 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-17 18:21 96,645 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-04-17 18:21 87,941 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-19 20:51 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Ahead
2008-03-19 20:24 --------- d-----w C:\Program Files\KProbe
2008-03-19 20:23 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-03-19 19:51 673,792 ----a-w C:\WINDOWS\is-EK8R6.exe
2008-03-17 19:24 --------- d-----w C:\Program Files\psx emulation cheater
2008-03-15 18:18 --------- d-----w C:\Program Files\NAPI-PROJEKT
2008-03-15 17:51 --------- d-----w C:\Program Files\Xilisoft
2008-03-14 19:57 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\fltk.org
2008-03-14 13:14 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-12 15:38 --------- d-----w C:\Program Files\mp3DirectCut
2008-03-12 15:04 --------- d-----w C:\Program Files\FDRLab
2008-03-12 11:10 633,344 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-03-08 21:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground
2008-03-08 21:14 --------- d-----w C:\Program Files\Common Files\DirectX
2008-03-07 10:21 --------- d-----w C:\Program Files\backburner 2
2008-03-07 10:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-03-07 10:02 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-03-07 10:02 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-03-07 10:02 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-03-06 16:10 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-04 10:43 --------- d-----w C:\Program Files\uTorrent
2008-03-04 10:43 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\uTorrent
2008-03-04 09:46 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-03-03 16:00 --------- d-----w C:\Program Files\Ganymede
2008-03-01 16:32 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 12:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Elaborate Bytes
2008-02-29 12:32 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-29 12:32 --------- d-----w C:\Program Files\Ahead
2008-02-29 11:02 47,360 ----a-w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\pcouffin.sys
2008-02-29 08:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:59 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-26 17:04 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\LimeWire
2008-02-25 15:03 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-02-25 15:03 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\Vso
2008-02-24 20:16 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
2008-02-24 16:42 --------- d-----w C:\Program Files\Deutsch Translator 2
2008-02-24 14:10 --------- d-----w C:\Documents and Settings\mEgGaBaSs\Dane aplikacji\eMule
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-21 13:29 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-17 18:03 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-15 14:12 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-01-29 00:53 612,864 ----a-w C:\WINDOWS\system32\x264vfw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 16:58 217544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2007-03-09 20:50 200768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-02-24 07:32 5537792]
"nwiz"="nwiz.exe" [2005-02-24 07:32 1495040 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-02-24 07:32 86016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2008-02-17 01:00:12 380928]
FF.lnk - C:\Program Files\Hmonitor\hmonitor.exe [2004-05-20 12:15:02 261594]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
"msacm.ac3acm"= ac3acm.acm
"msacm.lameacm"= lameACM.acm
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-02-22 16:58 217544 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"D:\\Program Files\\Total Commander\\TOTALCMD.EXE"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"6667:TCP"= 6667:TCP:GSA IRC
"3783:TCP"= 3783:TCP:GSA VCP
"29900:TCP"= 29900:TCP:GSA GPCM
"6500:TCP"= 6500:TCP:GSA QP
"13139:TCP"= 13139:TCP:GSA CUDPP
"6515:TCP"= 6515:TCP:GSA DPUDP
"28900:TCP"= 28900:TCP:GSA MSLR
"27900:TCP"= 27900:TCP:GSA MSUDPH
"25777:UDP"= 25777:UDP:XFire UDP
"9030:TCP"= 9030:TCP:Vidalia
"443:TCP"= 443:TCP:Vidalia
R2 hmonitor;hmonitor;C:\WINDOWS\system32\drivers\hmonitor.sys [2004-04-06 10:39]
R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys [2003-10-08 13:14]
S3 jatmlano;jatmlano;C:\DOCUME~1\MEGGAB~1\USTAWI~1\Temp\jatmlano.sys []
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a88c5536-c174-11e4-85e3-00904b896ac4}]
\Shell\AutoRun\command - F:\_AUTORUN\AUTORUN.EXE
.
Contents of the 'Scheduled Tasks' folder
"2008-04-06 15:28:06 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-04-16 15:59:46 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-04-07 08:54:12 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
"2008-04-21 07:21:36 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 09:50:40
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-21 9:51:16
ComboFix-quarantined-files.txt 2008-04-21 07:51:14
Pre-Run: 7,409,770,496 bajtów wolnych
Post-Run: 7,390,371,840 bajtów wolnych
289 --- E O F --- 2008-02-17 11:22:04
