ComboFix 09-04-14.09 - tomi 14/04/2009 22:04.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2038.993 [GMT 1:00]
Running from: c:\users\tomi\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.
2009-04-14 21:01 . 2009-04-14 21:01 3009764 ----a-r c:\users\tomi\ComboFix.exe
2009-04-12 09:21 . 2009-04-12 09:21 -------- d-----w c:\users\All Users\Trymedia
2009-04-12 09:21 . 2009-04-12 09:21 -------- d-----w c:\programdata\Trymedia
2009-03-31 18:41 . 2009-03-31 18:41 -------- d-----w c:\users\tomi\.gstreamer-0.10
2009-03-29 15:49 . 2009-03-29 15:53 -------- d-----w c:\users\tomi\AppData\Local\Siemens
2009-03-29 15:38 . 2009-03-29 15:38 -------- d-----w c:\windows\{6D6098EC-5ED2-48F3-95E8-CBC6337BF3AD}
2009-03-24 19:40 . 2009-03-10 22:42 3121464 ----a-w c:\windows\system32\GameMon.des
2009-03-24 17:45 . 2009-03-25 00:41 -------- d-----w c:\users\tomi\AppData\Local\PMB Files
2009-03-24 17:45 . 2009-03-24 17:46 -------- d-----w c:\users\All Users\PMB Files
2009-03-24 17:45 . 2009-03-24 17:46 -------- d-----w c:\programdata\PMB Files
2009-03-24 11:20 . 2005-01-04 00:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-03-24 11:20 . 2003-07-20 09:17 5174 ----a-w c:\windows\system32\nppt9x.vxd
2009-03-23 21:04 . 2009-03-23 21:04 -------- d-----w c:\users\tomi\New Folder
2009-03-21 07:45 . 2009-03-23 22:24 -------- d-----w c:\users\tomi\AppData\Local\S2
2009-03-20 21:45 . 2009-03-20 21:45 -------- d-----w c:\users\tomi\AppData\Local\Apps
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:11 . 2006-03-10 09:04 49152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2009-04-14 21:11 . 2006-03-10 09:04 32768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2009-04-14 21:11 . 2006-03-10 09:04 16384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2009-04-14 21:10 . 2009-04-14 21:10 2048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
2009-04-14 21:10 . 2009-04-14 21:10 2048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
2009-04-14 21:05 . 2009-03-12 22:44 -------- d-----w c:\users\tomi\AppData\Roaming\Skype
2009-04-14 19:38 . 2009-02-20 02:38 -------- d-----w c:\programdata\Google Updater
2009-04-14 19:34 . 2009-02-09 15:54 -------- d-----w c:\program files\Cheat Engine
2009-04-14 19:20 . 2008-10-17 23:52 27240 ----a-w c:\users\tomi\AppData\Roaming\nvModes.dat
2009-04-14 02:48 . 2006-03-10 08:29 -------- d-----w c:\program files\Roxio
2009-04-13 23:18 . 2009-02-10 23:10 -------- d-----w c:\program files\LogMeIn
2009-04-12 10:30 . 2006-03-10 08:30 -------- d-----w c:\program files\Google
2009-04-12 10:12 . 2008-10-30 22:06 -------- d-----w c:\program files\Java
2009-04-12 09:32 . 2008-10-17 21:37 -------- d-----w c:\program files\Electronic Arts
2009-04-12 09:31 . 2006-03-10 07:58 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-12 08:59 . 2008-10-17 21:08 -------- d-----w c:\users\tomi\AppData\Roaming\InstallShield
2009-04-05 13:14 . 2008-12-15 22:09 -------- d-----w c:\program files\DivX
2009-04-05 13:14 . 2009-04-05 13:14 -------- d-----w c:\program files\Common Files\DivX Shared
2009-04-03 22:47 . 2009-01-21 00:02 -------- d-----w c:\programdata\eMule
2009-04-03 22:46 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstrng.dat
2009-04-03 22:46 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-03 22:46 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-03 20:40 . 2009-04-03 20:39 -------- d-----w c:\program files\WorldOfGoo
2009-03-29 15:49 . 2009-03-29 15:49 -------- d-----w c:\program files\Tiscali
2009-03-26 21:05 . 2009-03-24 10:58 -------- d-----w c:\program files\Onimedia
2009-03-24 19:19 . 2009-03-24 19:19 -------- d-----w c:\program files\Acclaim
2009-03-24 17:45 . 2009-03-23 20:54 -------- d-----w c:\program files\Pando Networks
2009-03-24 17:43 . 2009-03-24 10:14 -------- d-----w c:\program files\The Chronicles of Spellborn
2009-03-24 11:20 . 2009-03-24 11:20 -------- d-----w c:\program files\Common Files\INCA Shared
2009-03-21 07:39 . 2009-03-21 07:39 -------- d-----w c:\program files\Ubisoft
2009-03-20 22:04 . 2008-10-17 20:37 -------- d-----w c:\program files\a-squared Free
2009-03-20 20:03 . 2008-12-25 22:26 -------- d-----w c:\program files\Gameforge4D
2009-03-19 00:41 . 2006-03-10 08:25 -------- d-----w c:\program files\Common Files\Adobe
2009-03-12 22:44 . 2009-03-12 22:44 -------- d-----r c:\program files\Skype
2009-03-12 22:44 . 2006-03-10 08:45 -------- d-----w c:\programdata\Skype
2009-03-12 19:57 . 2009-02-09 11:44 -------- d-----w c:\users\tomi\AppData\Roaming\skypePM
2009-03-11 08:33 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-03-10 22:51 . 2008-10-17 20:38 -------- d-----w c:\program files\CCleaner
2009-03-10 19:49 . 2008-10-17 21:59 1898 ----a-w c:\windows\System32\ealregsnapshot1.reg
2009-03-10 19:37 . 2009-02-02 13:32 -------- d-----w c:\program files\Warcraft III
2009-03-10 18:58 . 2009-02-02 20:23 -------- d-----w c:\program files\Steam
2009-03-09 04:19 . 2008-10-30 22:07 410984 ----a-w c:\windows\System32\deploytk.dll
2009-03-05 21:15 . 2009-03-03 00:05 138784 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-05 21:15 . 2009-03-03 00:04 188896 ----a-w c:\windows\System32\PnkBstrB.exe
2009-03-04 23:20 . 2009-03-04 23:20 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-04 23:11 . 2008-12-15 22:09 -------- d-----w c:\program files\Common Files\PX Storage Engine
2009-03-04 22:46 . 2009-01-16 18:18 -------- d-----w c:\program files\BitComet
2009-03-04 20:08 . 2009-03-03 23:53 -------- d-----w c:\program files\Tajemnice umys³u
2009-03-03 01:00 . 2009-03-03 00:04 70968 ----a-w c:\windows\System32\PnkBstrA.exe
2009-03-03 00:05 . 2009-03-03 00:05 22328 ----a-w c:\users\tomi\AppData\Roaming\PnkBstrK.sys
2009-03-03 00:04 . 2009-03-03 00:04 2246144 ----a-w c:\windows\System32\pbsvc.exe
2009-03-03 00:04 . 2009-03-03 00:04 -------- d-----w c:\programdata\id Software
2009-02-28 07:31 . 2009-02-11 00:50 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-13 12:18 . 2009-02-13 12:18 0 ----a-w C:\NdoorsLog.txt
2009-02-10 23:10 . 2009-02-07 16:31 1024 ----a-w C:\.rnd
2009-02-09 11:44 . 2009-02-09 11:44 56 ---ha-w c:\users\All Users\ezsidmv.dat
2009-02-09 11:44 . 2009-02-09 11:44 56 ---ha-w c:\programdata\ezsidmv.dat
2009-02-09 03:10 . 2009-03-10 23:40 2033152 ----a-w c:\windows\System32\win32k.sys
2009-02-09 02:55 . 2009-02-09 02:55 552 ----a-w c:\users\tomi\AppData\Local\d3d8caps.dat
2009-01-31 14:00 . 2008-11-23 19:25 1356 ----a-w c:\users\tomi\AppData\Local\d3d9caps.dat
2009-01-31 11:51 . 2009-01-31 11:51 1700352 ----a-w c:\windows\System32\gdiplus.dll
2009-01-20 00:05 . 2009-01-20 00:05 98304 ----a-w c:\windows\System32\CmdLineExt.dll
2009-01-15 06:11 . 2009-02-11 09:55 827392 ----a-w c:\windows\System32\wininet.dll
2008-10-22 22:20 . 2008-10-17 21:17 86392 ----a-w c:\users\tomi\AppData\Local\GDIPFONTCACHEV1.DAT
2008-10-17 23:33 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-02-27 9339496]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-07-19 1120568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-11 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-06 24095528]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-23 857648]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-16 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-16 8478720]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-16 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3D88F496-1CDD-4D18-AFF8-CFBD371D6F4F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5A18F818-9D32-4A24-B67D-FA61507F2C32}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{98325970-3DF5-4496-9CCC-7582648EA67C}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Packard Bell - Skype
"UDP Query User{FDE43C90-D351-4C60-8B4A-5F9701B5C081}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Packard Bell - Skype
"TCP Query User{75182324-54EC-403F-B093-BA96CE916D9D}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{27C8B137-6CAE-49A3-8AB9-3595DAC53D34}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{78DA0046-67BF-4719-A413-0925A9DCBD06}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{0EC23B99-B0C9-4AC2-B832-3D7CFD7F1DAC}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{586B5971-CCB1-4293-AC19-7BAC126B524D}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{60597E28-DE0D-42EC-BB20-58ACAE2A2CA8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{0B5405B6-5EAF-4423-89F3-CFC7C542A0BF}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{563EC7F7-5E04-4777-BACA-386875991CF9}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{60DCE6B2-B485-4B72-B257-141E4E4B117A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{03DB78DB-AFCB-409A-A22C-ECC80302C2F1}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{21CB3160-B3BB-4BE9-BED5-BB6970291402}c:\\program files\\steam\\steamapps\\squner8d\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\squner8d\counter-strike source\hl2.exe:hl2
"UDP Query User{09776FBD-92EF-47DA-B20C-0F54BF84BFC0}c:\\program files\\steam\\steamapps\\squner8d\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\squner8d\counter-strike source\hl2.exe:hl2
"TCP Query User{2E67D459-CB32-4C41-A0B8-2855ACF17D0C}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program glówny
"UDP Query User{013E729F-CD6A-4FB1-A351-84A55F09731F}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program glówny
"TCP Query User{9ABA21B8-E68E-41CD-8DCC-C6C8824567E3}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{92FAC493-B8A9-418B-82E1-051D4F30F463}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{19C7B010-69A6-4C5A-A6F0-92F89FA5F378}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{14DD6675-C6AB-456A-AC84-2E7F82E79466}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{2FBACB55-13F6-4530-8D64-98E1AE341373}"= UDP:c:\program files\iMesh Applications\iMesh\iMesh.exe:iMesh
"{59FC0212-2F40-4DC2-9E39-0BE23E729E7F}"= TCP:c:\program files\iMesh Applications\iMesh\iMesh.exe:iMesh
"TCP Query User{B3318B5E-9871-4B29-AE0D-F221F12A8F85}c:\\program files\\nowe gadu-gadu\\gg.exe"= UDP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta
"UDP Query User{E80F6AEE-32DD-422C-BC5A-8B13DE6F800E}c:\\program files\\nowe gadu-gadu\\gg.exe"= TCP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta
"TCP Query User{EFDB5E83-8CBE-44F4-BE76-6B2996EE7303}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{DE80FED5-DDBB-43A1-9366-D8D0203EFB31}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{C66FD026-390E-4B9F-AF6C-BC8EC4877362}c:\\program files\\mc2\\sniper elite\\sniperelite.exe"= UDP:c:\program files\mc2\sniper elite\sniperelite.exe:SniperElite
"UDP Query User{BB2607FA-82EE-43A1-A139-4117C96A8090}c:\\program files\\mc2\\sniper elite\\sniperelite.exe"= TCP:c:\program files\mc2\sniper elite\sniperelite.exe:SniperElite
"TCP Query User{6107B100-28E2-4029-8D62-267BA607FF13}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{DDD00128-3501-4226-A7FB-BCCB9E873F3B}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{A6C09320-398D-451D-8116-E1D661AF0C9A}c:\\program files\\atari\\test drive unlimited\\testdriveunlimited.exe"= UDP:c:\program files\atari\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"UDP Query User{3AEA2E48-CDB5-4256-80A4-3547F4F768E8}c:\\program files\\atari\\test drive unlimited\\testdriveunlimited.exe"= TCP:c:\program files\atari\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"TCP Query User{71BFDE88-AC8F-44FD-BB9A-C125D0E19BA1}c:\\program files\\namco bandai games\\warhammer mark of chaos\\warhammer.exe"= UDP:c:\program files\namco bandai games\warhammer mark of chaos\warhammer.exe:Warhammer®: Mark of Chaos™
"UDP Query User{33F6C174-CEAC-4925-A4D2-B0511F835D71}c:\\program files\\namco bandai games\\warhammer mark of chaos\\warhammer.exe"= TCP:c:\program files\namco bandai games\warhammer mark of chaos\warhammer.exe:Warhammer®: Mark of Chaos™
"TCP Query User{7FD403D1-58B8-422F-AEED-E6A61211D588}c:\\program files\\ipla\\ipla.exe"= UDP:c:\program files\ipla\ipla.exe:ipla
"UDP Query User{FE51A9B8-4F7B-4B99-9FC0-6B9369C45C07}c:\\program files\\ipla\\ipla.exe"= TCP:c:\program files\ipla\ipla.exe:ipla
"TCP Query User{F88EEECB-409B-4D50-A70D-27B30D74FF5D}c:\\program files\\steam\\steamapps\\squner8d\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\squner8d\day of defeat source\hl2.exe:hl2
"UDP Query User{098223E6-3C83-4325-A934-C089113E6C3C}c:\\program files\\steam\\steamapps\\squner8d\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\squner8d\day of defeat source\hl2.exe:hl2
"TCP Query User{D6021344-F10C-4387-8E4C-A80793E79D9A}c:\\program files\\metin2_pl\\metin2.bin"= UDP:c:\program files\metin2_pl\metin2.bin:metin2.bin
"UDP Query User{CEB01535-00C8-4068-B7E4-A47621839FEA}c:\\program files\\metin2_pl\\metin2.bin"= TCP:c:\program files\metin2_pl\metin2.bin:metin2.bin
"TCP Query User{AC019891-ACF3-4A36-8EB0-BC43CE042F71}c:\\program files\\steam\\steamapps\\squner8d\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\squner8d\team fortress 2\hl2.exe:hl2
"UDP Query User{B907C566-2C49-4ED1-A23D-6D8173937ADF}c:\\program files\\steam\\steamapps\\squner8d\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\squner8d\team fortress 2\hl2.exe:hl2
"{A5410D90-53AD-4131-8D0E-39B6CB6938D7}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{AEA9C7A4-E428-4B9E-96A6-F7E8360C8B8D}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{BE893ACA-CA2C-4888-875E-F7136F1FDF76}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{DDD4424E-94DC-4600-B7A8-F5174D913009}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{17022DB1-92D9-4C53-8C23-8486B8980CB5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{356EC01E-EAE1-43A5-A6FF-17CBE11CB2D0}c:\\users\\tomi\\spellborn_downloader_3-5-2008.exe"= UDP:c:\users\tomi\spellborn_downloader_3-5-2008.exe:spellborn_downloader_3-5-2008.exe
"UDP Query User{AF312CE8-B5B8-463F-BE70-957390D2DB90}c:\\users\\tomi\\spellborn_downloader_3-5-2008.exe"= TCP:c:\users\tomi\spellborn_downloader_3-5-2008.exe:spellborn_downloader_3-5-2008.exe
"TCP Query User{C77997D7-B894-4A7A-8DAA-38FD7A28F105}c:\\users\\tomi\\documents\\god\\god.exe"= UDP:c:\users\tomi\documents\god\god.exe:god.exe
"UDP Query User{801830B4-6AC6-4006-A237-6CC4BAD34E77}c:\\users\\tomi\\documents\\god\\god.exe"= TCP:c:\users\tomi\documents\god\god.exe:god.exe
"{FEE307C2-BEB6-41C6-87E1-4CE6704DEC3D}"= UDP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
"{873BCECD-AA1E-4C40-92F1-041D2436FDAC}"= TCP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster
"{0DA10578-630E-4251-9022-70DBB836A5CE}"= UDP:d:\release\Tiscali.exe:Tiscali Wireless Gateway Installation
"{EA9ECA71-E974-4C81-A3FF-52AC2B2CBECA}"= TCP:d:\release\Tiscali.exe:Tiscali Wireless Gateway Installation
"TCP Query User{6891AECE-A149-472B-9BFA-2B76184B2AC1}c:\\program files\\nowe gadu-gadu\\gg.exe"= UDP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu
"UDP Query User{AF0FB946-C6A5-4671-B412-87819DD55B7C}c:\\program files\\nowe gadu-gadu\\gg.exe"= TCP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-03-10 3121464]
R4 LMIRfsClientNP;LMIRfsClientNP; [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-02-05 51792]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-07-24 12856]
S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-07-24 47640]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-01-08 46592]
--- Other Services/Drivers In Memory ---
*Deregistered* - sptd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a69eb7d-9c8d-11dd-b2b5-001b24a39d8f}]
\shell\AutoRun\command - E:\cm_setup.exe
.
Contents of the 'Scheduled Tasks' folder
2009-04-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-03-10 14:57]
2009-04-14 c:\windows\Tasks\Recovery DVD Creator.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2006-03-10 16:34]
2009-04-14 c:\windows\Tasks\User_Feed_Synchronization-{89CD8CC0-560D-4638-8FAC-DE5BEED910FF}.job
- c:\windows\system32\msfeedssync.exe [2008-10-17 22:33]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomoca BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomoca BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomoca BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
FF - ProfilePath - c:\users\tomi\AppData\Roaming\Mozilla\Firefox\Profiles\fh61rsoz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - google.co.uk
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programdata\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\users\tomi\AppData\Roaming\Mozilla\Firefox\Profiles\fh61rsoz.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\users\tomi\AppData\Roaming\Mozilla\Firefox\Profiles\fh61rsoz.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\users\tomi\AppData\Roaming\Mozilla\Firefox\Profiles\fh61rsoz.default\extensions\TechnicianConsole@logmeinrescue.com\platform\WINNT\plugins\npRescue.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 22:17
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\LogMeIn\x86\ramaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\System32\PnkBstrA.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Nowe Gadu-Gadu\spellchecker_gg.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
.
**************************************************************************
.
Completion time: ~,10time:~,-3machine was rebootedCombobatch-by
ComboFix-quarantined-files.txt 2009-04-14 21:20
Pre-Run: 24,745,586,688 bytes free
Post-Run: 24,497,209,344 bytes free
275 --- E O F --- 2009-04-07 07:34
Logfile of HijackThis v1.99.1
Scan saved at 00:14:30, on 15/04/2009
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Nowe Gadu-Gadu\gg.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\a-squared Free\a2free.exe
C:\Users\tomi\Desktop\New Folder (2)\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/cgi-bin/redirect/?country=UK&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
