ComboFix 08-06-20.4 - Administrator 2008-06-24 11:09:25.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.269 [GMT 2:00]
Running from: C:\Documents and Settings\administrator.SBSMENIN\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.
2008-06-23 19:07 . 2008-06-23 19:07 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2008-06-23 18:28 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-23 18:28 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-23 18:25 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-06-23 18:11 . 2008-06-23 18:11 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-06-23 18:11 . 2008-06-24 11:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-23 18:11 . 2008-06-24 11:13 1,645,088 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-23 18:11 . 2008-06-23 18:31 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-23 18:11 . 2008-06-23 18:31 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-23 18:11 . 2008-06-24 11:13 24,864 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-23 18:11 . 2008-06-24 10:54 22,820 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-23 18:11 . 2008-06-24 10:54 3,284 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 16:32 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:52 178,976 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-23_23.15.29.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 21:00:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 08:55:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-23 21:55:41 270,056 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat
- 2008-06-23 21:05:20 53,942 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-06-24 09:05:08 53,942 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-06-23 21:05:20 68,752 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-06-24 09:05:08 68,752 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-06-23 21:05:20 383,588 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-06-24 09:05:08 383,588 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-06-23 21:05:20 439,776 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-06-24 09:05:08 439,776 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-06-24 07:52:52 26,212 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:00 15360]
"wsctf.exe"="wsctf.exe" []
"EXPLORER.EXE"="EXPLORER.EXE" [2007-06-13 15:23 1034752 C:\WINDOWS\explorer.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-25 12:32 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-25 12:29 77824]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-25 12:32 114688]
"AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 13:20 88363 C:\WINDOWS\AGRSMMSG.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-10-06 12:14 36972]
"PTHOSTTR"="C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2005-04-08 11:08 73728]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01 110592]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-04-27 05:33 122941]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-20 13:50 729178]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 10:59 794624]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 13:24 290816]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-09-07 16:28 213054]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2005-03-09 14:54 184320]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 10:00 143872]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 18:35 32768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:00 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Corel MEDIA FOLDERS INDEXER 8.LNK - C:\Corel\Graphics8\programs\MFIndexer.exe [2007-10-01 17:58:27 83456]
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2005-10-17 04:54:47 184320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3142\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3143\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3144\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3145\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3146\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3147\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3149\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3150\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3151\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3152\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3153\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3155\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2305338056-2891745705-811655994-3156\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-561495733-3256334632-909205982-2140\Scripts\Logon\0\0]
"Script"=printer.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2004-05-03 19:26]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26287b3c-06b1-11dc-a0f9-0014c2d557a7}]
\Shell\AutoRun\command - E:\EXPLORER.EXE
\Shell\explore\Command - E:\EXPLORER.EXE
\Shell\open\Command - E:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27714cc0-a952-11da-9fb2-0014c2d557a7}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8707cc2e-6c87-11da-9f3b-0014c2d557a7}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - E:\EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca95bee8-1104-11dc-a106-0014c2d557a7}]
\shell\AutoRun\command - E:\EXPLORER.EXE
\shell\explore\Command - E:\EXPLORER.EXE
\shell\open\Command - E:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb06451c-7038-11dc-a12f-0014c2d557a7}]
\Shell\AutoRun\command - E:\EXPLORER.EXE
\Shell\explore\Command - E:\EXPLORER.EXE
\Shell\open\Command - E:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb064521-7038-11dc-a12f-0014c2d557a7}]
\Shell\AutoRun\command - E:\h.cmd
\Shell\explore\Command - E:\h.cmd
\Shell\open\Command - E:\h.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d87b1a1a-ed9d-11db-a0e3-0014c2d557a7}]
\Shell\AutoRun\command - E:\EXPLORER.EXE
\Shell\explore\Command - E:\EXPLORER.EXE
\Shell\open\Command - E:\EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f12921b2-b8d1-11da-9fcd-0014c2d557a7}]
\Shell\AutoRun\command - E:\EXPLORER.EXE
\Shell\explore\Command - E:\EXPLORER.EXE
\Shell\open\Command - E:\EXPLORER.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 11:13:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????7?4?5?7??????? ???B???????????????B? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-24 11:14:49
ComboFix-quarantined-files.txt 2008-06-24 09:14:45
ComboFix2.txt 2008-06-23 21:15:50
Pre-Run: 27,826,565,120 bajtów wolnych
Post-Run: 27,835,826,176 bajtów wolnych
178 --- E O F --- 2008-06-23 17:14:48
