Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55, on 2008-05-17
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\WapSter\AQQ\AQQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\kamil\Pulpit\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{58524F8F-B305-4AA9-B971-4F27DE93C516}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
--
End of file - 4583 bytes
Combofix
ComboFix 08-05-15.3 - Administrator 2008-05-17 19:32:16.13 - FAT32x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.166 [GMT 2:00]
Running from: D:\z neta\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 )))))))))))))))))))))))))))))))
.
2008-05-13 15:23 . 2008-05-13 15:23 <DIR> d--hs---- C:\FOUND.000
2008-05-10 07:27 . 2008-05-10 07:27 <DIR> d-------- C:\Program Files\Winamp
2008-05-10 07:27 . 2008-05-10 07:27 <DIR> d-------- C:\Documents and Settings\kamil\Dane aplikacji\Winamp
2008-05-04 13:41 . 2008-03-20 04:14 <DIR> d-------- C:\SDFix
2008-05-02 16:56 . 2008-05-02 16:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-02 16:56 . 2008-05-02 16:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-02 16:46 . 2008-05-02 16:46 <DIR> d-------- C:\Documents and Settings\kamil\Dane aplikacji\Ahead
2008-05-02 16:38 . 2005-07-29 17:12 2,977,792 --------- C:\WINDOWS\UNNeroVision.exe
2008-05-02 16:38 . 2006-05-23 18:30 179,288 --------- C:\WINDOWS\UNNeroVision.cfg
2008-05-02 16:38 . 2001-03-08 19:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-05-02 16:37 . 2008-05-02 16:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-05-02 16:37 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll
2008-04-24 20:20 . 2008-04-24 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground
2008-04-24 19:46 . 2008-04-24 19:46 <DIR> d-------- C:\Program Files\Common Files\DirectX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-24 18:03 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-04-16 17:29 --------- d-----w C:\Program Files\Lavasoft
2008-04-16 17:29 --------- d-----w C:\Documents and Settings\kamil\Dane aplikacji\Lavasoft
2008-04-16 15:10 --------- d-----w C:\Program Files\Avira
2008-04-16 15:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-04-11 16:23 --------- d-----w C:\Program Files\Common Files\Nero
2008-04-11 16:23 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-11 16:20 --------- d-----w C:\Program Files\Common Files\Ahead
2008-04-09 17:15 --------- d-----w C:\Program Files\Skype
2008-04-09 17:15 --------- d-----w C:\Program Files\Common Files\Skype
2008-04-09 17:15 --------- d-----w C:\Documents and Settings\kamil\Dane aplikacji\Skype
2008-04-09 17:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-04-08 15:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-03-22 18:09 2,110 ----a-w C:\WINDOWS\system32\tmp.reg
.
------- Sigcheck -------
.
((((((((((((((((((((((((((((( snapshot@2008-05-04_13.45.05.19 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-04 10:09:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-17 17:31:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-15 09:38:50 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-05-03 18:18:28 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
- 2008-04-14 17:46:22 1,617,920 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-05-04 11:49:24 1,617,920 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
- 2008-04-14 17:46:22 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-04 11:49:24 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2001-10-26 15:29:26 179,712 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\cewmdm.dll
+ 2001-10-26 15:29:36 175,104 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSP.dll
+ 2001-10-26 15:29:36 245,760 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSSCP.dll
+ 2001-10-26 15:29:36 155,648 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSWMDM.dll
+ 2001-10-26 15:29:46 22,528 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMLOG.dll
+ 2001-10-26 15:29:46 20,480 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMPS.dll
+ 2005-01-28 11:44:28 164,864 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\cewmdm.dll
+ 2005-01-28 11:44:28 25,088 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
+ 2005-01-28 11:44:28 173,568 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSP.dll
+ 2005-01-28 11:44:28 364,784 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSSCP.dll
+ 2005-01-28 11:44:28 315,904 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSWMDM.dll
+ 2005-01-28 11:44:28 28,160 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMLOG.dll
+ 2005-01-28 11:44:28 33,792 ----a-w C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMPS.dll
+ 2005-01-28 11:44:28 47,104 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe
+ 2005-01-28 11:44:28 15,872 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfapi.dll
+ 2005-01-28 11:44:28 38,912 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe
+ 2005-01-28 11:44:28 38,912 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpd_ci.dll
+ 2005-01-28 11:44:28 61,952 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdconns.dll
+ 2005-01-28 11:44:28 114,176 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtp.dll
+ 2005-01-28 11:44:28 331,776 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpdr.dll
+ 2005-01-28 11:44:28 66,560 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpus.dll
+ 2005-01-28 11:44:28 331,264 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdsp.dll
+ 2005-01-28 11:44:28 10,752 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdtrace.dll
+ 2005-01-28 11:44:28 18,944 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdusb.sys
+ 2002-12-11 17:11:02 410,248 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmadmod.dll
+ 2002-12-11 17:12:50 760,968 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmsdmod.dll
+ 2002-12-11 17:07:54 486,536 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmspdmod.dll
+ 2002-12-11 17:10:00 816,264 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmvdmod.dll
+ 2005-01-28 11:44:28 396,528 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmadmod.dll
+ 2005-01-28 11:44:28 774,904 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmsdmod.dll
+ 2005-01-28 11:44:28 413,944 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmspdmod.dll
+ 2005-01-28 11:44:28 1,218,808 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvadvd.dll
+ 2005-01-28 11:44:28 895,736 ----a-w C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvdmod.dll
+ 2002-12-11 13:16:58 6,656 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\laprxy.dll
+ 2002-12-11 13:04:20 81,408 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe
+ 2002-12-11 15:34:40 241,664 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\qasf.dll
+ 2002-12-11 15:34:40 670,208 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmadmoe.dll
+ 2002-12-11 15:23:48 218,112 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmasf.dll
+ 2002-12-11 13:16:58 143,360 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmidx.dll
+ 2002-12-11 15:23:58 981,504 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmnetmgr.dll
+ 2002-12-11 15:34:40 1,111,040 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmsdmoe2.dll
+ 2002-12-11 15:34:40 892,416 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmspdmoe.dll
+ 2002-12-11 17:02:38 2,058,888 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvcore.dll
+ 2002-12-11 15:34:40 997,888 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvdmoe2.dll
+ 2005-01-28 11:44:28 6,656 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\laprxy.dll
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe
+ 2005-01-28 11:44:28 221,184 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\qasf.dll
+ 2005-01-28 11:44:28 716,288 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmadmoe.dll
+ 2005-01-28 11:44:28 224,768 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmasf.dll
+ 2005-01-28 11:44:28 335,872 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMdev.dll
+ 2005-01-28 11:44:28 290,816 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMNet.dll
+ 2005-01-28 11:44:28 150,016 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmidx.dll
+ 2005-01-28 11:44:28 1,027,072 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmnetmgr.dll
+ 2005-01-28 11:44:28 1,119,744 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmsdmoe2.dll
+ 2005-01-28 11:44:28 940,544 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmspdmoe.dll
+ 2005-01-28 11:44:28 1,512,448 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMVADVE.DLL
+ 2005-01-28 11:44:28 2,370,296 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvcore.dll
+ 2005-01-28 11:44:28 1,003,008 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvdmoe2.dll
+ 2002-12-11 16:09:20 232,960 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\blackbox.dll
+ 2002-12-11 16:50:18 301,712 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmclien.dll
+ 2002-12-11 15:34:42 82,432 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmstor.dll
+ 2002-12-11 16:09:22 678,912 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmv2clt.dll
+ 2002-12-11 16:09:22 253,952 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\msnetobj.dll
+ 2005-01-28 11:44:28 294,912 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\blackbox.dll
+ 2005-01-28 11:44:28 258,296 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmclien.dll
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmstor.dll
+ 2005-01-28 11:44:28 502,272 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmv2clt.dll
+ 2005-01-28 11:44:28 142,336 ----a-w C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\msnetobj.dll
- 2002-12-11 16:09:20 232,960 ----a-w C:\WINDOWS\system32\blackbox.dll
+ 2005-01-28 11:44:28 294,912 ----a-w C:\WINDOWS\system32\blackbox.dll
- 2001-10-26 15:29:26 179,712 ----a-w C:\WINDOWS\system32\cewmdm.dll
+ 2005-01-28 11:44:28 164,864 ----a-w C:\WINDOWS\system32\cewmdm.dll
- 2008-05-04 10:09:14 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-17 16:50:50 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-05-04 10:09:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
+ 2008-05-17 16:50:50 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
- 2008-05-04 10:09:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-17 16:50:50 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
- 2002-12-11 16:09:20 232,960 ----a-w C:\WINDOWS\system32\dllcache\blackbox.dll
+ 2005-01-28 11:44:28 294,912 ----a-w C:\WINDOWS\system32\dllcache\blackbox.dll
- 2001-10-26 15:29:26 179,712 ----a-w C:\WINDOWS\system32\dllcache\cewmdm.dll
+ 2005-01-28 11:44:28 164,864 ----a-w C:\WINDOWS\system32\dllcache\cewmdm.dll
- 2002-12-11 16:50:18 301,712 ----a-w C:\WINDOWS\system32\dllcache\drmclien.dll
+ 2005-01-28 11:44:28 258,296 ----a-w C:\WINDOWS\system32\dllcache\drmclien.dll
- 2002-12-11 15:34:42 82,432 ----a-w C:\WINDOWS\system32\dllcache\drmstor.dll
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\system32\dllcache\drmstor.dll
- 2002-12-11 16:09:22 678,912 ----a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll
+ 2005-01-28 11:44:28 502,272 ----a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll
- 2002-12-11 13:16:58 6,656 ----a-w C:\WINDOWS\system32\dllcache\laprxy.dll
+ 2005-01-28 11:44:28 6,656 ----a-w C:\WINDOWS\system32\dllcache\laprxy.dll
- 2002-12-11 13:04:20 81,408 ----a-w C:\WINDOWS\system32\dllcache\logagent.exe
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\system32\dllcache\logagent.exe
- 2002-12-11 16:09:22 253,952 ----a-w C:\WINDOWS\system32\dllcache\msnetobj.dll
+ 2005-01-28 11:44:28 142,336 ----a-w C:\WINDOWS\system32\dllcache\msnetobj.dll
- 2001-10-26 15:29:36 175,104 ----a-w C:\WINDOWS\system32\dllcache\mspmsp.dll
+ 2005-01-28 11:44:28 173,568 ----a-w C:\WINDOWS\system32\dllcache\mspmsp.dll
- 2001-10-26 15:29:36 245,760 ----a-w C:\WINDOWS\system32\dllcache\msscp.dll
+ 2005-01-28 11:44:28 364,784 ----a-w C:\WINDOWS\system32\dllcache\msscp.dll
- 2001-10-26 15:29:36 155,648 ----a-w C:\WINDOWS\system32\dllcache\mswmdm.dll
+ 2005-01-28 11:44:28 315,904 ----a-w C:\WINDOWS\system32\dllcache\mswmdm.dll
- 2002-12-11 15:34:40 241,664 ----a-w C:\WINDOWS\system32\dllcache\qasf.dll
+ 2005-01-28 11:44:28 221,184 ----a-w C:\WINDOWS\system32\dllcache\qasf.dll
- 2002-12-11 17:11:02 410,248 ----a-w C:\WINDOWS\system32\dllcache\wmadmod.dll
+ 2005-01-28 11:44:28 396,528 ----a-w C:\WINDOWS\system32\dllcache\wmadmod.dll
- 2002-12-11 15:34:40 670,208 ----a-w C:\WINDOWS\system32\dllcache\wmadmoe.dll
+ 2005-01-28 11:44:28 716,288 ----a-w C:\WINDOWS\system32\dllcache\wmadmoe.dll
- 2002-12-11 15:23:48 218,112 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
+ 2005-01-28 11:44:28 224,768 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
- 2001-10-26 15:29:46 22,528 ----a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll
+ 2005-01-28 11:44:28 28,160 ----a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll
- 2001-10-26 15:29:46 20,480 ----a-w C:\WINDOWS\system32\dllcache\wmdmps.dll
+ 2005-01-28 11:44:28 33,792 ----a-w C:\WINDOWS\system32\dllcache\wmdmps.dll
- 2002-12-11 15:23:58 981,504 ----a-w C:\WINDOWS\system32\dllcache\wmnetmgr.dll
+ 2005-01-28 11:44:28 1,027,072 ----a-w C:\WINDOWS\system32\dllcache\wmnetmgr.dll
- 2002-12-11 17:12:50 760,968 ----a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll
+ 2005-01-28 11:44:28 774,904 ----a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll
- 2002-12-11 17:02:38 2,058,888 ----a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
+ 2005-01-28 11:44:28 2,370,296 ----a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
- 2002-12-11 17:10:00 816,264 ----a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll
+ 2005-01-28 11:44:28 895,736 ----a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll
+ 2007-03-07 23:51:00 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
+ 2007-03-07 23:51:00 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
+ 2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
+ 2005-01-28 11:44:28 18,944 ----a-w C:\WINDOWS\system32\drivers\wpdusb.sys
- 2002-12-11 16:50:18 301,712 ----a-w C:\WINDOWS\system32\drmclien.dll
+ 2005-01-28 11:44:28 258,296 ----a-w C:\WINDOWS\system32\drmclien.dll
- 2002-12-11 15:34:42 82,432 ----a-w C:\WINDOWS\system32\drmstor.dll
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\system32\drmstor.dll
- 2002-12-11 16:09:22 678,912 ----a-w C:\WINDOWS\system32\drmv2clt.dll
+ 2005-01-28 11:44:28 502,272 ----a-w C:\WINDOWS\system32\drmv2clt.dll
- 2002-12-11 13:16:58 6,656 ----a-w C:\WINDOWS\system32\laprxy.dll
+ 2005-01-28 11:44:28 6,656 ----a-w C:\WINDOWS\system32\laprxy.dll
- 2002-12-11 13:04:20 81,408 ----a-w C:\WINDOWS\system32\logagent.exe
+ 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\system32\logagent.exe
- 2002-12-11 16:09:22 253,952 ----a-w C:\WINDOWS\system32\msnetobj.dll
+ 2005-01-28 11:44:28 142,336 ----a-w C:\WINDOWS\system32\msnetobj.dll
+ 2005-01-28 11:44:28 25,088 ----a-w C:\WINDOWS\system32\MsPMSNSv.dll
- 2001-10-26 15:29:36 175,104 ----a-w C:\WINDOWS\system32\mspmsp.dll
+ 2005-01-28 11:44:28 173,568 ----a-w C:\WINDOWS\system32\MsPMSP.dll
- 2001-10-26 15:29:36 245,760 ----a-w C:\WINDOWS\system32\msscp.dll
+ 2005-01-28 11:44:28 364,784 ----a-w C:\WINDOWS\system32\MSSCP.dll
- 2001-10-26 15:29:36 155,648 ----a-w C:\WINDOWS\system32\mswmdm.dll
+ 2005-01-28 11:44:28 315,904 ----a-w C:\WINDOWS\system32\MSWMDM.dll
+ 2007-03-07 23:51:00 547,576 ------w C:\WINDOWS\system32\px.dll
+ 2007-03-07 23:51:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll
+ 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxcpya64.exe
+ 2007-03-07 23:51:00 510,712 ------w C:\WINDOWS\system32\pxdrv.dll
+ 2007-03-07 23:51:00 72,440 ------w C:\WINDOWS\system32\pxhpinst.exe
+ 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxinsa64.exe
+ 2007-03-07 23:51:00 187,128 ------w C:\WINDOWS\system32\pxmas.dll
+ 2007-03-07 23:51:00 1,628,920 ------w C:\WINDOWS\system32\pxsfs.dll
+ 2007-03-07 23:51:00 379,640 ------w C:\WINDOWS\system32\pxwave.dll
- 2002-12-11 15:34:40 241,664 ----a-w C:\WINDOWS\system32\qasf.dll
+ 2005-01-28 11:44:28 221,184 ----a-w C:\WINDOWS\system32\qasf.dll
+ 2005-01-28 11:44:28 47,104 ----a-w C:\WINDOWS\system32\uwdf.exe
+ 2007-03-07 23:51:00 39,672 ------w C:\WINDOWS\system32\vxblock.dll
+ 2005-01-28 11:44:28 15,872 ----a-w C:\WINDOWS\system32\wdfapi.dll
+ 2005-01-28 11:44:28 38,912 ----a-w C:\WINDOWS\system32\wdfmgr.exe
- 2002-12-11 17:11:02 410,248 ----a-w C:\WINDOWS\system32\wmadmod.dll
+ 2005-01-28 11:44:28 396,528 ----a-w C:\WINDOWS\system32\wmadmod.dll
- 2002-12-11 15:34:40 670,208 ----a-w C:\WINDOWS\system32\wmadmoe.dll
+ 2005-01-28 11:44:28 716,288 ----a-w C:\WINDOWS\system32\wmadmoe.dll
- 2002-12-11 15:23:48 218,112 ----a-w C:\WINDOWS\system32\wmasf.dll
+ 2005-01-28 11:44:28 224,768 ----a-w C:\WINDOWS\system32\wmasf.dll
- 2001-10-26 15:29:46 22,528 ----a-w C:\WINDOWS\system32\wmdmlog.dll
+ 2005-01-28 11:44:28 28,160 ----a-w C:\WINDOWS\system32\WMDMLOG.dll
- 2001-10-26 15:29:46 20,480 ----a-w C:\WINDOWS\system32\wmdmps.dll
+ 2005-01-28 11:44:28 33,792 ----a-w C:\WINDOWS\system32\WMDMPS.dll
+ 2005-01-28 11:44:28 335,872 ----a-w C:\WINDOWS\system32\WMDRMdev.dll
+ 2005-01-28 11:44:28 290,816 ----a-w C:\WINDOWS\system32\WMDRMNet.dll
- 2002-12-11 13:16:58 143,360 ----a-w C:\WINDOWS\system32\wmidx.dll
+ 2005-01-28 11:44:28 150,016 ----a-w C:\WINDOWS\system32\wmidx.dll
- 2002-12-11 15:23:58 981,504 ----a-w C:\WINDOWS\system32\wmnetmgr.dll
+ 2005-01-28 11:44:28 1,027,072 ----a-w C:\WINDOWS\system32\wmnetmgr.dll
- 2002-12-11 17:12:50 760,968 ----a-w C:\WINDOWS\system32\wmsdmod.dll
+ 2005-01-28 11:44:28 774,904 ----a-w C:\WINDOWS\system32\wmsdmod.dll
- 2002-12-11 15:34:40 1,111,040 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
+ 2005-01-28 11:44:28 1,119,744 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
- 2002-12-11 17:07:54 486,536 ----a-w C:\WINDOWS\system32\wmspdmod.dll
+ 2005-01-28 11:44:28 413,944 ----a-w C:\WINDOWS\system32\wmspdmod.dll
- 2002-12-11 15:34:40 892,416 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
+ 2005-01-28 11:44:28 940,544 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
+ 2005-01-28 11:44:28 1,218,808 ----a-w C:\WINDOWS\system32\wmvadvd.dll
+ 2005-01-28 11:44:28 1,512,448 ----a-w C:\WINDOWS\system32\WMVADVE.DLL
- 2002-12-11 17:02:38 2,058,888 ----a-w C:\WINDOWS\system32\wmvcore.dll
+ 2005-01-28 11:44:28 2,370,296 ----a-w C:\WINDOWS\system32\wmvcore.dll
- 2002-12-11 17:10:00 816,264 ----a-w C:\WINDOWS\system32\wmvdmod.dll
+ 2005-01-28 11:44:28 895,736 ----a-w C:\WINDOWS\system32\wmvdmod.dll
- 2002-12-11 15:34:40 997,888 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
+ 2005-01-28 11:44:28 1,003,008 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
+ 2005-01-28 11:44:28 38,912 ----a-w C:\WINDOWS\system32\wpd_ci.dll
+ 2005-01-28 11:44:28 61,952 ----a-w C:\WINDOWS\system32\wpdconns.dll
+ 2005-01-28 11:44:28 114,176 ----a-w C:\WINDOWS\system32\wpdmtp.dll
+ 2005-01-28 11:44:28 331,776 ----a-w C:\WINDOWS\system32\wpdmtpdr.dll
+ 2005-01-28 11:44:28 66,560 ----a-w C:\WINDOWS\system32\wpdmtpus.dll
+ 2005-01-28 11:44:28 331,264 ----a-w C:\WINDOWS\system32\wpdsp.dll
+ 2005-01-28 11:44:28 10,752 ----a-w C:\WINDOWS\system32\wpdtrace.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-03-09 15:29 7561216]
"nwiz"="nwiz.exe" [2006-03-09 15:29 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-03-09 15:29 86016]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-12-31 09:16 2594712]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-01-14 16:36:52 962661]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2004-03-04 16:46 172032 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-12-14 03:42 144784 C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"=
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2008-01-21 18:11]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2008-01-21 18:12]
S1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-01-04 14:13]
S1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\System32\drivers\pctmp.sys [2008-01-04 14:13]
S1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\System32\drivers\pctssipc.sys [2008-01-04 14:13]
*Newly Created Service* - ADILOADER
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 19:33:25
Windows 5.1.2600 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-17 19:33:52
ComboFix-quarantined-files.txt 2008-05-17 17:33:50
ComboFix2.txt 2008-05-04 11:45:20
Pre-Run: 1,259,945,984 bajtów wolnych
Post-Run: 1,257,504,768 bajtów wolnych
308
