Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:02:04, on 2008-05-24
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Picasa2\PicasaMediaDetector.exe
D:\natural color\NaturalColorLoad.exe
C:\WINDOWS\System32\windfk.exe
C:\WINDOWS\System32\cmdld.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Paweł\Pulpit\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SlowDownCPU] C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [ldmgr] C:\WINDOWS\System32\ldmgr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] D:\Picasa2\PicasaMediaDetector.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
--
End of file - 5467 bytes
Tu z Combofix
ComboFix 08-05-21.3 - Paweł 2008-05-24 12:59:56.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.499 [GMT 2:00]
Running from: C:\Program Files\Piosenki\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-24 to 2008-05-24 )))))))))))))))))))))))))))))))
.
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-05-24 12:44 . 2008-03-17 19:17 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-05-24 12:44 . 2008-05-24 12:44 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-24 10:55 . 2008-05-24 10:55 250,368 --a------ C:\WINDOWS\system32\cmdld.exe
2008-05-24 10:55 . 2008-05-24 10:55 247,296 --a------ C:\WINDOWS\system32\ldmgr.exe
2008-05-24 10:55 . 2008-05-24 10:55 231,936 --a------ C:\WINDOWS\system32\hdfmig.exe
2008-05-24 10:55 . 2008-05-24 12:47 194,560 --a------ C:\WINDOWS\system32\windfk.exe
2008-05-23 14:31 . 2008-05-23 14:31 274,944 --a------ C:\WINDOWS\system32\wintime.exe
2008-05-17 13:35 . 2008-05-17 13:35 <DIR> d-------- C:\Program Files\Google
2008-05-17 13:08 . 2003-08-08 15:33 188,928 --a------ C:\GaduReader.exe
2008-05-16 18:00 . 2008-05-16 18:00 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Corel
2008-05-16 18:00 . 2008-05-16 18:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-05-16 17:28 . 2008-05-16 18:00 5,852 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-05-16 17:28 . 2008-05-16 18:00 88 -r-hs---- C:\WINDOWS\system32\6BCB731F28.sys
2008-05-15 16:54 . 2008-05-15 16:54 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Hamachi
2008-05-15 16:53 . 2008-05-15 16:53 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-05-15 15:40 . 2008-05-15 15:40 <DIR> d-------- C:\ConvertTemp
2008-05-14 17:54 . 2001-10-26 17:30 286,720 --a------ C:\WINDOWS\system32\msh263.drv
2008-05-14 17:54 . 2001-08-18 06:24 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2008-05-14 17:54 . 2001-08-18 06:24 135,040 --a------ C:\WINDOWS\system32\dllcache\portcls.sys
2008-05-14 17:54 . 2001-08-17 22:01 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-05-14 17:54 . 2001-08-17 22:01 57,344 --a------ C:\WINDOWS\system32\dllcache\drmk.sys
2008-05-14 17:54 . 2001-10-26 17:29 50,688 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll
2008-05-14 17:54 . 2001-10-26 17:29 45,568 --a------ C:\WINDOWS\system32\iyuv_32.dll
2008-05-14 17:54 . 2001-10-26 17:29 45,568 --a------ C:\WINDOWS\system32\dllcache\iyuv_32.dll
2008-05-14 17:54 . 2001-10-26 17:29 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll
2008-05-14 17:54 . 2001-10-26 17:29 8,192 --a------ C:\WINDOWS\system32\dllcache\tsbyuv.dll
2008-05-14 17:09 . 2008-05-14 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2008-05-13 19:02 . 2001-08-17 22:03 21,760 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-13 17:48 . 2008-05-13 17:48 <DIR> d-------- C:\Fraps
2008-05-13 17:48 . 2008-05-13 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-12 16:20 . 2008-05-12 16:20 <DIR> d-------- C:\Program Files\PhotoFiltre
2008-05-12 16:10 . 2008-05-12 16:10 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\CursorArts
2008-05-12 11:56 . 2008-05-12 11:56 303 --a------ C:\WINDOWS\ST6UNST.002
2008-05-12 11:56 . 2008-05-12 11:56 303 --a------ C:\WINDOWS\ST6UNST.001
2008-05-12 11:56 . 2008-05-12 11:56 303 --a------ C:\WINDOWS\ST6UNST.000
2008-05-12 11:54 . 2008-05-12 11:58 249,856 --------- C:\WINDOWS\Setup1.exe
2008-05-12 11:54 . 2008-05-12 11:58 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-10 20:03 . 2001-10-26 16:47 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys
2008-05-10 20:03 . 2001-10-26 16:47 36,224 --a------ C:\WINDOWS\system32\dllcache\isapnp.sys
2008-05-10 20:03 . 2003-07-02 04:42 27,904 --a------ C:\WINDOWS\system32\drivers\VIAAGP1.SYS
2008-05-10 20:03 . 2007-09-21 17:49 9,216 --a------ C:\WINDOWS\system32\drivers\videX32.sys
2008-05-10 19:50 . 2001-09-19 13:28 9,728 --a------ C:\WINDOWS\system32\drivers\viausb1.sys
2008-05-10 19:49 . 2008-05-10 19:49 <DIR> d-------- C:\Documents and Settings\Paweł\WINDOWS
2008-05-10 19:49 . 2008-05-10 19:49 <DIR> d-------- C:\Documents and Settings\Paweł\WINDOWS
2008-05-10 18:48 . 2008-05-10 18:48 <DIR> d-------- C:\Program Files\VIA
2008-05-10 18:48 . 2007-04-11 15:35 331,184 --------- C:\WINDOWS\system32\difxapi.dll
2008-05-10 18:48 . 2007-06-27 14:42 207,488 -ra------ C:\WINDOWS\system32\drivers\vinyl97.sys
2008-05-10 18:43 . 2008-05-10 18:44 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\ATI
2008-05-10 18:39 . 2008-05-10 18:39 <DIR> d-------- C:\ATI
2008-05-10 18:28 . 2007-12-04 16:44 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-05-06 10:05 . 2008-05-06 10:05 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Samsung
2008-05-06 10:03 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2008-05-06 10:03 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2008-05-06 10:02 . 2008-05-06 10:02 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-05-06 10:02 . 2008-05-06 10:02 <DIR> d-------- C:\Program Files\Samsung
2008-05-06 10:02 . 2007-05-02 11:11 109,704 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys
2008-05-06 10:02 . 2007-05-02 11:11 83,592 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys
2008-05-06 10:02 . 2007-05-02 11:11 15,112 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys
2008-05-06 10:02 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys
2008-05-06 10:02 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys
2008-05-06 10:02 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys
2008-05-06 10:02 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys
2008-05-06 10:02 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-05-02 22:23 . 2008-05-03 18:22 368 --a------ C:\WINDOWS\3Gsauron.INI
2008-05-02 20:15 . 2008-05-02 20:15 <DIR> d-------- C:\Program Files\Common Files\GTK
2008-05-02 20:03 . 2008-05-02 20:03 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\screennemo
2008-05-01 16:44 . 2008-05-01 16:44 <DIR> d-------- C:\Documents and Settings\Paweł\.thumbnails
2008-05-01 16:44 . 2008-05-01 16:44 <DIR> d-------- C:\Documents and Settings\Paweł\.thumbnails
2008-05-01 16:42 . 2008-05-01 16:42 <DIR> d-------- C:\Documents and Settings\Paweł\.gimp-2.2
2008-05-01 16:42 . 2008-05-01 16:42 <DIR> d-------- C:\Documents and Settings\Paweł\.gimp-2.2
2008-05-01 16:37 . 2008-05-02 20:19 222 --a------ C:\WINDOWS\VOGEL.INI
2008-04-30 11:56 . 2008-04-30 11:56 <DIR> d-------- C:\Program Files\Piosenki
2008-04-30 11:16 . 2008-04-30 11:17 <DIR> d-------- C:\Program Files\Winamp
2008-04-30 11:16 . 2008-04-30 11:17 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Winamp
2008-04-29 15:58 . 2005-08-06 05:06 28,704 -ra------ C:\WINDOWS\system32\drivers\usb2vcom.sys
2008-04-29 15:57 . 2003-03-05 09:07 54,784 -ra------ C:\WINDOWS\system32\drivers\ousb2hub.sys
2008-04-29 15:57 . 2003-03-05 09:07 39,680 -ra------ C:\WINDOWS\system32\drivers\ousbehci.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-24 10:47 23,524 ----a-w C:\WINDOWS\system32\drivers\GVTDrv.sys
2008-04-13 06:11 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-10 15:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-08 21:04 --------- d-----w C:\Program Files\ivo
2008-04-04 09:00 --------- d-----w C:\Program Files\Common Files\DirectX
2008-04-02 18:06 --------- d-----w C:\Program Files\Ahead
2008-04-01 18:36 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Ahead
2008-04-01 18:34 --------- d-----w C:\Program Files\Nero
2008-04-01 18:34 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-30 22:31 --------- d-----w C:\Program Files\Lavalys
2008-03-30 19:46 --------- d-----w C:\Program Files\D-Tools
2008-03-29 19:15 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Media Player Classic
2008-03-29 15:57 --------- d-----w C:\Program Files\AnMing
2008-03-29 15:33 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\NCH Swift Sound
2008-03-29 15:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound
2008-03-27 21:02 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-26 19:47 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\MSN6
2008-03-26 19:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MSN6
2008-03-25 20:18 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Azureus
2008-03-25 20:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-03-25 20:17 --------- d-----w C:\Program Files\Azureus
2008-03-24 22:22 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-03-24 22:20 --------- d-----w C:\Program Files\Java
2008-03-24 22:19 --------- d-----w C:\Program Files\Common Files\Java
2005-02-25 01:22 208,896 ----a-w C:\WINDOWS\inf\MSI\SlowDownCPU\SlowDownCPU.exe
2005-02-22 05:47 39,040 ----a-w C:\WINDOWS\inf\MSI\SlowDownCPU\RushTop.sys
2005-02-22 05:47 143,360 ----a-w C:\WINDOWS\inf\MSI\SlowDownCPU\RushTop.dll
2004-11-01 08:12 23,424 ----a-w C:\WINDOWS\inf\MSI\SlowDownCPU\NTGLM7X.SYS
2004-11-01 08:11 94,208 ----a-w C:\WINDOWS\inf\MSI\SlowDownCPU\GLM7x.dll
.
------- Sigcheck -------
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 17:29 13312]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"Picasa Media Detector"="D:\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SlowDownCPU"="C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe" [2005-02-25 03:22 208896]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
"VGAUtil"="C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe" [2004-09-17 13:32 552960]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"AudioDeck"="C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [2007-08-09 15:48 528384]
"ldmgr"="C:\WINDOWS\System32\ldmgr.exe" [2008-05-24 10:55 247296]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
NaturalColorLoad.lnk - D:\natural color\NaturalColorLoad.exe [2008-03-17 20:36:15 155715]
R0 videX32;videX32;C:\WINDOWS\System32\DRIVERS\videX32.sys [2007-09-21 17:49]
R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-16 01:20]
R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\System32\Drivers\ousbehci.sys [2003-03-05 09:07]
R3 GVTDrv;GVTDrv;C:\WINDOWS\System32\drivers\GVTDrv.sys [2008-05-24 12:47]
R3 RushTopDevice;RushTopDevice;C:\WINDOWS\INF\MSI\SlowDownCPU\RushTop.sys [2005-02-22 07:47]
R3 SlowDownCPU;SlowDownCPU;C:\WINDOWS\INF\MSI\SlowDownCPU\NTGLM7X.sys [2004-11-01 10:12]
R3 xgdimirror;xgdimirror;C:\WINDOWS\System32\DRIVERS\xgdimirror.sys [2005-03-05 12:06]
S1 oxser;OX16C95x Serial port driver;C:\WINDOWS\System32\DRIVERS\oxser.sys []
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\System32\DRIVERS\ss_bus.sys [2007-05-02 11:11]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\System32\DRIVERS\ss_mdfl.sys [2007-05-02 11:11]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\System32\DRIVERS\ss_mdm.sys [2007-05-02 11:11]
S3 usb2vcom;USB Data Cable;C:\WINDOWS\System32\DRIVERS\usb2vcom.sys [2005-08-06 05:06]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2001-08-17 22:03]
S3 viafilter;VIA USB Filter;C:\WINDOWS\System32\Drivers\viausb1.sys [2001-09-19 13:28]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-24 13:00:35
Windows 5.1.2600 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-24 13:00:51
ComboFix-quarantined-files.txt 2008-05-24 11:00:50
Pre-Run: 2,713,141,248 bajtów wolnych
Post-Run: 2,714,484,736 bajtów wolnych
186
