ComboFix 07-12-31.4 - Krzys 2008-01-02 18:39:59.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.65 [GMT 1:00] Running from: C:\Documents and Settings\Krzys\Ustawienia lokalne\Temporary Internet Files\Content.IE5\KLI34DQR\ComboFix[1].exe . ((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 ))))))))))))))))))))))))))))))) . 2008-01-01 22:19 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-01 21:35 . 2008-01-01 21:35 d-------- C:\Program Files\Trend Micro 2007-12-30 13:13 . 2007-12-30 13:13 d-------- C:\Program Files\Alwil Software 2007-12-30 13:13 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-12-29 19:42 . 2007-12-29 19:42 d-------- C:\Documents and Settings\Krzys\Dane aplikacji\PC Tools 2007-12-29 19:41 . 2008-01-02 18:15 d-------- C:\Program Files\PC Tools AntiVirus 2007-12-29 19:41 . 2007-12-29 19:41 d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Tools 2007-12-29 19:41 . 2006-11-24 11:19 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-29 19:41 . 2006-11-24 11:19 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-29 19:41 . 2007-09-17 13:38 22,528 --a------ C:\WINDOWS\system32\drivers\AVHook.sys 2007-12-29 19:41 . 2007-09-17 13:38 15,872 --a------ C:\WINDOWS\system32\drivers\AVRec.sys 2007-12-29 19:41 . 2007-09-17 13:38 15,872 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys 2007-12-29 19:32 . 2007-12-29 19:32 d-------- C:\Program Files\Advanced Registry Optimizer 2007-12-29 19:32 . 2007-12-29 19:32 d-------- C:\Documents and Settings\Krzys\Dane aplikacji\Sammsoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-02 17:07 --------- d-----w C:\Program Files\Skype 2008-01-02 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-01-01 14:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-01 14:59 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-01-01 14:55 --------- d-----w C:\Program Files\iPAQ Download Agent 2007-11-29 21:15 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-11-29 21:14 --------- d-----w C:\Program Files\Windows Live Favorites 2007-11-28 21:35 --------- d-----w C:\Program Files\Onet 2007-11-26 21:28 --------- d-----w C:\Program Files\eMule 2007-11-18 20:46 --------- d-----w C:\Program Files\Common Files\Onet.pl 2007-11-18 20:46 --------- d-----w C:\Documents and Settings\Krzys\Dane aplikacji\Flircik 2007-11-18 20:46 --------- d-----w C:\Documents and Settings\Krzys\Dane aplikacji\AutoUpdate 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-25 09:00 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll 2005-07-03 16:45 7,428,296 ----a-w C:\Program Files\INSTALL_MSN_MESSENGER_DL.EXE 2005-05-30 15:07 21,696,576 ----a-w C:\Program Files\AdbeRdr602_pol_full.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 22:42 401491] "Flircik"="C:\Program Files\Onet\Flircik\Flircik.exe" [ ] "AROReminder"="C:\Program Files\Advanced Registry Optimizer\aro.exe" [2007-07-23 09:34 2084480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-06-12 16:36 151552] "MKS_MENU"="C:\Program Files\MKS\Bin\mks_menu.exe" [2005-12-31 17:40 134656] "ABREGMON"="C:\Program Files\MKS\Bin\ABregmon.exe" [2005-10-28 18:46 70656] "PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2007-10-04 15:44 1082664] R1 ABTDI;ABTDI;C:\Program Files\MKS\Bin\ABTDI.sys [2005-09-29 21:05] R2 ppsio;PrmxPPDev;C:\WINDOWS\system32\drivers\ppsio.sys [1998-02-25 23:27] R3 MksMonEn;MkS_Mon Kernel Engine;C:\Program Files\MKS\Bin\MksMonEn.sys [2005-09-29 21:27] R3 MksMonEv;MkS_Mon Kernel Events;C:\Program Files\MKS\Bin\MksMonEv.sys [2005-09-29 21:05] R3 MksMonFd;MkS_Mon Kernel Filter Driver;C:\Program Files\MKS\Bin\MksMonFd.sys [2005-09-29 21:05] R3 NeroCd2k;NeroCd2k;C:\WINDOWS\system32\drivers\NeroCd2k.sys [2001-04-16 12:54] . Contents of the 'Scheduled Tasks' folder "2008-01-02 16:58:58 C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-01-01 21:09:00 C:\WINDOWS\Tasks\MkSUpdate.job" - C:\Program Files\MKS\bin\mks_upd.exe "2008-01-01 15:00:02 C:\WINDOWS\Tasks\{0F99B396-D6B9-494D-82E5-0ADFAFD00471}_CRISS_Krzys.job" - C:\WINDOWS\system32\mobsync.exe@ /Schedule= "2007-12-25 08:00:00 C:\WINDOWS\Tasks\{3475A2E8-D33F-4700-8962-40D18DA5FB1E}_CRISS_Krzys.job" - C:\WINDOWS\system32\mobsync.exe@ /Schedule= "2007-07-13 14:00:02 C:\WINDOWS\Tasks\{FB416D21-AFB6-4F9F-8FD0-E173D5E42C4E}_CRISS_Krzys.job" - C:\WINDOWS\system32\mobsync.exe@ /Schedule= . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-02 18:43:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-02 18:45:00 C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 17:44:47 . 2008-01-01 15:23:57 --- E O F ---