ComboFix 08-01-04.1 - Dawid 2008-01-07 15:38:22.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.639 [GMT 1:00] Running from: C:\Documents and Settings\Dawid\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\server.exe . ((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 ))))))))))))))))))))))))))))))) . 2008-01-05 17:28 . 2008-01-05 17:34 d----c--- C:\Program Files\ErrorKiller 2008-01-04 19:34 . 2008-01-04 19:34 d----c--- C:\Program Files\MP3 Player Utilities 4.15 2008-01-04 12:04 . 2008-01-04 12:04 d----c--- C:\Program Files\directx 2008-01-02 11:05 . 2008-01-02 11:05 d----c--- C:\Program Files\Lavasoft 2008-01-02 10:22 . 2008-01-02 10:22 d----c--- C:\Program Files\PITy 2007-12-31 12:48 . 2007-12-31 12:49 d----c--- C:\Program Files\Deutsch Translator 2 2007-12-31 12:46 . 2008-01-06 11:21 d----c--- C:\Program Files\English Translator 3 2007-12-31 12:17 . 2007-12-31 12:17 d----c--- C:\Program Files\ATI 2007-12-30 08:41 . 1998-10-07 13:54 327,168 --a--c--- C:\WINDOWS\IsUn0415.exe 2007-12-29 08:11 . 2008-01-04 10:58 d----c--- C:\Documents and Settings\Dawid\Dane aplikacji\XnView 2007-12-25 09:09 . 2004-08-03 23:00 22,016 --a--c--- C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2007-12-25 09:09 . 2004-08-03 23:00 22,016 --a--c--- C:\WINDOWS\system32\dllcache\msircomm.sys 2007-12-25 09:01 . 2000-07-14 23:00 434,252 --a--c--- C:\WINDOWS\system32\Msvcrtd.dll 2007-12-24 17:14 . 2007-12-24 17:14 d----c--- C:\Documents and Settings\Dawid\Dane aplikacji\Jasc 2007-12-24 17:13 . 2007-12-24 17:13 d----c--- C:\Program Files\Jasc Software Inc 2007-12-22 13:32 . 2007-07-02 11:27 338,304 --a--c--- C:\WINDOWS\system32\_AxShlEx.dll 2007-12-22 13:31 . 2007-12-22 13:31 d----c--- C:\Program Files\Alcohol Soft 2007-12-21 19:15 . 2007-12-21 19:17 d----c--- C:\Program Files\Common Files\EasyInfo 2007-12-16 15:59 . 2007-12-16 15:59 d----c--- C:\WINDOWS\system32\QuickTime 2007-12-16 15:59 . 1999-11-10 12:05 86,016 --a--c--- C:\WINDOWS\unvise32qt.exe 2007-12-16 15:59 . 2007-12-16 20:46 50,452 --a--c--- C:\WINDOWS\system32\QuickTime.qtp 2007-12-15 22:11 . 2007-12-15 22:11 d----c--- C:\Program Files\FLVPlayer 2007-12-15 21:53 . 2007-12-15 04:48 d----c--- C:\Program Files\AviSynth 2.5 2007-12-15 21:53 . 2004-02-22 10:11 719,872 --a--c--- C:\WINDOWS\system32\devil.dll 2007-12-15 21:53 . 2006-10-07 17:43 502,784 --a--c--- C:\WINDOWS\x2.64.exe 2007-12-15 21:53 . 2007-05-14 15:24 394,240 --a--c--- C:\WINDOWS\system32\Smab.dll 2007-12-15 21:53 . 2007-05-17 17:30 318,976 --a--c--- C:\WINDOWS\system32\avisynth.dll 2007-12-15 21:53 . 2005-02-28 13:16 240,128 --a--c--- C:\WINDOWS\system32\x.264.exe 2007-12-15 21:53 . 2006-04-12 09:47 217,073 --a--c--- C:\WINDOWS\meta4.exe 2007-12-15 21:53 . 2004-01-25 00:00 70,656 --a--c--- C:\WINDOWS\system32\yv12vfw.dll 2007-12-15 21:53 . 2004-01-25 00:00 70,656 --a--c--- C:\WINDOWS\system32\i420vfw.dll 2007-12-15 21:53 . 2006-04-05 08:09 66,560 --a--c--- C:\WINDOWS\MOTA113.exe 2007-12-15 21:53 . 2005-07-14 12:31 27,648 --a--c--- C:\WINDOWS\system32\AVSredirect.dll 2007-12-15 21:35 . 2007-12-15 21:36 d----c--- C:\Documents and Settings\Dawid\Dane aplikacji\Ringtone 2007-12-15 12:14 . 2007-12-15 12:14 dr-h-c--- C:\Documents and Settings\Dawid\Dane aplikacji\SecuROM 2007-12-15 12:14 . 2007-12-15 12:14 107,888 --a--c--- C:\WINDOWS\system32\CmdLineExt.dll 2007-12-09 15:13 . 2007-12-10 17:01 d----c--- C:\Program Files\BitTorrent 2007-12-09 15:13 . 2007-12-22 06:37 d----c--- C:\Documents and Settings\Dawid\Dane aplikacji\BitTorrent 2007-12-09 06:41 . 2007-12-09 06:41 d----c--- C:\WINDOWS\NU_DATA 2007-12-07 16:11 . 2007-12-07 16:11 d----c--- C:\Documents and Settings\Dawid\Dane aplikacji\Reallusion 2007-12-07 16:10 . 2007-12-07 16:10 d----c--- C:\Program Files\Common Files\Reallusion . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-07 14:42 45,140,512 -csha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-01-07 14:24 622,688 -csha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-01-07 14:24 187,688 -csha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-01-07 14:24 1,852,192 -csha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-01-07 06:55 --------- dc----w C:\Program Files\Yahoo! 2008-01-06 16:15 --------- dc----w C:\Program Files\SubEdit-Player 2008-01-06 16:15 --------- dc----w C:\Program Files\IrfanView 2008-01-06 16:03 --------- dc----w C:\Program Files\jv16 PowerTools 2007 2008-01-04 10:52 --------- dc-h--w C:\Program Files\InstallShield Installation Information 2008-01-02 10:06 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\Lavasoft 2007-12-31 11:29 --------- dc----w C:\Program Files\microsoft frontpage 2007-12-31 10:09 --------- dc----w C:\Program Files\Java 2007-12-29 18:07 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\Image Zone Express 2007-12-28 16:49 --------- dc----w C:\Program Files\Common Files\Wise Installation Wizard 2007-12-24 16:48 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\gtk-2.0 2007-12-23 18:34 --------- dc--a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-06 05:51 --------- dc----w C:\Program Files\Common Files\ACD Systems 2007-11-30 17:04 --------- dc----w C:\Program Files\Maniac 2007-11-29 05:06 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\ACD Systems 2007-11-29 05:05 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2007-11-28 05:01 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\OtakuSoftware 2007-11-22 14:17 --------- dc----w C:\Program Files\DITel 2007-11-22 06:17 66,872 -c--a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-11-22 06:17 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-22 06:17 22,328 -c--a-w C:\Documents and Settings\Dawid\Dane aplikacji\PnkBstrK.sys 2007-11-22 06:17 103,736 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-16 05:13 536 -c-ha-w C:\os582744.bin 2007-11-16 05:08 --------- dc----w C:\Program Files\TI Education 2007-11-13 10:25 20,480 -c--a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-11 11:59 --------- dc----w C:\Program Files\Dzielenie i laczenie plikow 2007-11-11 11:50 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\Thinstall 2007-11-11 07:44 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2007-11-11 07:14 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-11-07 21:38 --------- dc----w C:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu 2007-10-29 22:44 1,291,264 -c--a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 05:31 139,264 -c--a-w C:\WINDOWS\system32\hpzjrd01.dll 2007-10-25 08:28 222,720 -c--a-w C:\WINDOWS\system32\wmasf.dll 2007-10-15 15:17 5,632 -c--a-w C:\WINDOWS\system32\BReWErS.dll 2007-06-18 16:57 314 -c--a-w C:\Program Files\INSTALL.LOG 2007-03-19 18:13 6,422,611 -c--a-w C:\Program Files\frostwire-4.13.1.6.windows.exe 2004-10-01 13:00 40,960 -c--a-w C:\Program Files\Uninstall_CDS.exe 2006-05-03 09:06 163,328 -csh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 -csh--r C:\WINDOWS\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kav"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-24 18:09 139367] "Odkurzacz-MCD"="D:\Odkurzacz 10.0 Pro\odk_mcd.exe" [2005-12-07 17:28 245248] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ WL-8314 Configuration Utility.lnk - C:\Program Files\PLANET WL-8314\WLANMON.exe [2007-03-11 10:30:45] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-08-03 11:51 202024 --a--c--- C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] G:\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] F:\kopia z poprzedniego dysku\Gadu-Gadu\gg.exe /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] HDAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kav] 2006-03-24 18:09 139367 --a--c--- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] 2007-08-08 08:25 1828136 --a--c--- C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 14:57 153136 --a--c--- C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-09-25 00:11 132496 --a--c--- C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-10-10 06:28 36352 --a--c--- C:\Program Files\Winamp\winampa.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-20 13:50] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] . Contents of the 'Scheduled Tasks' folder "2008-01-04 16:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-07 15:42:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-07 15:43:33 ComboFix-quarantined-files.txt 2008-01-07 14:43:31 . 2007-12-12 05:24:13 --- E O F ---