ComboFix 07-09-17.2 - "Mati" 2007-09-17 22:45:34.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.467 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 ))))))))))))))))))))))))))))))) . 2007-09-17 22:45 99,328 --a------ C:\hxvaqsbo.exe 2007-09-17 22:45 86,528 --a------ C:\jvrmgf.exe 2007-09-17 22:45 75,264 --a------ C:\hbwpb.exe 2007-09-17 22:41 d-------- C:\!KillBox 2007-09-17 22:15 61,952 --a------ C:\WINDOWS\NirCmd.exe 2007-09-17 21:33 d-------- C:\DOCUME~1\Mati\DANEAP~1\foobar2000 2007-09-17 21:21 d-------- C:\WINDOWS\nview 2007-09-17 21:16 d-------- C:\Program Files\mks_vir_2007 2007-09-17 21:14 d-------- C:\WINDOWS\NV11561364.TMP 2007-09-17 21:13 d-------- C:\NVIDIA 2007-09-17 21:12 d-------- C:\Program Files\foobar2000 2007-09-17 21:11 d-------- C:\DOCUME~1\Mati\DANEAP~1\Tibia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2005-11-29 10:18 77 ---hs---- C:\Program Files\Common Files\Desktop.ini 2004-09-28 03:00 26240 --a------ C:\WINDOWS\inf\RAMDSK.SYS . ((((((((((((((((((((((((((((( snapshot_2007-09-17_222148,37 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 1,044,480 2005-04-07 17:48:42 C:\WINDOWS\explorer.exe ----a-w 101,376 2004-08-03 21:44:30 C:\WINDOWS\system32\userinit.exe ----a-w 76,800 2004-08-03 21:44:28 C:\WINDOWS\system32\rundll32.exe ----a-w 16,384 2004-08-03 21:44:30 C:\WINDOWS\system32\winver.exe ----a-w 525,824 2004-08-03 21:44:22 C:\WINDOWS\system32\logonui.exe ----a-w 26,624 2004-08-03 21:44:20 C:\WINDOWS\system32\dmremote.exe ----a-w 21,504 2004-08-03 21:44:20 C:\WINDOWS\system32\dumprep.exe ----a-w 192,512 2004-08-03 21:44:20 C:\WINDOWS\system32\dwwin.exe ----a-w 116,736 2004-08-03 21:44:22 C:\WINDOWS\system32\magnify.exe ----a-w 187,392 2004-08-03 21:44:22 C:\WINDOWS\system32\mobsync.exe ----a-w 77,824 2004-08-03 21:44:26 C:\WINDOWS\system32\odbcad32.exe ----a-w 259,584 2004-08-03 21:44:26 C:\WINDOWS\system32\osk.exe ----a-w 150,528 2004-08-03 21:44:28 C:\WINDOWS\system32\taskmgr.exe ----a-w 93,696 2004-08-03 21:44:30 C:\WINDOWS\system32\utilman.exe ----a-w 24,576 2004-08-03 21:44:30 C:\WINDOWS\system32\wscntfy.exe ----a-w 357,888 2004-08-03 21:44:28 C:\WINDOWS\system32\tourstart.exe ----a-w 49,664 2004-08-10 20:05:14 C:\WINDOWS\system32\wdfmgr.exe ----a-w 151,552 2004-08-03 22:44:30 C:\WINDOWS\system32\wuauclt.exe ----a-w 419,328 2004-08-03 22:33:18 C:\WINDOWS\system32\mstsc.exe ----a-w 549,888 2004-08-03 22:44:28 C:\WINDOWS\system32\spider.exe ----a-w 66,560 2001-10-26 16:29:54 C:\WINDOWS\system32\freecell.exe ----a-w 171,520 2001-10-26 16:29:58 C:\WINDOWS\system32\mshearts.exe ----a-w 163,328 2001-10-26 16:30:06 C:\WINDOWS\system32\winmine.exe ----a-w 68,096 2001-10-26 16:30:02 C:\WINDOWS\system32\sol.exe ----a-w 125,952 2001-10-26 16:29:48 C:\WINDOWS\system32\calc.exe ----a-w 172,098 2007-04-19 11:26:00 C:\WINDOWS\system32\nvsvc32.exe ----a-w 1,671,168 2007-04-19 11:26:00 C:\WINDOWS\system32\nwiz.exe ----a-w 806,912 2007-04-19 11:26:00 C:\WINDOWS\system32\nvcplui.exe ------w 65,808 2000-06-26 05:44:20 C:\WINDOWS\system32\MsPMSPSv.exe ----a-w 322,048 2007-07-22 16:39:28 C:\WINDOWS\system32\swreg.exe ----a-w 32,768 2007-09-17 20:43:32 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2007-09-17 20:43:32 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat ----a-w 10,240 2007-09-17 20:45:28 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SXGFK3KB\adv735[1].exe ----a-w 16,384 2007-09-17 20:43:32 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 253,440 2004-08-03 21:44:22 C:\WINDOWS\system32\usmt\migwiz.exe ----a-w 393,728 2004-08-03 22:44:28 C:\WINDOWS\system32\Restore\rstrui.exe ----a-r 79,872 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\xlicons.exe ----a-r 46,080 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\wordicon.exe ----a-r 38,912 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\misc.exe ----a-r 40,960 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\pptico.exe ----a-r 165,888 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\accicons.exe ----a-w 177,664 2007-03-13 08:57:12 C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . ----a-w 1,033,728 2005-04-07 17:48:42 C:\WINDOWS\explorer.exe ----a-w 25,088 2004-08-03 21:44:30 C:\WINDOWS\system32\userinit.exe ----a-w 33,280 2004-08-03 21:44:28 C:\WINDOWS\system32\rundll32.exe ----a-w 5,632 2004-08-03 21:44:30 C:\WINDOWS\system32\winver.exe ----a-w 515,072 2004-08-03 21:44:22 C:\WINDOWS\system32\logonui.exe ----a-w 15,872 2004-08-03 21:44:20 C:\WINDOWS\system32\dmremote.exe ----a-w 10,752 2004-08-03 21:44:20 C:\WINDOWS\system32\dumprep.exe ----a-w 180,224 2004-08-03 21:44:20 C:\WINDOWS\system32\dwwin.exe ----a-w 73,216 2004-08-03 21:44:22 C:\WINDOWS\system32\magnify.exe ----a-w 143,872 2004-08-03 21:44:22 C:\WINDOWS\system32\mobsync.exe ----a-w 32,768 2004-08-03 21:44:26 C:\WINDOWS\system32\odbcad32.exe ----a-w 216,064 2004-08-03 21:44:26 C:\WINDOWS\system32\osk.exe ----a-w 139,776 2004-08-03 21:44:28 C:\WINDOWS\system32\taskmgr.exe ----a-w 50,176 2004-08-03 21:44:30 C:\WINDOWS\system32\utilman.exe ----a-w 13,824 2004-08-03 21:44:30 C:\WINDOWS\system32\wscntfy.exe ----a-w 347,136 2004-08-03 21:44:28 C:\WINDOWS\system32\tourstart.exe ----a-w 38,912 2004-08-10 20:05:14 C:\WINDOWS\system32\wdfmgr.exe ----a-w 112,128 2004-08-03 22:44:30 C:\WINDOWS\system32\wuauclt.exe ----a-w 408,576 2004-08-03 22:33:18 C:\WINDOWS\system32\mstsc.exe ----a-w 539,136 2004-08-03 22:44:28 C:\WINDOWS\system32\spider.exe ----a-w 55,808 2001-10-26 16:29:54 C:\WINDOWS\system32\freecell.exe ----a-w 128,000 2001-10-26 16:29:58 C:\WINDOWS\system32\mshearts.exe ----a-w 119,808 2001-10-26 16:30:06 C:\WINDOWS\system32\winmine.exe ----a-w 57,344 2001-10-26 16:30:02 C:\WINDOWS\system32\sol.exe ----a-w 115,200 2001-10-26 16:29:48 C:\WINDOWS\system32\calc.exe ----a-w 159,810 2007-04-19 11:26:00 C:\WINDOWS\system32\nvsvc32.exe ----a-w 1,626,112 2007-04-19 11:26:00 C:\WINDOWS\system32\nwiz.exe ----a-w 794,624 2007-04-19 11:26:00 C:\WINDOWS\system32\nvcplui.exe ------w 53,520 2000-06-26 05:44:20 C:\WINDOWS\system32\MsPMSPSv.exe ----a-w 293,376 2007-07-22 16:39:28 C:\WINDOWS\system32\swreg.exe ----a-w 32,768 2005-11-28 07:35:52 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2005-11-28 07:35:52 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat ----a-w 16,384 2005-11-28 07:35:52 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 242,688 2004-08-03 21:44:22 C:\WINDOWS\system32\usmt\migwiz.exe ----a-w 382,976 2004-08-03 22:44:28 C:\WINDOWS\system32\Restore\rstrui.exe ----a-r 69,120 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\xlicons.exe ----a-r 35,328 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\wordicon.exe ----a-r 28,160 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\misc.exe ----a-r 30,208 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\pptico.exe ----a-r 155,136 2005-11-28 08:37:42 C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\accicons.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-11-28 10:32] "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2005-07-17 23:21] "mkstray"="C:\Program Files\mks_vir_2007\bin\mkstray.exe" [2007-06-29 16:41] "MKSRegmon"="C:\Program Files\mks_vir_2007\bin\mksregmon.exe" [2007-05-24 05:06] "mks_mail"="C:\Program Files\mks_vir_2007\bin\mks_mail.exe" [2007-05-24 05:06] "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @="service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SystemSuite Task Manager"=2 (0x2) R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys R1 mksfwallf;mksfwallf;\??\C:\WINDOWS\system32\mksfwallf.sys R1 mksfwallt;mksfwallt;\??\C:\WINDOWS\system32\mksfwallt.sys R2 MksFwall;MksFwall;"C:\Program Files\mks_vir_2007\bin\MksFwall.exe" R2 MksPC;MksPC;"C:\Program Files\mks_vir_2007\bin\MksPC.exe" R2 MksUpdate;MksUpdate;"C:\Program Files\mks_vir_2007\bin\mksupdate.exe" R2 windrvNT;windrvNT;\??\C:\WINDOWS\system32\windrvNT.sys R3 mksidsf;mksidsf;\??\C:\WINDOWS\system32\mksidsf.sys R3 MksMonEn;MksMonEn;\??\C:\Program Files\mks_vir_2007\bin\MksMonEn.sys R3 MksMonEv;MksMonEv;\??\C:\Program Files\mks_vir_2007\bin\MksMonEv.sys R3 MksMonFd;MksMonFd;\??\C:\Program Files\mks_vir_2007\bin\MksMonFd.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3bc43ba-5fef-11da-8bb0-806d6172696f}] AutoRun\command- I:\Bin\Assetup.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-17 22:46:33 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-17 22:47:12 C:\ComboFix-quarantined-files.txt ... 2007-09-17 22:47 C:\ComboFix2.txt ... 2007-09-17 22:22 . --- E O F ---