ComboFix 07-11-08.1 - Kiwak 2007-11-15 9:37:23.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.506 [GMT 1:00]
Running from: C:\Documents and Settings\Kiwak.D-FD9BCB557F364\Pulpit\ComboFix(2).exe
.
((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.
2007-11-15 09:33
2007-11-07 19:48
2007-11-07 19:47
2007-11-07 13:59
2007-10-18 09:52 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-14 21:57 --------- d-----w C:\Documents and Settings\Kiwak.D-FD9BCB557F364\Dane aplikacji\Skype
2007-11-13 07:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ZangoSA
2007-11-07 20:28 --------- d-----w C:\Documents and Settings\Kiwak.D-FD9BCB557F364\Dane aplikacji\AdobeUM
2007-10-27 09:19 --------- d-----w C:\Program Files\Java
2007-10-18 08:42 --------- d-----w C:\Program Files\Winamp Remote
2007-10-18 08:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\OrbNetworks
2007-10-16 11:54 20 —h–w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\PKP_DLec.DAT
2007-10-13 11:45 --------- d-----w C:\Documents and Settings\Kiwak.D-FD9BCB557F364\Dane aplikacji\Winamp
2007-10-13 11:43 --------- d-----w C:\Program Files\Winamp
2007-10-13 11:42 --------- d-----w C:\Program Files\Winamp Toolbar
2007-10-13 11:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Winamp Toolbar
2007-09-15 09:46 283,232 ----a-w C:\WINDOWS\system32\mljjh.dll
2007-09-15 07:30 283,232 ----a-w C:\WINDOWS\system32\jkhfg.dll
2007-09-10 19:42 283,232 ----a-w C:\WINDOWS\system32\ddcya.dll
2007-09-10 18:36 283,232 ----a-w C:\WINDOWS\system32\gebca.dll
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
.
((((((((((((((((((((((((((((( snapshot@2007-11-14_23.35.13.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:51:04 8,482,304 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-10-25 16:57:22 8,483,328 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-09-28 05:19:39 18,089,592 ----a-w C:\WINDOWS\system32\MRT.exe
-
2007-11-02 07:12:57 18,238,072 ----a-w C:\WINDOWS\system32\MRT.exe
-
2007-11-15 08:31:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{07AA283A-43D7-4CBE-A064-32A21112D94D}]
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
“{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]
[HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
“{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]
[HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2005-11-11 22:47]
“nwiz”=“nwiz.exe” [2005-11-11 22:47 C:\WINDOWS\system32\nwiz.exe]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2005-11-11 22:47]
“RTHDCPL”=“RTHDCPL.EXE” [2005-06-08 07:42 C:\WINDOWS\RTHDCPL.EXE]
“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2003-10-31 18:42]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50]
“InCD”=“C:\Program Files\Ahead\InCD\InCD.exe” [2005-05-13 16:11]
“LiveMonitor”=“C:\Program Files\MSI\Live Update 3\LMonitor.exe” [2005-07-11 09:44]
“QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-05-19 01:01]
“Share-to-Web Namespace Daemon”=“C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe” [2002-04-11 03:19]
“AVFX Engine”=“C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe” [2006-06-09 00:11]
“V0220Mon.exe”=“C:\WINDOWS\V0220Mon.exe” [2006-06-28 18:01]
“CreativeTaskScheduler”=“C:\Program Files\Creative\Shared Files\CTSched.exe” [2006-01-09 03:43]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11]
“ZangoOE”=“C:\Program Files\Zango\bin\10.0.341.0\OEAddOn.exe” [2007-08-01 17:03]
“ZangoSA”=“C:\Program Files\Zango\bin\10.0.341.0\ZangoSA.exe” [2007-08-01 17:14]
“iTunesHelper”=“C:\Program Files\iTunes\iTunesHelper.exe” [2005-10-06 17:03]
“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-10-10 06:28]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24]
“Creative Live! Cam Manager”=“C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe” [2006-05-31 15:00]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-18 15:31]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36]
“Orb”=“C:\Program Files\Winamp Remote\bin\OrbTray.exe” [2007-10-08 01:18]
“Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [2007-10-16 11:53]
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2007-05-19 00:14:14]
DigiCell.lnk - C:\Program Files\MSI\DigiCell\DigiCell.exe [2005-07-29 10:10:42]
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-06-11 09:31:50]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-08-01 05:55:33]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-06-11 09:32:22]
SecureDoc.lnk - C:\Program Files\MSI\SecureDoc\Logon.exe [2007-05-19 00:14:41]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcya]
C:\WINDOWS\system32\ddcya.dll 2007-09-10 20:42 283232 C:\WINDOWS\system32\ddcya.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebca]
C:\WINDOWS\system32\gebca.dll 2007-09-10 19:36 283232 C:\WINDOWS\system32\gebca.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhfg]
C:\WINDOWS\system32\jkhfg.dll 2007-09-15 08:30 283232 C:\WINDOWS\system32\jkhfg.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljjh]
C:\WINDOWS\system32\mljjh.dll 2007-09-15 10:46 283232 C:\WINDOWS\system32\mljjh.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutu]
C:\WINDOWS\system32\vtutu.dll
R2 NkPtpEnumP2;NkPtpEnumP2;“C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe” -a -d=“C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll”
R3 PCAlertDriver;PCAlertDriver;??\C:\Program Files\MSI\Core Center\NTGLM7X.sys
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys
R3 RushTopDevice;RushTopDevice;??\C:\Program Files\MSI\Core Center\RushTop.sys
R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys
R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys
R3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys
*Newly Created Service* - DIGICELLDRIVER
.
Contents of the ‘Scheduled Tasks’ folder
“2007-10-07 17:59:09 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1183831158.job”
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 09:38:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-15 9:39:14
C:\ComboFix2.txt … 2007-11-14 23:35
.
— E O F —