ComboFix 08-02-16.2 - XP 2008-02-17 15:11:19.5 - FAT32 x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.687 [GMT 1:00]
Running from: C:\Documents and Settings\XP\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\XP\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\FOUND.001
C:\FOUND.001\FILE0000.CHK
C:\FOUND.001\FILE0001.CHK
C:\FOUND.001\FILE0002.CHK
C:\FOUND.001\FILE0003.CHK
C:\FOUND.001\FILE0004.CHK
C:\FOUND.001\FILE0005.CHK
.
((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))
.
2008-02-08 20:25 . 2008-02-08 20:25 47,312 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-02-08 20:25 . 2008-02-08 20:25 31,568 --a------ C:\WINDOWS\system32\drivers\HookCentre.sys
2008-02-08 20:22 . 2008-02-08 20:22
2008-02-08 20:22 . 2008-02-08 20:22 40,400 --a------ C:\WINDOWS\system32\drivers\GDTdiIcpt.sys
2008-02-08 20:22 . 2008-02-08 20:22 20,096 --a------ C:\WINDOWS\system32\drivers\GDNdisIc.sys
2008-02-08 20:21 . 2008-02-08 20:21
2008-02-08 20:21 . 2008-02-08 20:21
2008-02-08 20:21 . 2008-02-08 20:21
2008-02-07 14:04 . 2008-02-07 14:08 5,364 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-07 12:34 . 2008-02-07 12:34
2008-02-07 12:33 . 2008-02-07 12:33
2008-02-07 12:33 . 2008-02-07 12:33
2008-02-07 12:33 . 2008-02-07 12:33
2008-02-07 12:28 . 2008-02-07 12:28
2008-02-07 12:28 . 2006-12-03 17:15 111,104 --a------ C:\WINDOWS\system32\Uharc.exe
2008-02-07 12:28 . 2008-02-07 12:28 78,942 --a------ C:\WINDOWS\Icon_1.ico
2008-02-07 12:28 . 2006-12-03 17:15 19,968 --a------ C:\WINDOWS\system32\reico.exe
2008-02-07 12:28 . 2006-12-03 17:14 8,636 --a------ C:\WINDOWS\system32\modifype.exe
2008-02-04 13:29 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll
2008-02-04 13:29 . 2008-02-04 13:29 24 --a------ C:\WINDOWS\LogonStudio.ini
2008-02-04 11:26 . 2008-02-04 11:27 520 --a------ C:\hpfr3320.xml
2008-02-04 11:04 . 2008-02-04 11:04
2008-02-03 21:05 . 2008-02-03 21:06
2008-02-02 19:37 . 2008-02-04 14:16 163,712 --a------ C:\WINDOWS\system32\drivers\vidstub.sys
2008-02-02 18:17 . 2008-02-02 18:17
2008-02-01 17:16 . 2008-02-01 17:16
2008-02-01 17:16 . 2008-02-01 17:16
2008-01-31 18:40 . 2008-01-31 18:40
2008-01-31 18:40 . 2002-09-22 12:42 17,408 --a------ C:\WINDOWS\Shortcut.exe
2008-01-30 21:13 . 2008-01-30 21:13
2008-01-30 20:55 . 2008-01-30 20:55
2008-01-30 11:33 . 2008-01-30 11:33
2008-01-29 11:44 . 2008-02-07 14:08 5,760,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-01-29 11:44 . 2008-02-07 14:08 69,118 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-01-29 11:42 . 2008-01-29 11:42
2008-01-29 10:40 . 2008-02-06 13:55 250 --a------ C:\WINDOWS\gmer.ini
2008-01-28 19:24 . 2008-01-28 19:24 100 --a------ C:\index.ini
2008-01-26 13:52 . 2008-01-26 13:52
2008-01-26 13:08 . 2008-01-26 13:08
2008-01-23 17:26 . 2008-01-23 17:26
2008-01-23 17:26 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-01-23 17:24 . 2008-01-23 17:24
2008-01-22 14:07 . 2008-01-22 14:07
2008-01-19 19:38 . 2008-01-19 19:38
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-31 17:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-31 17:01 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-31 17:00 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-29 10:44 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-01-13 17:51 --------- d-----w C:\Program Files\Yahoo!
2008-01-13 17:51 --------- d-----w C:\Program Files\CCleaner
2008-01-13 16:51 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-13 16:41 --------- d-----w C:\Program Files\Electronic Arts
2008-01-07 19:37 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-07 19:37 --------- d-----w C:\Documents and Settings\XP\Dane aplikacji\Thunderbird
2007-12-27 08:25 --------- d-----w C:\Program Files\Alwil Software
2007-12-27 08:08 --------- d-----w C:\Documents and Settings\XP\Dane aplikacji\PCToolsFirewallPlus
2007-12-26 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360]
“LClock”=“C:\Program Files\LClock\lclock.exe” []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“AdslTaskBar”=“stmctrl.dll” [2006-06-02 12:01 151552 C:\WINDOWS\system32\stmctrl.dll]
“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 13:49 20480]
“nwiz”=“nwiz.exe” [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2007-12-05 01:41 81920]
“a-squared”=“C:\Program Files\a-squared Anti-Malware\a2guard.exe” [2008-02-09 09:27 1845904]
“RAM Idle Professional”=“C:\Program Files\RAM Idle LE\RAM_XP.exe” [2006-01-17 05:38 135168]
“AVKTray”=“C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe” [2007-04-27 15:26 997200]
“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 15:55 32768]
“SkyTel”=“SkyTel.EXE” [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
“RTHDCPL”=“RTHDCPL.EXE” [2006-05-18 08:27 16207872 C:\WINDOWS\RTHDCPL.EXE]
“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2003-10-31 19:42 32768]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-12-05 01:41 8523776]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50 155648]
“HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe” [2002-11-04 20:11 188416]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 00:44 15360]
C:\Documents and Settings\XP\Menu Start\Programy\Autostart\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 20:41:18 65536]
Y’z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 08:43:14 155648]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 08:43:08 180224]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00 734872]
G DATA Firewall Tray.lnk - C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe [2008-02-08 20:22:12 874320]
R0 GDNdisIc;GDNdisIc;C:\WINDOWS\system32\drivers\GDNdisIc.sys [2008-02-08 20:22]
R2 AVKProxy;AVKProxy;“C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe” [2007-06-20 15:00]
R2 AVKService;AVK Service;C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe [2007-04-02 12:20]
R2 AVKWCtl;Strażnik AVK;C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe [2007-04-02 11:09]
R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2008-02-08 20:22]
R3 GDFwSvc;G DATA Personal Firewall;C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe [2007-05-31 14:53]
R3 GDMnIcpt;GDMnIcpt;C:\WINDOWS\system32\drivers\MiniIcpt.sys [2008-02-08 20:25]
R3 HookCentre;HookCentre;C:\WINDOWS\system32\drivers\HookCentre.sys [2008-02-08 20:25]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 15:51]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 16:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{453941ef-1072-11dc-8adb-0016e658c847}]
\Shell\AutoRun\command - H:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{73caf722-11c2-11dc-8ade-0016e658c847}]
\Shell\AutoRun\command - H:\Autorun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-17 15:13:13
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-17 15:13:33
ComboFix-quarantined-files.txt 2008-02-17 14:13:32
.
2007-11-25 12:42:45 — E O F —