ComboFix 08-05-12.1 - Fransua 2008-05-14 21:09:56.1 - NTFSx86 NETWORK Running from: C:\Documents and Settings\Fransua\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dane aplikacji\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 C:\Documents and Settings\All Users\Dane aplikacji\SeekmoSA C:\Documents and Settings\All Users\Dane aplikacji\SeekmoSA\SeekmoSA.dat C:\Documents and Settings\All Users\Dane aplikacji\SeekmoSA\SeekmoSAAbout.mht C:\Documents and Settings\All Users\Dane aplikacji\SeekmoSA\SeekmoSAEULA.mht C:\Documents and Settings\Fransua\Dane aplikacji\m C:\Documents and Settings\Fransua\Dane aplikacji\m\flec006.exe C:\Documents and Settings\Fransua\Dane aplikacji\m\list.oct C:\Documents and Settings\Fransua\Dane aplikacji\Seekmo C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\Config.xml C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml C:\Documents and Settings\Fransua\Dane aplikacji\ShoppingReport\cs\res2\WhiteList.dbs C:\Program Files\seekmo C:\Program Files\seekmo\bin\10.0.406.0\arrow.ico C:\Program Files\seekmo\bin\10.0.406.0\copyright.txt C:\Program Files\seekmo\bin\10.0.406.0\CoreSrv.dll C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\components\npclntax.xpt C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\install.rdf C:\Program Files\seekmo\bin\10.0.406.0\firefox\extensions\plugins\npclntax_SeekmoSA.dll C:\Program Files\seekmo\bin\10.0.406.0\HostOL.dll C:\Program Files\seekmo\bin\10.0.406.0\InstIE.dll C:\Program Files\seekmo\bin\10.0.406.0\link.ico C:\Program Files\seekmo\bin\10.0.406.0\OEAddOn.exe C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSA.exe C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSADF.exe C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAHook.dll C:\Program Files\seekmo\bin\10.0.406.0\SeekmoUnInstaller.exe C:\Program Files\seekmo\bin\10.0.406.0\Srv.exe C:\Program Files\seekmo\bin\10.0.406.0\Wallpaper.dll C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Uninst.exe C:\WINDOWS\system32\drivers\downld C:\WINDOWS\system32\drivers\downld\833875.exe C:\WINDOWS\system32\drivers\downld\847515.exe C:\WINDOWS\system32\drivers\downld\849234.exe C:\WINDOWS\system32\drivers\downld\852375.exe C:\WINDOWS\system32\drivers\downld\883593.exe C:\WINDOWS\system32\drivers\downld\897796.exe C:\WINDOWS\system32\drivers\downld\905296.exe C:\WINDOWS\system32\drivers\hldrrr.exe C:\WINDOWS\system32\drivers\mdelk.exe C:\WINDOWS\system32\drivers\srosa.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SROSA -------\Service_srosa ((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 ))))))))))))))))))))))))))))))) . 2008-05-13 17:10 . 2008-05-13 17:10 2008-05-13 17:10 . 2008-05-13 17:10 2008-05-13 17:10 . 2008-05-13 17:10 2008-05-13 16:21 . 2008-05-13 16:40 2008-05-13 15:44 . 2008-05-13 15:44 2008-05-13 15:44 . 2008-05-13 15:44 77,523 --a------ C:\WINDOWS\system32\drivers\klif.cab 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2007-10-30 20:29 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2007-10-30 20:25 2008-05-13 15:13 . 2008-05-13 15:13 2008-05-13 15:13 . 2008-05-14 21:13 1,024 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT.LOG 2008-05-13 14:59 . 2008-05-13 14:59 2008-05-10 18:56 . 2008-05-10 18:56 2008-05-10 18:54 . 2008-05-10 18:54 2008-05-10 17:55 . 2008-05-10 18:01 2008-05-10 17:55 . 2008-05-10 18:33 2008-05-09 21:33 . 2008-05-09 21:33 29 --a------ C:\WINDOWS\wordpad.ini 2008-05-09 21:31 . 2008-05-09 21:32 2008-05-08 18:21 . 2008-05-08 18:21 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-08 18:21 . 2008-05-08 18:21 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-08 07:40 . 2008-05-08 07:40 2008-05-08 07:32 . 2008-05-08 07:32 2008-05-08 07:32 . 2008-05-08 07:32 74,752 --a------ C:\WINDOWS\cadkasdeinst01e.exe 2008-05-07 21:46 . 2008-05-07 21:46 2008-05-07 21:39 . 2008-05-09 21:36 2008-05-07 21:26 . 2008-05-07 21:26 2008-05-06 16:37 . 2008-05-13 16:47 2008-05-04 08:54 . 2008-05-04 08:57 2008-05-04 08:53 . 2008-05-04 08:53 2008-05-04 08:27 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-05-04 08:11 . 2008-05-04 08:13 2008-05-04 08:07 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\003183_.tmp 2008-05-04 08:07 . 2008-05-04 08:24 2,639 --a------ C:\WINDOWS\imsins.BAK 2008-05-02 10:57 . 2008-05-02 10:57 2008-05-01 11:56 . 2008-05-01 11:56 0 --a------ C:\WINDOWS\Irremote.ini 2008-05-01 11:36 . 2008-05-13 16:21 2008-05-01 11:23 . 2008-05-01 11:23 2008-05-01 11:23 . 2008-05-01 11:26 2008-05-01 10:47 . 2008-05-01 10:47 2008-04-30 22:01 . 2008-04-30 22:01 2008-04-30 22:01 . 2002-12-21 20:01 274,432 --a------ C:\Documents and Settings\Fransua\wcpuid.exe 2008-04-30 22:01 . 2002-12-21 20:01 135,168 --a------ C:\Documents and Settings\Fransua\nrkctl32.dll 2008-04-30 22:01 . 2002-12-21 20:01 3,968 --a------ C:\Documents and Settings\Fransua\nrkctl32.sys 2008-04-26 15:22 . 2008-04-26 15:22 2008-04-26 12:32 . 2008-04-26 12:32 2008-04-26 12:29 . 2008-04-26 12:29 2008-04-26 08:38 . 2008-05-13 15:00 2008-04-26 08:32 . 2008-04-26 08:35 2008-04-26 08:32 . 1998-06-24 00:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-04-26 08:32 . 1998-06-24 00:00 67,376 --a------ C:\WINDOWS\system32\SYSINFO.OCX 2008-04-19 20:33 . 2008-04-19 20:33 2008-04-19 08:01 . 2008-04-19 08:03 2008-04-14 22:51 . 2008-04-14 22:51 20,992 --------- C:\WINDOWS\system32\spupdwxp.exe 2008-04-14 22:51 . 2008-04-14 22:51 20,992 --------- C:\WINDOWS\system32\faxpatch.exe 2008-04-14 22:51 . 2008-04-14 22:51 7,680 --a------ C:\WINDOWS\system32\spdwnwxp.exe 2008-04-14 22:33 . 2008-04-14 22:33 24,064 -----c— C:\WINDOWS\system32\dllcache\pidgen.dll 2008-04-14 22:05 . 2008-04-14 22:05 1,950 --------- C:\WINDOWS\system32\pid.inf 2008-04-14 18:09 . 2008-04-14 18:09 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-04-14 10:41 . 2008-04-14 10:41 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-14 12:22 --------- d-----w C:\Documents and Settings\Fransua\Dane aplikacji\skypePM 2008-05-14 12:22 --------- d-----w C:\Documents and Settings\Fransua\Dane aplikacji\Skype 2008-05-13 14:40 --------- d–h--w C:\Program Files\InstallShield Installation Information 2008-05-13 13:36 --------- d-----w C:\Program Files\eMule 2008-05-13 13:00 0 ----a-w C:\Program Files\AstonWriteTest.txt 2008-05-13 12:58 --------- d-----w C:\Program Files\Advanced MP3 Sound Recorder 2008-05-13 12:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Phenomedia 2008-05-10 05:00 --------- d-----w C:\Documents and Settings\Fransua\Dane aplikacji\uTorrent 2008-05-06 19:18 --------- d-----w C:\Program Files\Last.fm 2008-05-06 14:37 --------- d-----w C:\Program Files\Winamp 2008-05-06 14:37 --------- d-----w C:\Documents and Settings\Fransua\Dane aplikacji\Winamp 2008-05-04 06:57 --------- d-----w C:\Program Files\Usługi online 2008-05-04 06:29 --------- d-----w C:\Program Files\SpeedFan 2008-05-01 09:59 --------- d-----w C:\Program Files\Nero 2008-05-01 09:59 --------- d-----w C:\Program Files\Common Files\Nero 2008-05-01 09:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-30 20:05 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-04-26 13:20 --------- d-----w C:\Program Files\XP Codec Pack 2008-04-14 20:52 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys 2008-04-14 20:52 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys 2008-04-14 20:52 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys 2008-04-14 20:52 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys 2008-04-14 20:51 70,144 ----a-w C:\WINDOWS\notepad.exe 2008-04-14 20:51 32,866 ------w C:\WINDOWS\slrundll.exe 2008-04-14 20:51 285,696 ----a-w C:\WINDOWS\winhlp32.exe 2008-04-14 20:51 149,504 ----a-w C:\WINDOWS\regedit.exe 2008-04-14 20:51 10,752 ----a-w C:\WINDOWS\hh.exe 2008-04-14 20:51 1,035,264 ----a-w C:\WINDOWS\explorer.exe 2008-04-14 20:04 73,472 ----a-w C:\WINDOWS\system32\drivers\sr.sys 2008-04-14 20:03 80,256 ----a-w C:\WINDOWS\system32\drivers\parport.sys 2008-04-14 20:03 68,608 ----a-w C:\WINDOWS\system32\drivers\pci.sys 2008-04-14 20:03 46,848 ----a-w C:\WINDOWS\system32\drivers\p3.sys 2008-04-14 20:03 120,320 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys 2008-04-14 19:52 800,000 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys 2008-04-14 19:52 153,856 ----a-w C:\WINDOWS\system32\drivers\dmio.sys 2008-04-14 19:50 24,960 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys 2008-04-14 19:48 37,632 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys 2008-04-14 19:47 40,832 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys 2008-04-14 19:46 40,448 ----a-w C:\WINDOWS\system32\drivers\intelppm.sys 2008-04-14 19:41 65,280 ----a-w C:\WINDOWS\system32\drivers\serial.sys 2008-04-14 19:41 53,248 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys 2008-04-14 19:39 25,728 ------w C:\WINDOWS\system32\drivers\hidbth.sys 2008-04-14 19:35 58,880 ----a-w C:\WINDOWS\system32\drivers\redbook.sys 2008-04-14 19:35 273,920 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-04-14 19:33 44,672 ----a-w C:\WINDOWS\system32\drivers\fips.sys 2008-04-14 19:31 52,864 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys 2008-04-14 19:30 701,440 ------w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-04-14 19:30 39,936 ----a-w C:\WINDOWS\system32\drivers\processr.sys 2008-04-14 19:30 327,040 ------w C:\WINDOWS\system32\drivers\ati2mtaa.sys 2008-04-14 19:28 41,856 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys 2008-04-14 19:28 41,472 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys 2008-04-14 19:25 23,296 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys 2008-04-14 19:24 30,208 ----a-w C:\WINDOWS\system32\drivers\modem.sys 2008-04-14 19:24 188,544 ----a-w C:\WINDOWS\system32\drivers\acpi.sys 2008-04-13 22:58 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys 2008-04-13 22:51 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys 2008-04-13 22:50 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys 2008-04-13 22:50 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-04-13 22:50 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys 2008-04-13 22:49 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys 2008-04-13 22:49 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys 2008-04-13 22:49 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys 2008-04-13 22:49 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys 2008-04-13 22:49 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-04-13 22:47 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys 2008-04-13 22:47 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys 2008-04-13 22:47 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys 2008-04-13 22:46 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys 2008-04-13 22:46 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys 2008-04-13 22:45 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys 2008-04-13 22:45 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys 2008-04-13 22:45 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-04-13 22:44 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys 2008-04-13 22:44 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys 2008-04-13 22:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-04-13 22:30 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys 2008-04-13 22:27 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys 2008-04-13 22:27 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys 2008-04-13 22:27 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys 2008-04-13 22:27 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys 2008-04-13 22:27 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys 2008-04-13 22:27 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys 2008-04-13 22:27 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys 2008-04-13 22:26 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys 2008-04-13 22:26 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys 2008-04-13 22:26 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys 2008-04-13 22:26 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys 2008-04-13 22:26 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys 2008-04-13 22:26 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys 2008-04-13 22:26 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys 2008-04-13 22:26 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys 2008-04-13 22:26 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys 2008-04-13 22:26 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys 2008-04-13 22:25 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-13 22:24 88,192 ----a-w C:\WINDOWS\system32\drivers\irda.sys 2008-04-13 22:24 22,016 ----a-w C:\WINDOWS\system32\drivers\msircomm.sys 2008-04-13 22:24 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys 2008-04-13 22:23 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys 2008-04-13 22:23 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys 2008-04-13 22:23 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE~\Browser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-12-13 18:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] “{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}”= “C:\Program Files\Winamp Toolbar\winamptb.dll” [2007-12-13 18:49 1185120] [HKEY_CLASSES_ROOT\clsid{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] “{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120] [HKEY_CLASSES_ROOT\clsid{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2008-04-14 22:51 15360] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2008-02-01 17:22 21898024] “AQQ”=“C:\PROGRA~1\WapSter\AQQ\AQQ.exe” [] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [2007-11-07 16:33 6234624] “AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe” [2007-07-02 12:22 219008] “CursorXP”=“C:\Program Files\CursorXP\CursorXP.exe” [2005-01-19 17:34 128000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-12-05 02:41 8523776] “SW20”=“C:\WINDOWS\system32\sw20.exe” [2006-12-15 04:58 208896] “SW24”=“C:\WINDOWS\system32\sw24.exe” [2006-12-15 04:58 69632] “WinSys2”=“C:\WINDOWS\system32\winsys2.exe” [2006-12-15 04:59 217088] “AsusStartupHelp”=“C:\Program Files\ASUS\AASP\1.00.24\AsRunHelp.exe” [2006-12-29 03:54 363008] “High Definition Audio Property Page Shortcut”=“HDAShCut.exe” [2004-10-27 16:21 61952 C:\WINDOWS\system32\HdAShCut.exe] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2005-05-20 03:11 925696] “EPSON Stylus Photo R220 Series”=“C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.exe” [2005-03-09 06:00 98304] “GrooveMonitor”=“C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [2006-10-27 01:47 31016] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2007-12-05 02:41 81920] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-05-13 16:47 79224] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2008-04-14 22:51 15360] C:\Documents and Settings\Fransua\Menu Start\Programy\Autostart\ legalizacja.lnk - F:\Legalizator windows\Legalizator xp\Add Licence To Your Windows.reg [2007-11-24 15:54:17 2364] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-02-16 21:15:31 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “vidc.DIV3”= DivXc32.dll “vidc.DIV4”= DivXc32f.dll “msacm.l3fhg”= mp3fhg.acm “msacm.divxa32”= divxa32.acm “VIDC.X264”= x264vfw.dll “VIDC.HFYU”= huffyuv.dll “vidc.i263”= i263_32.drv “VIDC.YV12”= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “WMPNetworkSvc”=3 (0x3) “UPS”=3 (0x3) “TapiSrv”=3 (0x3) [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “C:\Program Files\Winamp Remote\bin\OrbTray.exe”= “C:\Program Files\uTorrent\uTorrent.exe”= “C:\Program Files\eMule\emule.exe”= “D:\FEAR\FEAR.exe”= “C:\Program Files\Gadu-Gadu\Gadu-Gadu.exe”= “C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”= “C:\Program Files\Microsoft Office\Office12\GROOVE.EXE”= “C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= “C:\Program Files\NAPI-PROJEKT\napisy.exe”= “D:\Paintball2\paintball2.exe”= “C:\Program Files\Winamp Remote\bin\Orb.exe”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “C:\Program Files\Tlen.pl\tlen.exe”= “C:\Program Files\GameSpy Arcade\Aphex.exe”= “C:\Program Files\BearShare Applications\BearShare\BearShare.exe”= “C:\Program Files\iTunes\iTunes.exe”= “C:\WINDOWS\system32\dpvsetup.exe”= “C:\WINDOWS\system32\rundll32.exe”= “C:\Program Files\Soulseek\slsk.exe”= “C:\WINDOWS\system32\usmt\migwiz.exe”= “D:\Sierra\Empire Earth - Sztuka Podboju\EE-AOC.exe”= “C:\Program Files\Skype\Phone\Skype.exe”= R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38] R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39] S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-12 18:36] S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-12 18:38] S3 efipsk;efipsk;C:\DOCUME~1\Fransua\USTAWI~1\Temp\efipsk.sys [] S3 Ext2FS;Ext2FS;C:\WINDOWS\system32\drivers\Ext2FS.sys [2004-01-23 20:34] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06] S3 NRKCTL32;NRKCTL32;C:\Documents and Settings\Fransua\NRKCTL32.SYS [2002-12-21 20:01] S3 PAC207;PC Camer@;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2006-11-20 09:48] S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3c9e0588-8dea-11dc-a25b-000000000000}] \Shell\Auto\command - activexdebugger32.exe f \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - activexdebugger32.exe f \Shell\open\Command - activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{75e1864e-92a9-11dc-a262-00304f46fe02}] \Shell\Auto\command - N:\activexdebugger32.exe f \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - N:\activexdebugger32.exe f \Shell\open\Command - N:\activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{8fc07220-b264-11dc-bdea-000000000000}] \Shell\Auto\command - L:\Cn911.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe . Contents of the ‘Scheduled Tasks’ folder “2008-03-02 17:30:19 C:\WINDOWS\Tasks\Add Licence To Your Windows.job” - M:\Legalizator windows\Legalizator xp\Add Licence To Your Windows.reg “2008-01-21 18:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-14 21:13:15 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\ASFWHide] “ImagePath”="??\C:\DOCUME~1\Fransua\USTAWI~1\Temp\ASFWHide" . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\WgaTray.exe . ************************************************************************** . Completion time: 2008-05-14 21:15:30 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-14 19:15:27 Pre-Run: 25,792,929,792 bajtów wolnych Post-Run: 25,890,652,160 bajt˘w wolnych 362 — E O F — 2008-05-04 07:35:10 W dniu 15.05.2008, o godzinie 15:22 został dopisany post przez Fransua ponawiam