ComboFix 08-01-23.2 - karollo 2008-01-24 20:16:57.2 - NTFSx86
Running from: C:\Documents and Settings\karollo.KAROL\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\eliteprotector
C:\WINDOWS\Help\agt037b.hlp
C:\WINDOWS\system32\1_exception.nls
C:\WINDOWS\system32\drivers\symavc32.sys
C:\WINDOWS\system32\drivers\VTJ39.sys
C:\WINDOWS\trayicon.exe
C:\WINDOWS\windsk.dll
C:\WINDOWS\wsystmp_fyg.exe
C:\WINDOWS\wsystmp_vsw.exe
C:\WINDOWS\wsystmp_ywx.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DRIVER
-------\LEGACY_RUNTIME
-------\LEGACY_VTJ39
-------\smtpdrv
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.
2008-01-24 19:48 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-23 12:19 . 2008-01-23 12:19
2008-01-23 12:17 . 2008-01-23 12:19
2008-01-21 18:33 . 2008-01-21 18:33 135,680 --a------ C:\WINDOWS\system32\drivers\Wtvb51.sys
2008-01-21 18:01 . 2008-01-21 18:01 29 --a------ C:\WINDOWS\system32\predrpou.tmp
2008-01-06 19:01 . 2008-01-14 16:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-06 19:01 . 2008-01-06 19:01 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-04 07:07 . 2008-01-04 07:07 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-04 06:18 . 2008-01-04 06:18 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-04 03:10 . 2008-01-04 03:10 268 --ah----- C:\sqmdata01.sqm
2008-01-04 03:10 . 2008-01-04 03:10 244 --ah----- C:\sqmnoopt01.sqm
2008-01-03 02:28 . 2004-08-10 04:13 73,728 --a–c— C:\WINDOWS\system32\dllcache\ehresja.dll
2008-01-03 02:28 . 2004-08-10 04:13 69,632 --a–c— C:\WINDOWS\system32\dllcache\ehresko.dll
2008-01-03 02:28 . 2004-08-10 04:13 69,632 --a–c— C:\WINDOWS\system32\dllcache\ehresfr.dll
2008-01-03 02:28 . 2004-08-10 04:13 69,632 --a–c— C:\WINDOWS\system32\dllcache\ehresde.dll
2008-01-03 02:28 . 2004-08-10 04:13 61,440 --a–c— C:\WINDOWS\system32\dllcache\ehreschs.dll
2008-01-03 02:26 . 2004-08-10 20:00 1,875,968 --a–c— C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-01-03 02:25 . 2004-08-10 20:00 13,463,552 --a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-03 02:24 . 2004-08-10 20:00 2,134,528 --a–c— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-01-03 02:23 . 2003-03-24 16:52 20,540 --a–c— C:\WINDOWS\system32\dllcache\admin.dll
2008-01-03 02:18 . 2008-01-04 15:13 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-01-03 02:18 . 2008-01-04 15:13 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-01-03 02:18 . 2008-01-04 15:13 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-01-03 02:18 . 2008-01-04 15:13 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-01-03 02:18 . 2008-01-04 15:13 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-01-03 02:18 . 2008-01-03 02:18 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-01-02 15:32 . 2004-08-10 20:00 1,086,058 -ra------ C:\WINDOWS\SET62.tmp
2008-01-02 14:31 . 2008-01-02 14:31
2008-01-02 00:37 . 2008-01-02 00:37
2008-01-02 00:37 . 2003-04-24 13:26 11,520 --a------ C:\WINDOWS\system32\drivers\PL2501NW.sys
2008-01-01 21:30 . 2005-01-10 09:57 29,535 -ra------ C:\WINDOWS\SETC9.tmp
2008-01-01 21:30 . 2004-10-28 02:50 15,304 -ra------ C:\WINDOWS\SETC7.tmp
2008-01-01 21:30 . 2004-10-29 01:43 11,421 -ra------ C:\WINDOWS\SETC6.tmp
2008-01-01 21:30 . 2004-08-12 19:13 10,425 -ra------ C:\WINDOWS\SETC8.tmp
2007-12-31 19:09 . 2006-03-01 20:42 91,136 -ra------ C:\WINDOWS\system32\OLD393.tmp
2007-12-31 19:08 . 2006-03-01 20:42 956,416 -ra------ C:\WINDOWS\system32\OLD38B.tmp
2007-12-31 19:08 . 2006-03-01 20:42 426,496 -ra------ C:\WINDOWS\system32\OLD389.tmp
2007-12-31 19:08 . 2006-03-01 20:42 161,280 -ra------ C:\WINDOWS\system32\OLD38D.tmp
2007-12-31 18:57 . 2005-07-26 00:46 7,680 --a–c— C:\WINDOWS\system32\dllcache\migregdb.exe
2007-12-31 14:05 . 2007-12-31 14:05 93 -r-hs---- C:\autorun.inf
2007-12-31 03:10 . 2007-12-31 03:10
2007-12-30 14:56 . 2007-12-30 14:53 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-12-30 14:56 . 2007-12-30 14:53 298,104 --a------ C:\WINDOWS\system32\imon.dll
2007-12-30 14:56 . 2007-12-30 14:53 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-30 14:01 . 2007-12-30 14:01 142,848 --a------ C:\WINDOWS\system32\drivers\Skw46.sys
2007-12-30 12:44 . 2007-12-31 18:20
2007-12-30 11:48 . 2007-12-31 15:11 18,088 --a------ C:\WINDOWS\system32\kalleny.config
2007-12-26 02:21 . 2007-12-26 02:21
2007-12-26 02:21 . 2007-06-28 18:54 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 18:53 --------- d-----w C:\Program Files\eMule
2008-01-02 22:11 22,392 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
2008-01-01 23:37 --------- d–h--w C:\Program Files\InstallShield Installation Information
2008-01-01 11:31 --------- d-----w C:\Program Files\programy-aplikacje
2007-12-31 17:20 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-31 14:35 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-31 14:35 --------- d-----w C:\Program Files\BitComet
2007-12-30 00:45 --------- d-----w C:\Program Files\QuickTime
2007-12-30 00:43 155,648 ----a-w C:\WINDOWS\system32\nerocheck.exe
2007-12-29 11:48 --------- d-----w C:\Program Files\Free Audio Pack
2007-12-19 23:03 --------- d-----w C:\Program Files\NAPI-PROJEKT
2007-12-06 00:40 --------- d-----w C:\Program Files\Picasa2
2007-12-05 20:12 4,828 ----a-w C:\WINDOWS\system32\drivers\srtspl.PNF
2007-12-05 20:12 4,828 ----a-w C:\WINDOWS\system32\drivers\srtsp.PNF
2007-12-05 20:12 4,820 ----a-w C:\WINDOWS\system32\drivers\srtspx.PNF
2007-12-05 20:12 4,484 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.PNF
2007-12-05 20:12 3,960 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.PNF
2007-12-01 23:25 6,748 ----a-w C:\WINDOWS\system32\drivers\O2MEDIA.PNF
2007-12-01 23:25 4,384 ----a-w C:\WINDOWS\system32\drivers\O2MDDISK.PNF
2007-12-01 23:25 4,352 ----a-w C:\WINDOWS\system32\drivers\O2SDDISK.PNF
2007-12-01 23:25 13,096 ----a-w C:\WINDOWS\system32\drivers\O2MWXP.PNF
2007-12-01 23:19 6,708 ----a-w C:\WINDOWS\system32\drivers\o2sd.PNF
2007-12-01 23:14 --------- d-----w C:\Program Files\Realtek
2007-12-01 23:13 --------- d-----w C:\Program Files\Common Files\ATI Technologies
2007-12-01 22:47 --------- d-----w C:\Program Files\ATI Technologies
2007-12-01 22:45 --------- d-----w C:\Program Files\DIFX
2007-12-01 21:31 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
2007-12-01 21:31 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
2007-12-01 21:31 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
2007-12-01 21:31 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
2007-12-01 21:31 5,120 ----a-w C:\WINDOWS\system32\drivers\SymRedir.PNF
2007-12-01 21:31 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
2007-12-01 21:31 12,204 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
2007-12-01 21:31 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
2007-11-07 03:02 892,928 ----a-w C:\WINDOWS\system32\iconv.dll
2007-11-07 03:02 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-10-31 02:11 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll
2007-10-31 02:11 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll
2007-10-31 02:11 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll
2007-10-31 02:10 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll
2007-10-31 02:10 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll
2007-10-31 02:10 45,056 ----a-w C:\WINDOWS\system32\ogg.dll
2007-10-31 02:10 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll
2007-10-31 02:10 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll
2007-10-31 02:10 167,936 ----a-w C:\WINDOWS\system32\ts.dll
2007-10-31 02:10 151,040 ----a-w C:\WINDOWS\system32\mkx.dll
2007-10-31 02:10 142,848 ----a-w C:\WINDOWS\system32\mp4.dll
2007-10-31 02:10 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll
.
Files Infected - Win32.Agent.zb
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\NeroCheck.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
C:\Program Files\eMule\emule.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-09-13 12:31 22880040]
“MsnMsgr”=“C:\Program Files\Windows Live\Messenger\MsnMsgr.exe” [2007-12-30 01:43 5724184]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-10 20:00 15360]
“eMuleAutoStart”=“C:\Program Files\eMule\emule.exe” [2007-12-30 01:43 5308416]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-12-30 01:43 132496]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2007-12-30 01:43 155648]
“RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2007-12-30 01:43 45056]
“QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-12-30 01:43 282624]
“ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 17:41 45056]
“nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-12-30 14:53 949376]
“RTHDCPL”=“RTHDCPL.EXE” [2006-04-17 15:34 16143872 C:\WINDOWS\RTHDCPL.exe]
C:\Documents and Settings\karollo.KAROL\Start Menu\Programs\Startup\
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-08-30 00:31:00 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
“InstallVisualStyle”= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
“InstallTheme”= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rdk45.sys]
@=“Driver”
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\
\Shell\open\Command - 44506E4B.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 20:17:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.