Hmmm...wirusa wykrywało w c:\documents and settings\xxx\ustawienia lokalne\temp i byl to plik o nazwie wtf3.tmp etc i byl to trojan PSW lineage xD ale teraz sprawdzalem to chyba wywaliło mi go na zawsze ... Logi wrzuce jutro, pzdr
[ Dodano: Dzisiaj o 14:17 ] Hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:25, on 2008-04-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\VDOTool\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PLANET WL-8313\WLANMON.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FLASHGET\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WL-8313 Configuration Utility.lnk = ?
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{49CFA931-BF51-4704-851C-5BC045B21E53}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{49CFA931-BF51-4704-851C-5BC045B21E53}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{49CFA931-BF51-4704-851C-5BC045B21E53}: NameServer = 194.204.159.1,194.204.152.34
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 7171 bytes
Sdfix:
SDFix: Version 1.167
Run by Administrator on 2008-04-07 at 15:00
Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 15:02:36
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\WINDOWS\\System32\\PnkBstrA.exe"="C:\\WINDOWS\\System32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\System32\\PnkBstrB.exe"="C:\\WINDOWS\\System32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"E:\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="E:\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Finished!
ComboFix:
ComboFix 08-04-06.1 - Dziura 2008-04-07 15:11:36.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1093 [GMT 2:00]
Running from: C:\Documents and Settings\Dziura\Pulpit\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-03-07 to 2008-04-07 )))))))))))))))))))))))))))))))
.
2008-04-07 15:00 . 2008-04-07 15:00 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-04-07 14:56 . 2007-11-19 17:53 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-04-07 14:54 . 2008-04-07 12:19 <DIR> d-------- C:\SDFix
2008-04-06 22:10 . 2008-04-06 22:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-05 16:50 . 2008-04-06 19:03 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-04-05 16:49 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-05 16:49 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-05 16:13 . 2008-04-05 16:13 <DIR> d-------- C:\Program Files\Driver Cleaner
2008-04-05 16:13 . 2007-12-05 01:41 7,435,392 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-04-05 16:13 . 2007-12-05 01:41 7,435,392 --a------ C:\WINDOWS\system32\dllcache\nv4_mini.sys
2008-04-05 14:13 . 2008-04-05 14:14 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-04-05 14:13 . 2008-04-05 14:14 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-04-05 14:13 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-04-05 14:13 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-04-05 13:32 . 2008-04-05 13:32 <DIR> d-------- C:\Program Files\RegCleaner
2008-04-05 13:03 . 2008-04-05 13:03 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-04-05 10:45 . 2008-04-05 10:45 <DIR> d-------- C:\Documents and Settings\Dziura\Dane aplikacji\Microsoft Games
2008-04-05 01:04 . 2008-04-05 01:04 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2008-04-05 01:04 . 2008-04-05 01:04 <DIR> d-------- C:\Documents and Settings\Dziura\Dane aplikacji\InstallShield
2008-04-05 01:03 . 2008-04-05 01:03 <DIR> d-------- C:\Program Files\AMD
2008-04-05 01:03 . 2007-06-29 14:47 34,304 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys
2008-04-04 19:26 . 2008-04-04 19:26 <DIR> d-------- C:\WINDOWS\nview
2008-04-04 19:26 . 2008-04-04 19:26 <DIR> d-------- C:\WINDOWS\nvidia icons
2008-04-04 19:25 . 2008-03-24 11:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-04-04 18:45 . 2008-04-04 18:45 <DIR> d-------- C:\Documents and Settings\Dziura\Dane aplikacji\Samsung
2008-04-04 18:36 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2008-04-04 18:36 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2008-04-04 18:31 . 2008-04-04 18:31 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-04-04 18:31 . 2008-04-04 18:31 <DIR> d-------- C:\Program Files\Samsung
2008-04-04 18:31 . 2007-05-02 11:11 109,704 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys
2008-04-04 18:31 . 2007-05-02 11:11 83,592 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys
2008-04-04 18:31 . 2007-05-02 11:11 15,112 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys
2008-04-04 18:31 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys
2008-04-04 18:31 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys
2008-04-04 18:31 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys
2008-04-04 18:31 . 2007-05-02 11:11 12,424 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys
2008-04-04 18:31 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-04-04 14:55 . 2008-04-04 14:55 299 --a------ C:\WINDOWS\game.ini
2008-04-03 21:37 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-04-03 21:37 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys
2008-04-03 16:01 . 2008-04-03 16:01 <DIR> d-------- C:\Documents and Settings\Dziura\Dane aplikacji\Ahead
2008-04-03 15:48 . 2008-04-07 15:07 558 --a------ C:\WINDOWS\DFC.INI
2008-04-03 15:45 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-04-03 15:45 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-04-03 15:45 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-04-03 15:45 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-04-03 15:43 . 2008-04-03 15:43 <DIR> d-------- C:\Program Files\VDOTool
2008-04-03 15:43 . 2007-03-16 10:11 12,256 --a------ C:\WINDOWS\system32\drivers\TBPanel.sys
2008-03-31 20:36 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-31 20:36 . 2008-03-31 20:36 421 --a------ C:\WINDOWS\ODBC.INI
2008-03-31 20:35 . 2008-03-31 20:35 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-31 20:35 . 2008-03-31 20:35 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-29 19:35 . 2005-06-15 03:00 102,400 --a------ C:\WINDOWS\system32\tsccvid.dll
2008-03-29 16:23 . 2008-03-29 16:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-03-26 20:14 . 2008-03-26 20:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-03-26 20:12 . 2008-03-26 20:12 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-03-22 11:12 . 2008-03-22 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-03-22 02:23 . 2008-03-22 02:23 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-22 02:05 . 2008-03-22 02:05 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-03-22 01:58 . 2008-03-22 01:58 <DIR> d-------- C:\Program Files\Setup Files
2008-03-22 01:56 . 2008-03-22 01:56 <DIR> d-------- C:\Program Files\MSI
2008-03-22 01:43 . 2008-03-22 01:43 <DIR> d-------- C:\Program Files\Lavalys
2008-03-22 01:40 . 2008-03-22 01:40 <DIR> d-------- C:\Program Files\ATITool
2008-03-21 20:13 . 2008-03-21 20:13 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-03-21 20:13 . 2008-03-21 20:13 <DIR> d-------- C:\Program Files\Futuremark
2008-03-21 20:13 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-03-21 20:13 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-03-21 03:11 . 2008-03-21 03:11 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-03-20 19:51 . 2008-03-20 19:51 <DIR> d-------- C:\Documents and Settings\Dziura\Dane aplikacji\THQ
2008-03-20 19:42 . 2008-03-20 19:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-03-12 20:14 . 2008-03-12 20:14 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-03-07 19:16 . 2006-05-03 02:56 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-07 19:15 . 2008-03-07 19:15 <DIR> d-------- C:\Program Files\Java
2008-03-07 19:15 . 2008-03-07 19:15 <DIR> d-------- C:\Program Files\Common Files\Java
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-03 16:29 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-04-03 16:29 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-04-03 16:29 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-03 16:29 22,328 ----a-w C:\Documents and Settings\Dziura\Dane aplikacji\PnkBstrK.sys
2008-04-03 16:29 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-25 13:50 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-25 13:49 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-25 13:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-25 13:47 --------- d-----w C:\Program Files\Ahead
2008-02-25 13:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-02-01 15:07 18,487 ----a-w C:\WINDOWS\system32\Ntaccess.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-10-10 16:51 1636040]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:29 220544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 13:32 579072]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 07:27 16207872 C:\WINDOWS\RTHDCPL.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 02:56 36975]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-01 13:25 2165272]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-19 19:49 219136]
C:\Documents and Settings\Dziura\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
WL-8313 Configuration Utility.lnk - C:\Program Files\PLANET WL-8313\WLANMON.exe [2007-11-19 18:38:59 258048]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.FPS1"= frapsvid.dll
"vidc.tscc"= tsccvid.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\WINDOWS\\System32\\PnkBstrA.exe"=
"C:\\WINDOWS\\System32\\PnkBstrB.exe"=
"E:\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
R0 m5288;m5288;C:\WINDOWS\system32\DRIVERS\m5288.sys [2005-12-23 22:54]
R2 CachemanXPService;CachemanXP;C:\PROGRA~1\CACHEM~1\CachemanXP.exe [2004-02-20 01:46]
R3 W8100PCI;PLANET WL-8313;C:\WINDOWS\system32\DRIVERS\mrv8k51.sys [2004-01-19 04:08]
S3 msloop;Sterownik karty Microsoft Loopback;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 21:53]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 11:11]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 11:11]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 11:11]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8a953912-96c5-11dc-9e8f-806d6172696f}]
\Shell\AutoRun\command - G:\cda_menu.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 15:12:17
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-07 15:12:33
ComboFix-quarantined-files.txt 2008-04-07 13:12:32
Pre-Run: 2,588,590,080 bajtów wolnych
Post-Run: 2,576,252,928 bajtów wolnych
