Knock

ComboFix 08-03-24.2 - Zuza 2008-03-25 12:32:00.1 - [color=red][b]FAT32[/b][/color]x86
Running from: C:\Documents and Settings\Zuza\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Zuza\Dane aplikacji\install.dat
C:\Documents and Settings\Zuza\Menu Start\Programy\Outerinfo
C:\Documents and Settings\Zuza\Menu Start\Programy\Outerinfo\Terms.lnk
C:\Documents and Settings\Zuza\Moje dokumenty\MBOLS~1
C:\Documents and Settings\Zuza\Moje dokumenty\SCURIT~1
C:\Program Files\Common Files\{30442~1
C:\Program Files\Common Files\{60442~1
C:\Program Files\Common Files\{60442~2
C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll
C:\Program Files\Common Files\scurit~1
C:\Program Files\Common Files\scurit~1\F?nts\
C:\Program Files\Common Files\scurit~1\spool32.exe
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\newdotnet
C:\Program Files\newdotnet\readme.html
C:\Program Files\newdotnet\uninstall6_38.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\outerinfo\Thumbs.db
C:\Program Files\outlook
C:\temp\tn3
C:\WINDOWS\drsmartload.dat
C:\WINDOWS\drsmartloadb.dat
C:\WINDOWS\drsmartloadb1.dat
C:\WINDOWS\enewsletterpro1.dat
C:\WINDOWS\hosts
C:\WINDOWS\icroso~1.net
C:\WINDOWS\system32\1.txt
C:\WINDOWS\system32\2.txt
C:\WINDOWS\system32\app.exe
C:\WINDOWS\system32\asks~1
C:\WINDOWS\system32\asks~1\?asks\
C:\WINDOWS\system32\bund1
C:\WINDOWS\system32\dlh9jkdq8.exe
C:\WINDOWS\system32\drivers\Bgl51.sys
C:\WINDOWS\system32\drivers\Fkp40.sys
C:\WINDOWS\system32\drivers\Ins05.sys
C:\WINDOWS\system32\drivers\Lqv05.sys
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\mcroso~1.net
C:\WINDOWS\system32\mcroso~1.net\M?crosoft.NET\
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\racle~1\?racle\
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\unsvchosts.exe
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm
C:\WINDOWS\ymbols~1
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
C:\WINDOWS\system32\drivers\core.sys . . . . failed to delete

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLIENT_IP-IPX
-------\Legacy_CORE
-------\Service_Client IP-IPX
-------\Service_core
-------\Legacy_Fkp40
-------\Legacy_Ins05
-------\Legacy_Lqv05
-------\Fkp40
-------\Ins05
-------\Lqv05


(((((((((((((((((((((((((   Files Created from 2008-02-25 to 2008-03-25  )))))))))))))))))))))))))))))))
.

2008-03-25 12:37 . 2008-03-25 12:38	<DIR>	d--------	C:\temp\tn3
2008-03-25 12:23 . 2008-03-25 12:24	26,496	--a------	C:\WINDOWS\system32\drivers\Oty16.sys
2008-03-25 12:23 . 2008-03-25 12:24	11,776	--a------	C:\WINDOWS\system32\WLCtrl32.dll
2008-03-25 12:03 . 2008-03-25 06:29	<DIR>	d--------	C:\SDFix
2008-03-25 08:15 . 2008-03-25 08:15	3,869	--a------	C:\ZB20080325081407001.xml
2008-03-20 13:39 . 2008-03-20 13:39	34,688	--a------	C:\WINDOWS\system32\drivers\ntio922.sys
2008-03-20 13:39 . 2008-03-20 13:39	10,880	--a------	C:\WINDOWS\system32\drivers\ndisaluo.sys
2008-03-20 13:39 . 2008-03-20 13:39	10,610	---hs----	C:\WINDOWS\system32\drivers\spools.exe
2008-03-20 13:31 . 2008-03-20 13:31	<DIR>	d--hs----	C:\FOUND.005
2008-03-09 12:26 . 2008-03-09 12:26	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-03-09 12:13 . 2008-03-09 12:13	<DIR>	d--------	C:\Program Files\Common Files\Adobe Systems Shared

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 08:59	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitLgx701_cfdg.exe
2008-01-13 13:16	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitSmL1Vc_cfdg.exe
2008-01-13 12:55	1,599,488	--sh--w	C:\Documents and Settings\Zuza\PulpitAhE6Gj_cfdg.exe
2007-03-01 15:53	142	----a-w	C:\Program Files\page.html
2006-11-25 08:57	482	----a-w	C:\Program Files\Del.js
2006-10-05 14:04	766	----a-w	C:\Program Files\Common Files\sms.ico
2006-10-05 14:04	70	----a-w	C:\Program Files\Common Files\moje.js
2006-03-12 13:11	16,066	----a-w	C:\Program Files\INSTALL.LOG
1998-04-30 13:56	129,024	----a-w	C:\Program Files\UNWISE.EXE
2006-03-17 19:54	3,350	--sha-w	C:\WINDOWS\system32\KGyGaAvL.sys
2006-03-17 19:54	88	--sh--r	C:\WINDOWS\system32\F2B1403595.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="D:\Program Files\CursorXP\CursorXP.exe" [2003-03-01 16:40 125440]
"SVCHOST.EXE"="C:\WINDOWS\System32\drivers\svchost.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05 13312]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 22:18 443968]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]
"{60442047-07CA-1045-0701-030309170030}"= "C:\Program Files\Common Files\{60442047-07CA-1045-0701-030309170030}\Update.exe" mc-110-12-0000137

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\partnershipreg]
C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll 2008-03-20 13:39 13587 C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2005-07-04 12:58]
R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\System32\DRIVERS\bsstor.sys [2002-06-06 00:07]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2006-02-23 18:17]
R1 core;core;C:\WINDOWS\System32\drivers\core.sys [2007-05-15 17:35]
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\System32\drivers\BsUDF.sys [2002-09-13 13:35]
S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\System32\Drivers\Ca533av.sys []
S2 MsaSvc;Microsoft authenticate service;C:\windows\System32\msasvc.exe []
S2 MSWinLogonProcService;Windows Logon Process Service;"C:\windows\winlogon.exe" -service []
S3 Oty16;Oty16;C:\WINDOWS\System32\drivers\Oty16.sys [2008-03-25 12:24]
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\System32\Drivers\Bulk533.sys []
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys [2006-11-07 09:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys [2006-11-07 09:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\System32\DRIVERS\w200mgmt.sys [2006-11-07 09:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\System32\DRIVERS\w200obex.sys [2006-11-07 09:42]

*Newly Created Service* - CORE
.
Contents of the 'Scheduled Tasks' folder
"2008-01-01 13:01:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-25 12:38:02
Windows 5.1.2600 Dodatek Service Pack. 1 FAT NTAPI

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Client IP-IPX]
"ImagePath"="\"C:\WINDOWS\System32\svchosts.exe\" -e mc-110-12-0000137"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Fkp40]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Fkp40.sys"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Ins05]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Ins05.sys"
--

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\Lqv05]
"ImagePath"="\??\C:\WINDOWS\System32\drivers\Lqv05.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
.
Completion time: 2008-03-25 12:39:31
ComboFix-quarantined-files.txt  2008-03-25 11:39:28