TechSpot

Malware redirecting pages in Google results

Solved
By hasek747
Jun 4, 2011
  1. Hi everyone,

    Seems like a common problem, but the solution seems different every time, so I'm posting a new thread.

    Clicking results in Google's search redirect me to pages that have completely nothing to do with the link I actually clicked (usually takes me to an XXX or dating site.) This happens around 50% of the time when I click a Google result.

    I've scanned my computer using: AVG antivirus, Spyware Terminator and Ad-Aware - didn't help.

    Attaching my HiJackThis log. Please let me know if you need anything else and hopefully I'll get rid of this annoying problem very quickly!

    Thanks :)
    Mark
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Hi Broni,

    Thanks for the welcome :)

    Let's get started!
     
  4. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Anti-Malware Coming through....


    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 6771

    Windows 5.1.2600 Dodatek Service Pack 3
    Internet Explorer 7.0.5730.13

    06/04/2011 7:08:19 PM
    mbam-log-2011-06-04 (19-08-19).txt

    Scan type: Quick scan
    Objects scanned: 196856
    Time elapsed: 11 minute(s), 17 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 10
    Registry Values Infected: 1
    Registry Data Items Infected: 3
    Folders Infected: 0
    Files Infected: 4

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\CE8SIIFGSU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\EWABQAF7KL (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\VXEG3ZNNE5 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\UBC5AB1IDP (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Value: kr_done1 -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\WINDOWS\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\WINDOWS\Tasks\{8c3fdd81-7ae0-4605-a46a-2488b179f2a3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
     
  5. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    GMER coming through...

    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit quick scan 2011-06-04 19:24:08
    Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7 SAMSUNG_HD200HJ rev.KF100-06
    Running: l12w4p99.exe; Driver: C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kgrorpow.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 MBR read error
    Disk \Device\Harddisk0\DR0 MBR BIOS signature not found 0

    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwEnumerateKey [0xB3CF5864]
    SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwEnumerateValueKey [0xB3CF5ABA]

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-12 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort0 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort1 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort2 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-7 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort3 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort4 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort5 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\a45td694 \Device\Scsi\a45td6941Port6Path0Target0Lun0 8A2C81F8
    Device \Driver\a45td694 \Device\Scsi\a45td6941 8A2C81F8
    Device \FileSystem\Ntfs \Ntfs 8A58E1F8
    Device \FileSystem\Fastfat \Fat 89AA81F8

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    ---- EOF - GMER 1.0.15 ----
     
  6. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    DDS.txt coming through....


    .
    DDS (Ver_2011-06-03.01) - NTFSx86
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_24
    Run by Administrator at 19:28:12 on 2011-06-04
    Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2046.871 [GMT 2:00]
    .
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    FW: COMODO Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Secway\SimpLite-Jabber 2.5\SimpLite-Jabber.exe
    C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\Google Talk\googletalk.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\AVG\AVG9\avgtray.exe
    C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.qemit.com
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    uURLSearchHooks: H - No File
    mURLSearchHooks: H - No File
    mURLSearchHooks: H - No File
    mURLSearchHooks: H - No File
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    mURLSearchHooks: H - No File
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    TB: FreeRIP.com Toolbar: {081230f8-ea50-42a9-983c-d22abc2eed3b} - c:\program files\freerip3\toolband.dll
    TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
    TB: {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Simp] c:\program files\secway\simplite-jabber 2.5\SimpLite-Jabber.exe
    mRun: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
    mRun: [oepsrv] c:\windows\oepext\oepsrv.exe
    mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    dRunOnce: [KeyScrambler] c:\program files\keyscrambler\getting_started.html
    dRunOnce: [<NO NAME>]
    mExplorerRun: [<NO NAME>] 1 (0x1)
    StartupFolder: c:\docume~1\admini~1\menust~1\programy\autost~1\tworze~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
    StartupFolder: c:\docume~1\admini~1\menust~1\programy\autost~1\autoru~1\micros~1.lnk - c:\program files\microsoft office\office12\GROOVE.EXE
    StartupFolder: c:\docume~1\alluse~1\menust~1\programy\autost~1\miniey~1.lnk - c:\program files\infinite mind lc\eyeq\ARLaunch.exe
    StartupFolder: c:\docume~1\alluse~1\menust~1\programy\autost~1\autoru~1\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
    uPolicies-explorer: DisallowRun = 0 (0x0)
    dPolicies-explorer: DisallowRun = 0 (0x0)
    IE: &FreeRIP Search - c:\program files\freerip3\toolband.dll/MENUSEARCH.HTM
    IE: E&ksport do programu Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\icq7.5\ICQ.exe
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
    Trusted Zone: mks.com.pl
    DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
    DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221038163406
    DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    TCP: DhcpNameServer = 62.179.1.63 62.179.1.62
    TCP: Interfaces\{97021395-5DDF-47EC-B789-B9D26E07F54E} : NameServer = 156.154.70.22,156.154.71.22
    TCP: Interfaces\{97021395-5DDF-47EC-B789-B9D26E07F54E} : DhcpNameServer = 62.179.1.63 62.179.1.62
    TCP: Interfaces\{D830D6ED-3C40-469D-A8E0-FA5F4C35CB7E} : NameServer = 216.131.95.20,216.131.94.5
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    AppInit_DLLs: c:\windows\system32\guard32.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4c39316f&v=6.103.018.001&i=23&tp=ab&iy=&ychte=us&lng=pl&q=
    FF - component: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCoreGecko19.dll
    FF - component: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll
    FF - plugin: c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\google\update\1.3.21.53\npGoogleUpdate3.dll
    FF - plugin: c:\documents and settings\all users\dane aplikacji\gadu-gadu 10\_userdata\npgg.3.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    FF - Ext: Menu Editor: {EDA7B1D7-F793-4e03-B074-E6F303317FB0} - %profile%\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
    FF - Ext: ScrapBook Plus: scrapbookplus@addons.mozilla.org - %profile%\extensions\scrapbookplus@addons.mozilla.org
    FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - %profile%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
    FF - Ext: United States English Spellchecker: en-US@dictionaries.addons.mozilla.org - %profile%\extensions\en-US@dictionaries.addons.mozilla.org
    FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
    FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
    FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
    FF - Ext: RankChecker: rankchecker@seobook.com - %profile%\extensions\rankchecker@seobook.com
    FF - Ext: Seo Toolbar: seotoolbar@seobook.com - %profile%\extensions\seotoolbar@seobook.com
    FF - Ext: SEO For Firefox: seo4firefox@seobook.com - %profile%\extensions\seo4firefox@seobook.com
    FF - Ext: FoxyProxy Standard: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
    FF - Ext: FoxyProxy Basic: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
    FF - Ext: AVG Security Toolbar em:version=6.103.018.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg9\toolbar\firefox\avg@igeared
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-6-4 64512]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-7-11 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-7-11 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-7-11 243152]
    R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-5-2 242472]
    R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-5-2 29400]
    R1 FDC1ANT;FDC1ANT;c:\windows\system32\drivers\FDC1ANT.SYS [2008-12-16 47855]
    R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-6-4 142592]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-11 308136]
    R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-5-9 1779792]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 2151128]
    R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-1-24 10384]
    R4 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
    R4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-4 366640]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-23 136176]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-9-30 374152]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-27 947528]
    S3 gupdatem;Usługa Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-23 136176]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-12-3 15232]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
    S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-6-13 137344]
    S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-6-13 8320]
    S3 RkHit;RkHit;\??\c:\windows\system32\drivers\rkhit.sys --> c:\windows\system32\drivers\RKHit.sys [?]
    S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2008-1-25 25088]
    S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\ultramonmirror.sys --> c:\windows\system32\drivers\UltraMonMirror.sys [?]
    S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\zdcndis5.sys --> c:\windows\system32\ZDCndis5.SYS [?]
    .
    =============== Created Last 30 ================
    .
    2011-06-04 16:54:49 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Malwarebytes
    2011-06-04 16:54:36 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Malwarebytes
    2011-06-04 16:54:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-06-04 16:24:01 388096 ----a-r- c:\documents and settings\administrator\dane aplikacji\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-06-04 16:23:58 -------- d-----w- c:\program files\Trend Micro
    2011-06-04 16:14:26 -------- d--h--w- C:\VritualRoot
    2011-06-04 16:11:39 -------- d-----w- c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\Eraser 6
    2011-06-04 16:10:38 16432 ----a-w- c:\windows\system32\lsdelete.exe
    2011-06-04 16:03:59 -------- d-----w- c:\program files\COMODO
    2011-06-04 16:03:02 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Comodo
    2011-06-04 15:15:45 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2011-06-04 15:15:35 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-06-04 15:10:56 -------- d-----w- c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\Sunbelt Software
    2011-06-04 15:09:40 -------- dc-h--w- c:\documents and settings\all users\dane aplikacji\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
    2011-06-04 13:13:59 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
    2011-06-04 11:33:41 5504 ----a-w- c:\windows\system32\drivers\StarOpen.sys
    2011-06-04 08:49:21 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-06-04 08:49:21 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-06-04 08:48:15 -------- d-----w- c:\program files\Infinite Mind LC
    2011-06-04 08:48:13 -------- d-----w- c:\program files\FreeRIP3
    2011-06-04 08:47:28 -------- d-----w- c:\documents and settings\all users\dane aplikacji\MicroSoftOcx
    2011-06-04 08:47:19 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Affilorama
    2011-06-03 23:37:22 -------- d-----w- C:\vseqrntn.bin
    2011-06-03 21:11:56 -------- d-----w- c:\program files\Lavasoft
    2011-06-03 21:07:38 -------- d-----w- c:\program files\CyberDefender
    2011-06-03 21:07:21 -------- d-----w- c:\program files\common files\Authentium
    2011-06-03 20:58:41 -------- d-----w- c:\program files\Spyware Terminator
    2011-06-03 20:58:41 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Spyware Terminator
    2011-06-02 19:04:07 -------- d-----w- c:\program files\Yahoo!
    2011-06-02 14:57:28 -------- d-----w- c:\program files\OpenVPN
    2011-06-02 11:11:19 -------- d-----w- c:\program files\Secway
    2011-06-02 10:53:26 -------- d-----w- c:\program files\ICQ7.5
    2011-06-02 10:26:00 -------- d-----w- c:\program files\ICQ6Toolbar
    2011-06-02 10:25:57 -------- d-----w- c:\documents and settings\all users\dane aplikacji\ICQ
    2011-06-02 09:28:25 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spider1
    2011-05-31 22:09:48 -------- d-----w- c:\documents and settings\all users\dane aplikacji\TrueCrypt
    2011-05-31 20:02:53 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\TrueCrypt
    2011-05-31 20:02:12 231248 ----a-w- c:\windows\system32\drivers\truecrypt.sys
    2011-05-31 20:02:06 -------- d-----w- c:\program files\TrueCrypt
    2011-05-27 14:17:47 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spiderss
    2011-05-27 13:03:56 -------- d-----w- c:\program files\fec
    2011-05-27 12:17:01 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Email Stacker
    2011-05-27 12:02:39 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Save Data
    2011-05-27 12:02:22 389120 ----a-w- c:\windows\system32\actskn43.ocx
    2011-05-27 11:48:17 -------- d-----w- c:\documents and settings\all users\Pulpit
    2011-05-27 11:38:55 124688 ------w- c:\windows\system32\Mswinsck.ocx
    2011-05-27 11:38:55 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\northworks.biz
    2011-05-27 11:36:46 -------- d-----w- c:\program files\Super Email Harvester
    2011-05-27 11:25:24 -------- d-----w- c:\program files\Power Email Harvester
    2011-05-27 11:00:11 -------- d-----w- c:\program files\Best Email Extractor
    2011-05-27 10:25:19 112640 ----a-w- c:\windows\lsb_un20.exe
    2011-05-27 10:25:17 -------- d-----w- c:\program files\Link Web Extractor
    2011-05-27 10:08:21 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spider
    2011-05-15 14:53:25 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Skype Extras
    2011-05-14 17:04:09 162432 ----a-w- c:\windows\system32\drivers\ithsgt.sys
    2011-05-14 17:04:09 12032 ----a-w- c:\windows\system32\drivers\lilsgt.sys
    .
    ==================== Find3M ====================
    .
    2011-05-17 08:26:53 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-05-06 08:17:51 243152 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2011-05-02 18:36:54 29400 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
    2011-05-02 18:36:52 242472 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
    2011-05-02 18:36:52 17416 ----a-w- c:\windows\system32\drivers\cmderd.sys
    2011-05-02 18:36:04 284744 ----a-w- c:\windows\system32\guard32.dll
    2011-04-26 09:21:06 26624 ----a-w- c:\windows\system32\drivers\tap0901.sys
    2011-03-07 05:33:36 692736 ----a-w- c:\windows\system32\inetcomm.dll
    .
    ============= FINISH: 19:30:06.01 ===============
     
  7. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    And Attach.txt coming through...


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-03.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 09/09/2008 9:51:55 PM
    System Uptime: 06/04/2011 7:11:08 PM (0 hours ago)
    .
    Motherboard: http://www.abit.com.tw/ | | IP35-E (Intel P35+ICH9/R)
    Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz | Socket 775 | 2244/204mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 186 GiB total, 29.082 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description: Urządzenie audio na High Definition Audio
    Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_147BA601&REV_1000\4&5A350D8&0&0001
    Manufacturer:
    Name: Urządzenie audio na High Definition Audio
    PNP Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_147BA601&REV_1000\4&5A350D8&0&0001
    Service:
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Kontroler magistrali zarządzania systemem
    Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_1085147B&REV_02\3&2411E6FE&0&FB
    Manufacturer:
    Name: Kontroler magistrali zarządzania systemem
    PNP Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_1085147B&REV_02\3&2411E6FE&0&FB
    Service:
    .
    ==== System Restore Points ===================
    .
    RP77: 04/03/2011 4:00:17 AM - Software Distribution Service 3.0
    RP78: 04/04/2011 1:02:41 AM - Software Distribution Service 3.0
    RP79: 04/04/2011 11:52:11 PM - Software Distribution Service 3.0
    RP80: 04/05/2011 12:27:32 PM - Software Distribution Service 3.0
    RP81: 04/06/2011 4:57:20 PM - Punkt kontrolny systemu
    RP82: 04/06/2011 5:00:15 PM - Software Distribution Service 3.0
    RP83: 04/07/2011 4:00:14 AM - Software Distribution Service 3.0
    RP84: 04/07/2011 11:37:26 PM - Software Distribution Service 3.0
    RP85: 04/09/2011 1:58:44 AM - Software Distribution Service 3.0
    RP86: 04/10/2011 12:28:12 AM - Software Distribution Service 3.0
    RP87: 04/11/2011 12:34:54 AM - Punkt kontrolny systemu
    RP88: 04/11/2011 4:00:16 AM - Software Distribution Service 3.0
    RP89: 04/12/2011 10:25:24 AM - Software Distribution Service 3.0
    RP90: 04/13/2011 4:00:24 AM - Software Distribution Service 3.0
    RP91: 04/14/2011 4:18:52 AM - Punkt kontrolny systemu
    RP92: 04/15/2011 4:03:56 PM - Punkt kontrolny systemu
    RP93: 04/16/2011 4:00:29 AM - Software Distribution Service 3.0
    RP94: 04/17/2011 4:00:15 AM - Software Distribution Service 3.0
    RP95: 04/18/2011 4:00:19 AM - Software Distribution Service 3.0
    RP96: 04/19/2011 4:00:16 AM - Software Distribution Service 3.0
    RP97: 04/20/2011 4:00:16 AM - Software Distribution Service 3.0
    RP98: 04/21/2011 1:32:28 AM - Software Distribution Service 3.0
    RP99: 04/22/2011 2:16:26 AM - Punkt kontrolny systemu
    RP100: 04/22/2011 4:00:14 AM - Software Distribution Service 3.0
    RP101: 04/23/2011 2:30:40 AM - Software Distribution Service 3.0
    RP102: 04/23/2011 1:28:07 PM - Software Distribution Service 3.0
    RP103: 04/24/2011 12:52:57 AM - Software Distribution Service 3.0
    RP104: 04/25/2011 1:26:44 AM - Punkt kontrolny systemu
    RP105: 04/25/2011 4:00:14 AM - Software Distribution Service 3.0
    RP106: 04/25/2011 5:16:09 PM - Software Distribution Service 3.0
    RP107: 04/26/2011 3:42:47 AM - Software Distribution Service 3.0
    RP108: 04/26/2011 2:23:28 PM - Software Distribution Service 3.0
    RP109: 04/27/2011 4:00:14 AM - Software Distribution Service 3.0
    RP110: 04/27/2011 4:05:31 PM - Installed iTunes
    RP111: 04/27/2011 8:28:42 PM - Software Distribution Service 3.0
    RP112: 04/28/2011 2:53:07 AM - Software Distribution Service 3.0
    RP113: 04/28/2011 4:21:13 PM - Software Distribution Service 3.0
    RP114: 04/29/2011 12:01:17 AM - Software Distribution Service 3.0
    RP115: 04/29/2011 9:46:37 AM - Software Distribution Service 3.0
    RP116: 04/30/2011 4:00:17 AM - Software Distribution Service 3.0
    RP117: 04/30/2011 11:40:15 PM - Software Distribution Service 3.0
    RP118: 05/01/2011 2:36:54 AM - Software Distribution Service 3.0
    RP119: 05/02/2011 3:04:53 AM - Punkt kontrolny systemu
    RP120: 05/02/2011 4:00:14 AM - Software Distribution Service 3.0
    RP121: 05/02/2011 11:25:33 PM - Software Distribution Service 3.0
    RP122: 05/03/2011 12:55:27 AM - Software Distribution Service 3.0
    RP123: 05/04/2011 1:49:03 AM - Software Distribution Service 3.0
    RP124: 05/05/2011 3:57:35 AM - Punkt kontrolny systemu
    RP125: 05/05/2011 4:00:14 AM - Software Distribution Service 3.0
    RP126: 05/06/2011 4:00:19 AM - Software Distribution Service 3.0
    RP127: 05/06/2011 10:17:56 AM - Avg Update
    RP128: 05/07/2011 4:00:16 AM - Software Distribution Service 3.0
    RP129: 05/07/2011 9:58:45 AM - Software Distribution Service 3.0
    RP130: 05/08/2011 2:36:59 AM - Software Distribution Service 3.0
    RP131: 05/09/2011 2:39:52 AM - Punkt kontrolny systemu
    RP132: 05/09/2011 4:00:17 AM - Software Distribution Service 3.0
    RP133: 05/10/2011 12:03:28 AM - Software Distribution Service 3.0
    RP134: 05/10/2011 2:26:56 AM - Software Distribution Service 3.0
    RP135: 05/10/2011 10:29:36 AM - Avg Update
    RP136: 05/11/2011 1:32:16 AM - Installed Safari
    RP137: 05/11/2011 4:00:14 AM - Software Distribution Service 3.0
    RP138: 05/12/2011 4:00:26 AM - Software Distribution Service 3.0
    RP139: 05/12/2011 9:13:03 AM - Avg Update
    RP140: 05/12/2011 11:16:32 PM - Software Distribution Service 3.0
    RP141: 05/13/2011 11:17:05 PM - Software Distribution Service 3.0
    RP142: 05/14/2011 6:54:18 PM - Installed Fahrenheit
    RP143: 05/15/2011 4:00:14 AM - Software Distribution Service 3.0
    RP144: 05/15/2011 9:02:51 AM - Software Distribution Service 3.0
    RP145: 05/16/2011 4:00:15 AM - Software Distribution Service 3.0
    RP146: 05/17/2011 4:00:17 AM - Software Distribution Service 3.0
    RP147: 05/17/2011 9:48:11 PM - Software Distribution Service 3.0
    RP148: 05/18/2011 4:00:14 AM - Software Distribution Service 3.0
    RP149: 05/18/2011 9:35:04 PM - Software Distribution Service 3.0
    RP150: 05/21/2011 9:39:16 PM - Software Distribution Service 3.0
    RP151: 05/23/2011 12:38:30 AM - Software Distribution Service 3.0
    RP152: 05/23/2011 10:46:20 PM - Software Distribution Service 3.0
    RP153: 05/24/2011 1:31:12 AM - Software Distribution Service 3.0
    RP154: 05/25/2011 2:24:44 AM - Punkt kontrolny systemu
    RP155: 05/25/2011 4:00:15 AM - Software Distribution Service 3.0
    RP156: 05/26/2011 4:00:24 AM - Software Distribution Service 3.0
    RP157: 05/27/2011 4:00:17 AM - Software Distribution Service 3.0
    RP158: 05/27/2011 11:36:40 AM - Installed Fast Email Extractor 7
    RP159: 05/27/2011 1:22:13 PM - Removed Market Samurai
    RP160: 05/27/2011 1:48:16 PM - Installed Web Email Extractor Pro.
    RP161: 05/27/2011 1:54:11 PM - Removed Web Email Extractor Pro.
    RP162: 05/27/2011 1:58:13 PM - Installed Web Email Extractor Pro.
    RP163: 05/27/2011 1:59:07 PM - Removed Web Email Extractor Pro.
    RP164: 05/27/2011 2:45:05 PM - Installed Email Extractor v3.0.
    RP165: 05/27/2011 2:53:04 PM - Removed Email Extractor v3.0.
    RP166: 05/28/2011 4:00:17 AM - Software Distribution Service 3.0
    RP167: 05/29/2011 4:00:15 AM - Software Distribution Service 3.0
    RP168: 05/30/2011 4:00:23 AM - Software Distribution Service 3.0
    RP169: 05/31/2011 4:00:17 AM - Software Distribution Service 3.0
    RP170: 05/31/2011 7:59:54 PM - Installed TheBat! Home v5.0.12
    RP171: 05/31/2011 8:10:20 PM - Installed TheBat! Home v5.0.12
    RP172: 05/31/2011 10:02:12 PM - TrueCrypt installation
    RP173: 05/31/2011 10:20:10 PM - Removed Advanced Web Ranking 7.5
    RP174: 05/31/2011 10:23:37 PM - Removed Fahrenheit
    RP175: 05/31/2011 10:24:04 PM - Removed Fast Email Extractor 7
    RP176: 05/31/2011 10:25:53 PM - Removed Holdem Manager
    RP177: 06/01/2011 12:17:55 AM - Software Distribution Service 3.0
    RP178: 06/02/2011 12:32:16 AM - Punkt kontrolny systemu
    RP179: 06/02/2011 4:00:14 AM - Software Distribution Service 3.0
    RP180: 06/02/2011 11:00:11 AM - Operacja przywracania
    RP181: 06/02/2011 11:18:10 AM - Operacja przywracania
    RP182: 06/02/2011 11:31:00 AM - Operacja przywracania
    RP183: 06/02/2011 11:32:11 AM - Operacja przywracania
    RP184: 06/02/2011 1:11:15 PM - Installed SimpLite-Jabber 2.5
    RP185: 06/02/2011 9:07:18 PM - Installed SimpLite-Yahoo 2.5
    RP186: 06/02/2011 9:09:17 PM - Installed SimpLite-ICQ-AIM 2.5
    RP187: 06/02/2011 11:55:33 PM - Software Distribution Service 3.0
    RP188: 06/03/2011 3:56:10 PM - Software Distribution Service 3.0
    RP189: 06/03/2011 9:55:06 PM - Installed HP USB Disk Storage Format Tool
    RP190: 06/03/2011 10:24:54 PM - Installed HP USB Disk Storage Format Tool
    RP191: 06/03/2011 11:10:17 PM - Installed Ad-Aware
    RP192: 06/03/2011 11:11:48 PM - Installed Ad-Aware
    RP193: 06/03/2011 11:24:45 PM - Removed AceReader Pro.
    RP194: 06/03/2011 11:28:18 PM - Removed Adobe Community Help
    RP195: 06/03/2011 11:29:22 PM - Removed Adobe Media Player
    RP196: 06/03/2011 11:31:27 PM - Removed Apple Application Support
    RP197: 06/03/2011 11:35:46 PM - Removed Bonjour
    RP198: 06/03/2011 11:44:24 PM - Removed LogMeIn
    RP199: 06/03/2011 11:46:47 PM - Removed LogMeIn
    RP200: 06/03/2011 11:50:57 PM - Removed Marvell Miniport Driver
    RP201: 06/03/2011 11:54:22 PM - Removed Microsoft Silverlight
    RP202: 06/03/2011 11:57:57 PM - Removed NVIDIA PhysX
    RP203: 06/04/2011 12:01:38 AM - Removed SimpLite-Yahoo 2.5
    RP204: 06/04/2011 12:12:36 AM - Usunięto: Asystent rejestracji usługi Windows Live
    RP205: 06/04/2011 12:16:08 AM - Removed HP USB Disk Storage Format Tool
    RP206: 06/04/2011 12:17:58 AM - Removed Foxit PDF IFilter
    RP207: 06/04/2011 12:22:21 AM - Removed PostgreSQL 8.3
    RP208: 06/04/2011 12:24:49 AM - Removed Safari
    RP209: 06/04/2011 12:29:06 AM - Spyware Terminator - restore point
    RP210: 06/04/2011 4:00:15 AM - Software Distribution Service 3.0
    RP211: 06/04/2011 10:45:45 AM - Operacja przywracania
    RP212: 06/04/2011 10:54:23 AM - Software Distribution Service 3.0
    RP213: 06/04/2011 11:03:59 AM - Removed AceReader Pro.
    RP214: 06/04/2011 11:09:09 AM - Removed Adobe Community Help
    RP215: 06/04/2011 11:09:22 AM - Removed Adobe Media Player
    RP216: 06/04/2011 11:09:48 AM - Usunięto: Asystent rejestracji usługi Windows Live
    RP217: 06/04/2011 11:10:34 AM - Removed Bonjour
    RP218: 06/04/2011 11:23:17 AM - Removed LogMeIn
    RP219: 06/04/2011 11:23:56 AM - Removed LogMeIn
    RP220: 06/04/2011 11:25:35 AM - Removed PostgreSQL 8.3
    RP221: 06/04/2011 11:26:26 AM - Removed Safari
    RP222: 06/04/2011 11:26:53 AM - Removed SimpLite-Yahoo 2.5
    RP223: 06/04/2011 11:28:16 AM - Removed TheBat! Home v5.0.12
    RP224: 06/04/2011 12:01:53 PM - Create by Wise Registry Cleaner
    RP225: 06/04/2011 12:48:58 PM - Installed Eraser 6.0.8.2273
    RP226: 06/04/2011 3:29:35 PM - Spyware Terminator - restore point
    RP227: 06/04/2011 4:04:22 PM - Removed NVIDIA PhysX
    RP228: 06/04/2011 4:24:27 PM - Spyware Terminator - restore point
    RP229: 06/04/2011 5:27:37 PM - Removed Eraser 6.0.8.2273
    RP230: 06/04/2011 6:03:53 PM - Installed COMODO Internet Security
    RP231: 06/04/2011 6:23:51 PM - Installed HiJackThis
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Aktualizacja dla systemu Windows Internet Explorer 7 (KB976749)
    Aktualizacja dla systemu Windows Internet Explorer 7 (KB980182)
    Aktualizacja dla systemu Windows XP (KB2141007)
    Aktualizacja dla systemu Windows XP (KB2345886)
    Aktualizacja dla systemu Windows XP (KB951072-v2)
    Aktualizacja dla systemu Windows XP (KB951978)
    Aktualizacja dla systemu Windows XP (KB955759)
    Aktualizacja dla systemu Windows XP (KB955839)
    Aktualizacja dla systemu Windows XP (KB961503)
    Aktualizacja dla systemu Windows XP (KB967715)
    Aktualizacja dla systemu Windows XP (KB968389)
    Aktualizacja dla systemu Windows XP (KB971029)
    Aktualizacja dla systemu Windows XP (KB971737)
    Aktualizacja dla systemu Windows XP (KB973687)
    Aktualizacja dla systemu Windows XP (KB973815)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB2378111)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB952069)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB954155)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB968816)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB973540)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB975558)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB978695)
    Aktualizacja zabezpieczeń dla programu Windows Media Player (KB979402)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2183461)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2360131)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2482017)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2497640)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127-v2)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB953838)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB956390)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB958215)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB960714)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB961260)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB963027)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB969897)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB972260)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB974455)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB976325)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB978207)
    Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB982381)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2079403)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2115168)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2121546)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2160329)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2229593)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2259922)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2279986)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2286198)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2296011)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2347290)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2360937)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2387149)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2393802)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2412687)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2419632)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2423089)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2440591)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2443105)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2476687)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2478960)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2478971)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2479628)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2479943)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2481109)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2483185)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2485376)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2485663)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2503658)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2506212)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2506223)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2507618)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2508272)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2508429)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2509553)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2510581)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2511455)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB2524375)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB923561)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464-v2)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB952004)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB953838)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB953839)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB954600)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956391)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956572)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956744)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956802)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB956844)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB957095)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB958687)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB958690)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB958869)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB959426)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB960225)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB960715)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB960803)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB960859)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB961371)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB961373)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB961501)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB968537)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB969059)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB969898)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB969947)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB970238)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB970430)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971468)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971486)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971557)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971633)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971657)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB971961)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB972270)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973346)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973354)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973507)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973525)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973869)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB973904)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB974112)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB974318)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB974392)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB974571)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975025)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975467)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975560)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975561)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975562)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB975713)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB977165-v2)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB977816)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB977914)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978037)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978251)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978262)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978338)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978542)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978601)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB978706)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB979309)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB979482)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB979559)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB979683)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB979687)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB980195)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB980218)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB980232)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB980436)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB981322)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB981349)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB981852)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB981957)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB981997)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB982132)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB982214)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB982665)
    Aktualizacja zabezpieczeń dla systemu Windows XP (KB982802)
    Aktualizacja zabezpieczeń dla Windows XP (KB941569)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Archiwizator WinRAR
    ASIO4ALL
    µTorrent
    AVG Free 9.0
    Betfair Poker
    CDBurnerXP
    CDDRV_Installer
    COMODO Internet Security
    Compatibility Pack for the 2007 Office system
    Eraser
    eyeQ
    F.lux
    FeedReader
    FileZilla Client 3.3.5.1
    Foxit PDF IFilter
    Foxit Reader
    FreeRIP v3.5
    Gadu-Gadu 7.0
    Google Chrome
    Google Talk (remove only)
    Google Update Helper
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB976002-v5)
    ICQ7.5
    IrfanView (remove only)
    iriver plus 3 (remove only)
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 24
    K-Lite Codec Pack 5.4.4 (Basic)
    KhalInstallWrapper
    Left 4 Dead
    LG Internet Kit
    LG USB Modem Drivers
    Logitech SetPoint
    Marvell Miniport Driver
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PLK
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PLK
    Microsoft .NET Framework 3.5 Language Pack SP1 - plk
    Microsoft .NET Framework 3.5 SP1
    Microsoft 3D Movie Maker 1.0
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (Polish) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (Polish) 2007
    Microsoft Office Groove MUI (Polish) 2007
    Microsoft Office InfoPath MUI (Polish) 2007
    Microsoft Office OneNote MUI (Polish) 2007
    Microsoft Office Outlook MUI (Polish) 2007
    Microsoft Office PowerPoint MUI (Polish) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (German) 2007
    Microsoft Office Proof (Polish) 2007
    Microsoft Office Proofing (Polish) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (Polish) 2007
    Microsoft Office Shared MUI (Polish) 2007
    Microsoft Office Word MUI (Polish) 2007
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (Polish) 12
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Mozilla Firefox (3.6.17)
    MSVC80_x86
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser
    NAPIPROJEKT 1.0.6.2
    Nokia Connectivity Cable Driver
    Nokia PC Suite
    Nokia Software Updater
    Notepad++
    NVIDIA Drivers
    NVIDIA nView Desktop Manager
    OpenVPN 2.2.0
    Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK
    Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1)
    Pakiet sterowników systemu Windows - Nokia Modem (03/05/2008 3.7)
    Pakiet sterowników systemu Windows - Nokia Modem (03/13/2008 6.86.0.1)
    Pakiet sterowników systemu Windows - Nokia Modem (05/24/2007 6.84.0.1)
    Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 4.1)
    Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 7.01.0.3)
    PCWin Speaker Recorder
    Podstawowe programy Windows Live
    Poprawka dla systemu Windows XP (KB2158563)
    Poprawka dla systemu Windows XP (KB2443685)
    Poprawka dla systemu Windows XP (KB952287)
    Poprawka dla systemu Windows XP (KB961118)
    Poprawka dla systemu Windows XP (KB970653-v3)
    Poprawka dla systemu Windows XP (KB976098-v2)
    Poprawka dla systemu Windows XP (KB979306)
    Poprawka dla systemu Windows XP (KB981793)
    QuickTime
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2466156)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2464583)
    Security Update for Microsoft Office Groove 2007 (KB2494047)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Segoe UI
    SimpLite-ICQ-AIM 2.5
    SimpLite-Jabber 2.5
    Skype™ 5.3
    Spybot - Search & Destroy
    Spyware Terminator
    SQLite ODBC Driver (remove only)
    Steam
    Super Email Spider
    TheBat! Home v5.0.12
    Total Commander (Remove or Repair)
    TrueCrypt
    Tweet Adder 3
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office Outlook 2007 (KB2509470)
    Update for Outlook 2007 Junk Email Filter (KB2536413)
    VideoLAN VLC media player 0.8.6h
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Internet Explorer 7
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Messenger
    Windows Live Upload Tool
    Windows Media Format Runtime
    Windows Media Player Firefox Plugin
    Windows Presentation Foundation
    Windows XP Service Pack 3
    Xenu's Link Sleuth
    XML Paper Specification Shared Components Language Pack 1.0
    XML Paper Specification Shared Components Pack 1.0
    .
    ==== End Of File ===========================
     
  8. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    This should be the whole thing. What should I do now? :)

    Thanks to anyone who takes the time to go through this!
     
  9. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Dzień dobry :)

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]

    ===================================================================

    Please download Rootkit Unhooker from one of the following links and save it to your desktop.
    In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

    • Double-click on RKUnhookerLE.exe to start the program.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • Click the Report tab, then click Scan.
    • Check Drivers, Stealth, and uncheck the rest.
    • Click OK.
    • Wait until it's finished and then go to File > Save Report.
    • Save the report to your Desktop.
    • Copy and paste the contents of the report into your next reply.
    -- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".
     
  10. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Cześć Broni! :)

    Here is the aswMBR log....


    aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
    Run date: 2011-06-04 19:40:57
    -----------------------------
    19:40:57.546 OS Version: Windows 5.1.2600 Dodatek Service Pack 3
    19:40:57.546 Number of processors: 2 586 0xF0D
    19:40:57.546 ComputerName: WORKSTATION UserName:
    19:40:58.984 Initialize success
    19:41:06.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7
    19:41:06.343 Disk 0 Vendor: SAMSUNG_HD200HJ KF100-06 Size: 190781MB BusType: 3
    19:41:06.343 Disk 0 MBR read error 0
    19:41:06.343 Disk 0 MBR scan
    19:41:06.343 Disk 0 unknown MBR code
    19:41:06.343 MBR BIOS signature not found 0
    19:41:06.343 Disk 0 scanning sectors +390700800
    19:41:06.359 Disk 0 scanning C:\WINDOWS\system32\drivers
    19:41:19.531 Service scanning
    19:41:22.234 Disk 0 trace - called modules:
    19:41:22.250 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS
    19:41:22.250 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5dc368]
    19:41:22.250 3 CLASSPNP.SYS[b80f8fd7] -> nt!IofCallDriver -> \Device\0000007a[0x8a55ff18]
    19:41:22.250 5 ACPI.sys[b7e53620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-7[0x8a5c6940]
    19:41:22.250 Scan finished successfully
    19:41:42.671 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Pulpit\MBR.dat"
    19:41:42.687 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Pulpit\aswMBR.txt"
     
  11. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    And the second one - the RKUnhookerLE report


    RkU Version: 3.8.389.593, Type LE (SR2)
    ==============================================
    OS Name: Windows XP
    Version 5.1.2600 (Dodatek Service Pack 3)
    Number of processors #2
    ==============================================
    >Drivers
    ==============================================
    0xB66D8000 C:\WINDOWS\System32\DRIVERS\nv4_mini.sys 10604544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 258.96 )
    0xBD012000 C:\WINDOWS\System32\nv4_disp.dll 6344704 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 258.96 )
    0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, Jądro i system NT)
    0x804D7000 PnpManager 2154496 bytes
    0x804D7000 RAW 2154496 bytes
    0x804D7000 WMIxWDM 2154496 bytes
    0xBF800000 Win32k 1859584 bytes
    0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Współużytkowany sterownik Win32)
    0xB62A1000 C:\WINDOWS\system32\drivers\p17xfilt.sys 1667072 bytes (Creative, Creative WDM 3D Audio Driver)
    0xB64D8000 C:\WINDOWS\system32\drivers\P17xfi.sys 1449984 bytes (Creative Technology Ltd., WDM Audio Miniport)
    0xB7E94000 PCI_PNP3328 1126400 bytes
    0xB7E94000 sptd.sys 1126400 bytes
    0xB7D09000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
    0xB3A6F000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
    0xB61B2000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
    0xB3C36000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
    0xB2B55000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
    0xBD61F000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
    0xB2370000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
    0xB663A000 C:\WINDOWS\System32\DRIVERS\yk51x86.sys 253952 bytes (Marvell, NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller)
    0xB3BD6000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
    0xB6268000 C:\WINDOWS\System32\Drivers\a45td694.SYS 233472 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
    0xB3CEA000 C:\WINDOWS\System32\DRIVERS\cmdguard.sys 233472 bytes (COMODO, COMODO Internet Security Sandbox Driver)
    0xB3B55000 C:\WINDOWS\System32\drivers\truecrypt.sys 225280 bytes (TrueCrypt Foundation, TrueCrypt Driver)
    0xB3A3B000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
    0xB645F000 C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 204800 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM))
    0xB6210000 C:\WINDOWS\System32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
    0xB7E4D000 ACPI.sys 192512 bytes (Microsoft Corporation, Sterownik ACPI dla systemu NT)
    0xB2CED000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
    0xB7CC6000 C:\WINDOWS\System32\DRIVERS\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
    0xB1430000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
    0xB3B07000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
    0xB2F52000 C:\WINDOWS\system32\drivers\ctusfsyn.sys 163840 bytes (Creative Technology Ltd., Creative SoundFont Synthesizer (32-bit))
    0xB6678000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
    0xB2BD5000 C:\WINDOWS\system32\DRIVERS\ithsgt.sys 163840 bytes
    0xB3BAE000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
    0xB6438000 C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 159744 bytes (Creative Technology Ltd, SoundFont(R) Manager (WDM))
    0xB7DF7000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, Sterownik We/Wy menedżera dysków NT)
    0xB3C10000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
    0xB2A19000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
    0xB64B4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
    0xB66A0000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
    0xB6491000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
    0xB3B32000 C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 143360 bytes (-, -)
    0xB3B8C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
    0x806E5000 ACPI_HAL 134400 bytes
    0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
    0xB7DBF000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
    0xB7E1D000 ftdisk.sys 126976 bytes (Microsoft Corporation, Sterownik dysku FT)
    0xB3A1D000 C:\WINDOWS\System32\Drivers\usbvideo.sys 122880 bytes (Microsoft Corporation, USB Video Class Driver)
    0xB7CAC000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
    0xB145B000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kgrorpow.sys 102400 bytes
    0xB7DDF000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xB7E7C000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
    0xB7D96000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
    0xB6251000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
    0xB7CF3000 inspect.sys 90112 bytes (COMODO, COMODO Internet Security Firewall Driver)
    0xB2FC8000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
    0xB66C4000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
    0xB3C8F000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
    0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
    0xB7DAD000 sr.sys 73728 bytes (Microsoft Corporation, Sterownik filtru systemu plików Przywracania systemu)
    0xB7E3C000 pci.sys 69632 bytes (Microsoft Corporation, Licznik NT Plug and Play PCI)
    0xB6240000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
    0xB2DFA000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
    0xB8258000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
    0xB8228000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
    0xB8108000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)
    0xB8268000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Sterownik filtru audio Redbook)
    0xB31B5000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
    0xB82F8000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
    0xB80A8000 qyaxcg.sys 57344 bytes
    0xB80F8000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
    0xB8238000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, Sterownik portu i8042)
    0xB8278000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
    0xB80D8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Sterownik kopiowania woluminów w tle)
    0xB7165000 C:\WINDOWS\system32\drivers\FDC1ANT.SYS 49152 bytes (Silence of Troubles United Company Ltd., Filter Device)
    0xB8298000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
    0xB2731000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\aswMBR.sys 45056 bytes
    0xB7185000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, Sterownik kryptografii FIPS)
    0xB8248000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
    0xB80C8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
    0xB8288000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
    0xB82B8000 C:\WINDOWS\system32\DRIVERS\tap0901.sys 45056 bytes (The OpenVPN Project, TAP-Win32 Virtual Network Driver)
    0xB8218000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 40960 bytes (Microsoft Corporation, Sterownik urządzenia procesora)
    0xB80B8000 isapnp.sys 40960 bytes (Microsoft Corporation, Sterownik magistrali ISA PNP)
    0xB82D8000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
    0xB82C8000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
    0xB150C000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
    0xB80E8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
    0xB7155000 C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
    0xB3085000 C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)
    0xB82A8000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
    0xB8138000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
    0xB8318000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
    0xB8428000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
    0xB8400000 C:\WINDOWS\System32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
    0xB8490000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
    0xB8498000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
    0xB8410000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
    0xB84A0000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 28672 bytes (Microsoft Corporation, Sterownik klasy klawiatury)
    0xB39CD000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\mbr.sys 28672 bytes
    0xB8328000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
    0xB8450000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
    0xB8440000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
    0xB8438000 C:\WINDOWS\System32\DRIVERS\cmdhlp.sys 24576 bytes (COMODO, COMODO Internet Security Helper Driver)
    0xB84A8000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
    0xB83E8000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Sterownik klasy myszy)
    0xB8488000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
    0xB8418000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
    0xB83F8000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
    0xB8458000 C:\WINDOWS\system32\drivers\HPFXGEN.SYS 20480 bytes (Hewlett Packard, HPFXBULK Support Driver)
    0xB8420000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
    0xB8330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
    0xB83D8000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
    0xB83E0000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
    0xB8338000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
    0xB8468000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
    0xB7C60000 C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys 16384 bytes (Logitech, Inc., Logitech PS2 Keyboard Filter Driver.)
    0xB34FD000 C:\WINDOWS\system32\drivers\mbam.sys 16384 bytes
    0xB8568000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
    0xB33CD000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
    0xB84B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
    0xB8590000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
    0xB7C54000 C:\WINDOWS\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
    0xB7C50000 C:\WINDOWS\system32\drivers\hpfxbulk.sys 12288 bytes (Hewlett Packard, hpfxbulk.sys)
    0xB2CC5000 C:\WINDOWS\system32\DRIVERS\lilsgt.sys 12288 bytes
    0xB5E3F000 C:\WINDOWS\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, Sterownik filtru myszy HID)
    0xB7C4C000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
    0xB85A0000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
    0xB85EE000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
    0xB85AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
    0xB85EC000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
    0xB85A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
    0xB85F0000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
    0xB85F2000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
    0xB8618000 C:\WINDOWS\System32\Drivers\StarOpen.SYS 8192 bytes
    0xB85E0000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
    0xB85E4000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
    0xB85AA000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
    0xB870D000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
    0xB8778000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
    0xB87EE000 C:\WINDOWS\System32\Drivers\LBeepKE.sys 4096 bytes (Logitech, Inc., Logitech Consumer Control Filter Driver.)
    0xB871B000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
    0xB8670000 pciide.sys 4096 bytes (Microsoft Corporation, Rodzajowy sterownik magistrali PCI IDE)
    0x8A58E1F8 unknown_irp_handler 3592 bytes
    0x89AA81F8 unknown_irp_handler 3592 bytes
    0x8A2C81F8 unknown_irp_handler 3592 bytes
    0x8A3001F8 unknown_irp_handler 3592 bytes
    0x8A3A91F8 unknown_irp_handler 3592 bytes
    0x8A3871F8 unknown_irp_handler 3592 bytes
    0x892A61F8 unknown_irp_handler 3592 bytes
    0x8A3D93F0 unknown_irp_handler 3088 bytes
    0x89A7B430 unknown_irp_handler 3024 bytes
    ==============================================
    >Stealth
    ==============================================
    WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]
     
     
  12. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Prosto z Polski? Z jakiego miasta?

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  13. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Tak jest - Warszawa, Wilanów. A Ciebie co stąd wywiało? :)

    Here is the TDSSKiller report....


    2011/06/04 19:51:06.0875 6124 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
    2011/06/04 19:51:07.0343 6124 ================================================================================
    2011/06/04 19:51:07.0343 6124 SystemInfo:
    2011/06/04 19:51:07.0343 6124
    2011/06/04 19:51:07.0343 6124 OS Version: 5.1.2600 ServicePack: 3.0
    2011/06/04 19:51:07.0343 6124 Product type: Workstation
    2011/06/04 19:51:07.0343 6124 ComputerName: WORKSTATION
    2011/06/04 19:51:07.0343 6124 UserName: Administrator
    2011/06/04 19:51:07.0343 6124 Windows directory: C:\WINDOWS
    2011/06/04 19:51:07.0343 6124 System windows directory: C:\WINDOWS
    2011/06/04 19:51:07.0343 6124 Processor architecture: Intel x86
    2011/06/04 19:51:07.0343 6124 Number of processors: 2
    2011/06/04 19:51:07.0343 6124 Page size: 0x1000
    2011/06/04 19:51:07.0343 6124 Boot type: Normal boot
    2011/06/04 19:51:07.0343 6124 ================================================================================
    2011/06/04 19:51:08.0046 6124 Initialize success
    2011/06/04 19:51:16.0406 4876 ================================================================================
    2011/06/04 19:51:16.0406 4876 Scan started
    2011/06/04 19:51:16.0406 4876 Mode: Manual;
    2011/06/04 19:51:16.0406 4876 ================================================================================
    2011/06/04 19:51:16.0875 4876 ACPI (05118282f5d039595a2b92b4a4afe197) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/06/04 19:51:16.0921 4876 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2011/06/04 19:51:16.0953 4876 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/06/04 19:51:17.0000 4876 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
    2011/06/04 19:51:17.0140 4876 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/06/04 19:51:17.0140 4876 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/06/04 19:51:17.0187 4876 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/06/04 19:51:17.0218 4876 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/06/04 19:51:17.0265 4876 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
    2011/06/04 19:51:17.0265 4876 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
    2011/06/04 19:51:17.0328 4876 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\WINDOWS\system32\Drivers\avgtdix.sys
    2011/06/04 19:51:17.0375 4876 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/06/04 19:51:17.0421 4876 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/06/04 19:51:17.0453 4876 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2011/06/04 19:51:17.0484 4876 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/06/04 19:51:17.0515 4876 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/06/04 19:51:17.0531 4876 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/06/04 19:51:17.0640 4876 cmdGuard (cc56fa45ba18904cb04382ae9f52b1a5) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
    2011/06/04 19:51:17.0671 4876 cmdHlp (3a70948ab6e966bdaef2baec1f8ef9d1) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
    2011/06/04 19:51:17.0750 4876 ctsfm2k (fcbb8ea6fe935d2c531d3a4dee9f985b) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
    2011/06/04 19:51:17.0781 4876 CTUSFSYN (12a7b253f9128b3b68a9979827047b76) C:\WINDOWS\system32\drivers\ctusfsyn.sys
    2011/06/04 19:51:17.0828 4876 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/06/04 19:51:17.0890 4876 dmboot (bc9219abc5696942e6f9ac8a9b28670f) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/06/04 19:51:17.0906 4876 dmio (5fa232e3ba6e1346f9f5a7e519320cb0) C:\WINDOWS\system32\drivers\dmio.sys
    2011/06/04 19:51:17.0921 4876 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/06/04 19:51:17.0953 4876 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/06/04 19:51:17.0984 4876 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/06/04 19:51:18.0031 4876 DSI_SiUSBXp_3_1 (bc9c2ef22ee0320c079e3ff9b4d29951) C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys
    2011/06/04 19:51:18.0078 4876 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/06/04 19:51:18.0109 4876 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/06/04 19:51:18.0140 4876 FDC1ANT (9575002157bdae1c1b4812b57dfaa967) C:\WINDOWS\system32\drivers\FDC1ANT.SYS
    2011/06/04 19:51:18.0156 4876 Fips (09e2a4d33f81a06a8aab2ba0a0b5d235) C:\WINDOWS\system32\drivers\Fips.sys
    2011/06/04 19:51:18.0171 4876 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/06/04 19:51:18.0203 4876 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/06/04 19:51:18.0218 4876 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/06/04 19:51:18.0234 4876 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/06/04 19:51:18.0250 4876 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    2011/06/04 19:51:18.0296 4876 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/06/04 19:51:18.0328 4876 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2011/06/04 19:51:18.0343 4876 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/06/04 19:51:18.0375 4876 HPFXBULK (e4e0b356a8756066cf89080d9da69f22) C:\WINDOWS\system32\drivers\hpfxbulk.sys
    2011/06/04 19:51:18.0421 4876 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/06/04 19:51:18.0453 4876 i8042prt (177b372af55c4460d0968b5f1d02aa1c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/06/04 19:51:18.0484 4876 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/06/04 19:51:18.0562 4876 Inspect (28c95218d0c19db3a86bb4e53d6586e9) C:\WINDOWS\system32\DRIVERS\inspect.sys
    2011/06/04 19:51:18.0593 4876 intelppm (da153edc09de8c4f846c085caa39d1cc) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/06/04 19:51:18.0609 4876 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/06/04 19:51:18.0656 4876 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/06/04 19:51:18.0671 4876 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/06/04 19:51:18.0718 4876 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/06/04 19:51:18.0734 4876 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/06/04 19:51:18.0765 4876 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/06/04 19:51:18.0796 4876 isapnp (c8eef2e93835b81bd335de2123121283) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/06/04 19:51:18.0843 4876 ithsgt (b7a5fadf67136fda7e8f25303565b674) C:\WINDOWS\system32\DRIVERS\ithsgt.sys
    2011/06/04 19:51:18.0859 4876 Kbdclass (2aeca45d4aeaacbdcb77ad11184e4601) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/06/04 19:51:18.0875 4876 kbdhid (f718dcddac2544bc693f22977d06f78b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2011/06/04 19:51:18.0906 4876 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/06/04 19:51:18.0953 4876 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/06/04 19:51:18.0968 4876 L8042Kbd (dc61f15187372d164769c841655e58f3) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
    2011/06/04 19:51:19.0078 4876 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
    2011/06/04 19:51:19.0109 4876 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
    2011/06/04 19:51:19.0140 4876 LBeepKE (8f4d784b3f22f468eea99da02b0e39e5) C:\WINDOWS\system32\Drivers\LBeepKE.sys
    2011/06/04 19:51:19.0203 4876 LHidFilt (dd83dc92463fce6324fd30a13d17d0da) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
    2011/06/04 19:51:19.0250 4876 lilsgt (16767ea492b5d140e1de3679a65eae74) C:\WINDOWS\system32\DRIVERS\lilsgt.sys
    2011/06/04 19:51:19.0296 4876 LMouFilt (8fe0008e183ff0293a925b78a5581c5f) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
    2011/06/04 19:51:19.0390 4876 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/06/04 19:51:19.0437 4876 Modem (4a068db7dc37d5afedb6512d2931d7b3) C:\WINDOWS\system32\drivers\Modem.sys
    2011/06/04 19:51:19.0468 4876 Mouclass (fbed3df6b884f8cf00447b73507f2c48) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/06/04 19:51:19.0468 4876 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2011/06/04 19:51:19.0500 4876 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/06/04 19:51:19.0531 4876 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/06/04 19:51:19.0562 4876 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/06/04 19:51:19.0593 4876 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/06/04 19:51:19.0625 4876 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/06/04 19:51:19.0640 4876 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/06/04 19:51:19.0656 4876 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/06/04 19:51:19.0703 4876 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/06/04 19:51:19.0718 4876 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    2011/06/04 19:51:19.0734 4876 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/06/04 19:51:19.0765 4876 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2011/06/04 19:51:19.0812 4876 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/06/04 19:51:19.0843 4876 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2011/06/04 19:51:19.0859 4876 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/06/04 19:51:19.0875 4876 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/06/04 19:51:19.0906 4876 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/06/04 19:51:19.0953 4876 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/06/04 19:51:19.0968 4876 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/06/04 19:51:20.0000 4876 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/06/04 19:51:20.0093 4876 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
    2011/06/04 19:51:20.0125 4876 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
    2011/06/04 19:51:20.0156 4876 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
    2011/06/04 19:51:20.0187 4876 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
    2011/06/04 19:51:20.0203 4876 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/06/04 19:51:20.0234 4876 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/06/04 19:51:20.0265 4876 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/06/04 19:51:20.0531 4876 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/06/04 19:51:20.0656 4876 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/06/04 19:51:20.0687 4876 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/06/04 19:51:20.0734 4876 ossrv (3649eefa90990249267dd6c7808cbc86) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
    2011/06/04 19:51:20.0781 4876 P17xfi (06902b5f2a17dddf1282ff402b5bd51b) C:\WINDOWS\system32\drivers\P17xfi.sys
    2011/06/04 19:51:20.0859 4876 p17xfilt (a782e03a3b54c13fa7c29d33e1c9a044) C:\WINDOWS\system32\drivers\p17xfilt.sys
    2011/06/04 19:51:20.0890 4876 Parport (2d4cdaebced17743aa9e25d3016dc229) C:\WINDOWS\system32\drivers\Parport.sys
    2011/06/04 19:51:20.0921 4876 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/06/04 19:51:20.0937 4876 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/06/04 19:51:20.0984 4876 PCI (6862c69168d787b85a7d95ccd33c694e) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/06/04 19:51:21.0031 4876 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/06/04 19:51:21.0062 4876 Pcmcia (8db27f1ae9593c94095485305a583862) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2011/06/04 19:51:21.0218 4876 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/06/04 19:51:21.0234 4876 Processor (7a1367d250502c6416a4d3a19ef155f5) C:\WINDOWS\system32\DRIVERS\processr.sys
    2011/06/04 19:51:21.0250 4876 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/06/04 19:51:21.0296 4876 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/06/04 19:51:21.0437 4876 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/06/04 19:51:21.0468 4876 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/06/04 19:51:21.0484 4876 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/06/04 19:51:21.0500 4876 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/06/04 19:51:21.0531 4876 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/06/04 19:51:21.0546 4876 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/06/04 19:51:21.0593 4876 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/06/04 19:51:21.0687 4876 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/06/04 19:51:21.0796 4876 redbook (e0c7bbd18040b58651bac700c804861d) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/06/04 19:51:21.0937 4876 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/06/04 19:51:22.0156 4876 Serial (d07b02f88165e69b9f17162cf592c8a6) C:\WINDOWS\system32\drivers\Serial.sys
    2011/06/04 19:51:22.0265 4876 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/06/04 19:51:22.0515 4876 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2011/06/04 19:51:22.0640 4876 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/06/04 19:51:22.0703 4876 sptd (a199171385be17973fd800fa91f8f78a) C:\WINDOWS\system32\Drivers\sptd.sys
    2011/06/04 19:51:22.0703 4876 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a
    2011/06/04 19:51:22.0703 4876 sptd - detected LockedFile.Multi.Generic (1)
    2011/06/04 19:51:22.0750 4876 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
    2011/06/04 19:51:22.0765 4876 sr (eb032822be406ef220d546ddffcf0002) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/06/04 19:51:22.0796 4876 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/06/04 19:51:22.0843 4876 StarOpen (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
    2011/06/04 19:51:22.0890 4876 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2011/06/04 19:51:22.0906 4876 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/06/04 19:51:22.0937 4876 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/06/04 19:51:23.0062 4876 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/06/04 19:51:23.0109 4876 tap0901 (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
    2011/06/04 19:51:23.0171 4876 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/06/04 19:51:23.0203 4876 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/06/04 19:51:23.0218 4876 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/06/04 19:51:23.0234 4876 teamviewervpn (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys
    2011/06/04 19:51:23.0265 4876 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/06/04 19:51:23.0359 4876 truecrypt (be45dad1c73a3216edc8c485916f6594) C:\WINDOWS\system32\drivers\truecrypt.sys
    2011/06/04 19:51:23.0437 4876 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/06/04 19:51:23.0531 4876 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/06/04 19:51:23.0578 4876 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
    2011/06/04 19:51:23.0609 4876 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
    2011/06/04 19:51:23.0671 4876 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
    2011/06/04 19:51:23.0687 4876 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/06/04 19:51:23.0750 4876 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
    2011/06/04 19:51:23.0765 4876 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/06/04 19:51:23.0781 4876 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/06/04 19:51:23.0812 4876 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
    2011/06/04 19:51:23.0859 4876 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/06/04 19:51:23.0890 4876 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
    2011/06/04 19:51:23.0906 4876 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
    2011/06/04 19:51:23.0937 4876 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/06/04 19:51:23.0953 4876 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/06/04 19:51:23.0984 4876 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
    2011/06/04 19:51:24.0015 4876 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/06/04 19:51:24.0046 4876 VolSnap (56b191ac5fc0df219949c95a6c87afe7) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/06/04 19:51:24.0109 4876 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/06/04 19:51:24.0171 4876 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2011/06/04 19:51:24.0218 4876 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/06/04 19:51:24.0343 4876 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
    2011/06/04 19:51:24.0390 4876 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2011/06/04 19:51:24.0437 4876 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
    2011/06/04 19:51:24.0515 4876 MBR (0x1B8) (32052574bf9f325ae309abc7bfd04460) \Device\Harddisk0\DR0
    2011/06/04 19:51:24.0671 4876 ================================================================================
    2011/06/04 19:51:24.0671 4876 Scan finished
    2011/06/04 19:51:24.0671 4876 ================================================================================
    2011/06/04 19:51:24.0687 4784 Detected object count: 1
    2011/06/04 19:51:24.0687 4784 Actual detected object count: 1
    2011/06/04 19:51:51.0109 4784 LockedFile.Multi.Generic(sptd) - User select action: Skip
    2011/06/04 19:52:13.0140 4192 ================================================================================
    2011/06/04 19:52:13.0140 4192 Scan started
    2011/06/04 19:52:13.0140 4192 Mode: Manual;
    2011/06/04 19:52:13.0140 4192 ================================================================================
    2011/06/04 19:52:13.0468 4192 ACPI (05118282f5d039595a2b92b4a4afe197) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/06/04 19:52:13.0500 4192 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2011/06/04 19:52:13.0531 4192 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/06/04 19:52:13.0562 4192 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
    2011/06/04 19:52:13.0718 4192 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/06/04 19:52:13.0718 4192 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/06/04 19:52:13.0750 4192 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/06/04 19:52:13.0781 4192 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/06/04 19:52:13.0843 4192 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
    2011/06/04 19:52:13.0859 4192 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
    2011/06/04 19:52:13.0906 4192 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\WINDOWS\system32\Drivers\avgtdix.sys
    2011/06/04 19:52:13.0953 4192 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/06/04 19:52:14.0000 4192 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/06/04 19:52:14.0062 4192 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2011/06/04 19:52:14.0093 4192 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/06/04 19:52:14.0125 4192 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/06/04 19:52:14.0140 4192 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/06/04 19:52:14.0234 4192 cmdGuard (cc56fa45ba18904cb04382ae9f52b1a5) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
    2011/06/04 19:52:14.0265 4192 cmdHlp (3a70948ab6e966bdaef2baec1f8ef9d1) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
    2011/06/04 19:52:14.0343 4192 ctsfm2k (fcbb8ea6fe935d2c531d3a4dee9f985b) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
    2011/06/04 19:52:14.0375 4192 CTUSFSYN (12a7b253f9128b3b68a9979827047b76) C:\WINDOWS\system32\drivers\ctusfsyn.sys
    2011/06/04 19:52:14.0421 4192 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/06/04 19:52:14.0468 4192 dmboot (bc9219abc5696942e6f9ac8a9b28670f) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/06/04 19:52:14.0484 4192 dmio (5fa232e3ba6e1346f9f5a7e519320cb0) C:\WINDOWS\system32\drivers\dmio.sys
    2011/06/04 19:52:14.0515 4192 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/06/04 19:52:14.0531 4192 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/06/04 19:52:14.0578 4192 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/06/04 19:52:14.0609 4192 DSI_SiUSBXp_3_1 (bc9c2ef22ee0320c079e3ff9b4d29951) C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys
    2011/06/04 19:52:14.0656 4192 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/06/04 19:52:14.0671 4192 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/06/04 19:52:14.0703 4192 FDC1ANT (9575002157bdae1c1b4812b57dfaa967) C:\WINDOWS\system32\drivers\FDC1ANT.SYS
    2011/06/04 19:52:14.0750 4192 Fips (09e2a4d33f81a06a8aab2ba0a0b5d235) C:\WINDOWS\system32\drivers\Fips.sys
    2011/06/04 19:52:14.0765 4192 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/06/04 19:52:14.0781 4192 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/06/04 19:52:14.0796 4192 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/06/04 19:52:14.0812 4192 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/06/04 19:52:14.0843 4192 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    2011/06/04 19:52:14.0859 4192 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/06/04 19:52:14.0890 4192 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2011/06/04 19:52:14.0906 4192 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/06/04 19:52:14.0937 4192 HPFXBULK (e4e0b356a8756066cf89080d9da69f22) C:\WINDOWS\system32\drivers\hpfxbulk.sys
    2011/06/04 19:52:15.0000 4192 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/06/04 19:52:15.0031 4192 i8042prt (177b372af55c4460d0968b5f1d02aa1c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/06/04 19:52:15.0046 4192 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/06/04 19:52:15.0140 4192 Inspect (28c95218d0c19db3a86bb4e53d6586e9) C:\WINDOWS\system32\DRIVERS\inspect.sys
    2011/06/04 19:52:15.0187 4192 intelppm (da153edc09de8c4f846c085caa39d1cc) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/06/04 19:52:15.0218 4192 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/06/04 19:52:15.0250 4192 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/06/04 19:52:15.0265 4192 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/06/04 19:52:15.0296 4192 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/06/04 19:52:15.0312 4192 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/06/04 19:52:15.0343 4192 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/06/04 19:52:15.0359 4192 isapnp (c8eef2e93835b81bd335de2123121283) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/06/04 19:52:15.0453 4192 ithsgt (b7a5fadf67136fda7e8f25303565b674) C:\WINDOWS\system32\DRIVERS\ithsgt.sys
    2011/06/04 19:52:15.0468 4192 Kbdclass (2aeca45d4aeaacbdcb77ad11184e4601) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/06/04 19:52:15.0484 4192 kbdhid (f718dcddac2544bc693f22977d06f78b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2011/06/04 19:52:15.0500 4192 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/06/04 19:52:15.0531 4192 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/06/04 19:52:15.0546 4192 L8042Kbd (dc61f15187372d164769c841655e58f3) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
    2011/06/04 19:52:15.0656 4192 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
    2011/06/04 19:52:15.0687 4192 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
    2011/06/04 19:52:15.0718 4192 LBeepKE (8f4d784b3f22f468eea99da02b0e39e5) C:\WINDOWS\system32\Drivers\LBeepKE.sys
    2011/06/04 19:52:15.0765 4192 LHidFilt (dd83dc92463fce6324fd30a13d17d0da) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
    2011/06/04 19:52:15.0828 4192 lilsgt (16767ea492b5d140e1de3679a65eae74) C:\WINDOWS\system32\DRIVERS\lilsgt.sys
    2011/06/04 19:52:15.0875 4192 LMouFilt (8fe0008e183ff0293a925b78a5581c5f) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
    2011/06/04 19:52:15.0953 4192 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/06/04 19:52:15.0984 4192 Modem (4a068db7dc37d5afedb6512d2931d7b3) C:\WINDOWS\system32\drivers\Modem.sys
    2011/06/04 19:52:16.0015 4192 Mouclass (fbed3df6b884f8cf00447b73507f2c48) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/06/04 19:52:16.0031 4192 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2011/06/04 19:52:16.0078 4192 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/06/04 19:52:16.0109 4192 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/06/04 19:52:16.0140 4192 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/06/04 19:52:16.0171 4192 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/06/04 19:52:16.0187 4192 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/06/04 19:52:16.0203 4192 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/06/04 19:52:16.0218 4192 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/06/04 19:52:16.0250 4192 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/06/04 19:52:16.0312 4192 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    2011/06/04 19:52:16.0328 4192 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/06/04 19:52:16.0359 4192 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2011/06/04 19:52:16.0406 4192 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/06/04 19:52:16.0421 4192 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2011/06/04 19:52:16.0437 4192 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/06/04 19:52:16.0468 4192 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/06/04 19:52:16.0484 4192 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/06/04 19:52:16.0562 4192 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/06/04 19:52:16.0578 4192 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/06/04 19:52:16.0593 4192 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/06/04 19:52:16.0671 4192 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
    2011/06/04 19:52:16.0703 4192 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
    2011/06/04 19:52:16.0750 4192 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
    2011/06/04 19:52:16.0781 4192 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
    2011/06/04 19:52:16.0796 4192 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/06/04 19:52:16.0828 4192 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/06/04 19:52:16.0843 4192 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/06/04 19:52:17.0125 4192 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/06/04 19:52:17.0265 4192 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/06/04 19:52:17.0281 4192 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/06/04 19:52:17.0328 4192 ossrv (3649eefa90990249267dd6c7808cbc86) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
    2011/06/04 19:52:17.0375 4192 P17xfi (06902b5f2a17dddf1282ff402b5bd51b) C:\WINDOWS\system32\drivers\P17xfi.sys
    2011/06/04 19:52:17.0468 4192 p17xfilt (a782e03a3b54c13fa7c29d33e1c9a044) C:\WINDOWS\system32\drivers\p17xfilt.sys
    2011/06/04 19:52:17.0515 4192 Parport (2d4cdaebced17743aa9e25d3016dc229) C:\WINDOWS\system32\drivers\Parport.sys
    2011/06/04 19:52:17.0531 4192 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/06/04 19:52:17.0562 4192 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/06/04 19:52:17.0593 4192 PCI (6862c69168d787b85a7d95ccd33c694e) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/06/04 19:52:17.0671 4192 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/06/04 19:52:17.0703 4192 Pcmcia (8db27f1ae9593c94095485305a583862) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2011/06/04 19:52:17.0843 4192 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/06/04 19:52:17.0875 4192 Processor (7a1367d250502c6416a4d3a19ef155f5) C:\WINDOWS\system32\DRIVERS\processr.sys
    2011/06/04 19:52:17.0906 4192 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/06/04 19:52:17.0953 4192 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/06/04 19:52:18.0046 4192 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/06/04 19:52:18.0062 4192 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/06/04 19:52:18.0093 4192 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/06/04 19:52:18.0109 4192 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/06/04 19:52:18.0125 4192 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/06/04 19:52:18.0140 4192 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/06/04 19:52:18.0171 4192 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/06/04 19:52:18.0203 4192 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/06/04 19:52:18.0218 4192 redbook (e0c7bbd18040b58651bac700c804861d) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/06/04 19:52:18.0328 4192 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/06/04 19:52:18.0359 4192 Serial (d07b02f88165e69b9f17162cf592c8a6) C:\WINDOWS\system32\drivers\Serial.sys
    2011/06/04 19:52:18.0390 4192 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/06/04 19:52:18.0453 4192 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2011/06/04 19:52:18.0484 4192 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/06/04 19:52:18.0578 4192 sptd (a199171385be17973fd800fa91f8f78a) C:\WINDOWS\system32\Drivers\sptd.sys
    2011/06/04 19:52:18.0578 4192 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a
    2011/06/04 19:52:18.0578 4192 sptd - detected LockedFile.Multi.Generic (1)
    2011/06/04 19:52:18.0625 4192 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
    2011/06/04 19:52:18.0640 4192 sr (eb032822be406ef220d546ddffcf0002) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/06/04 19:52:18.0671 4192 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/06/04 19:52:18.0718 4192 StarOpen (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
    2011/06/04 19:52:18.0750 4192 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2011/06/04 19:52:18.0781 4192 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/06/04 19:52:18.0812 4192 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/06/04 19:52:18.0937 4192 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/06/04 19:52:18.0968 4192 tap0901 (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
    2011/06/04 19:52:19.0031 4192 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/06/04 19:52:19.0046 4192 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/06/04 19:52:19.0078 4192 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/06/04 19:52:19.0093 4192 teamviewervpn (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys
    2011/06/04 19:52:19.0125 4192 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/06/04 19:52:19.0218 4192 truecrypt (be45dad1c73a3216edc8c485916f6594) C:\WINDOWS\system32\drivers\truecrypt.sys
    2011/06/04 19:52:19.0265 4192 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/06/04 19:52:19.0359 4192 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/06/04 19:52:19.0421 4192 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
    2011/06/04 19:52:19.0484 4192 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
    2011/06/04 19:52:19.0546 4192 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
    2011/06/04 19:52:19.0578 4192 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/06/04 19:52:19.0609 4192 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
    2011/06/04 19:52:19.0640 4192 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/06/04 19:52:19.0687 4192 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/06/04 19:52:19.0734 4192 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
    2011/06/04 19:52:19.0765 4192 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/06/04 19:52:19.0812 4192 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
    2011/06/04 19:52:19.0843 4192 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
    2011/06/04 19:52:19.0875 4192 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/06/04 19:52:19.0890 4192 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/06/04 19:52:19.0921 4192 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
    2011/06/04 19:52:19.0953 4192 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/06/04 19:52:19.0984 4192 VolSnap (56b191ac5fc0df219949c95a6c87afe7) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/06/04 19:52:20.0031 4192 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/06/04 19:52:20.0140 4192 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2011/06/04 19:52:20.0187 4192 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/06/04 19:52:20.0296 4192 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
    2011/06/04 19:52:20.0343 4192 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2011/06/04 19:52:20.0406 4192 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
    2011/06/04 19:52:20.0484 4192 MBR (0x1B8) (32052574bf9f325ae309abc7bfd04460) \Device\Harddisk0\DR0
    2011/06/04 19:52:20.0609 4192 ================================================================================
    2011/06/04 19:52:20.0609 4192 Scan finished
    2011/06/04 19:52:20.0609 4192 ================================================================================
    2011/06/04 19:52:20.0609 5148 Detected object count: 1
    2011/06/04 19:52:20.0609 5148 Actual detected object count: 1
    2011/06/04 19:52:24.0515 5148 LockedFile.Multi.Generic(sptd) - User select action: Skip
     
  14. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    I ran the scan twice as you can see, sorry for that - I didn't notice the "Report" button the first time so I thought I missed something and repeated the process.
     
  15. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    O, komuna mnie wygnała dawno temu. Wyjechałem z Krakowa w 1985.

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  16. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    No proszę, a ja się urodziłem w czerwcu 1985 - może się 'mineliśmy' :)

    This step is going to take a bit longer as I'm removing AVG - I'll get back with the results ASAP (working on it right now.)
     
  17. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    No problem :)
     
  18. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    ComboFix report coming through...



    ComboFix 08-12-03.01 - Administrator 2008-12-04 12:28:42.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1546 [GMT 1:00]
    Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe
    * Utworzono nowy punkt przywracania
    .

    ((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\Microsoft\backup.ftp

    .
    ((((((((((((((((((((((((( Pliki utworzone od 2008-11-04 do 2008-12-04 )))))))))))))))))))))))))))))))
    .

    2008-12-04 12:03 . 2008-12-04 12:03 <DIR> d--h----- c:\windows\system32\GroupPolicy
    2008-12-03 21:49 . 2008-12-03 21:49 <DIR> d-------- c:\program files\SkanerOnline
    2008-11-30 18:21 . 2008-11-30 18:21 <DIR> d-------- c:\windows\system32\TimeCtrlLibs
    2008-11-30 18:13 . 2008-11-30 18:14 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\SKL
    2008-11-25 18:32 . 2008-12-02 19:21 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\SimpLogs
    2008-11-20 20:14 . 2008-11-20 20:14 <DIR> d-------- C:\Temorasoft_Timer_Setup
    2008-11-16 11:30 . 2008-11-16 11:30 <DIR> d-------- c:\program files\www.freewordexcelpassword.com
    2008-11-14 23:05 . 2008-11-14 23:05 <DIR> d-------- c:\program files\Stoper
    2008-11-13 02:13 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
    2008-11-13 02:13 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
    2008-11-04 16:16 . 2008-11-04 16:16 <DIR> d-------- c:\windows\system32\QuickTime
    2008-11-04 16:16 . 2008-03-12 02:37 107,864 --a------ c:\windows\system32\tsccvid.dll
    2008-11-04 16:15 . 2008-11-04 16:15 <DIR> d-------- c:\program files\TechSmith
    2008-11-04 16:15 . 2008-11-04 16:15 <DIR> d-------- c:\program files\Common Files\TechSmith Shared

    .
    (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-04 11:29 --------- d-----w c:\program files\Common Files\Symantec Shared
    2008-12-04 11:24 --------- d-----w c:\program files\PokerStars
    2008-12-04 08:37 --------- d-----w c:\program files\Full Tilt Poker
    2008-12-03 21:45 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\uTorrent
    2008-12-02 17:29 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Skype
    2008-12-02 17:19 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\skypePM
    2008-11-25 18:23 --------- d-----w c:\program files\Secway
    2008-11-25 18:11 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
    2008-11-25 05:31 --------- d-----w c:\program files\Spyware Doctor
    2008-11-18 10:47 --------- d-----w c:\program files\NAPI-PROJEKT
    2008-11-03 09:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip
    2008-11-02 14:48 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-02 14:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Fallout3
    2008-11-02 14:47 --------- d-----w c:\program files\Bethesda Softworks
    2008-11-02 14:45 --------- d-----w c:\program files\MSBuild
    2008-11-02 14:42 --------- d-----w c:\program files\Reference Assemblies
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-18 20:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec
    2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
    2008-09-10 10:40 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
    2008-09-10 10:20 413,696 ----a-w c:\windows\system32\wrap_oal.dll
    2008-09-10 10:20 102,400 ----a-w c:\windows\system32\OpenAL32.dll
    2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
    2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll
    .

    ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Simp"="c:\program files\Secway\SimpPro 2.2\SimpPro.exe" [2007-10-25 2347008]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "msmsgs"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2007-06-28 8466432]
    "NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2007-06-28 81920]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
    "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704]
    "PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
    "nwiz"="nwiz.exe" [2007-06-28 c:\windows\system32\nwiz.exe]
    "P17Helper"="SPIRun.dll" [2006-07-03 c:\windows\system32\SPIRun.dll]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= c:\documents and settings\Administrator\Pulpit\95495_natalie104_122_1094lo.jpg
    FriendlyName=

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
    Source= c:\documents and settings\Administrator\Moje dokumenty\Moje obrazy\95495_natalie104_122_1094lo.jpg
    FriendlyName=

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-01-25 149352]
    R3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-10 99376]
    S3 {FAA5C1BB-9412-4043-901A-F14040632269};{FAA5C1BB-9412-4043-901A-F14040632269};\??\c:\windows\system32\drivers\scfsp.sys []
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-09-10 356920]

    *Newly Created Service* - COMHOST
    *Newly Created Service* - FILEMON701
    *Newly Created Service* - PROCEXP90
    .
    Zawartość folderu 'Zaplanowane zadania'

    2008-12-02 c:\windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Administrator.job
    - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05]
    .
    .
    ------- Skan uzupełniający -------
    .
    FireFox -: Profile - c:\documents and settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\ymtr4d1k.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1396957&SearchSource=3&q=
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-04 12:29:49
    Windows 5.1.2600 Dodatek Service Pack 3 NTFS

    skanowanie ukrytych procesów ...

    skanowanie ukrytych wpisów autostartu ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

    skanowanie ukrytych plików ...

    skanowanie pomyślnie ukończone
    ukryte pliki: 0

    **************************************************************************
    .
    Czas ukończenia: 2008-12-04 12:30:24
    ComboFix-quarantined-files.txt 2008-12-04 11:30:14

    Przed: 138*568*101*888 bajtów wolnych
    Po: 141,053,980,672 bajtów wolnych

    WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

    153 --- E O F --- 2008-11-22 08:10:37
     
  19. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    By the way; how likely is it that I will need to uninstall AVG again soon? I'm not sure whether I should be re-installing it right now or not :)
     
  20. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Widzę, że sobie dajesz świetnie radę z angielskim :)
    Polskie dziewczyny nadal najładniejsze na świecie?

    Combofix log looks good, but it looks like we have some issue with your MBR.
    I assume, you're still getting redirected?
    If so, which browser is affected?

    You also have some Norton's leftovers.
    Run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

    Now, regarding your MBR...
    Restart computer
    When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
    You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.
    If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.

    You should get a black screen with a C:\> prompt. Type with an Enter after each line:

    fixmbr

    (If it asks you if you are sure then say "Y".)

    exit

    Reboot computer.

    Post fresh aswMBR log.
     
  21. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Hold AVG off for now.
     
  22. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Dużo Cartoon Network się naoglądałem w dzieciństwie i trochę mi zostało :) Dziewczyny bardzo ładne tutaj, chociaż osobiście wolę hiszpanki i latynoski. Nie pytam jak z dziewczynami w USA, bo słyszałem relacje od wielu osób i były dość jednoznaczne... :)

    Yes, the problem still occurs. It manifests itself in Google Chrome only. (I have just checked in internet explorer and it was clean.)

    Thanks for the Norton Removal Tool, it's definitely annoying to remove anything created by Norton :)

    Taking care of the MBR right now and will post the aswMBR log in a few.
     
  23. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    (Waiting for Norton Removal Tools to finish before I reboot... :) )
     
  24. Broni

    Broni Malware Annihilator Posts: 48,011   +271

    Hahaha, nie komentuje :)
     
  25. hasek747

    hasek747 TS Rookie Topic Starter Posts: 46

    Pewnie najładniejsze amerykanki to polki ;-) Ja swoją drogą polakiem nie jestem; rodzice przyjechali tutaj z Jordanii za młodu na stypendiach (Akademia Medyczna) i się tutaj na miejscu poznali :)

    New MBR has been successfully created. Will post a new aswMBR log in a few.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.