Solved Malware redirecting pages in Google results

[hasek747]

Hi everyone,

Seems like a common problem, but the solution seems different every time, so I'm posting a new thread.

Clicking results in Google's search redirect me to pages that have completely nothing to do with the link I actually clicked (usually takes me to an XXX or dating site.) This happens around 50% of the time when I click a Google result.

I've scanned my computer using: AVG antivirus, Spyware Terminator and Ad-Aware - didn't help.

Attaching my HiJackThis log. Please let me know if you need anything else and hopefully I'll get rid of this annoying problem very quickly!

Thanks
Mark

 

[Broni]

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

 

[hasek747]

Hi Broni,

Thanks for the welcome

Let's get started!

 

[hasek747]

Anti-Malware Coming through....


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6771

Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 7.0.5730.13

06/04/2011 7:08:19 PM
mbam-log-2011-06-04 (19-08-19).txt

Scan type: Quick scan
Objects scanned: 196856
Time elapsed: 11 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\CE8SIIFGSU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\EWABQAF7KL (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VXEG3ZNNE5 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\UBC5AB1IDP (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Value: kr_done1 -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{8c3fdd81-7ae0-4605-a46a-2488b179f2a3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

 

[hasek747]

GMER coming through...

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-04 19:24:08
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7 SAMSUNG_HD200HJ rev.KF100-06
Running: l12w4p99.exe; Driver: C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kgrorpow.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 MBR read error
Disk \Device\Harddisk0\DR0 MBR BIOS signature not found 0

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwEnumerateKey [0xB3CF5864]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwEnumerateValueKey [0xB3CF5ABA]

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-12 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-7 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort3 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort4 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort5 [B7DE8B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\a45td694 \Device\Scsi\a45td6941Port6Path0Target0Lun0 8A2C81F8
Device \Driver\a45td694 \Device\Scsi\a45td6941 8A2C81F8
Device \FileSystem\Ntfs \Ntfs 8A58E1F8
Device \FileSystem\Fastfat \Fat 89AA81F8

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----

 

[hasek747]

DDS.txt coming through....


.
DDS (Ver_2011-06-03.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_24
Run by Administrator at 19:28:12 on 2011-06-04
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2046.871 [GMT 2:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
FW: COMODO Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Secway\SimpLite-Jabber 2.5\SimpLite-Jabber.exe
C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.qemit.com
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: FreeRIP.com Toolbar: {081230f8-ea50-42a9-983c-d22abc2eed3b} - c:\program files\freerip3\toolband.dll
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB: {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Simp] c:\program files\secway\simplite-jabber 2.5\SimpLite-Jabber.exe
mRun: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
mRun: [oepsrv] c:\windows\oepext\oepsrv.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [KeyScrambler] c:\program files\keyscrambler\getting_started.html
dRunOnce: [<NO NAME>]
mExplorerRun: [<NO NAME>] 1 (0x1)
StartupFolder: c:\docume~1\admini~1\menust~1\programy\autost~1\tworze~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\admini~1\menust~1\programy\autost~1\autoru~1\micros~1.lnk - c:\program files\microsoft office\office12\GROOVE.EXE
StartupFolder: c:\docume~1\alluse~1\menust~1\programy\autost~1\miniey~1.lnk - c:\program files\infinite mind lc\eyeq\ARLaunch.exe
StartupFolder: c:\docume~1\alluse~1\menust~1\programy\autost~1\autoru~1\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
uPolicies-explorer: DisallowRun = 0 (0x0)
dPolicies-explorer: DisallowRun = 0 (0x0)
IE: &FreeRIP Search - c:\program files\freerip3\toolband.dll/MENUSEARCH.HTM
IE: E&ksport do programu Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\icq7.5\ICQ.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
Trusted Zone: mks.com.pl
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221038163406
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 62.179.1.63 62.179.1.62
TCP: Interfaces\{97021395-5DDF-47EC-B789-B9D26E07F54E} : NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{97021395-5DDF-47EC-B789-B9D26E07F54E} : DhcpNameServer = 62.179.1.63 62.179.1.62
TCP: Interfaces\{D830D6ED-3C40-469D-A8E0-FA5F4C35CB7E} : NameServer = 216.131.95.20,216.131.94.5
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: avgrsstarter - avgrsstx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
AppInit_DLLs: c:\windows\system32\guard32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4c39316f&v=6.103.018.001&i=23&tp=ab&iy=&ychte=us&lng=pl&q=
FF - component: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\administrator\dane aplikacji\mozilla\firefox\profiles\ymtr4d1k.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\all users\dane aplikacji\gadu-gadu 10\_userdata\npgg.3.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Menu Editor: {EDA7B1D7-F793-4e03-B074-E6F303317FB0} - %profile%\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
FF - Ext: ScrapBook Plus: scrapbookplus@addons.mozilla.org - %profile%\extensions\scrapbookplus@addons.mozilla.org
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - %profile%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: United States English Spellchecker: en-US@dictionaries.addons.mozilla.org - %profile%\extensions\en-US@dictionaries.addons.mozilla.org
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
FF - Ext: RankChecker: rankchecker@seobook.com - %profile%\extensions\rankchecker@seobook.com
FF - Ext: Seo Toolbar: seotoolbar@seobook.com - %profile%\extensions\seotoolbar@seobook.com
FF - Ext: SEO For Firefox: seo4firefox@seobook.com - %profile%\extensions\seo4firefox@seobook.com
FF - Ext: FoxyProxy Standard: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
FF - Ext: FoxyProxy Basic: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
FF - Ext: AVG Security Toolbar em:version=6.103.018.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg9\toolbar\firefox\avg@igeared
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-6-4 64512]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-7-11 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-7-11 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-7-11 243152]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-5-2 242472]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-5-2 29400]
R1 FDC1ANT;FDC1ANT;c:\windows\system32\drivers\FDC1ANT.SYS [2008-12-16 47855]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-6-4 142592]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-11 308136]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-5-9 1779792]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 2151128]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-1-24 10384]
R4 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
R4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-4 366640]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-23 136176]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-9-30 374152]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-27 947528]
S3 gupdatem;Usługa Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-23 136176]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-12-3 15232]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-6-13 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-6-13 8320]
S3 RkHit;RkHit;\??\c:\windows\system32\drivers\rkhit.sys --> c:\windows\system32\drivers\RKHit.sys [?]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2008-1-25 25088]
S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\ultramonmirror.sys --> c:\windows\system32\drivers\UltraMonMirror.sys [?]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\zdcndis5.sys --> c:\windows\system32\ZDCndis5.SYS [?]
.
=============== Created Last 30 ================
.
2011-06-04 16:54:49 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Malwarebytes
2011-06-04 16:54:36 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Malwarebytes
2011-06-04 16:54:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-04 16:24:01 388096 ----a-r- c:\documents and settings\administrator\dane aplikacji\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-06-04 16:23:58 -------- d-----w- c:\program files\Trend Micro
2011-06-04 16:14:26 -------- d--h--w- C:\VritualRoot
2011-06-04 16:11:39 -------- d-----w- c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\Eraser 6
2011-06-04 16:10:38 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-06-04 16:03:59 -------- d-----w- c:\program files\COMODO
2011-06-04 16:03:02 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Comodo
2011-06-04 15:15:45 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-06-04 15:15:35 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-06-04 15:10:56 -------- d-----w- c:\documents and settings\administrator\ustawienia lokalne\dane aplikacji\Sunbelt Software
2011-06-04 15:09:40 -------- dc-h--w- c:\documents and settings\all users\dane aplikacji\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-06-04 13:13:59 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-06-04 11:33:41 5504 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2011-06-04 08:49:21 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-06-04 08:49:21 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-04 08:48:15 -------- d-----w- c:\program files\Infinite Mind LC
2011-06-04 08:48:13 -------- d-----w- c:\program files\FreeRIP3
2011-06-04 08:47:28 -------- d-----w- c:\documents and settings\all users\dane aplikacji\MicroSoftOcx
2011-06-04 08:47:19 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Affilorama
2011-06-03 23:37:22 -------- d-----w- C:\vseqrntn.bin
2011-06-03 21:11:56 -------- d-----w- c:\program files\Lavasoft
2011-06-03 21:07:38 -------- d-----w- c:\program files\CyberDefender
2011-06-03 21:07:21 -------- d-----w- c:\program files\common files\Authentium
2011-06-03 20:58:41 -------- d-----w- c:\program files\Spyware Terminator
2011-06-03 20:58:41 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Spyware Terminator
2011-06-02 19:04:07 -------- d-----w- c:\program files\Yahoo!
2011-06-02 14:57:28 -------- d-----w- c:\program files\OpenVPN
2011-06-02 11:11:19 -------- d-----w- c:\program files\Secway
2011-06-02 10:53:26 -------- d-----w- c:\program files\ICQ7.5
2011-06-02 10:26:00 -------- d-----w- c:\program files\ICQ6Toolbar
2011-06-02 10:25:57 -------- d-----w- c:\documents and settings\all users\dane aplikacji\ICQ
2011-06-02 09:28:25 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spider1
2011-05-31 22:09:48 -------- d-----w- c:\documents and settings\all users\dane aplikacji\TrueCrypt
2011-05-31 20:02:53 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\TrueCrypt
2011-05-31 20:02:12 231248 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2011-05-31 20:02:06 -------- d-----w- c:\program files\TrueCrypt
2011-05-27 14:17:47 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spiderss
2011-05-27 13:03:56 -------- d-----w- c:\program files\fec
2011-05-27 12:17:01 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\Email Stacker
2011-05-27 12:02:39 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Save Data
2011-05-27 12:02:22 389120 ----a-w- c:\windows\system32\actskn43.ocx
2011-05-27 11:48:17 -------- d-----w- c:\documents and settings\all users\Pulpit
2011-05-27 11:38:55 124688 ------w- c:\windows\system32\Mswinsck.ocx
2011-05-27 11:38:55 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\northworks.biz
2011-05-27 11:36:46 -------- d-----w- c:\program files\Super Email Harvester
2011-05-27 11:25:24 -------- d-----w- c:\program files\Power Email Harvester
2011-05-27 11:00:11 -------- d-----w- c:\program files\Best Email Extractor
2011-05-27 10:25:19 112640 ----a-w- c:\windows\lsb_un20.exe
2011-05-27 10:25:17 -------- d-----w- c:\program files\Link Web Extractor
2011-05-27 10:08:21 -------- d-----w- c:\documents and settings\administrator\dane aplikacji\GSA Email Spider
2011-05-15 14:53:25 -------- d-----w- c:\documents and settings\all users\dane aplikacji\Skype Extras
2011-05-14 17:04:09 162432 ----a-w- c:\windows\system32\drivers\ithsgt.sys
2011-05-14 17:04:09 12032 ----a-w- c:\windows\system32\drivers\lilsgt.sys
.
==================== Find3M ====================
.
2011-05-17 08:26:53 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-05-06 08:17:51 243152 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-05-02 18:36:54 29400 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-02 18:36:52 242472 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-02 18:36:52 17416 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-02 18:36:04 284744 ----a-w- c:\windows\system32\guard32.dll
2011-04-26 09:21:06 26624 ----a-w- c:\windows\system32\drivers\tap0901.sys
2011-03-07 05:33:36 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
============= FINISH: 19:30:06.01 ===============

 

[hasek747]

And Attach.txt coming through...


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-03.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 09/09/2008 9:51:55 PM
System Uptime: 06/04/2011 7:11:08 PM (0 hours ago)
.
Motherboard: http://www.abit.com.tw/ | | IP35-E (Intel P35+ICH9/R)
Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz | Socket 775 | 2244/204mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 186 GiB total, 29.082 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: Urządzenie audio na High Definition Audio
Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_147BA601&REV_1000\4&5A350D8&0&0001
Manufacturer:
Name: Urządzenie audio na High Definition Audio
PNP Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_147BA601&REV_1000\4&5A350D8&0&0001
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Kontroler magistrali zarządzania systemem
Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_1085147B&REV_02\3&2411E6FE&0&FB
Manufacturer:
Name: Kontroler magistrali zarządzania systemem
PNP Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_1085147B&REV_02\3&2411E6FE&0&FB
Service:
.
==== System Restore Points ===================
.
RP77: 04/03/2011 4:00:17 AM - Software Distribution Service 3.0
RP78: 04/04/2011 1:02:41 AM - Software Distribution Service 3.0
RP79: 04/04/2011 11:52:11 PM - Software Distribution Service 3.0
RP80: 04/05/2011 12:27:32 PM - Software Distribution Service 3.0
RP81: 04/06/2011 4:57:20 PM - Punkt kontrolny systemu
RP82: 04/06/2011 5:00:15 PM - Software Distribution Service 3.0
RP83: 04/07/2011 4:00:14 AM - Software Distribution Service 3.0
RP84: 04/07/2011 11:37:26 PM - Software Distribution Service 3.0
RP85: 04/09/2011 1:58:44 AM - Software Distribution Service 3.0
RP86: 04/10/2011 12:28:12 AM - Software Distribution Service 3.0
RP87: 04/11/2011 12:34:54 AM - Punkt kontrolny systemu
RP88: 04/11/2011 4:00:16 AM - Software Distribution Service 3.0
RP89: 04/12/2011 10:25:24 AM - Software Distribution Service 3.0
RP90: 04/13/2011 4:00:24 AM - Software Distribution Service 3.0
RP91: 04/14/2011 4:18:52 AM - Punkt kontrolny systemu
RP92: 04/15/2011 4:03:56 PM - Punkt kontrolny systemu
RP93: 04/16/2011 4:00:29 AM - Software Distribution Service 3.0
RP94: 04/17/2011 4:00:15 AM - Software Distribution Service 3.0
RP95: 04/18/2011 4:00:19 AM - Software Distribution Service 3.0
RP96: 04/19/2011 4:00:16 AM - Software Distribution Service 3.0
RP97: 04/20/2011 4:00:16 AM - Software Distribution Service 3.0
RP98: 04/21/2011 1:32:28 AM - Software Distribution Service 3.0
RP99: 04/22/2011 2:16:26 AM - Punkt kontrolny systemu
RP100: 04/22/2011 4:00:14 AM - Software Distribution Service 3.0
RP101: 04/23/2011 2:30:40 AM - Software Distribution Service 3.0
RP102: 04/23/2011 1:28:07 PM - Software Distribution Service 3.0
RP103: 04/24/2011 12:52:57 AM - Software Distribution Service 3.0
RP104: 04/25/2011 1:26:44 AM - Punkt kontrolny systemu
RP105: 04/25/2011 4:00:14 AM - Software Distribution Service 3.0
RP106: 04/25/2011 5:16:09 PM - Software Distribution Service 3.0
RP107: 04/26/2011 3:42:47 AM - Software Distribution Service 3.0
RP108: 04/26/2011 2:23:28 PM - Software Distribution Service 3.0
RP109: 04/27/2011 4:00:14 AM - Software Distribution Service 3.0
RP110: 04/27/2011 4:05:31 PM - Installed iTunes
RP111: 04/27/2011 8:28:42 PM - Software Distribution Service 3.0
RP112: 04/28/2011 2:53:07 AM - Software Distribution Service 3.0
RP113: 04/28/2011 4:21:13 PM - Software Distribution Service 3.0
RP114: 04/29/2011 12:01:17 AM - Software Distribution Service 3.0
RP115: 04/29/2011 9:46:37 AM - Software Distribution Service 3.0
RP116: 04/30/2011 4:00:17 AM - Software Distribution Service 3.0
RP117: 04/30/2011 11:40:15 PM - Software Distribution Service 3.0
RP118: 05/01/2011 2:36:54 AM - Software Distribution Service 3.0
RP119: 05/02/2011 3:04:53 AM - Punkt kontrolny systemu
RP120: 05/02/2011 4:00:14 AM - Software Distribution Service 3.0
RP121: 05/02/2011 11:25:33 PM - Software Distribution Service 3.0
RP122: 05/03/2011 12:55:27 AM - Software Distribution Service 3.0
RP123: 05/04/2011 1:49:03 AM - Software Distribution Service 3.0
RP124: 05/05/2011 3:57:35 AM - Punkt kontrolny systemu
RP125: 05/05/2011 4:00:14 AM - Software Distribution Service 3.0
RP126: 05/06/2011 4:00:19 AM - Software Distribution Service 3.0
RP127: 05/06/2011 10:17:56 AM - Avg Update
RP128: 05/07/2011 4:00:16 AM - Software Distribution Service 3.0
RP129: 05/07/2011 9:58:45 AM - Software Distribution Service 3.0
RP130: 05/08/2011 2:36:59 AM - Software Distribution Service 3.0
RP131: 05/09/2011 2:39:52 AM - Punkt kontrolny systemu
RP132: 05/09/2011 4:00:17 AM - Software Distribution Service 3.0
RP133: 05/10/2011 12:03:28 AM - Software Distribution Service 3.0
RP134: 05/10/2011 2:26:56 AM - Software Distribution Service 3.0
RP135: 05/10/2011 10:29:36 AM - Avg Update
RP136: 05/11/2011 1:32:16 AM - Installed Safari
RP137: 05/11/2011 4:00:14 AM - Software Distribution Service 3.0
RP138: 05/12/2011 4:00:26 AM - Software Distribution Service 3.0
RP139: 05/12/2011 9:13:03 AM - Avg Update
RP140: 05/12/2011 11:16:32 PM - Software Distribution Service 3.0
RP141: 05/13/2011 11:17:05 PM - Software Distribution Service 3.0
RP142: 05/14/2011 6:54:18 PM - Installed Fahrenheit
RP143: 05/15/2011 4:00:14 AM - Software Distribution Service 3.0
RP144: 05/15/2011 9:02:51 AM - Software Distribution Service 3.0
RP145: 05/16/2011 4:00:15 AM - Software Distribution Service 3.0
RP146: 05/17/2011 4:00:17 AM - Software Distribution Service 3.0
RP147: 05/17/2011 9:48:11 PM - Software Distribution Service 3.0
RP148: 05/18/2011 4:00:14 AM - Software Distribution Service 3.0
RP149: 05/18/2011 9:35:04 PM - Software Distribution Service 3.0
RP150: 05/21/2011 9:39:16 PM - Software Distribution Service 3.0
RP151: 05/23/2011 12:38:30 AM - Software Distribution Service 3.0
RP152: 05/23/2011 10:46:20 PM - Software Distribution Service 3.0
RP153: 05/24/2011 1:31:12 AM - Software Distribution Service 3.0
RP154: 05/25/2011 2:24:44 AM - Punkt kontrolny systemu
RP155: 05/25/2011 4:00:15 AM - Software Distribution Service 3.0
RP156: 05/26/2011 4:00:24 AM - Software Distribution Service 3.0
RP157: 05/27/2011 4:00:17 AM - Software Distribution Service 3.0
RP158: 05/27/2011 11:36:40 AM - Installed Fast Email Extractor 7
RP159: 05/27/2011 1:22:13 PM - Removed Market Samurai
RP160: 05/27/2011 1:48:16 PM - Installed Web Email Extractor Pro.
RP161: 05/27/2011 1:54:11 PM - Removed Web Email Extractor Pro.
RP162: 05/27/2011 1:58:13 PM - Installed Web Email Extractor Pro.
RP163: 05/27/2011 1:59:07 PM - Removed Web Email Extractor Pro.
RP164: 05/27/2011 2:45:05 PM - Installed Email Extractor v3.0.
RP165: 05/27/2011 2:53:04 PM - Removed Email Extractor v3.0.
RP166: 05/28/2011 4:00:17 AM - Software Distribution Service 3.0
RP167: 05/29/2011 4:00:15 AM - Software Distribution Service 3.0
RP168: 05/30/2011 4:00:23 AM - Software Distribution Service 3.0
RP169: 05/31/2011 4:00:17 AM - Software Distribution Service 3.0
RP170: 05/31/2011 7:59:54 PM - Installed TheBat! Home v5.0.12
RP171: 05/31/2011 8:10:20 PM - Installed TheBat! Home v5.0.12
RP172: 05/31/2011 10:02:12 PM - TrueCrypt installation
RP173: 05/31/2011 10:20:10 PM - Removed Advanced Web Ranking 7.5
RP174: 05/31/2011 10:23:37 PM - Removed Fahrenheit
RP175: 05/31/2011 10:24:04 PM - Removed Fast Email Extractor 7
RP176: 05/31/2011 10:25:53 PM - Removed Holdem Manager
RP177: 06/01/2011 12:17:55 AM - Software Distribution Service 3.0
RP178: 06/02/2011 12:32:16 AM - Punkt kontrolny systemu
RP179: 06/02/2011 4:00:14 AM - Software Distribution Service 3.0
RP180: 06/02/2011 11:00:11 AM - Operacja przywracania
RP181: 06/02/2011 11:18:10 AM - Operacja przywracania
RP182: 06/02/2011 11:31:00 AM - Operacja przywracania
RP183: 06/02/2011 11:32:11 AM - Operacja przywracania
RP184: 06/02/2011 1:11:15 PM - Installed SimpLite-Jabber 2.5
RP185: 06/02/2011 9:07:18 PM - Installed SimpLite-Yahoo 2.5
RP186: 06/02/2011 9:09:17 PM - Installed SimpLite-ICQ-AIM 2.5
RP187: 06/02/2011 11:55:33 PM - Software Distribution Service 3.0
RP188: 06/03/2011 3:56:10 PM - Software Distribution Service 3.0
RP189: 06/03/2011 9:55:06 PM - Installed HP USB Disk Storage Format Tool
RP190: 06/03/2011 10:24:54 PM - Installed HP USB Disk Storage Format Tool
RP191: 06/03/2011 11:10:17 PM - Installed Ad-Aware
RP192: 06/03/2011 11:11:48 PM - Installed Ad-Aware
RP193: 06/03/2011 11:24:45 PM - Removed AceReader Pro.
RP194: 06/03/2011 11:28:18 PM - Removed Adobe Community Help
RP195: 06/03/2011 11:29:22 PM - Removed Adobe Media Player
RP196: 06/03/2011 11:31:27 PM - Removed Apple Application Support
RP197: 06/03/2011 11:35:46 PM - Removed Bonjour
RP198: 06/03/2011 11:44:24 PM - Removed LogMeIn
RP199: 06/03/2011 11:46:47 PM - Removed LogMeIn
RP200: 06/03/2011 11:50:57 PM - Removed Marvell Miniport Driver
RP201: 06/03/2011 11:54:22 PM - Removed Microsoft Silverlight
RP202: 06/03/2011 11:57:57 PM - Removed NVIDIA PhysX
RP203: 06/04/2011 12:01:38 AM - Removed SimpLite-Yahoo 2.5
RP204: 06/04/2011 12:12:36 AM - Usunięto: Asystent rejestracji usługi Windows Live
RP205: 06/04/2011 12:16:08 AM - Removed HP USB Disk Storage Format Tool
RP206: 06/04/2011 12:17:58 AM - Removed Foxit PDF IFilter
RP207: 06/04/2011 12:22:21 AM - Removed PostgreSQL 8.3
RP208: 06/04/2011 12:24:49 AM - Removed Safari
RP209: 06/04/2011 12:29:06 AM - Spyware Terminator - restore point
RP210: 06/04/2011 4:00:15 AM - Software Distribution Service 3.0
RP211: 06/04/2011 10:45:45 AM - Operacja przywracania
RP212: 06/04/2011 10:54:23 AM - Software Distribution Service 3.0
RP213: 06/04/2011 11:03:59 AM - Removed AceReader Pro.
RP214: 06/04/2011 11:09:09 AM - Removed Adobe Community Help
RP215: 06/04/2011 11:09:22 AM - Removed Adobe Media Player
RP216: 06/04/2011 11:09:48 AM - Usunięto: Asystent rejestracji usługi Windows Live
RP217: 06/04/2011 11:10:34 AM - Removed Bonjour
RP218: 06/04/2011 11:23:17 AM - Removed LogMeIn
RP219: 06/04/2011 11:23:56 AM - Removed LogMeIn
RP220: 06/04/2011 11:25:35 AM - Removed PostgreSQL 8.3
RP221: 06/04/2011 11:26:26 AM - Removed Safari
RP222: 06/04/2011 11:26:53 AM - Removed SimpLite-Yahoo 2.5
RP223: 06/04/2011 11:28:16 AM - Removed TheBat! Home v5.0.12
RP224: 06/04/2011 12:01:53 PM - Create by Wise Registry Cleaner
RP225: 06/04/2011 12:48:58 PM - Installed Eraser 6.0.8.2273
RP226: 06/04/2011 3:29:35 PM - Spyware Terminator - restore point
RP227: 06/04/2011 4:04:22 PM - Removed NVIDIA PhysX
RP228: 06/04/2011 4:24:27 PM - Spyware Terminator - restore point
RP229: 06/04/2011 5:27:37 PM - Removed Eraser 6.0.8.2273
RP230: 06/04/2011 6:03:53 PM - Installed COMODO Internet Security
RP231: 06/04/2011 6:23:51 PM - Installed HiJackThis
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Aktualizacja dla systemu Windows Internet Explorer 7 (KB976749)
Aktualizacja dla systemu Windows Internet Explorer 7 (KB980182)
Aktualizacja dla systemu Windows XP (KB2141007)
Aktualizacja dla systemu Windows XP (KB2345886)
Aktualizacja dla systemu Windows XP (KB951072-v2)
Aktualizacja dla systemu Windows XP (KB951978)
Aktualizacja dla systemu Windows XP (KB955759)
Aktualizacja dla systemu Windows XP (KB955839)
Aktualizacja dla systemu Windows XP (KB961503)
Aktualizacja dla systemu Windows XP (KB967715)
Aktualizacja dla systemu Windows XP (KB968389)
Aktualizacja dla systemu Windows XP (KB971029)
Aktualizacja dla systemu Windows XP (KB971737)
Aktualizacja dla systemu Windows XP (KB973687)
Aktualizacja dla systemu Windows XP (KB973815)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB2378111)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB952069)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB954155)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB968816)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB973540)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB975558)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB978695)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB979402)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2183461)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2360131)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2482017)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB2497640)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127-v2)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB953838)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB956390)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB958215)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB960714)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB961260)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB963027)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB969897)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB972260)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB974455)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB976325)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB978207)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB982381)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2079403)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2115168)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2121546)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2160329)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2229593)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2259922)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2279986)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2286198)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2296011)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2347290)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2360937)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2387149)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2393802)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2412687)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2419632)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2423089)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2440591)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2443105)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2476687)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2478960)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2478971)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2479628)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2479943)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2481109)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2483185)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2485376)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2485663)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2503658)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2506212)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2506223)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2507618)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2508272)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2508429)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2509553)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2510581)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2511455)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB2524375)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923561)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464-v2)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB952004)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB953838)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB953839)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954600)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956391)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956572)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956744)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956802)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956844)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB957095)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958687)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958690)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958869)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB959426)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB960225)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB960715)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB960803)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB960859)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB961371)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB961373)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB961501)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB968537)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB969059)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB969898)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB969947)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB970238)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB970430)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971468)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971486)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971557)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971633)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971657)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB971961)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB972270)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973346)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973354)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973507)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973525)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973869)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB973904)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB974112)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB974318)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB974392)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB974571)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975025)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975467)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975560)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975561)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975562)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB975713)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB977165-v2)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB977816)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB977914)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978037)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978251)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978262)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978338)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978542)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978601)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB978706)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB979309)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB979482)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB979559)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB979683)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB979687)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB980195)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB980218)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB980232)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB980436)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB981322)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB981349)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB981852)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB981957)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB981997)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB982132)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB982214)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB982665)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB982802)
Aktualizacja zabezpieczeń dla Windows XP (KB941569)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Archiwizator WinRAR
ASIO4ALL
µTorrent
AVG Free 9.0
Betfair Poker
CDBurnerXP
CDDRV_Installer
COMODO Internet Security
Compatibility Pack for the 2007 Office system
Eraser
eyeQ
F.lux
FeedReader
FileZilla Client 3.3.5.1
Foxit PDF IFilter
Foxit Reader
FreeRIP v3.5
Gadu-Gadu 7.0
Google Chrome
Google Talk (remove only)
Google Update Helper
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB976002-v5)
ICQ7.5
IrfanView (remove only)
iriver plus 3 (remove only)
iTunes
Java Auto Updater
Java(TM) 6 Update 24
K-Lite Codec Pack 5.4.4 (Basic)
KhalInstallWrapper
Left 4 Dead
LG Internet Kit
LG USB Modem Drivers
Logitech SetPoint
Marvell Miniport Driver
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PLK
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PLK
Microsoft .NET Framework 3.5 Language Pack SP1 - plk
Microsoft .NET Framework 3.5 SP1
Microsoft 3D Movie Maker 1.0
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (Polish) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Polish) 2007
Microsoft Office Groove MUI (Polish) 2007
Microsoft Office InfoPath MUI (Polish) 2007
Microsoft Office OneNote MUI (Polish) 2007
Microsoft Office Outlook MUI (Polish) 2007
Microsoft Office PowerPoint MUI (Polish) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Polish) 2007
Microsoft Office Proofing (Polish) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (Polish) 2007
Microsoft Office Shared MUI (Polish) 2007
Microsoft Office Word MUI (Polish) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (Polish) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox (3.6.17)
MSVC80_x86
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser
NAPIPROJEKT 1.0.6.2
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia Software Updater
Notepad++
NVIDIA Drivers
NVIDIA nView Desktop Manager
OpenVPN 2.2.0
Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK
Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1)
Pakiet sterowników systemu Windows - Nokia Modem (03/05/2008 3.7)
Pakiet sterowników systemu Windows - Nokia Modem (03/13/2008 6.86.0.1)
Pakiet sterowników systemu Windows - Nokia Modem (05/24/2007 6.84.0.1)
Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 4.1)
Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 7.01.0.3)
PCWin Speaker Recorder
Podstawowe programy Windows Live
Poprawka dla systemu Windows XP (KB2158563)
Poprawka dla systemu Windows XP (KB2443685)
Poprawka dla systemu Windows XP (KB952287)
Poprawka dla systemu Windows XP (KB961118)
Poprawka dla systemu Windows XP (KB970653-v3)
Poprawka dla systemu Windows XP (KB976098-v2)
Poprawka dla systemu Windows XP (KB979306)
Poprawka dla systemu Windows XP (KB981793)
QuickTime
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2466156)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2464583)
Security Update for Microsoft Office Groove 2007 (KB2494047)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Segoe UI
SimpLite-ICQ-AIM 2.5
SimpLite-Jabber 2.5
Skype™ 5.3
Spybot - Search & Destroy
Spyware Terminator
SQLite ODBC Driver (remove only)
Steam
Super Email Spider
TheBat! Home v5.0.12
Total Commander (Remove or Repair)
TrueCrypt
Tweet Adder 3
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office Outlook 2007 (KB2509470)
Update for Outlook 2007 Junk Email Filter (KB2536413)
VideoLAN VLC media player 0.8.6h
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format Runtime
Windows Media Player Firefox Plugin
Windows Presentation Foundation
Windows XP Service Pack 3
Xenu's Link Sleuth
XML Paper Specification Shared Components Language Pack 1.0
XML Paper Specification Shared Components Pack 1.0
.
==== End Of File ===========================

 

[hasek747]

This should be the whole thing. What should I do now?

Thanks to anyone who takes the time to go through this!

 

[Broni]

Dzień dobry

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
Click the "Scan" button to start scan:


On completion of the scan click "Save log", save it to your desktop and post in your next reply:


===================================================================

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

• Link 1 (.exe file)
  Link 2 (zipped file)
  Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth, and uncheck the rest.
• Click OK.
• Wait until it's finished and then go to File > Save Report.
• Save the report to your Desktop.
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

 

[hasek747]

Cześć Broni!

Here is the aswMBR log....


aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-06-04 19:40:57
-----------------------------
19:40:57.546 OS Version: Windows 5.1.2600 Dodatek Service Pack 3
19:40:57.546 Number of processors: 2 586 0xF0D
19:40:57.546 ComputerName: WORKSTATION UserName:
19:40:58.984 Initialize success
19:41:06.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7
19:41:06.343 Disk 0 Vendor: SAMSUNG_HD200HJ KF100-06 Size: 190781MB BusType: 3
19:41:06.343 Disk 0 MBR read error 0
19:41:06.343 Disk 0 MBR scan
19:41:06.343 Disk 0 unknown MBR code
19:41:06.343 MBR BIOS signature not found 0
19:41:06.343 Disk 0 scanning sectors +390700800
19:41:06.359 Disk 0 scanning C:\WINDOWS\system32\drivers
19:41:19.531 Service scanning
19:41:22.234 Disk 0 trace - called modules:
19:41:22.250 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS
19:41:22.250 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5dc368]
19:41:22.250 3 CLASSPNP.SYS[b80f8fd7] -> nt!IofCallDriver -> \Device\0000007a[0x8a55ff18]
19:41:22.250 5 ACPI.sys[b7e53620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-7[0x8a5c6940]
19:41:22.250 Scan finished successfully
19:41:42.671 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Pulpit\MBR.dat"
19:41:42.687 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Pulpit\aswMBR.txt"

 

[hasek747]

And the second one - the RKUnhookerLE report


RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Dodatek Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xB66D8000 C:\WINDOWS\System32\DRIVERS\nv4_mini.sys 10604544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 258.96 )
0xBD012000 C:\WINDOWS\System32\nv4_disp.dll 6344704 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 258.96 )
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, Jądro i system NT)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Współużytkowany sterownik Win32)
0xB62A1000 C:\WINDOWS\system32\drivers\p17xfilt.sys 1667072 bytes (Creative, Creative WDM 3D Audio Driver)
0xB64D8000 C:\WINDOWS\system32\drivers\P17xfi.sys 1449984 bytes (Creative Technology Ltd., WDM Audio Miniport)
0xB7E94000 PCI_PNP3328 1126400 bytes
0xB7E94000 sptd.sys 1126400 bytes
0xB7D09000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xB3A6F000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB61B2000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xB3C36000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xB2B55000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBD61F000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xB2370000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB663A000 C:\WINDOWS\System32\DRIVERS\yk51x86.sys 253952 bytes (Marvell, NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller)
0xB3BD6000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0xB6268000 C:\WINDOWS\System32\Drivers\a45td694.SYS 233472 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xB3CEA000 C:\WINDOWS\System32\DRIVERS\cmdguard.sys 233472 bytes (COMODO, COMODO Internet Security Sandbox Driver)
0xB3B55000 C:\WINDOWS\System32\drivers\truecrypt.sys 225280 bytes (TrueCrypt Foundation, TrueCrypt Driver)
0xB3A3B000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0xB645F000 C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 204800 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM))
0xB6210000 C:\WINDOWS\System32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB7E4D000 ACPI.sys 192512 bytes (Microsoft Corporation, Sterownik ACPI dla systemu NT)
0xB2CED000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB7CC6000 C:\WINDOWS\System32\DRIVERS\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB1430000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xB3B07000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB2F52000 C:\WINDOWS\system32\drivers\ctusfsyn.sys 163840 bytes (Creative Technology Ltd., Creative SoundFont Synthesizer (32-bit))
0xB6678000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xB2BD5000 C:\WINDOWS\system32\DRIVERS\ithsgt.sys 163840 bytes
0xB3BAE000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB6438000 C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 159744 bytes (Creative Technology Ltd, SoundFont(R) Manager (WDM))
0xB7DF7000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, Sterownik We/Wy menedżera dysków NT)
0xB3C10000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xB2A19000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xB64B4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB66A0000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB6491000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xB3B32000 C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 143360 bytes (-, -)
0xB3B8C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB7DBF000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB7E1D000 ftdisk.sys 126976 bytes (Microsoft Corporation, Sterownik dysku FT)
0xB3A1D000 C:\WINDOWS\System32\Drivers\usbvideo.sys 122880 bytes (Microsoft Corporation, USB Video Class Driver)
0xB7CAC000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB145B000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kgrorpow.sys 102400 bytes
0xB7DDF000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB7E7C000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xB7D96000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB6251000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xB7CF3000 inspect.sys 90112 bytes (COMODO, COMODO Internet Security Firewall Driver)
0xB2FC8000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB66C4000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xB3C8F000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB7DAD000 sr.sys 73728 bytes (Microsoft Corporation, Sterownik filtru systemu plików Przywracania systemu)
0xB7E3C000 pci.sys 69632 bytes (Microsoft Corporation, Licznik NT Plug and Play PCI)
0xB6240000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB2DFA000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xB8258000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB8228000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xB8108000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)
0xB8268000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Sterownik filtru audio Redbook)
0xB31B5000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xB82F8000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xB80A8000 qyaxcg.sys 57344 bytes
0xB80F8000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xB8238000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, Sterownik portu i8042)
0xB8278000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xB80D8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Sterownik kopiowania woluminów w tle)
0xB7165000 C:\WINDOWS\system32\drivers\FDC1ANT.SYS 49152 bytes (Silence of Troubles United Company Ltd., Filter Device)
0xB8298000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xB2731000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\aswMBR.sys 45056 bytes
0xB7185000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, Sterownik kryptografii FIPS)
0xB8248000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xB80C8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB8288000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xB82B8000 C:\WINDOWS\system32\DRIVERS\tap0901.sys 45056 bytes (The OpenVPN Project, TAP-Win32 Virtual Network Driver)
0xB8218000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 40960 bytes (Microsoft Corporation, Sterownik urządzenia procesora)
0xB80B8000 isapnp.sys 40960 bytes (Microsoft Corporation, Sterownik magistrali ISA PNP)
0xB82D8000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB82C8000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xB150C000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xB80E8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xB7155000 C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB3085000 C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)
0xB82A8000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xB8138000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xB8318000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xB8428000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xB8400000 C:\WINDOWS\System32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xB8490000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xB8498000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xB8410000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xB84A0000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 28672 bytes (Microsoft Corporation, Sterownik klasy klawiatury)
0xB39CD000 C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\mbr.sys 28672 bytes
0xB8328000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xB8450000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xB8440000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0xB8438000 C:\WINDOWS\System32\DRIVERS\cmdhlp.sys 24576 bytes (COMODO, COMODO Internet Security Helper Driver)
0xB84A8000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xB83E8000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Sterownik klasy myszy)
0xB8488000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xB8418000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xB83F8000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xB8458000 C:\WINDOWS\system32\drivers\HPFXGEN.SYS 20480 bytes (Hewlett Packard, HPFXBULK Support Driver)
0xB8420000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xB8330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xB83D8000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xB83E0000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xB8338000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xB8468000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xB7C60000 C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys 16384 bytes (Logitech, Inc., Logitech PS2 Keyboard Filter Driver.)
0xB34FD000 C:\WINDOWS\system32\drivers\mbam.sys 16384 bytes
0xB8568000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xB33CD000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB84B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xB8590000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xB7C54000 C:\WINDOWS\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xB7C50000 C:\WINDOWS\system32\drivers\hpfxbulk.sys 12288 bytes (Hewlett Packard, hpfxbulk.sys)
0xB2CC5000 C:\WINDOWS\system32\DRIVERS\lilsgt.sys 12288 bytes
0xB5E3F000 C:\WINDOWS\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, Sterownik filtru myszy HID)
0xB7C4C000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB85A0000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xB85EE000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xB85AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xB85EC000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xB85A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xB85F0000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xB85F2000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xB8618000 C:\WINDOWS\System32\Drivers\StarOpen.SYS 8192 bytes
0xB85E0000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xB85E4000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xB85AA000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xB870D000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xB8778000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xB87EE000 C:\WINDOWS\System32\Drivers\LBeepKE.sys 4096 bytes (Logitech, Inc., Logitech Consumer Control Filter Driver.)
0xB871B000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xB8670000 pciide.sys 4096 bytes (Microsoft Corporation, Rodzajowy sterownik magistrali PCI IDE)
0x8A58E1F8 unknown_irp_handler 3592 bytes
0x89AA81F8 unknown_irp_handler 3592 bytes
0x8A2C81F8 unknown_irp_handler 3592 bytes
0x8A3001F8 unknown_irp_handler 3592 bytes
0x8A3A91F8 unknown_irp_handler 3592 bytes
0x8A3871F8 unknown_irp_handler 3592 bytes
0x892A61F8 unknown_irp_handler 3592 bytes
0x8A3D93F0 unknown_irp_handler 3088 bytes
0x89A7B430 unknown_irp_handler 3024 bytes
==============================================
>Stealth
==============================================
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]

 

[Broni]

Prosto z Polski? Z jakiego miasta?

Download TDSSKiller and save it to your desktop.

• Extract (unzip) its contents to your desktop.
• Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

 

[hasek747]

Tak jest - Warszawa, Wilanów. A Ciebie co stąd wywiało?

Here is the TDSSKiller report....


2011/06/04 19:51:06.0875 6124 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/06/04 19:51:07.0343 6124 ================================================================================
2011/06/04 19:51:07.0343 6124 SystemInfo:
2011/06/04 19:51:07.0343 6124
2011/06/04 19:51:07.0343 6124 OS Version: 5.1.2600 ServicePack: 3.0
2011/06/04 19:51:07.0343 6124 Product type: Workstation
2011/06/04 19:51:07.0343 6124 ComputerName: WORKSTATION
2011/06/04 19:51:07.0343 6124 UserName: Administrator
2011/06/04 19:51:07.0343 6124 Windows directory: C:\WINDOWS
2011/06/04 19:51:07.0343 6124 System windows directory: C:\WINDOWS
2011/06/04 19:51:07.0343 6124 Processor architecture: Intel x86
2011/06/04 19:51:07.0343 6124 Number of processors: 2
2011/06/04 19:51:07.0343 6124 Page size: 0x1000
2011/06/04 19:51:07.0343 6124 Boot type: Normal boot
2011/06/04 19:51:07.0343 6124 ================================================================================
2011/06/04 19:51:08.0046 6124 Initialize success
2011/06/04 19:51:16.0406 4876 ================================================================================
2011/06/04 19:51:16.0406 4876 Scan started
2011/06/04 19:51:16.0406 4876 Mode: Manual;
2011/06/04 19:51:16.0406 4876 ================================================================================
2011/06/04 19:51:16.0875 4876 ACPI (05118282f5d039595a2b92b4a4afe197) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/06/04 19:51:16.0921 4876 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/06/04 19:51:16.0953 4876 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/06/04 19:51:17.0000 4876 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/06/04 19:51:17.0140 4876 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/06/04 19:51:17.0140 4876 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/06/04 19:51:17.0187 4876 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/06/04 19:51:17.0218 4876 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/06/04 19:51:17.0265 4876 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
2011/06/04 19:51:17.0265 4876 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
2011/06/04 19:51:17.0328 4876 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\WINDOWS\system32\Drivers\avgtdix.sys
2011/06/04 19:51:17.0375 4876 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/06/04 19:51:17.0421 4876 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/06/04 19:51:17.0453 4876 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/06/04 19:51:17.0484 4876 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/06/04 19:51:17.0515 4876 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/06/04 19:51:17.0531 4876 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/06/04 19:51:17.0640 4876 cmdGuard (cc56fa45ba18904cb04382ae9f52b1a5) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
2011/06/04 19:51:17.0671 4876 cmdHlp (3a70948ab6e966bdaef2baec1f8ef9d1) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
2011/06/04 19:51:17.0750 4876 ctsfm2k (fcbb8ea6fe935d2c531d3a4dee9f985b) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
2011/06/04 19:51:17.0781 4876 CTUSFSYN (12a7b253f9128b3b68a9979827047b76) C:\WINDOWS\system32\drivers\ctusfsyn.sys
2011/06/04 19:51:17.0828 4876 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/06/04 19:51:17.0890 4876 dmboot (bc9219abc5696942e6f9ac8a9b28670f) C:\WINDOWS\system32\drivers\dmboot.sys
2011/06/04 19:51:17.0906 4876 dmio (5fa232e3ba6e1346f9f5a7e519320cb0) C:\WINDOWS\system32\drivers\dmio.sys
2011/06/04 19:51:17.0921 4876 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/06/04 19:51:17.0953 4876 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/06/04 19:51:17.0984 4876 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/06/04 19:51:18.0031 4876 DSI_SiUSBXp_3_1 (bc9c2ef22ee0320c079e3ff9b4d29951) C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys
2011/06/04 19:51:18.0078 4876 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/06/04 19:51:18.0109 4876 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/06/04 19:51:18.0140 4876 FDC1ANT (9575002157bdae1c1b4812b57dfaa967) C:\WINDOWS\system32\drivers\FDC1ANT.SYS
2011/06/04 19:51:18.0156 4876 Fips (09e2a4d33f81a06a8aab2ba0a0b5d235) C:\WINDOWS\system32\drivers\Fips.sys
2011/06/04 19:51:18.0171 4876 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/06/04 19:51:18.0203 4876 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/06/04 19:51:18.0218 4876 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/06/04 19:51:18.0234 4876 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/06/04 19:51:18.0250 4876 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/06/04 19:51:18.0296 4876 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/06/04 19:51:18.0328 4876 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/06/04 19:51:18.0343 4876 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/06/04 19:51:18.0375 4876 HPFXBULK (e4e0b356a8756066cf89080d9da69f22) C:\WINDOWS\system32\drivers\hpfxbulk.sys
2011/06/04 19:51:18.0421 4876 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/06/04 19:51:18.0453 4876 i8042prt (177b372af55c4460d0968b5f1d02aa1c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/06/04 19:51:18.0484 4876 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/06/04 19:51:18.0562 4876 Inspect (28c95218d0c19db3a86bb4e53d6586e9) C:\WINDOWS\system32\DRIVERS\inspect.sys
2011/06/04 19:51:18.0593 4876 intelppm (da153edc09de8c4f846c085caa39d1cc) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/06/04 19:51:18.0609 4876 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/06/04 19:51:18.0656 4876 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/06/04 19:51:18.0671 4876 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/06/04 19:51:18.0718 4876 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/06/04 19:51:18.0734 4876 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/06/04 19:51:18.0765 4876 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/06/04 19:51:18.0796 4876 isapnp (c8eef2e93835b81bd335de2123121283) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/06/04 19:51:18.0843 4876 ithsgt (b7a5fadf67136fda7e8f25303565b674) C:\WINDOWS\system32\DRIVERS\ithsgt.sys
2011/06/04 19:51:18.0859 4876 Kbdclass (2aeca45d4aeaacbdcb77ad11184e4601) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/06/04 19:51:18.0875 4876 kbdhid (f718dcddac2544bc693f22977d06f78b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/06/04 19:51:18.0906 4876 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/06/04 19:51:18.0953 4876 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/06/04 19:51:18.0968 4876 L8042Kbd (dc61f15187372d164769c841655e58f3) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
2011/06/04 19:51:19.0078 4876 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
2011/06/04 19:51:19.0109 4876 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
2011/06/04 19:51:19.0140 4876 LBeepKE (8f4d784b3f22f468eea99da02b0e39e5) C:\WINDOWS\system32\Drivers\LBeepKE.sys
2011/06/04 19:51:19.0203 4876 LHidFilt (dd83dc92463fce6324fd30a13d17d0da) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
2011/06/04 19:51:19.0250 4876 lilsgt (16767ea492b5d140e1de3679a65eae74) C:\WINDOWS\system32\DRIVERS\lilsgt.sys
2011/06/04 19:51:19.0296 4876 LMouFilt (8fe0008e183ff0293a925b78a5581c5f) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
2011/06/04 19:51:19.0390 4876 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/06/04 19:51:19.0437 4876 Modem (4a068db7dc37d5afedb6512d2931d7b3) C:\WINDOWS\system32\drivers\Modem.sys
2011/06/04 19:51:19.0468 4876 Mouclass (fbed3df6b884f8cf00447b73507f2c48) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/06/04 19:51:19.0468 4876 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/06/04 19:51:19.0500 4876 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/06/04 19:51:19.0531 4876 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/06/04 19:51:19.0562 4876 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/06/04 19:51:19.0593 4876 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/06/04 19:51:19.0625 4876 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/06/04 19:51:19.0640 4876 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/06/04 19:51:19.0656 4876 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/06/04 19:51:19.0703 4876 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/06/04 19:51:19.0718 4876 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/06/04 19:51:19.0734 4876 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/06/04 19:51:19.0765 4876 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/06/04 19:51:19.0812 4876 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/06/04 19:51:19.0843 4876 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/06/04 19:51:19.0859 4876 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/06/04 19:51:19.0875 4876 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/06/04 19:51:19.0906 4876 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/06/04 19:51:19.0953 4876 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/06/04 19:51:19.0968 4876 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/06/04 19:51:20.0000 4876 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/06/04 19:51:20.0093 4876 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/06/04 19:51:20.0125 4876 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/06/04 19:51:20.0156 4876 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2011/06/04 19:51:20.0187 4876 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2011/06/04 19:51:20.0203 4876 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/06/04 19:51:20.0234 4876 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/06/04 19:51:20.0265 4876 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/06/04 19:51:20.0531 4876 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/06/04 19:51:20.0656 4876 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/06/04 19:51:20.0687 4876 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/06/04 19:51:20.0734 4876 ossrv (3649eefa90990249267dd6c7808cbc86) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
2011/06/04 19:51:20.0781 4876 P17xfi (06902b5f2a17dddf1282ff402b5bd51b) C:\WINDOWS\system32\drivers\P17xfi.sys
2011/06/04 19:51:20.0859 4876 p17xfilt (a782e03a3b54c13fa7c29d33e1c9a044) C:\WINDOWS\system32\drivers\p17xfilt.sys
2011/06/04 19:51:20.0890 4876 Parport (2d4cdaebced17743aa9e25d3016dc229) C:\WINDOWS\system32\drivers\Parport.sys
2011/06/04 19:51:20.0921 4876 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/06/04 19:51:20.0937 4876 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/06/04 19:51:20.0984 4876 PCI (6862c69168d787b85a7d95ccd33c694e) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/06/04 19:51:21.0031 4876 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/06/04 19:51:21.0062 4876 Pcmcia (8db27f1ae9593c94095485305a583862) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/06/04 19:51:21.0218 4876 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/06/04 19:51:21.0234 4876 Processor (7a1367d250502c6416a4d3a19ef155f5) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/06/04 19:51:21.0250 4876 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/06/04 19:51:21.0296 4876 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/06/04 19:51:21.0437 4876 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/06/04 19:51:21.0468 4876 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/06/04 19:51:21.0484 4876 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/06/04 19:51:21.0500 4876 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/06/04 19:51:21.0531 4876 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/06/04 19:51:21.0546 4876 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/06/04 19:51:21.0593 4876 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/06/04 19:51:21.0687 4876 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/06/04 19:51:21.0796 4876 redbook (e0c7bbd18040b58651bac700c804861d) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/06/04 19:51:21.0937 4876 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/06/04 19:51:22.0156 4876 Serial (d07b02f88165e69b9f17162cf592c8a6) C:\WINDOWS\system32\drivers\Serial.sys
2011/06/04 19:51:22.0265 4876 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/06/04 19:51:22.0515 4876 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/06/04 19:51:22.0640 4876 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/06/04 19:51:22.0703 4876 sptd (a199171385be17973fd800fa91f8f78a) C:\WINDOWS\system32\Drivers\sptd.sys
2011/06/04 19:51:22.0703 4876 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a
2011/06/04 19:51:22.0703 4876 sptd - detected LockedFile.Multi.Generic (1)
2011/06/04 19:51:22.0750 4876 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011/06/04 19:51:22.0765 4876 sr (eb032822be406ef220d546ddffcf0002) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/06/04 19:51:22.0796 4876 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/06/04 19:51:22.0843 4876 StarOpen (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
2011/06/04 19:51:22.0890 4876 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/06/04 19:51:22.0906 4876 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/06/04 19:51:22.0937 4876 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/06/04 19:51:23.0062 4876 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/06/04 19:51:23.0109 4876 tap0901 (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
2011/06/04 19:51:23.0171 4876 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/06/04 19:51:23.0203 4876 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/06/04 19:51:23.0218 4876 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/06/04 19:51:23.0234 4876 teamviewervpn (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys
2011/06/04 19:51:23.0265 4876 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/06/04 19:51:23.0359 4876 truecrypt (be45dad1c73a3216edc8c485916f6594) C:\WINDOWS\system32\drivers\truecrypt.sys
2011/06/04 19:51:23.0437 4876 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/06/04 19:51:23.0531 4876 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/06/04 19:51:23.0578 4876 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/06/04 19:51:23.0609 4876 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/06/04 19:51:23.0671 4876 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
2011/06/04 19:51:23.0687 4876 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/06/04 19:51:23.0750 4876 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
2011/06/04 19:51:23.0765 4876 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/06/04 19:51:23.0781 4876 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/06/04 19:51:23.0812 4876 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
2011/06/04 19:51:23.0859 4876 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/06/04 19:51:23.0890 4876 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/06/04 19:51:23.0906 4876 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/06/04 19:51:23.0937 4876 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/06/04 19:51:23.0953 4876 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/06/04 19:51:23.0984 4876 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/06/04 19:51:24.0015 4876 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/06/04 19:51:24.0046 4876 VolSnap (56b191ac5fc0df219949c95a6c87afe7) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/06/04 19:51:24.0109 4876 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/06/04 19:51:24.0171 4876 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2011/06/04 19:51:24.0218 4876 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/06/04 19:51:24.0343 4876 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/06/04 19:51:24.0390 4876 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/06/04 19:51:24.0437 4876 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/06/04 19:51:24.0515 4876 MBR (0x1B8) (32052574bf9f325ae309abc7bfd04460) \Device\Harddisk0\DR0
2011/06/04 19:51:24.0671 4876 ================================================================================
2011/06/04 19:51:24.0671 4876 Scan finished
2011/06/04 19:51:24.0671 4876 ================================================================================
2011/06/04 19:51:24.0687 4784 Detected object count: 1
2011/06/04 19:51:24.0687 4784 Actual detected object count: 1
2011/06/04 19:51:51.0109 4784 LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/06/04 19:52:13.0140 4192 ================================================================================
2011/06/04 19:52:13.0140 4192 Scan started
2011/06/04 19:52:13.0140 4192 Mode: Manual;
2011/06/04 19:52:13.0140 4192 ================================================================================
2011/06/04 19:52:13.0468 4192 ACPI (05118282f5d039595a2b92b4a4afe197) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/06/04 19:52:13.0500 4192 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/06/04 19:52:13.0531 4192 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/06/04 19:52:13.0562 4192 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/06/04 19:52:13.0718 4192 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/06/04 19:52:13.0718 4192 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/06/04 19:52:13.0750 4192 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/06/04 19:52:13.0781 4192 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/06/04 19:52:13.0843 4192 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
2011/06/04 19:52:13.0859 4192 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
2011/06/04 19:52:13.0906 4192 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\WINDOWS\system32\Drivers\avgtdix.sys
2011/06/04 19:52:13.0953 4192 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/06/04 19:52:14.0000 4192 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/06/04 19:52:14.0062 4192 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/06/04 19:52:14.0093 4192 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/06/04 19:52:14.0125 4192 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/06/04 19:52:14.0140 4192 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/06/04 19:52:14.0234 4192 cmdGuard (cc56fa45ba18904cb04382ae9f52b1a5) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
2011/06/04 19:52:14.0265 4192 cmdHlp (3a70948ab6e966bdaef2baec1f8ef9d1) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
2011/06/04 19:52:14.0343 4192 ctsfm2k (fcbb8ea6fe935d2c531d3a4dee9f985b) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
2011/06/04 19:52:14.0375 4192 CTUSFSYN (12a7b253f9128b3b68a9979827047b76) C:\WINDOWS\system32\drivers\ctusfsyn.sys
2011/06/04 19:52:14.0421 4192 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/06/04 19:52:14.0468 4192 dmboot (bc9219abc5696942e6f9ac8a9b28670f) C:\WINDOWS\system32\drivers\dmboot.sys
2011/06/04 19:52:14.0484 4192 dmio (5fa232e3ba6e1346f9f5a7e519320cb0) C:\WINDOWS\system32\drivers\dmio.sys
2011/06/04 19:52:14.0515 4192 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/06/04 19:52:14.0531 4192 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/06/04 19:52:14.0578 4192 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/06/04 19:52:14.0609 4192 DSI_SiUSBXp_3_1 (bc9c2ef22ee0320c079e3ff9b4d29951) C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys
2011/06/04 19:52:14.0656 4192 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/06/04 19:52:14.0671 4192 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/06/04 19:52:14.0703 4192 FDC1ANT (9575002157bdae1c1b4812b57dfaa967) C:\WINDOWS\system32\drivers\FDC1ANT.SYS
2011/06/04 19:52:14.0750 4192 Fips (09e2a4d33f81a06a8aab2ba0a0b5d235) C:\WINDOWS\system32\drivers\Fips.sys
2011/06/04 19:52:14.0765 4192 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/06/04 19:52:14.0781 4192 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/06/04 19:52:14.0796 4192 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/06/04 19:52:14.0812 4192 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/06/04 19:52:14.0843 4192 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/06/04 19:52:14.0859 4192 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/06/04 19:52:14.0890 4192 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/06/04 19:52:14.0906 4192 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/06/04 19:52:14.0937 4192 HPFXBULK (e4e0b356a8756066cf89080d9da69f22) C:\WINDOWS\system32\drivers\hpfxbulk.sys
2011/06/04 19:52:15.0000 4192 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/06/04 19:52:15.0031 4192 i8042prt (177b372af55c4460d0968b5f1d02aa1c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/06/04 19:52:15.0046 4192 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/06/04 19:52:15.0140 4192 Inspect (28c95218d0c19db3a86bb4e53d6586e9) C:\WINDOWS\system32\DRIVERS\inspect.sys
2011/06/04 19:52:15.0187 4192 intelppm (da153edc09de8c4f846c085caa39d1cc) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/06/04 19:52:15.0218 4192 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/06/04 19:52:15.0250 4192 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/06/04 19:52:15.0265 4192 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/06/04 19:52:15.0296 4192 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/06/04 19:52:15.0312 4192 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/06/04 19:52:15.0343 4192 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/06/04 19:52:15.0359 4192 isapnp (c8eef2e93835b81bd335de2123121283) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/06/04 19:52:15.0453 4192 ithsgt (b7a5fadf67136fda7e8f25303565b674) C:\WINDOWS\system32\DRIVERS\ithsgt.sys
2011/06/04 19:52:15.0468 4192 Kbdclass (2aeca45d4aeaacbdcb77ad11184e4601) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/06/04 19:52:15.0484 4192 kbdhid (f718dcddac2544bc693f22977d06f78b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/06/04 19:52:15.0500 4192 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/06/04 19:52:15.0531 4192 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/06/04 19:52:15.0546 4192 L8042Kbd (dc61f15187372d164769c841655e58f3) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
2011/06/04 19:52:15.0656 4192 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
2011/06/04 19:52:15.0687 4192 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
2011/06/04 19:52:15.0718 4192 LBeepKE (8f4d784b3f22f468eea99da02b0e39e5) C:\WINDOWS\system32\Drivers\LBeepKE.sys
2011/06/04 19:52:15.0765 4192 LHidFilt (dd83dc92463fce6324fd30a13d17d0da) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
2011/06/04 19:52:15.0828 4192 lilsgt (16767ea492b5d140e1de3679a65eae74) C:\WINDOWS\system32\DRIVERS\lilsgt.sys
2011/06/04 19:52:15.0875 4192 LMouFilt (8fe0008e183ff0293a925b78a5581c5f) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
2011/06/04 19:52:15.0953 4192 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/06/04 19:52:15.0984 4192 Modem (4a068db7dc37d5afedb6512d2931d7b3) C:\WINDOWS\system32\drivers\Modem.sys
2011/06/04 19:52:16.0015 4192 Mouclass (fbed3df6b884f8cf00447b73507f2c48) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/06/04 19:52:16.0031 4192 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/06/04 19:52:16.0078 4192 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/06/04 19:52:16.0109 4192 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/06/04 19:52:16.0140 4192 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/06/04 19:52:16.0171 4192 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/06/04 19:52:16.0187 4192 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/06/04 19:52:16.0203 4192 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/06/04 19:52:16.0218 4192 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/06/04 19:52:16.0250 4192 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/06/04 19:52:16.0312 4192 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/06/04 19:52:16.0328 4192 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/06/04 19:52:16.0359 4192 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/06/04 19:52:16.0406 4192 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/06/04 19:52:16.0421 4192 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/06/04 19:52:16.0437 4192 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/06/04 19:52:16.0468 4192 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/06/04 19:52:16.0484 4192 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/06/04 19:52:16.0562 4192 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/06/04 19:52:16.0578 4192 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/06/04 19:52:16.0593 4192 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/06/04 19:52:16.0671 4192 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/06/04 19:52:16.0703 4192 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/06/04 19:52:16.0750 4192 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2011/06/04 19:52:16.0781 4192 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2011/06/04 19:52:16.0796 4192 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/06/04 19:52:16.0828 4192 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/06/04 19:52:16.0843 4192 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/06/04 19:52:17.0125 4192 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/06/04 19:52:17.0265 4192 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/06/04 19:52:17.0281 4192 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/06/04 19:52:17.0328 4192 ossrv (3649eefa90990249267dd6c7808cbc86) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
2011/06/04 19:52:17.0375 4192 P17xfi (06902b5f2a17dddf1282ff402b5bd51b) C:\WINDOWS\system32\drivers\P17xfi.sys
2011/06/04 19:52:17.0468 4192 p17xfilt (a782e03a3b54c13fa7c29d33e1c9a044) C:\WINDOWS\system32\drivers\p17xfilt.sys
2011/06/04 19:52:17.0515 4192 Parport (2d4cdaebced17743aa9e25d3016dc229) C:\WINDOWS\system32\drivers\Parport.sys
2011/06/04 19:52:17.0531 4192 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/06/04 19:52:17.0562 4192 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/06/04 19:52:17.0593 4192 PCI (6862c69168d787b85a7d95ccd33c694e) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/06/04 19:52:17.0671 4192 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/06/04 19:52:17.0703 4192 Pcmcia (8db27f1ae9593c94095485305a583862) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/06/04 19:52:17.0843 4192 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/06/04 19:52:17.0875 4192 Processor (7a1367d250502c6416a4d3a19ef155f5) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/06/04 19:52:17.0906 4192 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/06/04 19:52:17.0953 4192 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/06/04 19:52:18.0046 4192 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/06/04 19:52:18.0062 4192 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/06/04 19:52:18.0093 4192 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/06/04 19:52:18.0109 4192 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/06/04 19:52:18.0125 4192 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/06/04 19:52:18.0140 4192 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/06/04 19:52:18.0171 4192 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/06/04 19:52:18.0203 4192 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/06/04 19:52:18.0218 4192 redbook (e0c7bbd18040b58651bac700c804861d) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/06/04 19:52:18.0328 4192 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/06/04 19:52:18.0359 4192 Serial (d07b02f88165e69b9f17162cf592c8a6) C:\WINDOWS\system32\drivers\Serial.sys
2011/06/04 19:52:18.0390 4192 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/06/04 19:52:18.0453 4192 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/06/04 19:52:18.0484 4192 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/06/04 19:52:18.0578 4192 sptd (a199171385be17973fd800fa91f8f78a) C:\WINDOWS\system32\Drivers\sptd.sys
2011/06/04 19:52:18.0578 4192 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a
2011/06/04 19:52:18.0578 4192 sptd - detected LockedFile.Multi.Generic (1)
2011/06/04 19:52:18.0625 4192 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011/06/04 19:52:18.0640 4192 sr (eb032822be406ef220d546ddffcf0002) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/06/04 19:52:18.0671 4192 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/06/04 19:52:18.0718 4192 StarOpen (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
2011/06/04 19:52:18.0750 4192 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/06/04 19:52:18.0781 4192 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/06/04 19:52:18.0812 4192 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/06/04 19:52:18.0937 4192 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/06/04 19:52:18.0968 4192 tap0901 (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
2011/06/04 19:52:19.0031 4192 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/06/04 19:52:19.0046 4192 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/06/04 19:52:19.0078 4192 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/06/04 19:52:19.0093 4192 teamviewervpn (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys
2011/06/04 19:52:19.0125 4192 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/06/04 19:52:19.0218 4192 truecrypt (be45dad1c73a3216edc8c485916f6594) C:\WINDOWS\system32\drivers\truecrypt.sys
2011/06/04 19:52:19.0265 4192 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/06/04 19:52:19.0359 4192 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/06/04 19:52:19.0421 4192 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/06/04 19:52:19.0484 4192 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/06/04 19:52:19.0546 4192 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
2011/06/04 19:52:19.0578 4192 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/06/04 19:52:19.0609 4192 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
2011/06/04 19:52:19.0640 4192 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/06/04 19:52:19.0687 4192 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/06/04 19:52:19.0734 4192 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
2011/06/04 19:52:19.0765 4192 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/06/04 19:52:19.0812 4192 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/06/04 19:52:19.0843 4192 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/06/04 19:52:19.0875 4192 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/06/04 19:52:19.0890 4192 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/06/04 19:52:19.0921 4192 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/06/04 19:52:19.0953 4192 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/06/04 19:52:19.0984 4192 VolSnap (56b191ac5fc0df219949c95a6c87afe7) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/06/04 19:52:20.0031 4192 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/06/04 19:52:20.0140 4192 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2011/06/04 19:52:20.0187 4192 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/06/04 19:52:20.0296 4192 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/06/04 19:52:20.0343 4192 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/06/04 19:52:20.0406 4192 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/06/04 19:52:20.0484 4192 MBR (0x1B8) (32052574bf9f325ae309abc7bfd04460) \Device\Harddisk0\DR0
2011/06/04 19:52:20.0609 4192 ================================================================================
2011/06/04 19:52:20.0609 4192 Scan finished
2011/06/04 19:52:20.0609 4192 ================================================================================
2011/06/04 19:52:20.0609 5148 Detected object count: 1
2011/06/04 19:52:20.0609 5148 Actual detected object count: 1
2011/06/04 19:52:24.0515 5148 LockedFile.Multi.Generic(sptd) - User select action: Skip

 

[hasek747]

I ran the scan twice as you can see, sorry for that - I didn't notice the "Report" button the first time so I thought I missed something and repeated the process.

 

[Broni]

O, komuna mnie wygnała dawno temu. Wyjechałem z Krakowa w 1985.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[hasek747]

No proszę, a ja się urodziłem w czerwcu 1985 - może się 'mineliśmy'

This step is going to take a bit longer as I'm removing AVG - I'll get back with the results ASAP (working on it right now.)

 

[Broni]

No problem

 

[hasek747]

ComboFix report coming through...



ComboFix 08-12-03.01 - Administrator 2008-12-04 12:28:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1546 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Microsoft\backup.ftp

.
((((((((((((((((((((((((( Pliki utworzone od 2008-11-04 do 2008-12-04 )))))))))))))))))))))))))))))))
.

2008-12-04 12:03 . 2008-12-04 12:03 <DIR> d--h----- c:\windows\system32\GroupPolicy
2008-12-03 21:49 . 2008-12-03 21:49 <DIR> d-------- c:\program files\SkanerOnline
2008-11-30 18:21 . 2008-11-30 18:21 <DIR> d-------- c:\windows\system32\TimeCtrlLibs
2008-11-30 18:13 . 2008-11-30 18:14 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\SKL
2008-11-25 18:32 . 2008-12-02 19:21 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\SimpLogs
2008-11-20 20:14 . 2008-11-20 20:14 <DIR> d-------- C:\Temorasoft_Timer_Setup
2008-11-16 11:30 . 2008-11-16 11:30 <DIR> d-------- c:\program files\www.freewordexcelpassword.com
2008-11-14 23:05 . 2008-11-14 23:05 <DIR> d-------- c:\program files\Stoper
2008-11-13 02:13 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 02:13 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-04 16:16 . 2008-11-04 16:16 <DIR> d-------- c:\windows\system32\QuickTime
2008-11-04 16:16 . 2008-03-12 02:37 107,864 --a------ c:\windows\system32\tsccvid.dll
2008-11-04 16:15 . 2008-11-04 16:15 <DIR> d-------- c:\program files\TechSmith
2008-11-04 16:15 . 2008-11-04 16:15 <DIR> d-------- c:\program files\Common Files\TechSmith Shared

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 11:29 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-04 11:24 --------- d-----w c:\program files\PokerStars
2008-12-04 08:37 --------- d-----w c:\program files\Full Tilt Poker
2008-12-03 21:45 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\uTorrent
2008-12-02 17:29 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Skype
2008-12-02 17:19 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\skypePM
2008-11-25 18:23 --------- d-----w c:\program files\Secway
2008-11-25 18:11 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-11-25 05:31 --------- d-----w c:\program files\Spyware Doctor
2008-11-18 10:47 --------- d-----w c:\program files\NAPI-PROJEKT
2008-11-03 09:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip
2008-11-02 14:48 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-02 14:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Fallout3
2008-11-02 14:47 --------- d-----w c:\program files\Bethesda Softworks
2008-11-02 14:45 --------- d-----w c:\program files\MSBuild
2008-11-02 14:42 --------- d-----w c:\program files\Reference Assemblies
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-18 20:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
2008-09-10 10:40 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-09-10 10:20 413,696 ----a-w c:\windows\system32\wrap_oal.dll
2008-09-10 10:20 102,400 ----a-w c:\windows\system32\OpenAL32.dll
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Simp"="c:\program files\Secway\SimpPro 2.2\SimpPro.exe" [2007-10-25 2347008]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"msmsgs"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2007-06-28 81920]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"nwiz"="nwiz.exe" [2007-06-28 c:\windows\system32\nwiz.exe]
"P17Helper"="SPIRun.dll" [2006-07-03 c:\windows\system32\SPIRun.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= c:\documents and settings\Administrator\Pulpit\95495_natalie104_122_1094lo.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= c:\documents and settings\Administrator\Moje dokumenty\Moje obrazy\95495_natalie104_122_1094lo.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-01-25 149352]
R3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-10 99376]
S3 {FAA5C1BB-9412-4043-901A-F14040632269};{FAA5C1BB-9412-4043-901A-F14040632269};\??\c:\windows\system32\drivers\scfsp.sys []
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-09-10 356920]

*Newly Created Service* - COMHOST
*Newly Created Service* - FILEMON701
*Newly Created Service* - PROCEXP90
.
Zawartość folderu 'Zaplanowane zadania'

2008-12-02 c:\windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Administrator.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\ymtr4d1k.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1396957&SearchSource=3&q=
FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 12:29:49
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-12-04 12:30:24
ComboFix-quarantined-files.txt 2008-12-04 11:30:14

Przed: 138*568*101*888 bajtów wolnych
Po: 141,053,980,672 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

153 --- E O F --- 2008-11-22 08:10:37

 

[hasek747]

By the way; how likely is it that I will need to uninstall AVG again soon? I'm not sure whether I should be re-installing it right now or not

 

[Broni]

Widzę, że sobie dajesz świetnie radę z angielskim
Polskie dziewczyny nadal najładniejsze na świecie?

Combofix log looks good, but it looks like we have some issue with your MBR.
I assume, you're still getting redirected?
If so, which browser is affected?

You also have some Norton's leftovers.
Run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

Now, regarding your MBR...
Restart computer
When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.
If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.

You should get a black screen with a C:\> prompt. Type with an Enter after each line:

fixmbr

(If it asks you if you are sure then say "Y".)

exit

Reboot computer.

Post fresh aswMBR log.

 

[Broni]

Hold AVG off for now.

 

[hasek747]

Dużo Cartoon Network się naoglądałem w dzieciństwie i trochę mi zostało Dziewczyny bardzo ładne tutaj, chociaż osobiście wolę hiszpanki i latynoski. Nie pytam jak z dziewczynami w USA, bo słyszałem relacje od wielu osób i były dość jednoznaczne...

Yes, the problem still occurs. It manifests itself in Google Chrome only. (I have just checked in internet explorer and it was clean.)

Thanks for the Norton Removal Tool, it's definitely annoying to remove anything created by Norton

Taking care of the MBR right now and will post the aswMBR log in a few.

 

[hasek747]

(Waiting for Norton Removal Tools to finish before I reboot... )

 

[Broni]

Nie pytam jak z dziewczynami w USA, bo słyszałem relacje od wielu osób i były dość jednoznaczne

Hahaha, nie komentuje

 

[hasek747]

Pewnie najładniejsze amerykanki to polki ;-) Ja swoją drogą polakiem nie jestem; rodzice przyjechali tutaj z Jordanii za młodu na stypendiach (Akademia Medyczna) i się tutaj na miejscu poznali

New MBR has been successfully created. Will post a new aswMBR log in a few.