- Kod: Zaznacz wszystko
ComboFix 09-09-14.02 - ppp 2009-09-15 16:33.1.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1250.48.1045.18.767.522 [GMT 2:00]
Uruchomiony z: c:\documents and settings\ppp\Pulpit\ComboFix.exe
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\boot.exe
C:\cc.exe
c:\documents and settings\All Users\Menu Start\Programy\325 USB PC Camera
c:\documents and settings\All Users\Menu Start\Programy\325 USB PC Camera \AMCap.lnk
c:\documents and settings\All Users\Menu Start\Programy\325 USB PC Camera \Uninstall.lnk
C:\sc.exe
c:\winnt\62.exe
c:\winnt\a1.exe
c:\winnt\a2.exe
c:\winnt\s.exe
c:\winnt\se.exe
c:\winnt\system32\1.txt
c:\winnt\system32\c.txt
c:\winnt\system32\cc.bat
c:\winnt\system32\f.exe
c:\winnt\system32\ieuinit.inf
c:\winnt\system32\mm.exe
c:\winnt\system32\mm1.exe
c:\winnt\system32\setupla.exe
c:\winnt\system32\setuplc.exe
c:\winnt\system32\sysme.bat
c:\winnt\system32\system1.bat
c:\winnt\system32\system2.bat
c:\winnt\system32\tcpyi.exe
c:\winnt\tmd.exe
c:\winnt\tmd1.exe
c:\winnt\tmd2.exe
c:\winnt\Web\default.htt
c:\winnt\system32\qmgr.dll . . . jest zainfekowany!!
c:\winnt\system32\comres.dll . . . jest zainfekowany!!
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BACKGROUND_SWITCH
-------\Service_Distributed Allocated Memory Unit
((((((((((((((((((((((((( Pliki utworzone od 2009-08-15 do 2009-09-15 )))))))))))))))))))))))))))))))
.
2009-09-14 16:58 . 2003-06-19 12:05 147728 ----a-w- c:\winnt\system32\dmadmin.exe
2009-09-14 16:54 . 2000-03-09 00:35 10000 ----a-w- c:\winnt\system32\rundll32.exe
2009-09-14 16:53 . 2003-06-19 12:05 111888 ----a-w- c:\winnt\system32\mobsync.exe
2009-09-14 16:51 . 2000-03-09 00:34 9488 ----a-w- c:\winnt\system32\cidaemon.exe
2009-09-14 16:50 . 2000-03-09 00:35 20752 ----a-w- c:\winnt\system32\internat.exe
2009-09-14 16:49 . 2003-06-19 12:05 243472 ----a-w- c:\winnt\explorer.exe
2009-09-14 16:49 . 2003-06-19 12:05 62224 ----a-w- c:\winnt\system32\stisvc.exe
2009-09-14 16:48 . 2003-06-19 12:05 120080 ----a-w- c:\winnt\system32\mstask.exe
2009-09-14 16:47 . 2000-03-09 00:34 5392 ----a-w- c:\winnt\system32\cisvc.exe
2009-09-14 16:46 . 2003-06-19 12:05 45328 ----a-w- c:\winnt\system32\spoolsv.exe
2009-09-14 16:45 . 1999-12-01 07:40 7952 ----a-w- c:\winnt\system32\svchost.exe
2009-09-14 16:44 . 2003-06-19 12:05 35600 ----a-w- c:\winnt\system32\lsass.exe
2009-09-14 16:43 . 2003-06-19 12:05 89360 ----a-w- c:\winnt\system32\services.exe
2009-09-14 16:42 . 2003-06-19 12:05 183568 ----a-w- c:\winnt\system32\winlogon.exe
2009-09-14 16:42 . 2003-06-19 12:05 45840 ----a-w- c:\winnt\system32\smss.exe
2009-09-14 14:12 . 2009-09-14 14:12 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_234.dat
2009-09-12 08:35 . 2009-09-12 08:35 -------- d-----w- c:\program files\Lavasoft
2009-09-12 08:35 . 2009-09-12 09:02 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2009-08-25 15:49 . 2009-08-25 15:49 -------- d--h--w- c:\winnt\PIF
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-15 12:58 . 2009-02-17 09:15 -------- d-----w- c:\program files\SpeedFan
2009-09-07 15:05 . 2009-03-28 16:04 -------- d-----w- c:\documents and settings\ppp\Dane aplikacji\OpenOffice.org2
2009-09-05 10:59 . 2008-03-17 13:30 -------- d-----w- c:\program files\neostrada tp
2009-08-17 16:10 . 2009-07-14 17:00 1279456 ----a-w- c:\winnt\system32\aswBoot.exe
2009-08-17 16:06 . 2009-07-14 17:01 93392 ----a-w- c:\winnt\system32\drivers\aswmon.sys
2009-08-17 16:06 . 2009-07-14 17:01 94160 ----a-w- c:\winnt\system32\drivers\aswmon2.sys
2009-08-17 16:05 . 2009-07-14 17:01 114768 ----a-w- c:\winnt\system32\drivers\aswSP.sys
2009-08-17 16:04 . 2009-07-14 17:01 51376 ----a-w- c:\winnt\system32\drivers\aswTdi.sys
2009-08-17 16:04 . 2009-07-14 17:01 23152 ----a-w- c:\winnt\system32\drivers\aswRdr.sys
2009-08-17 16:03 . 2009-07-14 17:01 26944 ----a-w- c:\winnt\system32\drivers\aavmker4.sys
2009-08-17 16:02 . 2009-07-14 17:01 97480 ----a-w- c:\winnt\system32\AvastSS.scr
2009-08-02 11:04 . 2009-08-02 11:04 -------- d-----w- c:\documents and settings\ppp\Dane aplikacji\FileZilla
2008-03-13 16:22 . 2008-03-13 16:22 22039 ---h--w- c:\program files\folder.htt
2009-05-01 12:36 . 2008-03-13 18:40 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-05-01 12:36 . 2008-03-13 18:40 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-05-01 12:36 . 2008-03-13 18:40 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-05-01 12:36 . 2008-03-13 18:40 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-05-01 12:36 . 2008-03-13 18:40 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2003-07-08 12:00 . 2003-07-08 12:00 243984 --sha-r- c:\winnt\system32\cmd.exe
2003-07-08 12:00 . 2003-07-08 12:00 12560 --sha-r- c:\winnt\system32\doskey.exe
2003-07-08 12:00 . 2003-07-08 12:00 41232 --sha-r- c:\winnt\system32\ftp.exe
2003-07-08 12:00 . 2003-07-08 12:00 124176 --sha-r- c:\winnt\system32\net1.exe
2003-07-08 12:00 . 2003-07-08 12:00 438330 --sha-r- c:\winnt\system32\vbscript.dll
2003-07-08 12:00 . 2003-07-08 12:00 243984 -csha-r- c:\winnt\system32\dllcache\cmd.exe
2003-07-08 12:00 . 2003-07-08 12:00 12560 -csha-r- c:\winnt\system32\dllcache\doskey.exe
2003-07-08 12:00 . 2003-07-08 12:00 41232 -csha-r- c:\winnt\system32\dllcache\ftp.exe
2003-07-08 12:00 . 2003-07-08 12:00 124176 -csha-r- c:\winnt\system32\dllcache\net1.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [2000-03-09 20752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2006-10-22 7700480]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
"Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-19 111888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [2000-03-09 20752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-07-08 188688]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2009-07-14 114768]
R1 fwdrv;Firewall Driver;c:\winnt\system32\drivers\fwdrv.sys [2005-09-26 286720]
R1 khips;Kerio HIPS Driver;c:\winnt\system32\drivers\khips.sys [2005-09-26 81920]
R2 aswMon;avast! Standard Shield Support;c:\winnt\system32\drivers\aswmon.sys [2009-07-14 93392]
R2 MSSQL$GASTRO;MSSQL$GASTRO;c:\program files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlservr.exe -sGASTRO --> c:\program files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlservr.exe -sGASTRO [?]
R3 usbhub20;Obsługa koncentratora USB;c:\winnt\system32\drivers\usbhub20.sys [2000-01-11 49776]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\winnt\system32\drivers\e4ldr.sys [2008-03-13 64000]
S3 cwbwdm_device;Sterownik kodera-dekodera audio Crystal WDM;c:\winnt\system32\drivers\cwbwdm.sys [2008-03-13 79264]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\winnt\system32\drivers\e4usbaw.sys [2008-03-13 116992]
S3 foghorn;Zgodny z Windows Sound System (WDM);c:\winnt\system32\drivers\foghorn.sys [2000-01-11 21008]
S3 S3Inc;S3Inc;c:\winnt\system32\drivers\s3mt3d.sys [2008-03-13 41008]
S3 SNP325;USB PC Camera (SNPSTD325);c:\winnt\system32\drivers\snp325.sys [2008-12-01 10343168]
S3 sonydcam;Kamera z podstawką Sony 1394 CCM-DS250;c:\winnt\system32\drivers\sonydcam.sys [2003-06-19 22064]
S3 SQLAgent$GASTRO;SQLAgent$GASTRO;c:\program files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlagent.EXE -i GASTRO --> c:\program files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlagent.EXE -i GASTRO [?]
--- Inne Usługi/Sterowniki w Pamięci ---
*NewlyCreated* - IPNAT
*NewlyCreated* - SHAREDACCESS
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
krnlsvc REG_MULTI_SZ MedpiaaCenterj
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.dbsarticles.com/
LSP: %SystemRoot%\system32\msafd.dll
FF - ProfilePath - c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\606tsum0.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - USUNIĘTO PUSTE WPISY - - - -
SafeBoot-SRService
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-15 17:04
Windows 5.0.2195 Service Pack 4 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(224)
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL
- - - - - - - > 'explorer.exe'(1684)
c:\winnt\AppPatch\AcLayers.DLL
c:\winnt\system32\msi.dll
.
Czas ukończenia: 2009-09-15 17:06 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-09-15 15:06
Przed: 3 161 833 472 bajtów wolnych
Po: 3 099 070 464 bajtów wolnych
189
Logfile of Advanced SystemCare 3 Security Analyzer
Scan saved at 17:12:43, on 2009-09-15
Platform: Windows 2000 (WinNT 5.0)
MSIE: Internet Explorer v5.00 (5.00.3700.1000)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlservr.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\cidaemon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\WINNT\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
OTL logfile created on: 2009-09-15 17:31:35 - Run 1
OTL by OldTimer - Version 3.0.14.0 Folder = C:\Documents and Settings\ppp\Pulpit
Windows 2000 Professional Edition Service Pack 4 (Version = 5.0.2195) - Type = NTWorkstation
Internet Explorer (Version = 5.00.3700.1000)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
767,48 Mb Total Physical Memory | 493,05 Mb Available Physical Memory | 64,24% Memory free
913,06 Mb Paging File | 590,84 Mb Available in Paging File | 64,71% Paging File free
Paging file location(s): C:\pagefile.sys 192 800 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 5,96 Gb Total Space | 2,90 Gb Free Space | 48,70% Space Free | Partition Type: NTFS
Drive D: | 2,50 Gb Total Space | 0,86 Gb Free Space | 34,24% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 8,00 Gb Total Space | 7,87 Gb Free Space | 98,30% Space Free | Partition Type: NTFS
Drive G: | 8,05 Gb Total Space | 3,34 Gb Free Space | 41,55% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: POS
Current User Name: ppp
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [1980-06-03 08:00:00 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINNT\System32\LEXBCES.EXE
PRC - [2009-08-17 17:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-08-17 18:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2002-12-17 17:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlservr.exe
PRC - [2006-10-22 13:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) -- C:\WINNT\System32\nvsvc32.exe
PRC - [2003-06-19 14:05:04 | 00,120,080 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\MSTask.exe
PRC - [2003-06-19 14:05:04 | 00,062,224 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\stisvc.exe
PRC - [2003-07-08 14:00:00 | 00,196,706 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\WBEM\WinMgmt.exe
PRC - [2000-03-09 02:34:54 | 00,009,488 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\cidaemon.exe
PRC - [2009-08-17 18:07:23 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2000-03-09 02:35:04 | 00,020,752 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\internat.exe
PRC - [2003-06-19 14:05:04 | 00,243,472 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe
PRC - [2009-08-17 18:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-08-17 18:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2005-10-10 09:58:14 | 01,617,920 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
PRC - [2003-07-08 14:00:00 | 00,089,872 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\taskmgr.exe
PRC - [2006-06-02 15:36:58 | 13,115,124 | ---- | M] ( P.U.K. Softech BIS) -- C:\G_POS\pos.exe
PRC - [2006-01-27 11:12:28 | 00,147,096 | ---- | M] () -- C:\G_POS\RSAUT.EXE
PRC - [2005-10-10 09:56:46 | 02,887,680 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
PRC - [2005-10-10 09:56:46 | 02,887,680 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
PRC - [2009-05-01 14:36:55 | 07,678,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-09-15 17:31:07 | 00,514,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ppp\Pulpit\OTL.exe
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009-08-17 17:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2009-08-17 18:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009-08-17 18:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Running])
SRV - [2009-08-17 18:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Running])
SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2003-06-19 14:05:04 | 00,147,728 | ---- | M] (VERITAS Software Corp.) -- C:\WINNT\System32\dmadmin.exe -- (dmadmin [On_Demand | Stopped])
SRV - [2003-07-08 14:00:00 | 00,095,504 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\faxsvc.exe -- (Fax [On_Demand | Stopped])
SRV - [2005-10-10 09:58:14 | 01,617,920 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe -- (KPF4 [Auto | Running])
SRV - [1980-06-03 08:00:00 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINNT\System32\LEXBCES.EXE -- (LexBceS [Auto | Running])
SRV - [2002-12-17 17:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlservr.exe -- (MSSQL$GASTRO [Auto | Running])
SRV - [2002-12-17 17:23:30 | 00,066,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe -- (MSSQLServerADHelper [On_Demand | Stopped])
SRV - [2006-10-22 13:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) -- C:\WINNT\System32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-08 14:00:00 | 00,068,368 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\regsvc.exe -- (RemoteRegistry [Disabled | Stopped])
SRV - [2003-06-19 14:05:04 | 00,120,080 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\MSTask.exe -- (Schedule [Auto | Running])
SRV - [2002-12-17 17:23:30 | 00,311,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL$GASTRO\Binn\sqlagent.EXE -- (SQLAgent$GASTRO [On_Demand | Stopped])
SRV - [2003-06-19 14:05:04 | 00,062,224 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\stisvc.exe -- (StiSvc [Auto | Running])
SRV - [2003-07-08 14:00:00 | 00,022,800 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\UtilMan.exe -- (UtilMan [On_Demand | Stopped])
SRV - [2003-07-08 14:00:00 | 00,196,706 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\WBEM\WinMgmt.exe -- (WinMgmt [Auto | Running])
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV - [2009-08-17 18:03:21 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2004-03-02 09:26:58 | 00,050,007 | ---- | M] (Analog Deivces) -- C:\WINNT\System32\Drivers\adildr.sys -- (ADILOADER [Auto | Stopped])
DRV - [2005-09-19 14:28:08 | 00,126,489 | ---- | M] (Analog Devices Inc.) -- C:\WINNT\System32\DRIVERS\adiusbaw.sys -- (adiusbaw [On_Demand | Stopped])
DRV - [2009-08-17 18:06:54 | 00,093,392 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys -- (aswMon [Auto | Running])
DRV - [2009-08-17 18:04:29 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Running])
DRV - [2009-08-17 18:05:52 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-08-17 18:04:40 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - File not found -- -- (catchme [On_Demand | Running])
DRV - [1999-11-02 07:10:56 | 00,079,264 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\drivers\cwbwdm.sys -- (cwbwdm_device [On_Demand | Stopped])
DRV - [2003-07-08 14:00:00 | 00,007,728 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\drivers\diskperf.sys -- (Diskperf [Boot | Running])
DRV - [2003-07-08 14:00:00 | 00,369,104 | ---- | M] (VERITAS Software Corp.) -- C:\WINNT\System32\drivers\dmboot.sys -- (dmboot [Disabled | Stopped])
DRV - [2003-07-08 14:00:00 | 00,137,936 | ---- | M] (VERITAS Software Corp.) -- C:\WINNT\System32\drivers\dmio.sys -- (dmio [Boot | Running])
DRV - [2003-07-08 14:00:00 | 00,007,312 | ---- | M] (VERITAS Software Corp.) -- C:\WINNT\System32\drivers\dmload.sys -- (dmload [Boot | Running])
DRV - [2003-06-19 13:05:04 | 00,085,776 | ---- | M] (Intel Corporation) -- C:\WINNT\System32\DRIVERS\e100bnt5.sys -- (E100B [On_Demand | Stopped])
DRV - [2006-09-19 12:03:28 | 00,116,992 | ---- | M] (Analog Devices Inc.) -- C:\WINNT\System32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Running])
DRV - [2003-07-08 14:00:00 | 00,027,440 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\drivers\efs.sys -- (EFS [Disabled | Running])
DRV - [1999-10-07 01:17:30 | 00,021,008 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\drivers\foghorn.sys -- (foghorn [On_Demand | Stopped])
DRV - [2005-09-26 11:05:06 | 00,286,720 | ---- | M] (Kerio Technologies) -- C:\WINNT\system32\drivers\fwdrv.sys -- (fwdrv [System | Running])
DRV - [2003-06-19 13:05:04 | 00,009,808 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running])
DRV - [1996-04-03 21:33:26 | 00,005,248 | ---- | M] () -- C:\WINNT\System32\giveio.sys -- (giveio [System | Running])
DRV - [2006-09-15 12:07:54 | 00,064,000 | ---- | M] (Analog Deivces) -- C:\WINNT\System32\Drivers\e4ldr.sys -- (IKANLOADER2 [Auto | Stopped])
DRV - [2005-09-26 11:05:06 | 00,081,920 | ---- | M] () -- C:\WINNT\system32\drivers\khips.sys -- (khips [System | Running])
DRV - [2004-07-09 03:58:10 | 00,015,104 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\MPE.sys -- (MPE [On_Demand | Stopped])
DRV - [2003-07-08 14:00:00 | 00,009,680 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\drivers\netdtect.sys -- (NetDetect [On_Demand | Stopped])
DRV - [2006-10-22 13:22:00 | 03,994,624 | ---- | M] (NVIDIA Corporation) -- C:\WINNT\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2003-07-08 14:00:00 | 00,060,272 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\parallel.sys -- (Parallel [On_Demand | Running])
DRV - [2003-07-08 14:00:00 | 00,017,680 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINNT\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2003-07-08 14:00:00 | 00,021,712 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\drivers\RCA.sys -- (RCA [On_Demand | Stopped])
DRV - [1999-10-29 22:11:42 | 00,041,008 | ---- | M] (S3 Incorporated) -- C:\WINNT\System32\DRIVERS\s3mt3d.sys -- (S3Inc [On_Demand | Stopped])
DRV - [2007-04-26 12:03:12 | 10,343,168 | ---- | M] (Sonix Co. Ltd.) -- C:\WINNT\System32\DRIVERS\snp325.sys -- (SNP325 [On_Demand | Stopped])
DRV - [2003-07-08 14:00:00 | 00,022,064 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\sonydcam.sys -- (sonydcam [On_Demand | Stopped])
DRV - [2006-09-24 15:28:46 | 00,005,248 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINNT\System32\speedfan.sys -- (speedfan [System | Running])
DRV - [2000-03-09 00:31:26 | 00,006,800 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\serscan.sys -- (StillCam [On_Demand | Stopped])
DRV - [2008-03-13 20:38:46 | 00,044,384 | ---- | M] (Acronis) -- C:\WINNT\System32\DRIVERS\tifsfilt.sys -- (tifsfilter [Auto | Running])
DRV - [2008-03-13 20:38:46 | 00,441,760 | ---- | M] (Acronis) -- C:\WINNT\system32\DRIVERS\timntr.sys -- (timounter [Boot | Running])
DRV - [2003-07-08 14:00:00 | 00,032,848 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\uhcd.sys -- (uhcd [On_Demand | Running])
DRV - [1999-09-25 19:51:26 | 00,023,472 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\umaxpcls.sys -- (UMAXPCLS [Auto | Stopped])
DRV - [2003-06-19 13:05:04 | 00,049,776 | ---- | M] (Microsoft Corporation) -- C:\WINNT\System32\DRIVERS\usbhub20.sys -- (usbhub20 [On_Demand | Running])
DRV - [2001-11-26 03:20:00 | 00,041,152 | ---- | M] (VIA Technologies, Inc.) -- C:\WINNT\System32\drivers\viaudio.sys -- (VIAudio [On_Demand | Running])
DRV - [2007-08-03 11:27:04 | 01,470,592 | ---- | M] (ZSMC.Corporation) -- C:\WINNT\System32\Drivers\ZS211.sys -- (ZSMC211 [On_Demand | Stopped])
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dbsarticles.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[color=#E56717]========== FireFox ==========[/color]
FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008-12-03 14:32:16 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-05-01 14:37:07 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-05-26 15:22:21 | 00,000,000 | ---D | M]
[2008-03-13 20:41:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\mozilla\Firefox\Profiles\606tsum0.default\extensions
[2009-09-12 16:49:30 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-05-01 14:37:07 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008-12-03 14:35:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009-05-01 14:37:07 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\[email protected]
[2009-05-01 14:36:24 | 00,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jar50.dll
[2009-05-01 14:36:25 | 00,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jsd3250.dll
[2009-05-01 14:36:25 | 00,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\myspell.dll
[2009-05-01 14:36:30 | 00,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\spellchk.dll
[2009-05-01 14:36:31 | 00,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\xpinstal.dll
[2008-12-03 14:32:12 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009-02-10 11:29:19 | 00,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2008-01-29 09:33:16 | 00,120,296 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npganymedenet.dll
[2009-05-01 14:36:59 | 00,022,656 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009-05-01 14:37:02 | 00,000,904 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2009-05-01 14:37:02 | 00,001,419 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2009-05-01 14:37:02 | 00,002,368 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009-05-01 14:37:02 | 00,000,926 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2009-05-01 14:37:02 | 00,000,866 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2009-05-01 14:37:02 | 00,001,198 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2009-05-01 14:37:02 | 00,001,693 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml
O1 HOSTS File: (27 bytes) - C:\WINNT\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINNT\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Synchronization Manager] C:\WINNT\System32\mobsync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [internat.exe] C:\WINNT\System32\internat.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINNT\System32\rnr20.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINNT\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINNT\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINNT\System32\msafd.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: 8 domain(s) and sub-domain(s) not assigned to a zone.
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\System32\msdxm.ocx (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - No CLSID value found
O18 - Protocol\Filter: - application/x-complus - No CLSID value found
O18 - Protocol\Filter: - application/x-msdownload - No CLSID value found
O18 - Protocol\Filter: - Class Install Handler - No CLSID value found
O18 - Protocol\Filter: - deflate - No CLSID value found
O18 - Protocol\Filter: - gzip - No CLSID value found
O18 - Protocol\Filter: - lzdhtml - No CLSID value found
O18 - Protocol\Filter: - text/webviewhtml - No CLSID value found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\wzcnotif: DllName - wzcdlg.dll - C:\WINNT\System32\wzcdlg.dll (Microsoft Corporation)
O21 - SSODL: Network.ConnectionTray - {7007ACCF-3202-11D1-AAD2-00805FC1270E} - C:\WINNT\System32\NETSHELL.dll (Microsoft Corporation)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-03-13 18:24:13 | 00,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINNT\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2 C:\WINNT\*.tmp files]
[2009-09-15 17:31:04 | 00,514,560 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ppp\Pulpit\OTL.exe
[2009-09-15 17:07:03 | 00,000,000 | ---D | C] -- C:\WINNT\temp
[2009-09-15 16:32:24 | 00,229,888 | ---- | C] () -- C:\WINNT\PEV.exe
[2009-09-15 16:32:24 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINNT\SWXCACLS.exe
[2009-09-15 16:32:24 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINNT\SWREG.exe
[2009-09-15 16:32:24 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINNT\SWSC.exe
[2009-09-15 16:32:24 | 00,098,816 | ---- | C] () -- C:\WINNT\sed.exe
[2009-09-15 16:32:24 | 00,080,412 | ---- | C] () -- C:\WINNT\grep.exe
[2009-09-15 16:32:24 | 00,068,096 | ---- | C] () -- C:\WINNT\zip.exe
[2009-09-15 16:32:24 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINNT\NIRCMD.exe
[2009-09-15 16:32:19 | 00,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2009-09-15 16:29:37 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009-09-15 15:59:28 | 03,315,456 | R--- | C] () -- C:\Documents and Settings\ppp\Pulpit\ComboFix.exe
[2009-09-14 18:58:29 | 00,147,728 | ---- | C] (VERITAS Software Corp.) -- C:\WINNT\System32\dmadmin.exe
[2009-09-14 18:54:25 | 00,010,000 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\rundll32.exe
[2009-09-14 18:53:34 | 00,111,888 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\mobsync.exe
[2009-09-14 18:51:24 | 00,009,488 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\cidaemon.exe
[2009-09-14 18:50:45 | 00,020,752 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\internat.exe
[2009-09-14 18:49:59 | 00,243,472 | ---- | C] (Microsoft Corporation) -- C:\WINNT\explorer.exe
[2009-09-14 18:49:04 | 00,062,224 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\stisvc.exe
[2009-09-14 18:48:30 | 00,120,080 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\mstask.exe
[2009-09-14 18:47:34 | 00,005,392 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\cisvc.exe
[2009-09-14 18:46:17 | 00,045,328 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\spoolsv.exe
[2009-09-14 18:45:04 | 00,007,952 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\svchost.exe
[2009-09-14 18:44:30 | 00,035,600 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\lsass.exe
[2009-09-14 18:43:57 | 00,089,360 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\services.exe
[2009-09-14 18:42:57 | 00,183,568 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\winlogon.exe
[2009-09-14 18:42:07 | 00,045,840 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\smss.exe
[2009-09-14 16:12:41 | 00,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_234.dat
[2009-09-12 10:35:33 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2009-09-12 10:35:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
[2009-08-25 17:49:26 | 00,000,000 | -H-D | C] -- C:\WINNT\PIF
[2009-08-01 20:21:55 | 00,000,014 | ---- | C] () -- C:\WINNT\System32\drivers\acpiec1.sys
[2009-08-01 20:21:37 | 00,000,090 | RHS- | C] () -- C:\WINNT\System32\zxxyyy.sys
[2009-08-01 20:21:37 | 00,000,087 | RHS- | C] () -- C:\WINNT\System32\tcpips.sys
[2009-08-01 20:21:37 | 00,000,083 | RHS- | C] () -- C:\WINNT\System32\gx.sys
[2009-08-01 20:21:37 | 00,000,071 | RHS- | C] () -- C:\WINNT\System32\spcmd.sys
[2009-08-01 20:21:37 | 00,000,071 | RHS- | C] () -- C:\WINNT\System32\dbcmd.sys
[2009-08-01 20:21:37 | 00,000,065 | RHS- | C] () -- C:\WINNT\System32\Ls09.sys
[2009-08-01 20:21:36 | 00,000,153 | RHS- | C] () -- C:\WINNT\System32\setuplc.sys
[2009-08-01 20:21:36 | 00,000,116 | RHS- | C] () -- C:\WINNT\System32\xiaoyi20093.sys
[2009-08-01 20:21:36 | 00,000,116 | RHS- | C] () -- C:\WINNT\System32\xiaoyi20092.sys
[2009-08-01 20:21:36 | 00,000,111 | RHS- | C] () -- C:\WINNT\System32\forme.sys
[2009-08-01 20:21:36 | 00,000,103 | RHS- | C] () -- C:\WINNT\cwssao.sys
[2009-08-01 20:21:35 | 00,000,116 | RHS- | C] () -- C:\WINNT\System32\xiaoyi20091.sys
[2009-08-01 20:21:35 | 00,000,115 | RHS- | C] () -- C:\WINNT\System32\tcpyi.sys
[2009-08-01 20:21:35 | 00,000,103 | RHS- | C] () -- C:\WINNT\System32\setupla.sys
[2009-08-01 20:21:35 | 00,000,056 | RHS- | C] () -- C:\WINNT\System32\cc.sys
[2009-08-01 20:21:34 | 00,000,113 | RHS- | C] () -- C:\WINNT\System32\zzjkxs.sys
[2009-08-01 20:21:34 | 00,000,083 | RHS- | C] () -- C:\WINNT\System32\tencent.sys
[2009-08-01 20:21:34 | 00,000,070 | RHS- | C] () -- C:\WINNT\System32\zzxxxd.sys
[2009-02-06 12:58:07 | 00,354,816 | ---- | C] () -- C:\WINNT\System32\psisdecd.dll
[2008-12-01 12:44:27 | 00,015,498 | ---- | C] () -- C:\WINNT\snp325.ini
[2008-12-01 12:44:19 | 00,053,248 | ---- | C] ( ) -- C:\WINNT\System32\csnp325.dll
[2008-12-01 12:44:18 | 00,147,456 | ---- | C] ( ) -- C:\WINNT\System32\rsnp325.dll
[2008-12-01 12:44:18 | 00,057,344 | ---- | C] ( ) -- C:\WINNT\System32\vsnp325.dll
[2008-04-19 20:03:43 | 00,000,754 | ---- | C] () -- C:\WINNT\WORDPAD.INI
[2008-03-17 15:33:27 | 00,000,021 | ---- | C] () -- C:\WINNT\kit.ini
[2008-03-13 21:41:42 | 00,000,507 | ---- | C] () -- C:\WINNT\LEXSTAT.INI
[2008-03-13 21:31:15 | 00,000,168 | ---- | C] () -- C:\WINNT\adidsl.ini
[2008-03-13 21:31:15 | 00,000,021 | ---- | C] () -- C:\WINNT\Fast800.ini
[2008-03-13 21:30:48 | 00,001,094 | ---- | C] () -- C:\WINNT\adiras.ini
[2008-03-13 21:30:29 | 00,126,976 | ---- | C] () -- C:\WINNT\System32\coclassfast.dll
[2008-03-13 21:30:22 | 00,046,892 | ---- | C] () -- C:\WINNT\System32\ADADIX16.DLL
[2008-03-13 19:37:10 | 00,000,730 | ---- | C] () -- C:\WINNT\wincmd.ini
[2008-03-13 18:59:59 | 00,000,441 | ---- | C] () -- C:\WINNT\ODBC.INI
[2006-10-22 13:22:00 | 01,662,976 | ---- | C] () -- C:\WINNT\System32\nvwdmcpl.dll
[2006-10-22 13:22:00 | 01,470,464 | ---- | C] () -- C:\WINNT\System32\nview.dll
[2006-10-22 13:22:00 | 01,019,904 | ---- | C] () -- C:\WINNT\System32\nvwimg.dll
[2006-10-22 13:22:00 | 00,581,632 | ---- | C] () -- C:\WINNT\System32\nvhwvid.dll
[2006-10-22 13:22:00 | 00,466,944 | ---- | C] () -- C:\WINNT\System32\nvshell.dll
[2006-10-22 13:22:00 | 00,286,720 | ---- | C] () -- C:\WINNT\System32\nvnt4cpl.dll
[2006-10-22 13:22:00 | 00,212,992 | ---- | C] () -- C:\WINNT\System32\nvapi.dll
[2005-09-26 11:05:06 | 00,081,920 | ---- | C] () -- C:\WINNT\System32\drivers\khips.sys
[2003-07-08 14:00:00 | 00,176,400 | ---- | C] () -- C:\WINNT\System32\qcut.dll
[2003-07-08 14:00:00 | 00,034,064 | ---- | C] () -- C:\WINNT\System32\efsadu.dll
[2003-07-08 14:00:00 | 00,013,419 | ---- | C] () -- C:\WINNT\System32\iasperf.ini
[2003-07-08 14:00:00 | 00,003,182 | ---- | C] () -- C:\WINNT\System32\faxperf.ini
[2003-07-08 14:00:00 | 00,000,708 | ---- | C] () -- C:\WINNT\win.ini
[2003-07-08 14:00:00 | 00,000,485 | ---- | C] () -- C:\WINNT\system.ini
[2003-07-08 14:00:00 | 00,000,023 | ---- | C] () -- C:\WINNT\welcome.ini
[1999-09-25 20:36:24 | 00,088,816 | ---- | C] () -- C:\WINNT\System32\drivers\lvcam.sys
[1999-09-25 20:36:22 | 00,017,424 | ---- | C] () -- C:\WINNT\System32\drivers\lvsound.sys
[1996-04-03 21:33:26 | 00,005,248 | ---- | C] () -- C:\WINNT\System32\giveio.sys
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2 C:\WINNT\*.tmp files]
[2009-09-15 17:31:07 | 00,514,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ppp\Pulpit\OTL.exe
[2009-09-15 17:04:22 | 00,000,485 | ---- | M] () -- C:\WINNT\system.ini
[2009-09-15 17:03:45 | 00,088,566 | ---- | M] () -- C:\WINNT\System32\nvapps.xml
[2009-09-15 17:03:33 | 00,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2009-09-15 16:53:36 | 00,000,006 | -H-- | M] () -- C:\WINNT\tasks\SA.DAT
[2009-09-15 16:00:21 | 03,315,456 | R--- | M] () -- C:\Documents and Settings\ppp\Pulpit\ComboFix.exe
[2009-09-15 12:42:15 | 00,731,998 | -H-- | M] () -- C:\WINNT\ShellIconCache
[2009-09-15 10:01:51 | 00,001,550 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Antivirus.lnk
[2009-09-14 20:56:02 | 00,000,507 | ---- | M] () -- C:\WINNT\LEXSTAT.INI
[2009-09-14 16:12:41 | 00,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_234.dat
[2009-09-14 02:12:36 | 00,229,888 | ---- | M] () -- C:\WINNT\PEV.exe
[2009-09-12 10:35:51 | 00,002,645 | ---- | M] () -- C:\WINNT\System32\CONFIG.NT
[2009-08-17 18:10:20 | 01,279,456 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\aswBoot.exe
[2009-08-17 18:06:54 | 00,093,392 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2009-08-17 18:06:43 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2009-08-17 18:05:52 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2009-08-17 18:04:40 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2009-08-17 18:04:29 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2009-08-17 18:03:21 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2009-08-17 18:02:50 | 00,097,480 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\AvastSS.scr
[color=#E56717]========== Alternate Data Streams ==========[/color]
@Alternate Data Stream - 5832 bytes -> C:\WINNT\Bąbelki.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 3864 bytes -> C:\WINNT\Pod mikroskopem.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 3840 bytes -> C:\WINNT\Stiuk z Santa Fe.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 2980 bytes -> C:\WINNT\System32\setup.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 2500 bytes -> C:\WINNT\winnt256.bmp:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 1256 bytes -> C:\WINNT\System32\ntimage.gif:Q30lsldxJoudresxAaaqpcawXc
< End of report >
Przepraszam że tak ale inaczej nie dałem rady
zapisz jako 
