zacina sie

[munkk]

ComboFix 09-02-28.01 - admin 2009-03-01 17:52:25.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.447.92 [GMT 1:00]
Uruchomiony z: c:\documents and settings\admin\Moje dokumenty\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Utworzono nowy punkt przywracania
.

((((((((((((((((((((((((( Pliki utworzone od 2009-02-01 do 2009-03-01 )))))))))))))))))))))))))))))))
.

2009-03-01 12:22 . 2009-03-01 12:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\311D4
2009-02-28 11:58 . 2009-02-28 11:58 <DIR> d-------- c:\program files\GomPlayer2.0.11.3373 pl
2009-02-28 11:35 . 2009-02-28 11:35 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\gtk-2.0
2009-02-28 11:35 . 2009-02-28 11:35 <DIR> d-------- c:\documents and settings\admin\.thumbnails
2009-02-28 11:33 . 2009-02-28 11:36 <DIR> d-------- c:\documents and settings\admin\.gimp-2.6
2009-02-28 11:33 . 2009-02-28 11:33 <DIR> d-------- c:\documents and settings\admin\.gegl-0.0
2009-02-28 11:32 . 2009-02-28 11:32 <DIR> d-------- c:\program files\GIMP-2.0
2009-02-26 18:43 . 2009-02-26 18:43 56 --ah----- c:\windows\system32\ezsidmv.dat
2009-02-26 18:42 . 2009-02-26 18:42 <DIR> d-------- c:\program files\Common Files\Skype
2009-02-26 11:54 . 2006-08-11 15:51 327,680 --a------ C:\GomEng.dll
2009-02-26 11:27 . 2009-02-26 11:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\32222
2009-02-25 16:28 . 2009-02-25 17:27 <DIR> d-------- c:\program files\Cyfro
2009-02-25 10:29 . 2009-02-25 10:29 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\1534B
2009-02-24 10:05 . 2009-02-24 10:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\2420D
2009-02-23 19:45 . 2009-02-23 19:45 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\1096
2009-02-23 11:54 . 2009-02-23 11:55 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-02-23 11:54 . 2008-11-06 17:33 684,032 --a------ c:\windows\system32\divx.dll
2009-02-23 11:54 . 2004-01-25 17:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-02-23 11:54 . 2008-09-16 20:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-02-23 11:54 . 2009-02-09 19:56 67,584 --a------ c:\windows\system32\ff_vfw.dll
2009-02-23 11:54 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-23 11:54 . 2008-10-03 13:30 414 --a------ c:\windows\system32\lame_acm.xml
2009-02-22 13:22 . 2009-02-22 13:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\1A2EE
2009-02-21 17:08 . 2009-02-21 17:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\39243
2009-02-21 10:22 . 2009-02-21 10:22 <DIR> d-------- c:\program files\ivo
2009-02-21 10:22 . 2009-02-21 14:11 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\Expressivo
2009-02-19 18:10 . 2009-02-19 18:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\529B
2009-02-17 18:13 . 2009-02-17 18:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\25109
2009-02-12 23:56 . 2009-02-12 23:57 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\BESTplayer
2009-02-12 16:38 . 2009-02-12 16:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\7109
2009-02-08 14:33 . 2009-02-08 14:34 <DIR> d-------- c:\program files\MWSnap
2009-02-07 13:09 . 2009-02-07 13:09 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\9186
2009-02-07 09:47 . 2009-02-07 09:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\8119
2009-02-06 19:51 . 2009-02-06 19:51 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\1835B
2009-02-06 19:45 . 2009-02-06 19:45 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\191D4
2009-02-06 19:27 . 2009-02-06 19:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\2B7D
2009-02-06 14:00 . 2006-08-11 15:51 327,680 --a------ c:\program files\GomEng.dll
2009-02-06 13:56 . 2009-02-06 13:56 <DIR> d-------- C:\GomPlayer2.0.11.3373 pl
2009-02-03 09:34 . 2009-02-03 09:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\372E
2009-02-02 16:27 . 2009-02-02 16:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-02-02 16:26 . 2009-02-02 16:27 <DIR> d-------- c:\program files\PowerShot Pinball
2009-02-02 12:00 . 2009-03-01 03:56 <DIR> d--h----- C:\$AVG8.VAULT$
2009-02-02 10:02 . 2009-02-02 10:02 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\223B9
2009-02-01 22:36 . 2009-02-28 21:54 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-01 22:36 . 2009-02-01 22:40 <DIR> d-------- c:\documents and settings\admin\Dane aplikacji\AVGTOOLBAR
2009-02-01 22:36 . 2009-02-04 09:50 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-01 22:36 . 2009-02-04 09:50 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-01 22:36 . 2009-02-04 09:50 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-01 22:35 . 2009-02-01 22:35 <DIR> d-------- c:\program files\AVG
2009-02-01 22:35 . 2009-02-04 09:51 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\avg8
2009-02-01 15:06 . 2009-02-01 15:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\363D8

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 16:59 --------- d-----w c:\documents and settings\admin\Dane aplikacji\Skype
2009-03-01 15:04 --------- d-----w c:\documents and settings\admin\Dane aplikacji\skypePM
2009-03-01 11:33 --------- d-----w c:\documents and settings\admin\Dane aplikacji\BearShare
2009-03-01 02:45 --------- d-----w c:\program files\ZumieSearch
2009-02-27 12:01 --------- d-----w c:\program files\Odkurzacz
2009-02-26 17:42 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2009-02-26 17:42 --------- d-----r c:\program files\Skype
2009-02-26 17:09 --------- d-----w c:\documents and settings\admin\Dane aplikacji\SmartShopper
2009-02-25 15:58 --------- d-----w c:\program files\Astonsoft
2009-02-23 10:52 --------- d-----w c:\program files\DivX
2009-02-16 05:20 --------- d-----w c:\program files\Google
2009-01-30 21:53 --------- d-----w c:\program files\SilentNight Microburner
2009-01-29 21:33 --------- d-----w c:\program files\ImgBurn
2009-01-29 21:33 --------- d-----w c:\documents and settings\admin\Dane aplikacji\ImgBurn
2009-01-29 19:12 --------- d-----w c:\program files\Lavalys
2009-01-29 19:04 --------- d-----w c:\program files\AC3Filter
2009-01-29 18:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\172E
2009-01-29 16:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NexonEU
2009-01-29 12:13 421,888 ----a-w c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-01-29 09:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\38CB
2009-01-29 09:16 --------- d-----w c:\program files\Full Pack Codecs
2009-01-28 22:43 --------- d-----w c:\documents and settings\admin\Dane aplikacji\DivX
2009-01-25 16:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\391FC
2009-01-24 18:18 --------- d-----w c:\program files\Real Alternative
2009-01-24 15:10 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-23 20:09 --------- d-----w c:\documents and settings\admin\Dane aplikacji\dp3d
2009-01-23 19:57 --------- d-----w c:\program files\Dream Pinball 3D
2009-01-20 15:46 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\13280
2009-01-20 10:25 --------- d-----w c:\program files\Java
2009-01-19 15:51 --------- d-----w c:\program files\CDBurnerXP
2009-01-19 15:51 --------- d-----w c:\documents and settings\admin\Dane aplikacji\Canneverbe_Limited
2009-01-14 23:42 --------- d-----w c:\program files\MarBit
2009-01-14 13:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ZumieSearch
2009-01-13 19:47 --------- d-----w c:\program files\Reference Assemblies
2009-01-13 19:47 --------- d-----w c:\program files\MSBuild
2009-01-13 19:11 --------- d-----w c:\program files\MSXML 6.0
2009-01-13 12:21 --------- d-----w c:\program files\CCleaner
2009-01-09 15:40 --------- d-----w c:\documents and settings\admin\Dane aplikacji\Nowe Gadu-Gadu
2009-01-07 16:58 --------- d-----w c:\program files\Nowe Gadu-Gadu
2009-01-07 13:58 --------- d-----w c:\program files\eDonkey2000
2009-01-03 18:30 --------- d-----w c:\program files\NAPI-PROJEKT
2009-01-02 17:25 --------- d-----w c:\program files\Gadu-Gadu
2008-09-21 15:13 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-04-29 15:59 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-02-27_13.06.04.75 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-28 07:56:57 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_b0.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]
"{cd36797a-70f3-4acd-8825-623d3b896881}"= "c:\program files\securedie\tbsec1.dll" [2008-06-29 1470488]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CLASSES_ROOT\clsid\{cd36797a-70f3-4acd-8825-623d3b896881}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2008-09-02 15:05 398776 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd36797a-70f3-4acd-8825-623d3b896881}]
2008-06-29 10:50 1470488 --a------ c:\program files\securedie\tbsec1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{cd36797a-70f3-4acd-8825-623d3b896881}"= "c:\program files\securedie\tbsec1.dll" [2008-06-29 1470488]

[HKEY_CLASSES_ROOT\clsid\{cd36797a-70f3-4acd-8825-623d3b896881}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CD36797A-70F3-4ACD-8825-623D3B896881}"= "c:\program files\securedie\tbsec1.dll" [2008-06-29 1470488]

[HKEY_CLASSES_ROOT\clsid\{cd36797a-70f3-4acd-8825-623d3b896881}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-15 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648]
"CreativeTaskScheduler"="c:\program files\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2008-12-22 8966760]
"Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2007-05-03 264704]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-05-10 2111176]
"ExprOElauncher"="c:\program files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe" [2008-09-24 86016]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-01-29 23975720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cyfro 2"="c:\program files\Cyfro\Cyfro2.exeNO" [X]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"V0420Mon.exe"="c:\windows\V0420Mon.exe" [2007-04-30 32768]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-04 1601304]
"VTTrayp"="VTtrayp.exe" [2004-06-22 c:\windows\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2004-10-01 c:\windows\system32\VTTimer.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-04 09:50 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"=
"c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms EU\CombatArms.exe"= c:\nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"c:\nexon\Combat Arms EU\Engine.exe"= c:\nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19470:TCP"= 19470:TCP:BitComet 19470 TCP
"19470:UDP"= 19470:UDP:BitComet 19470 UDP
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-01 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-01 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-01 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-01 298264]
R3 V0420VID;Live! Cam Vista IM (VF0420);c:\windows\system32\drivers\V0420Vid.sys [2008-04-19 99648]
S1 13e9c325;13e9c325;c:\windows\system32\drivers\13e9c325.sys --> c:\windows\system32\drivers\13e9c325.sys [?]
S2 ShellHWDetection_Untrusted_BZ;Wykrywanie sprzętu powłoki_Untrusted_BZ;c:\virtual\Untrusted\C_\WINDOWS\System32\svchost.exe -k netsvcs [2004-08-03 14336]
S2 StiSvc_Untrusted_BZ;Windows Image Acquisition (WIA)_Untrusted_BZ;c:\virtual\Untrusted\C_\WINDOWS\system32\svchost.exe -k imgsvc [2004-08-03 14336]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};\??\c:\windows\TEMP\175.tmp --> c:\windows\TEMP\175.tmp [?]
S3 netman_Untrusted_BZ;Połączenia sieciowe_Untrusted_BZ;c:\virtual\Untrusted\C_\WINDOWS\System32\svchost.exe -k netsvcs [2004-08-03 14336]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16b55e57-4685-11dd-99c9-00194b656ab7}]
\Shell\Auto\command - E:\setup.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a791df5-fde4-11dd-a998-001f95be6e77}]
\Shell\Auto\command - E:\setup.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a791df6-fde4-11dd-a998-001f95be6e77}]
\Shell\Auto\command - G:\setup.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62e2c911-53f8-11dd-99d4-00194b656ab7}]
\Shell\Auto\command - E:\setup.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Zawartość folderu 'Zaplanowane zadania'

2009-03-01 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe []

2009-03-01 c:\windows\Tasks\rpc.job
- c:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe []
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-01 17:58:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\c:\windows\TEMP\175.tmp"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\ClsID\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
"VRegSpecialValueName"=dword:000000aa
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\ClsID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Implemented Categories]
"VRegSpecialValueName"=dword:00000000

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\ClsID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32]
"VRegSpecialValueName"=dword:000000aa
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\ClsID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\MiscStatus]
"VRegSpecialValueName"=dword:000000aa
@="0"

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
"VRegSpecialValueName"=dword:000000aa

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\Software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
"VRegSpecialValueName"=dword:000000aa
@="Shockwave Flash"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'explorer.exe'(2148)
c:\program files\Windows Media Player\wmpband.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\pl.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
.
Czas ukończenia: 2009-03-01 18:02:05
ComboFix-quarantined-files.txt 2009-03-01 17:01:54
ComboFix2.txt 2009-03-01 10:56:33
ComboFix3.txt 2009-02-28 08:13:09
ComboFix4.txt 2009-02-27 12:07:47

Przed: 17 687 961 600 bajtów wolnych
Po: 17,909,534,720 bajtów wolnych

280 --- E O F --- 2009-02-25 02:02:07