Od około 2 tygodni Kaspersky Internet Security nie aktualizuje się w ogóle. Po przeskanowaniu kompa wyszło, że mam trojana trojan-psw.win32.tibia.ru oraz sporo malware'u. Dodatkowym objawem jest okazjonalne zwieszenie się kompa i konieczność twardego resetu. Zdarza się to niestety w sposób losowy, czasem po 5 minutach, czasem po 2 godzinach. Zawsze gdzieś w tle włączony jest wtedy Firefox.
Windows XP Pro 32-bity z SP3.
Załączam pliki OTL i GMER
OTL
- Kod: Zaznacz wszystko
OTL logfile created on: 2011-11-01 22:53:36 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\FORUM\OTL
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
1022,79 Mb Total Physical Memory | 307,36 Mb Available Physical Memory | 30,05% Memory free
2,40 Gb Paging File | 1,70 Gb Available in Paging File | 70,77% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57,10 Gb Total Space | 29,04 Gb Free Space | 50,86% Space Free | Partition Type: NTFS
Drive D: | 37,27 Gb Total Space | 1,82 Gb Free Space | 4,88% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 26,44 Gb Free Space | 54,14% Space Free | Partition Type: NTFS
Drive F: | 175,78 Gb Total Space | 4,34 Gb Free Space | 2,47% Space Free | Partition Type: NTFS
Drive G: | 62,95 Gb Total Space | 1,96 Gb Free Space | 3,11% Space Free | Partition Type: NTFS
Drive I: | 3,76 Gb Total Space | 3,75 Gb Free Space | 99,86% Space Free | Partition Type: FAT32
Computer Name: KRZYSIEK | User Name: Dom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2011-11-01 22:49:33 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\FORUM\OTL\OTL.exe
PRC - [2011-09-04 21:53:12 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011-04-24 22:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
PRC - [2011-04-24 22:12:42 | 000,131,472 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
PRC - [2011-01-23 19:00:23 | 000,148,280 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\ezprint.exe
PRC - [2011-01-23 19:00:20 | 000,770,728 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebmon.exe
PRC - [2010-10-28 01:11:28 | 003,792,943 | ---- | M] (FreeDownloadManager.ORG) -- C:\Program Files\Free Download Manager\fdm.exe
PRC - [2010-06-17 06:55:00 | 003,680,568 | ---- | M] (Ghisler Software GmbH) -- C:\totalcmd\TOTALCMD.EXE
PRC - [2010-06-14 15:10:32 | 000,153,672 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Gaming Software\LWEMon.exe
PRC - [2010-04-14 13:56:01 | 000,598,696 | ---- | M] ( ) -- C:\WINDOWS\system32\lxebcoms.exe
PRC - [2010-03-25 18:42:36 | 000,388,096 | ---- | M] (Trend Micro Inc.) -- F:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
PRC - [2010-01-21 23:47:36 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009-03-09 11:45:22 | 001,662,976 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\Ralink\Common\RaUI.exe
PRC - [2008-09-05 09:23:20 | 000,075,040 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
PRC - [2007-10-23 13:19:06 | 001,410,344 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007-10-23 13:18:46 | 000,202,024 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2002-07-02 16:56:00 | 000,024,576 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTHELPER.EXE
[color=#E56717]========== Modules (No Company Name) ==========[/color]
MOD - [2011-10-30 09:37:17 | 008,522,400 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011-10-17 09:07:21 | 011,800,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\60df958ca96c9b8945f836759b6abd34\System.Web.ni.dll
MOD - [2011-10-17 09:05:14 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll
MOD - [2011-10-17 09:04:11 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d86a3346c3d90ff12d0df9d7726f3ece\Accessibility.ni.dll
MOD - [2011-10-17 09:02:45 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll
MOD - [2011-10-17 09:02:38 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll
MOD - [2011-10-17 09:02:15 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll
MOD - [2011-10-17 08:59:24 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll
MOD - [2011-10-17 08:58:39 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011-10-14 20:49:48 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2011-09-05 18:05:04 | 000,300,544 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.POL
MOD - [2011-09-04 21:53:11 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011-04-24 22:13:30 | 007,008,656 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtgui4.dll
MOD - [2011-04-24 22:13:28 | 000,192,912 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtsql4.dll
MOD - [2011-04-24 22:13:26 | 001,270,160 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtscript4.dll
MOD - [2011-04-24 22:13:26 | 000,758,160 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtnetwork4.dll
MOD - [2011-04-24 22:13:24 | 002,118,032 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtcore4.dll
MOD - [2011-04-24 22:13:24 | 002,089,360 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\qtdeclarative4.dll
MOD - [2011-04-20 18:56:28 | 000,025,088 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll
MOD - [2011-03-08 23:45:10 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011-01-23 19:00:23 | 000,148,280 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\ezprint.exe
MOD - [2011-01-23 19:00:20 | 000,770,728 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebmon.exe
MOD - [2010-09-08 17:12:12 | 000,143,360 | ---- | M] () -- C:\Program Files\Free Download Manager\iefdm2.dll
MOD - [2010-04-05 04:56:07 | 000,716,954 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\epwizard.dll
MOD - [2010-04-05 04:55:15 | 000,159,890 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\customui.dll
MOD - [2010-04-05 04:55:04 | 000,061,604 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\epfunct.dll
MOD - [2010-04-05 04:54:59 | 000,123,033 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\eputil.dll
MOD - [2010-04-05 04:54:52 | 000,143,502 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\imagutil.dll
MOD - [2010-04-01 11:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebdrs.dll
MOD - [2010-04-01 11:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebscw.dll
MOD - [2010-03-16 12:22:12 | 000,014,848 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll
MOD - [2009-11-04 07:14:38 | 000,165,376 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxebdrui.dll
MOD - [2009-11-04 07:14:19 | 000,157,696 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxebdrpp.dll
MOD - [2009-11-04 07:14:06 | 000,236,032 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxebdr.dll
MOD - [2009-06-23 05:11:11 | 000,094,208 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\epoemdll.dll
MOD - [2009-06-23 05:10:44 | 000,049,152 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\epstring.dll
MOD - [2009-06-23 05:09:46 | 002,203,648 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\epwizres.dll
MOD - [2009-06-07 18:44:02 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxebprpr.dll
MOD - [2009-05-27 06:16:50 | 000,192,512 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxebdatr.dll
MOD - [2009-05-18 07:29:08 | 000,819,200 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxebptpc.dll
MOD - [2009-04-28 01:56:40 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\LXEBsmr.dll
MOD - [2009-04-07 13:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\iptk.dll
MOD - [2009-03-09 23:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebcaps.dll
MOD - [2009-03-02 08:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files\Lexmark Pro200-S500 Series\lxebptp.dll
MOD - [2009-02-20 02:48:03 | 000,299,008 | ---- | M] () -- C:\WINDOWS\system32\LXEBsm.dll
MOD - [2007-12-06 04:50:44 | 000,401,408 | ---- | M] () -- C:\Program Files\Free Download Manager\FUM\fumcore.dll
MOD - [2007-11-28 03:32:00 | 001,163,264 | ---- | M] () -- C:\Program Files\Ralink\Common\acAuth.dll
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011-06-29 14:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011-04-24 22:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe -- (AVP)
SRV - [2010-04-14 13:56:01 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxebcoms.exe -- (lxeb_device)
SRV - [2010-04-14 13:55:54 | 000,193,192 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxebserv.exe -- (lxebCATSCustConnectService)
SRV - [2009-08-10 12:34:40 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2008-09-05 09:23:20 | 000,075,040 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe -- (RalinkRegistryWriter)
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV - [2011-04-20 13:50:22 | 000,565,552 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2011-03-10 17:34:46 | 000,034,608 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2011-03-09 10:13:30 | 006,553,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011-03-04 12:23:20 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)
DRV - [2011-03-04 12:23:14 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\kl1.sys -- (KL1)
DRV - [2010-04-27 15:57:28 | 000,066,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)
DRV - [2010-04-27 15:57:28 | 000,015,048 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)
DRV - [2010-04-27 15:57:24 | 000,031,816 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmHidLo.sys -- (WmHidLo)
DRV - [2010-04-27 15:57:22 | 000,022,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)
DRV - [2010-04-27 13:01:26 | 000,037,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)
DRV - [2010-01-21 23:47:36 | 000,215,856 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\Si3132r5.sys -- (Si3132r5)
DRV - [2010-01-21 23:47:36 | 000,212,520 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\Si3531.sys -- (Si3531)
DRV - [2010-01-21 23:47:36 | 000,195,072 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\Si3114r5.sys -- (Si3114r5)
DRV - [2010-01-21 23:47:36 | 000,074,672 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\si3132.sys -- (Si3132)
DRV - [2010-01-21 23:47:36 | 000,069,248 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\si3124.sys -- (Si3124)
DRV - [2010-01-21 23:47:36 | 000,062,336 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112)
DRV - [2009-11-02 19:27:24 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009-08-07 22:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\WNt500x86\sandra.sys -- (SANDRA)
DRV - [2009-03-04 16:30:14 | 000,709,248 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)
DRV - [2008-08-07 13:42:36 | 000,016,512 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RAPIProtocol.sys -- (RAPIProtocol)
DRV - [2008-04-13 22:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2002-12-17 07:41:10 | 000,076,288 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2002-09-16 16:14:32 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv)
DRV - [2002-07-24 12:52:26 | 000,998,004 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)
DRV - [2002-07-19 09:48:32 | 000,156,604 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)
DRV - [2002-07-19 09:48:22 | 000,213,860 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2002-07-19 09:48:08 | 000,011,068 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV - [2002-07-19 09:48:04 | 000,195,432 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2002-07-19 09:47:52 | 000,837,548 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
DRV - [2002-07-19 09:46:28 | 000,127,948 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)
DRV - [2001-08-17 20:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Sterownik Creative SoundFont Manager (WDM)
DRV - [2001-08-17 20:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Sterownik Creative Interface Manager (WDM)
DRV - [2001-08-17 20:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001-08-17 20:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
DRV - [1999-12-17 00:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\PFMODNT.SYS -- (PfModNT)
DRV - [1997-12-23 02:02:46 | 000,023,936 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\aspi32.sys -- (Aspi32)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1708537768-329068152-1606980848-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1708537768-329068152-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[color=#E56717]========== FireFox ==========[/color]
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?l=dis&o=14597"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2011-10-08 21:55:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2011-10-08 21:55:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\linkfilter@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2011-10-08 21:55:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-09-04 21:53:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-09-15 20:36:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011-08-30 20:15:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2011-04-13 21:13:04 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dom\Dane aplikacji\Mozilla\Extensions
[2011-10-25 08:32:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\5e230u4y.default\extensions
[2011-10-25 08:32:38 | 000,000,000 | ---D | M] (Download Youtube Videos +) -- C:\Documents and Settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\5e230u4y.default\extensions\video.downloader.plugin@ffpimp.com
[2011-10-10 17:21:28 | 000,002,410 | ---- | M] () -- C:\Documents and Settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\5e230u4y.default\searchplugins\s-amazon.xml
[2011-10-20 19:07:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011-04-15 22:39:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011-07-03 13:25:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011-10-20 19:07:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011-04-13 22:03:31 | 000,000,000 | ---D | M] (Blokowanie banerów) -- C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak
[2011-04-13 22:03:29 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak
() (No name found) -- C:\DOCUMENTS AND SETTINGS\DOM\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\5E230U4Y.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
() (No name found) -- C:\DOCUMENTS AND SETTINGS\DOM\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\5E230U4Y.DEFAULT\EXTENSIONS\BRIEF@MOZDEV.ORG.XPI
() (No name found) -- C:\DOCUMENTS AND SETTINGS\DOM\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\5E230U4Y.DEFAULT\EXTENSIONS\IPLEXTOALL@ALLPLAYER.ORG.XPI
[2011-04-15 22:38:57 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011-10-08 21:55:09 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2012\FFEXT\KAVANTIBANNER@KASPERSKY.RU
[2011-10-08 21:55:10 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2012\FFEXT\LINKFILTER@KASPERSKY.RU
[2011-10-08 21:55:11 | 000,000,000 | ---D | M] (Kaspersky Virtual Keyboard) -- C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2012\FFEXT\VIRTUALKEYBOARD@KASPERSKY.RU
[2011-04-18 14:09:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011-09-04 21:53:12 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011-10-03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011-03-22 19:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010-01-01 09:00:00 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2010-01-01 09:00:00 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2010-01-01 09:00:00 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2010-01-01 09:00:00 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2010-01-01 09:00:00 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2010-01-01 09:00:00 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml
O1 HOSTS File: ([2011-04-19 22:05:25 | 000,000,774 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKU\S-1-5-21-1708537768-329068152-1606980848-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark Pro200-S500 Series\ezprint.exe ()
O4 - HKLM..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe ()
O4 - HKLM..\Run: [lxebmon.exe] C:\Program Files\Lexmark Pro200-S500 Series\lxebmon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WINDVDPatch] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKU\S-1-5-21-1708537768-329068152-1606980848-1003..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe ()
O4 - HKU\S-1-5-21-1708537768-329068152-1606980848-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk = C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1708537768-329068152-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Pobierz w Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O9 - Extra Button: &Klawiatura wirtualna - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Sprawdzanie adresów internetowych - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1302724941531 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{52849768-654B-4ACD-8BBB-443FD48E687B}: DhcpNameServer = 62.179.1.63 62.179.1.62
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011-04-13 20:30:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008-08-03 22:33:34 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2011-11-01 22:39:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dom\Menu Start\Programy\HiJackThis
[2011-10-30 21:37:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\CCleaner
[2011-10-30 21:37:16 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011-10-30 21:29:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Hitman Pro
[2011-10-20 19:19:20 | 000,348,672 | ---- | C] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVSplitter.ax
[2011-10-20 19:19:19 | 000,429,056 | ---- | C] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVVideo.ax
[2011-10-20 19:19:17 | 000,206,336 | ---- | C] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVAudio.ax
[2011-10-20 19:07:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011-10-20 19:07:27 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011-10-20 19:07:27 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011-10-20 19:07:27 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011-10-14 19:03:34 | 000,000,000 | ---D | C] -- C:\KOSMOS
[2011-10-14 18:52:23 | 000,000,000 | ---D | C] -- C:\Filmy
[2011-04-15 20:25:00 | 000,442,368 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebcoin.dll
[2011-04-15 20:23:44 | 001,048,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebserv.dll
[2011-04-15 20:23:44 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebusb1.dll
[2011-04-15 20:23:44 | 000,688,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebhbn3.dll
[2011-04-15 20:23:44 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebpmui.dll
[2011-04-15 20:23:44 | 000,577,536 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeblmpm.dll
[2011-04-15 20:23:44 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebinpa.dll
[2011-04-15 20:23:44 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\LXEBhcp.dll
[2011-04-15 20:23:44 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebiesc.dll
[2011-04-15 20:23:44 | 000,324,264 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebih.exe
[2011-04-15 20:23:43 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebcomc.dll
[2011-04-15 20:23:43 | 000,598,696 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebcoms.exe
[2011-04-15 20:23:43 | 000,373,416 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebcfg.exe
[2011-04-15 20:23:43 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\lxebcomm.dll
[3 C:\Documents and Settings\All Users\Dane aplikacji\*.tmp files -> C:\Documents and Settings\All Users\Dane aplikacji\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2011-11-01 22:39:20 | 000,001,976 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\HiJackThis.lnk
[2011-11-01 21:22:36 | 003,374,301 | ---- | M] () -- C:\WINDOWS\{00000002-00000000-00000002-00001102-00000002-80641102}.CDF
[2011-11-01 21:22:36 | 003,374,301 | ---- | M] () -- C:\WINDOWS\{00000002-00000000-00000002-00001102-00000002-80641102}.BAK
[2011-11-01 21:22:21 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011-11-01 21:22:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011-10-31 23:27:25 | 000,029,208 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000002-00001102-00000002-80641102}.rfx
[2011-10-31 23:27:25 | 000,029,208 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000002-00001102-00000002-80641102}.rfx
[2011-10-31 23:27:25 | 000,017,012 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000002-00001102-00000002-80641102}.rfx
[2011-10-31 23:27:25 | 000,017,012 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000002-00000000-00000002-00001102-00000002-80641102}.rfx
[2011-10-31 23:27:25 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2011-10-31 23:27:25 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
[2011-10-31 23:27:25 | 000,000,024 | ---- | M] () -- C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000002-80641102}.dat
[2011-10-31 23:27:25 | 000,000,024 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000002-80641102}.dat
[2011-10-31 20:39:42 | 000,002,513 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\Microsoft Office Word 2007.lnk
[2011-10-30 21:41:37 | 000,000,788 | ---- | M] () -- C:\reg_backup.reg
[2011-10-30 21:29:35 | 000,023,624 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011-10-30 21:13:43 | 000,155,445 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\GetSystemInfo_KRZYSIEK_Dom_2011_10_30_21_11_05.zip
[2011-10-30 09:37:18 | 000,493,924 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2011-10-30 09:37:18 | 000,435,552 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011-10-30 09:37:18 | 000,085,208 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2011-10-30 09:37:18 | 000,068,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011-10-30 09:37:17 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011-10-20 19:29:53 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011-10-20 19:29:51 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-10-20 19:20:39 | 000,000,694 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\ALLPlayer V4.7.lnk
[2011-10-20 19:19:20 | 000,348,672 | ---- | M] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVSplitter.ax
[2011-10-20 19:19:19 | 000,429,056 | ---- | M] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVVideo.ax
[2011-10-20 19:19:17 | 000,206,336 | ---- | M] (1f0.de - Hendrik Leppkes) -- C:\WINDOWS\System32\LAVAudio.ax
[2011-10-20 19:19:16 | 000,215,296 | ---- | M] () -- C:\WINDOWS\System32\avutil-lav-51.dll
[2011-10-20 19:19:15 | 000,933,098 | ---- | M] () -- C:\WINDOWS\System32\avformat-lav-53.dll
[2011-10-20 19:19:14 | 005,616,084 | ---- | M] () -- C:\WINDOWS\System32\avcodec-lav-53.dll
[2011-10-20 19:19:08 | 000,161,280 | ---- | M] () -- C:\WINDOWS\System32\libbluray.dll
[2011-10-20 19:19:07 | 000,335,239 | ---- | M] () -- C:\WINDOWS\System32\swscale-lav-2.dll
[2011-10-17 08:57:57 | 000,273,376 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011-10-14 20:45:31 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011-10-08 21:53:25 | 000,513,234 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\w2 001.jpg
[2011-10-08 21:53:23 | 001,250,026 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\w1 001.jpg
[2011-10-08 21:53:22 | 001,549,486 | ---- | M] () -- C:\Documents and Settings\Dom\Pulpit\wyrys dzialki 001.jpg
[2011-10-03 14:14:09 | 000,000,016 | -H-- | M] () -- C:\WINDOWS\System32\servdat.slm
[2011-10-03 14:12:44 | 000,000,219 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.tgz
[2011-10-03 14:12:44 | 000,000,205 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.dll
[2011-10-03 14:12:44 | 000,000,014 | ---- | M] () -- C:\WINDOWS\System32\ssprs.tgz
[2011-10-03 09:30:24 | 005,972,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2011-10-03 04:06:16 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011-10-03 04:06:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011-10-03 04:06:14 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011-10-03 04:06:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011-10-03 01:37:52 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[3 C:\Documents and Settings\All Users\Dane aplikacji\*.tmp files -> C:\Documents and Settings\All Users\Dane aplikacji\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2011-11-01 22:39:20 | 000,001,976 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\HiJackThis.lnk
[2011-10-30 21:39:15 | 000,000,788 | ---- | C] () -- C:\reg_backup.reg
[2011-10-30 21:29:35 | 000,023,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011-10-30 21:11:38 | 000,155,445 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\GetSystemInfo_KRZYSIEK_Dom_2011_10_30_21_11_05.zip
[2011-10-20 19:20:39 | 000,000,694 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\ALLPlayer V4.7.lnk
[2011-10-20 19:19:16 | 000,215,296 | ---- | C] () -- C:\WINDOWS\System32\avutil-lav-51.dll
[2011-10-20 19:19:15 | 000,933,098 | ---- | C] () -- C:\WINDOWS\System32\avformat-lav-53.dll
[2011-10-20 19:19:13 | 005,616,084 | ---- | C] () -- C:\WINDOWS\System32\avcodec-lav-53.dll
[2011-10-20 19:19:08 | 000,161,280 | ---- | C] () -- C:\WINDOWS\System32\libbluray.dll
[2011-10-20 19:19:07 | 000,335,239 | ---- | C] () -- C:\WINDOWS\System32\swscale-lav-2.dll
[2011-10-08 21:53:24 | 000,513,234 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\w2 001.jpg
[2011-10-08 21:53:22 | 001,250,026 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\w1 001.jpg
[2011-10-08 21:53:20 | 001,549,486 | ---- | C] () -- C:\Documents and Settings\Dom\Pulpit\wyrys dzialki 001.jpg
[2011-09-10 15:15:40 | 000,017,408 | ---- | C] () -- C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\WebpageIcons.db
[2011-08-30 20:50:28 | 012,824,576 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\sandra.mda
[2011-06-16 21:33:22 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011-04-19 21:38:35 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2011-04-19 21:38:35 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2011-04-19 21:38:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2011-04-19 21:38:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
[2011-04-19 21:38:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
[2011-04-19 21:38:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
[2011-04-19 21:26:40 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2011-04-19 21:26:40 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2011-04-19 21:20:57 | 000,723,981 | ---- | C] () -- C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\unins000.exe
[2011-04-19 21:20:57 | 000,002,159 | ---- | C] () -- C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\unins000.dat
[2011-04-16 14:23:23 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\Dom\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-04-15 22:19:39 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2011-04-15 22:00:12 | 000,207,360 | ---- | C] () -- C:\WINDOWS\System32\evrprop.dll
[2011-04-15 21:59:47 | 000,080,384 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2011-04-15 21:59:46 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2011-04-15 21:53:40 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011-04-15 21:49:51 | 000,644,608 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011-04-15 21:49:51 | 000,258,048 | ---- | C] () -- C:\WINDOWS\System32\libFLAC.dll
[2011-04-15 20:25:02 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxebvs.dll
[2011-04-15 20:24:57 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxebcui.dll
[2011-04-15 20:24:57 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\lxebcuir.dll
[2011-04-15 20:24:57 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\lxebgcfg.dll
[2011-04-15 20:23:44 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\LXEBinst.dll
[2011-04-15 20:23:44 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\lxebins.dll
[2011-04-15 20:23:44 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\lxebinsb.dll
[2011-04-15 20:23:44 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\lxebcu.dll
[2011-04-15 20:23:44 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxebgrd.dll
[2011-04-15 20:23:44 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\lxebinsr.dll
[2011-04-15 20:23:44 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\lxebcub.dll
[2011-04-15 20:23:44 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\lxebjswr.dll
[2011-04-15 20:23:44 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxebcur.dll
[2011-04-13 22:24:15 | 000,000,024 | ---- | C] () -- C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000002-80641102}.dat
[2011-04-13 22:24:15 | 000,000,024 | ---- | C] () -- C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000002-80641102}.dat
[2011-04-13 22:22:10 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011-04-13 22:18:56 | 000,273,376 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011-04-13 22:10:05 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\LXEBsmr.dll
[2011-04-13 22:10:04 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\LXEBsm.dll
[2011-04-13 22:03:19 | 000,115,369 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2011-04-13 22:03:19 | 000,097,961 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2011-04-13 21:17:41 | 000,000,066 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2011-04-13 21:17:40 | 001,048,576 | ---- | C] () -- C:\WINDOWS\System32\SFMAN.DAT
[2011-04-13 21:17:40 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
[2011-04-13 21:17:23 | 000,037,727 | ---- | C] () -- C:\WINDOWS\System32\Emu10kx.ini
[2011-04-13 21:17:23 | 000,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2011-04-13 21:17:22 | 000,184,320 | ---- | C] () -- C:\WINDOWS\PSCONV.EXE
[2011-04-13 21:17:22 | 000,179,669 | ---- | C] () -- C:\WINDOWS\System32\ctstatic.dat
[2011-04-13 21:17:22 | 000,164,044 | ---- | C] () -- C:\WINDOWS\System32\ctdlang.dat
[2011-04-13 21:17:22 | 000,113,373 | ---- | C] () -- C:\WINDOWS\System32\ctbasicw.dat
[2011-04-13 21:17:22 | 000,113,273 | ---- | C] () -- C:\WINDOWS\System32\CTBAS2W.DAT
[2011-04-13 21:17:22 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\KILLAPPS.EXE
[2011-04-13 21:17:22 | 000,044,055 | ---- | C] () -- C:\WINDOWS\System32\ctdaught.dat
[2011-04-13 21:17:22 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\REGPLIB.EXE
[2011-04-13 21:17:22 | 000,000,180 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI
[2011-04-13 21:13:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011-04-13 20:46:42 | 000,013,931 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2011-04-13 20:38:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011-04-13 20:38:40 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011-04-13 20:38:40 | 000,227,586 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011-04-13 20:38:40 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011-04-13 20:33:18 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011-04-13 20:27:44 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011-03-21 18:56:22 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2010-01-21 23:47:36 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010-01-21 23:47:36 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010-01-21 23:47:36 | 000,493,924 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat
[2010-01-21 23:47:36 | 000,435,552 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2010-01-21 23:47:36 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat
[2010-01-21 23:47:36 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010-01-21 23:47:36 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010-01-21 23:47:36 | 000,085,208 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat
[2010-01-21 23:47:36 | 000,068,448 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2010-01-21 23:47:36 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010-01-21 23:47:36 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat
[2010-01-21 23:47:36 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010-01-21 23:47:36 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010-01-21 23:47:36 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010-01-21 23:47:36 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010-01-21 23:47:36 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2009-09-09 17:01:40 | 000,029,763 | ---- | C] () -- C:\WINDOWS\System32\drivers\klopp.dat
[color=#E56717]========== LOP Check ==========[/color]
[2011-04-19 21:43:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
[2011-04-19 20:53:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\FreeDownloadManager.ORG
[2011-10-30 21:33:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Hitman Pro
[2011-05-25 13:11:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Juniper Networks
[2011-06-01 10:35:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Lexmark Pro200-S500 Series
[2011-04-13 20:46:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ralink Driver
[2011-04-19 21:28:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SafeNet Sentinel
[2011-04-19 21:27:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SPSS
[2011-06-08 13:20:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Thomson.ResearchSoft.Installers
[2011-06-25 20:41:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\ACD Systems
[2011-09-29 09:15:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\EndNote
[2011-11-01 22:59:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\Free Download Manager
[2011-04-15 20:37:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\GHISLER
[2011-10-24 11:14:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\Juniper Networks
[2011-08-30 20:15:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dom\Dane aplikacji\Thunderbird
[color=#E56717]========== Purity Check ==========[/color]
< End of report >
OTL extras
- Kod: Zaznacz wszystko
OTL Extras logfile created on: 2011-11-01 22:53:36 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\FORUM\OTL
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
1022,79 Mb Total Physical Memory | 307,36 Mb Available Physical Memory | 30,05% Memory free
2,40 Gb Paging File | 1,70 Gb Available in Paging File | 70,77% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57,10 Gb Total Space | 29,04 Gb Free Space | 50,86% Space Free | Partition Type: NTFS
Drive D: | 37,27 Gb Total Space | 1,82 Gb Free Space | 4,88% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 26,44 Gb Free Space | 54,14% Space Free | Partition Type: NTFS
Drive F: | 175,78 Gb Total Space | 4,34 Gb Free Space | 2,47% Space Free | Partition Type: NTFS
Drive G: | 62,95 Gb Total Space | 1,96 Gb Free Space | 3,11% Space Free | Partition Type: NTFS
Drive I: | 3,76 Gb Total Space | 3,75 Gb Free Space | 99,86% Space Free | Partition Type: FAT32
Computer Name: KRZYSIEK | User Name: Dom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
[color=#E56717]========== File Associations ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_USERS\S-1-5-21-1708537768-329068152-1606980848-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[color=#E56717]========== Shell Spawning ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee 11.0.Browse] -- "C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" "%1" (ACD Systems)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[color=#E56717]========== Security Center Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[color=#E56717]========== System Restore Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
[color=#E56717]========== Firewall Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[color=#E56717]========== Authorized Applications List ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\lxebcoms.exe" = C:\WINDOWS\system32\lxebcoms.exe:*:Enabled:Pro200-S500 Series Server -- ( )
"D:\ASIA\SPSS\statistics.exe" = D:\ASIA\SPSS\statistics.exe:*:Disabled:Statistics17:exe -- (SPSS Inc)
"D:\ASIA\SPSS\statistics.com" = D:\ASIA\SPSS\statistics.com:*:Disabled:Statistics17:com -- (SPSS Inc)
"D:\ASIA\SPSS\SPSSWinWrapIDE.exe" = D:\ASIA\SPSS\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor -- (SPSS Inc.)
"C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\RpcAgentSrv.exe" = C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service -- (SiSoftware)
"C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\WNt500x86\RpcSandraSrv.exe" = C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2010.SP2\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service -- (SiSoftware)
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0297C87B-CC40-446F-865A-031B4FC0CF22}" = ToCA Race Driver 3
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 29
"{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}" = Ralink RT2870 Wireless LAN Card
"{300578F9-9EFF-4B93-9AB1-C0E5707EF463}" = ACDSee Photo Manager 2009
"{32FEA42D-3A59-49D9-8A2F-A3E2D8E663DF}" = SPSS SmartViewer 15.0
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3E5CBADD-2E51-47C1-BBE2-B802DB6DA56A}" = MetaTrader Admiral Markets AS 4.00
"{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}" = Sound Blaster Live! Web 2K/XP
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012
"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5758F1B9-E911-A4DC-F32E-3183A3EAA2CD}" = ccc-utility
"{5CB817DC-E5B1-5111-1ECA-2D9F8E6134BB}" = CCC Help English
"{5F3A7E60-BDB4-288C-A1A4-F8825D9DBBA6}" = Catalyst Control Center InstallProxy
"{60D32CDC-E3BE-4578-BA10-29322307CDDC}" = Logitech Gaming Software 5.10
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7CBD8A89-45F4-4203-9923-673F72603747}" = Adobe Photoshop Lightroom 2.3
"{81BF6353-3C5B-4E6E-A566-7E162A00BF72}_is1" = Wtyczka e-Deklaracje
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86B3F2D6-AC2B-0014-8AE1-F2F77F781B0C}" = EndNote X4
"{88589E19-665C-4575-A4A0-CE9C43C51045}" = Nero 8
"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12
"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007
"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007
"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007
"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007
"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007
"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007
"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007
"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007
"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007
"{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1045-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Polish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Professional Business 2010.SP2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{E5810CC7-4D59-FA3E-5CFD-0C28CB40F949}" = Catalyst Control Center
"{E8E27E0D-7A44-AF39-7D75-DC0C9C615A14}" = Catalyst Control Center Localization All
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.217
"{F3E15CDA-BD74-CD08-B286-A19E1B1A0647}" = Catalyst Control Center Graphics Previews Common
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALLPlayer_is1" = ALLPlayer V4.X
"BSPlayer1" = BSPlayer
"CCleaner" = CCleaner
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ffdshow_is1" = ffdshow v1.1.3984 [2011-09-22]
"FormatFactory" = FormatFactory 2.70
"Free Download Manager_is1" = Free Download Manager 3.5 RC
"HaaliMkx" = Haali Media Splitter
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012
"Lexmark Pro200-S500 Series" = Lexmark Pro200-S500 Series
"Matroska Pack" = Matroska Pack
"MatroskaProp" = MatroskaProp (remove only)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 6.0.1 (x86 pl)" = Mozilla Firefox 6.0.1 (x86 pl)
"Mozilla Thunderbird (7.0.1)" = Mozilla Thunderbird (7.0.1)
"PowerDVD" = PowerDVD
"Product_Name" = Planit Millennium II
"Rainbow Sentinel Driver" = Sentinel System Driver
"RealAlt_is1" = Real Alternative 1.9.0 Lite
"ResearchSoft Direct Export Helper" = ResearchSoft Direct Export Helper
"Totalcmd" = Total Commander (Remove or Repair)
"Winamp" = Winamp
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-21-1708537768-329068152-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CGoban 3" = CGoban 3
"JForex Client" = JForex Client
"Winamp Detect" = Detektor Winampa
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
[ Application Events ]
Error - 2011-09-22 15:46:40 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-22 15:46:55 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-22 15:47:58 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-22 15:48:09 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-22 16:34:45 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-22 16:34:47 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca AcroRd32.exe, wersja 10.1.1.33, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-09-27 05:00:37 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca firefox.exe, wersja 6.0.1.4259, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2011-10-10 07:25:08 | Computer Name = KRZYSIEK | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd acrord32.exe, wersja 10.1.1.33, moduł powodujący
błąd acrord32.dll, wersja 10.1.1.33, adres błędu 0x000218f8.
Error - 2011-10-17 06:51:46 | Computer Name = KRZYSIEK | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd acrord32.exe, wersja 10.1.1.33, moduł powodujący
błąd acrord32.dll, wersja 10.1.1.33, adres błędu 0x000218f8.
Error - 2011-10-30 16:36:41 | Computer Name = KRZYSIEK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca TOTALCMD.EXE, wersja 7.5.5.0, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
[ System Events ]
Error - 2011-10-30 16:04:47 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi lxebCATSCustConnectService z powodu następującego
błędu: %%1053
Error - 2011-10-30 16:07:17 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą lxebCATSCustConnectService.
Error - 2011-10-30 16:07:17 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi lxebCATSCustConnectService z powodu następującego
błędu: %%1053
Error - 2011-10-30 16:34:01 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Hitman Pro 3.5 Crusader z powodu następującego
błędu: %%2
Error - 2011-10-31 04:19:47 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą lxebCATSCustConnectService.
Error - 2011-10-31 04:19:47 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi lxebCATSCustConnectService z powodu następującego
błędu: %%1053
Error - 2011-10-31 11:57:29 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą lxebCATSCustConnectService.
Error - 2011-10-31 11:57:29 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi lxebCATSCustConnectService z powodu następującego
błędu: %%1053
Error - 2011-11-01 16:22:27 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą lxebCATSCustConnectService.
Error - 2011-11-01 16:22:27 | Computer Name = KRZYSIEK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi lxebCATSCustConnectService z powodu następującego
błędu: %%1053
< End of report >
GMER
- Kod: Zaznacz wszystko
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-01 23:39:33
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T1L0-20 ST3250824A rev.3.AAE
Running: vb13ht25.exe; Driver: C:\DOCUME~1\Dom\USTAWI~1\Temp\kxloqpob.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xAE6A7FBA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xAE6A88B4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xAE6C1AEE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xAE6A8E26]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xAE6A8D14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xAE6C1E06]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateProcess [0xAE6A9056]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateProcessEx [0xAE6A921E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xAE6A7D76]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xAE6A8F3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xAE6C3110]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xAE6A85E6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xAE6C1ECE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xAE6A953C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xAE6BC084]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xAE6BD88E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xAE6A88F6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xAE6AA53C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xAE6BD088]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xAE6BDA38]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xAE6A962E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xAE6BCBC0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xAE6BCE1C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xAE6A9B9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xAE6C030A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xAE6A8EB8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xAE6A8DA0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xAE6A81F4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xAE6A997E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xAE6A8FD0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xAE6A80E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwPlugPlayControl [0xAE6C3120]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xAE6BBEB8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xAE6BD698]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryObject [0xAE6C0500]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xAE6A9EC0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xAE6BD488]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xAE6A97CE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xAE6BC198]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xAE6BC80C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xAE6C2048]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xAE6C1F96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xAE6C20B4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xAE6BCA14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xAE6AA3DE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xAE6BC33E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKeyEx [0xAE6BC4D4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveMergedKeys [0xAE6BC670]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xAE6C1C76]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xAE6A8756]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xAE6A93E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xAE6AA010]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xAE6BD248]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xAE6AA104]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xAE6AA23E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xAE6A945E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xAE6A8392]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xAE6A82EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xAE6A9D78]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xAE6A847C]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!ZwYieldExecution + 12E 804E4988 12 Bytes [06, 1E, 6C, AE, 56, 90, 6A, ...] {PUSH ES; PUSH DS; INSB ; SCASB ; PUSH ESI; NOP ; PUSH -0x52; PUSH DS; XCHG EDX, EAX; PUSH -0x52}
.text ntoskrnl.exe!ZwYieldExecution + 13E 804E4998 16 Bytes [76, 7D, 6A, AE, 3E, 8F, 6A, ...]
.text ntoskrnl.exe!ZwYieldExecution + 1FA 804E4A54 12 Bytes [2E, 96, 6A, AE, C0, CB, 6B, ...]
.text ntoskrnl.exe!ZwYieldExecution + 276 804E4AD0 4 Bytes [E8, 80, 6A, AE]
.text ntoskrnl.exe!ZwYieldExecution + 376 804E4BD0 16 Bytes [98, C1, 6B, AE, 0C, C8, 6B, ...] {CWDE ; SHR DWORD [EBX-0x52], 0xc; ENTER 0xae6b, 0x48; AND [ESI+EBP*4-0x6a], CH; POP DS; INSB ; SCASB }
.text ...
.text ntoskrnl.exe!IoIsOperationSynchronous 804EAFCE 5 Bytes JMP AE69ADCC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804F45B3 5 Bytes JMP AE69A9F0 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF5ABF000, 0x2A556C, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[632] USER32.dll!SetWindowLongA 7E37C29D 5 Bytes JMP 106AA047 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[632] USER32.dll!SetWindowLongW 7E37C2BB 5 Bytes JMP 106A9FD9 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[632] USER32.dll!GetWindowInfo 7E37C49C 5 Bytes JMP 104B1B87 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[632] USER32.dll!TrackPopupMenu 7E3B531E 5 Bytes JMP 104B2155 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[792] ntdll.dll!LdrLoadDll 7C915C35 5 Bytes JMP 00401410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 6AC91765 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ushata.dll (Ushata module/Kaspersky Lab ZAO)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] USER32.dll!AlignRects 7E362A78 4 Bytes [E0, 13, 54, 67]
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 6AC91765 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ushata.dll (Ushata module/Kaspersky Lab ZAO)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] USER32.dll!AlignRects 7E362A78 4 Bytes [E0, 13, 54, 67]
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\ipsec.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [F6F79DC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [F6F79DC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\mouhid.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\mrxdav.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\kbdhid.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\USBSTOR.SYS[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice] [F6F79C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 7DFF058C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 7DFF05F8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 7DFF0664
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF06D0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF0370
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1368] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 7DFF058C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 7DFF05F8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 7DFF0664
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF06D0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF0370
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1760] @ C:\WINDOWS\system32\SAMLIB.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk2\DR2 malicious Win32:MBRoot code @ sector 61
Disk \Device\Harddisk2\DR2 PE file @ sector 488392065
---- EOF - GMER 1.0.15 ----
