prosze o sprawdzenie loga

[Raider]

Witam, Avast dal mi dziś znać ze mam cos takiego

C:\WINDOWS\system32\Drivers\mchInjDrv.sys

Niby usuwa to cos ale przy każdym następnym włączeniu komputera znowu sie pojawia komunikat o tym. Czy jest jakaś możliwość pozbycia sie tego?

Logfile of HijackThis v1.99.1
Scan saved at 11:07:03, on 2007-09-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Alwil Software\Avast4\aswUpdSv.exe
D:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
D:\Alwil Software\Avast4\ashMaiSv.exe
D:\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
D:\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Mozilla\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Prabek82\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [RemoteControl] D:\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\AQQ\AQQ.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

[Red]

Zastosuj:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

po czynności wklej wynik z combo na forum...

dodatkowo zastosuj:

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Uruchom komputer w trybie awaryjnym .

Uruchom SDFix, a jak się wypakuje do C:\SDFix dwuklik na plik RunThis.bat. Zatwierdź czyszczenie przez Y. Będzie dezynfekcja i reset kompa.

również daj log do oceny na forum

[Raider]

Combofix

ComboFix 07-09-21.2 - "Prabek82" 2007-09-26 11:50:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.575 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Prabek82\DANEAP~1\macromedia\Flash Player\#SharedObjects\2ES5WN8H\www.broadcaster.com
C:\DOCUME~1\Prabek82\DANEAP~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\Prabek82\DANEAP~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol

.
((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-26 11:49 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-18 08:59 <DIR> d-------- C:\Program Files\Ashampoo
2007-09-11 12:46 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-09-11 12:46 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-09-11 12:46 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-09-11 12:45 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-09-11 12:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-11 12:45 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-08-30 19:44 <DIR> d-------- C:\Program Files\Media Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-26 11:00 5112 --a------ C:\WINDOWS\GPCIDrv.sys
2007-09-26 11:00 19039 --a------ C:\WINDOWS\system32\drivers\GVTDrv.sys
2007-09-26 11:00 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\Skype
2007-09-26 02:12 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\uTorrent
2007-09-25 12:53 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-24 20:27 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-24 20:27 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-24 20:26 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\teamspeak2
2007-09-12 22:40 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-09-06 12:09 801144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-09-06 12:05 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 12:05 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 12:03 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 12:02 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 12:00 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 12:00 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-28 23:07 --------- d-------- C:\Program Files\SkanerOnline
2007-08-21 22:25 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\Gadu-Gadu
2007-08-17 23:05 --------- d-------- C:\Program Files\Common Files\Onet.pl
2007-08-17 23:05 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\Onet
2007-08-17 23:05 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\MozillaControl
2007-08-17 23:05 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\Listonosz
2007-08-17 23:05 --------- d-------- C:\DOCUME~1\Prabek82\DANEAP~1\AutoUpdate
2007-08-17 22:40 --------- d-------- C:\Program Files\Skype
2007-08-17 22:40 --------- d-------- C:\Program Files\Common Files\Skype
2007-08-17 22:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-08-04 22:13 22328 --a------ C:\DOCUME~1\Prabek82\DANEAP~1\PnkBstrK.sys
2007-08-04 22:12 674600 --a------ C:\WINDOWS\system32\pbsvc.exe
2007-08-04 21:35 --------- d-------- C:\Program Files\America's Army
2007-08-04 21:32 --------- d-------- C:\Program Files\America's Army Server Manager
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 13:12 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43]
"nwiz"="nwiz.exe" [2006-08-11 22:43 C:\WINDOWS\system32\nwiz.exe]
"VGAUtil"="C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe" [2006-07-12 16:27]
"RemoteControl"="D:\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43]
"avast!"="D:\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-27 23:50]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" [2006-02-08 16:40]
"Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"AntiSpyWare2Guard"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2007-08-14 09:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"AQQ"="D:\AQQ\AQQ.exe" [2006-05-22 11:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 19:43]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-13 18:55]

R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
R3 GPCIDrv;GPCIDrv;\??\C:\WINDOWS\GPCIDrv.sys
R3 GVTDrv;GVTDrv;\??\C:\WINDOWS\system32\Drivers\GVTDrv.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16ac14ca-2353-11dc-95ea-0040f4719881}]
AutoRun\command- EXPLORER.EXE
explore\Command- EXPLORER.EXE
open\Command- EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e4b9f46-6443-11dc-969f-0040f4719881}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 11:51:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 11:51:59
C:\ComboFix-quarantined-files.txt ... 2007-09-26 11:51
.
--- E O F ---

Sdfix

SDFix: Version 1.107

Run by Prabek82 on 2007-09-26 at 12:20

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\sdfix\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\AQQ\\AQQ.exe"="D:\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ"
"C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-VGA.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-VGA.exe:*:Enabled:Menu"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Onet.pl - Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Mon 10 Sep 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Finished!

Nadal Avast wykrywa to samo ;/ . Troche mnie dziwi ze jak ten Combofix uruchomiłem to Avast traktował go jak trojana, dopóki Combo nie skończył swoich czynności. Czy to normalne? Czy są jeszcze jakieś sposoby na pozbycie się tego?

edit: zapomniałem jeszcze o tym nie wiem czy to coś istotnego ale wrzuce

catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 12:07:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:87c48e0d
"s2"=dword:dc9e73f1
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:fe,76,7a,5b,93,8a,69,94,ee,90,1c,2f,39,07,eb,44,58,dc,c4,f2,bd,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,84,e7,da,66,a5,97,71,1e,64,be,aa,aa,38,e8,55,fe,0a,..
"khjeh"=hex:26,97,3d,56,17,f3,87,6f,27,fa,d9,fa,44,04,a1,c4,ee,b3,dc,e2,da,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e2,ce,b9,a4,3c,dd,d0,2d,f8,96,41,85,8e,95,50,47,df,59,5c,f4,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:fe,76,7a,5b,93,8a,69,94,ee,90,1c,2f,39,07,eb,44,58,dc,c4,f2,bd,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,84,e7,da,66,a5,97,71,1e,64,be,aa,aa,38,e8,55,fe,0a,..
"khjeh"=hex:26,97,3d,56,17,f3,87,6f,27,fa,d9,fa,44,04,a1,c4,ee,b3,dc,e2,da,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e2,ce,b9,a4,3c,dd,d0,2d,f8,96,41,85,8e,95,50,47,df,59,5c,f4,af,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

[Red]

Avast traktował go jak trojana, dopóki Combo nie skończył swoich czynności. Czy to normalne?

normalne,nie przejmuj się tym

prosze o jeszcze jeden log:

http://www.techsupportforum.com/sectools/Deckard/dss.exe

znajdziesz w ComboScan.txt i Supplementary.txt.

[Raider]

znajdziesz w ComboScan.txt i Supplementary.txt.

Tego nie bardzo rozumiem, mam coś poszukać? jeżeli mozna proszę o podpowiedz


a co do tamtego wyskoczyły mi dwa logi

1

Deckard's System Scanner v20070905.67
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: Polish

CPU 0: AMD Athlon(tm) XP 2200+
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 1023.48 MiB / 593.52 MiB
Pagefile Memory (total/avail): 2461.75 MiB / 2110.64 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1982.11 MiB

C: is Fixed (NTFS) - 8.99 GiB total, 4.97 GiB free.
D: is Fixed (FAT32) - 8.98 GiB total, 2.23 GiB free.
E: is Fixed (NTFS) - 56.55 GiB total, 18.39 GiB free.
F: is CDROM (No Media)
G: is CDROM (CDFS)

\\.\PHYSICALDRIVE0 - ST380011A - 74.53 GiB - 3 partitions
\PARTITION0 (bootable) - Instalowalny system plików - 8.99 GiB - C:
\PARTITION1 - Unknown - 8.99 GiB - D:
\PARTITION2 - Instalowalny system plików - 56.55 GiB - E:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Prabek82\Dane aplikacji
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PRABEK
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Prabek82
LOGONSERVER=\\PRABEK
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Prabek82\USTAWI~1\Temp
TMP=C:\DOCUME~1\Prabek82\USTAWI~1\Temp
USERDOMAIN=PRABEK
USERNAME=Prabek82
USERPROFILE=C:\Documents and Settings\Prabek82
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Prabek82 (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
--> E:\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
--> MsiExec /X{65F1CF63-31E0-450B-96F3-4A88BE7361A6}
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E7DC12A-3597-4A94-9429-F6C6987361B1}\setup.exe" -l0x9 -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DADB304-AF20-48C3-A780-4B4133A08817}\setup.exe" -l0x9 -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C423CF6-2DAA-4A37-94B8-59D7ECC7DB13}\setup.exe" -l0x9 -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FA6CC4B4-7741-4F8D-8E81-15C4BAB9869B}\setup.exe" -l0x9 -removeonly
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
"SubEdit-Player + CodecPack" --> D:\SUBEDIT\Odinstaluj.exe
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
AGEIA PhysX v7.07.09 --> MsiExec.exe /X{65F1CF63-31E0-450B-96F3-4A88BE7361A6}
America's Army --> MsiExec.exe /I{6778954C-13C2-4333-AF77-F5C885EB280F}
Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Ashampoo AntiSpyWare 2.01 --> "C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\unins000.exe"
µTorrent --> "E:\uTorrent\uninstall.exe"
avast! Antivirus --> rundll32 D:\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
Balloon Pop --> C:\PROGRA~1\GALAXY~1\GAMESF~1\BALLOO~1\UNWISE.EXE C:\PROGRA~1\GALAXY~1\GAMESF~1\BALLOO~1\INSTALL.LOG
ffdshow --> "D:\SUBEDIT\codec\ffdshow\uninstall.exe"
Fran's Frog Hop --> C:\PROGRA~1\GALAXY~1\GAMESF~1\FRAN'S~1\UNWISE.EXE C:\PROGRA~1\GALAXY~1\GAMESF~1\FRAN'S~1\INSTALL.LOG
Gadu-Gadu 7.7 --> D:\Gadu Gadu\Gadu-Gadu\Setup.exe
GameShadow --> MsiExec.exe /I{373C3DAE-62C8-4F63-887C-769A8986ED50}
GIGABYTE VGA Utility Manager --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\GigaByte\VGA Utility Manager\Uninst.isu"
Ground Control II --> C:\Program Files\InstallShield Installation Information\{21C41BAF-6F62-469D-A43B-DDF01628346E}\setup.exe -runfromtemp -l0x0015 -removeonly
Hamachi 0.9.9.9 --> D:\Hamachi\uninstall.exe
HijackThis 1.99.1 --> C:\Documents and Settings\Prabek82\Pulpit\HijackThis.exe /uninstall
J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Listonosz : Klient Poczty 1.0.5.0 --> E:\Listonosz\deinstalacja.exe
Medal of Honor Airborne --> MsiExec.exe /X{25F28E39-FDBB-11DB-8314-0800200C9A66}
Microsoft Office PowerPoint Viewer 2003 --> MsiExec.exe /X{90AF0415-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110415-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (1.5.0.9) --> D:\Mozilla\uninstall\uninstall.exe /ua "1.5.0.9 (pl)"
Mozilla Firefox (2.0.0.7) --> D:\Mozilla\Mozilla Firefox\uninstall\helper.exe
Nero 7 Demo --> MsiExec.exe /I{1CBCC734-E92F-C744-D86C-3699D5351045}
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
O&O Defrag Professional Edition --> MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
PBCool --> MsiExec.exe /I{663D1234-43C2-4A22-B7BA-D376CA4ECDCD}
Pogoda 1.61 --> "D:\Pogoda\unins000.exe"
PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
PunkBuster Services --> C:\WINDOWS\system32\pbsvc.exe -u
QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Real Alternative 1.29 --> "E:\Real Alternative\unins000.exe"
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Red Orchestra --> C:\Program Files\InstallShield Installation Information\{69997863-7239-4E5C-833C-EAC2F0116EB3}\setup.exe -runfromtemp -l0x0015 -removeonly
Sid Meier's Pirates! --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}
Silent Hunter 4 Wolves of the Pacific --> C:\Program Files\InstallShield Installation Information\{0D005F09-A5F4-473B-A901-5735C6AF5628}\setup.exe -runfromtemp -l0x0009 -removeonly
Skaner on-line mks_vir --> C:\WINDOWS\system32\SkanerOnlineUninstall.exe
Skype™ Beta 3.5 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sony Picture Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe" -l0x9 /removeonly uninstall -removeonly
Sony USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL
Spolszczenie Sid Meier's Pirates by Termez & AliG --> E:\Firaxis Games\Sid Meier's Pirates!\Uninstal.exe
TeamSpeak 2 RC2 --> D:\Teamspeak2_RC2\unins000.exe
TWL AA Cheat Deterrent Client --> MsiExec.exe /I{A9BD391C-A3D7-47EC-847C-A22935AB0193}
Wapster AQQ --> D:\AQQ\uninstall.exe
Winamp (remove only) --> "D:\Winamp\UninstWA.exe"
Yahoo! Companion --> rundll32.exe C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn2\YCOMP5~1.DLL,DllCommand ui


-- Application Event Log -------------------------------------------------------

Event Record #/Type1408 / Warning
Event Submitted/Written: 09/22/2007 01:25:07 PM
Event ID/Source: 1524 / Userenv
Event Description:
System Windows nie może zwolnić pliku rejestru klas - plik jest ciągle używany przez inną aplikację lub usługę. Plik zostanie zwolniony, gdy nie będzie używany.

Event Record #/Type1382 / Error
Event Submitted/Written: 09/16/2007 03:17:58 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Aplikacja zawieszająca Skype.exe, wersja 3.5.11.178, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Event Record #/Type1381 / Error
Event Submitted/Written: 09/16/2007 03:17:56 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Aplikacja zawieszająca Skype.exe, wersja 3.5.11.178, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Event Record #/Type1380 / Error
Event Submitted/Written: 09/16/2007 03:16:06 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd skype.exe, wersja 3.5.11.178, moduł powodujący błąd skype.exe, wersja 3.5.11.178, adres błędu 0x0000450e.
Przetwarzanie zdarzenia określonego nośnika dla [skype.exe!ws!]

Event Record #/Type1344 / Error
Event Submitted/Written: 09/11/2007 01:25:51 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd skype.exe, wersja 3.5.11.178, moduł powodujący błąd skype.exe, wersja 3.5.11.178, adres błędu 0x000048be.
Przetwarzanie zdarzenia określonego nośnika dla [skype.exe!ws!]



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type39787 / Error
Event Submitted/Written: 09/26/2007 00:24:08 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Usługa Usługa przywracania systemu zakończyła działanie; wystąpił następujący błąd:
%%2

Event Record #/Type39786 / Error
Event Submitted/Written: 09/26/2007 00:24:01 PM
Event ID/Source: 104 / SRService
Event Description:
Proces inicjalizacji Przywracania systemu nie powiódł się.

Event Record #/Type39785 / Error
Event Submitted/Written: 09/26/2007 00:23:29 PM / 09/26/2007 00:23:55 PM
Event ID/Source: 4 / sptd
Event Description:
Sterownik wykrył błąd wewnętrzny w swoich strukturach danych dla .

Event Record #/Type39784 / Error
Event Submitted/Written: 09/26/2007 00:23:29 PM / 09/26/2007 00:23:55 PM
Event ID/Source: 4 / sptd
Event Description:
Sterownik wykrył błąd wewnętrzny w swoich strukturach danych dla .

Event Record #/Type39783 / Error
Event Submitted/Written: 09/26/2007 00:23:29 PM / 09/26/2007 00:23:55 PM
Event ID/Source: 4 / sptd
Event Description:
Sterownik wykrył błąd wewnętrzny w swoich strukturach danych dla .



-- End of Deckard's System Scanner: finished at 2007-09-26 12:47:37 ------------

2

Deckard's System Scanner v20070905.67
Run by Prabek82 on 2007-09-26 12:46:35
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Prabek82.exe) --------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 12:47:09, on 2007-09-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Alwil Software\Avast4\aswUpdSv.exe
D:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\Alwil Software\Avast4\ashMaiSv.exe
D:\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
D:\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Mozilla\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Prabek82\Pulpit\dss.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\DOCUME~1\Prabek82\Pulpit\Prabek82.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [RemoteControl] D:\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AQQ] D:\AQQ\AQQ.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe


-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 GPCIDrv - c:\windows\gpcidrv.sys
R3 GVTDrv - c:\windows\system32\drivers\gvtdrv.sys

S3 catchme - c:\docume~1\prabek82\ustawi~1\temp\catchme.sys (file missing)
S3 GMSIPCI - f:\install\gmsipci.sys (file missing)
S3 GVCplDrv - c:\windows\system32\drivers\gvcpldrv.sys
S3 hamachi (Hamachi Network Interface) - c:\windows\system32\drivers\hamachi.sys <Not Verified; Applied Networking Inc.; Hamachi Virtual Network Interface Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Hamachi Network Interface
Device ID: ROOT\NET\0000
Manufacturer: Applied Networking Inc.
Name: Hamachi Network Interface
PNP Device ID: ROOT\NET\0000
Service: hamachi


-- Files created between 2007-08-26 and 2007-09-26 -----------------------------

2007-09-26 12:20:07 0 d-------- C:\WINDOWS\ERUNT
2007-09-18 08:59:36 0 d-------- C:\Program Files\Ashampoo
2007-09-11 12:46:04 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-09-11 12:45:50 0 d-------- C:\WINDOWS\system32\AGEIA
2007-09-11 12:45:48 0 d-------- C:\Program Files\AGEIA Technologies
2007-09-11 12:45:33 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-30 19:44:39 0 d-------- C:\Program Files\Media Player Classic


-- Find3M Report ---------------------------------------------------------------

2007-09-26 12:29:15 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\Skype
2007-09-26 12:26:15 5112 --a------ C:\WINDOWS\GPCIDrv.sys
2007-09-26 02:12:04 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\uTorrent
2007-09-25 12:53:14 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-09-24 20:26:57 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\teamspeak2
2007-09-06 15:06:53 0 d-------- C:\Program Files\Common Files\Adobe
2007-08-28 23:07:09 0 d-------- C:\Program Files\SkanerOnline
2007-08-21 22:25:49 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\Gadu-Gadu
2007-08-17 23:05:51 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\MozillaControl
2007-08-17 23:05:47 0 d-------- C:\Program Files\Common Files\Onet.pl
2007-08-17 23:05:35 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\Onet
2007-08-17 23:05:31 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\Listonosz
2007-08-17 23:05:30 0 d-------- C:\Documents and Settings\Prabek82\Dane aplikacji\AutoUpdate
2007-08-17 23:04:50 0 d-------- C:\Program Files\Common Files
2007-08-17 22:40:30 0 d-------- C:\Program Files\Skype
2007-08-17 22:40:27 0 d-------- C:\Program Files\Common Files\Skype
2007-08-04 21:35:16 0 d-------- C:\Program Files\America's Army
2007-08-04 21:32:38 0 d-------- C:\Program Files\America's Army Server Manager


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 13:12 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43]
"nwiz"="nwiz.exe" [2006-08-11 22:43 C:\WINDOWS\system32\nwiz.exe]
"VGAUtil"="C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe" [2006-07-12 16:27]
"RemoteControl"="D:\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43]
"avast!"="D:\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-27 23:50]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]
"Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" [2006-02-08 16:40]
"Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"AntiSpyWare2Guard"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2007-08-14 09:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"AQQ"="D:\AQQ\AQQ.exe" [2006-05-22 11:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 19:43]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-13 18:55]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16ac14ca-2353-11dc-95ea-0040f4719881}]
AutoRun\command- EXPLORER.EXE
explore\Command- EXPLORER.EXE
open\Command- EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e4b9f46-6443-11dc-969f-0040f4719881}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe




-- End of Deckard's System Scanner: finished at 2007-09-26 12:47:37 ------------

[Red]

Chodziło o to co pokazałeś.Więc nic więcej nie szukaj.W/g mnie jest to bład avasta(pomyłka antywira)

C:\WINDOWS\system32\Drivers\mchInjDrv.sys

należy do Ashampoo AntiSpyWare 2

Autor postu otrzymał pochwałę

[Raider]

No to teraz jak to zostawię, to co będę uruchamiał system będzie wyskakiwał ALERT W każdym bądź razie dziękuje za pomoc

[Red]

to co będę uruchamiał system będzie wyskakiwał ALERT

dodaj ten wpis do zaufanych w avascie i będziesz miał spokój,nic nie będzie wyskakiwać