SilentRunners:
"Silent Runners.vbs", revision 55, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min" ["Avira GmbH"]
"WinPatrol" = "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot" ["BillP Studios"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{B8323370-FF27-11D2-97B6-204C4F4F5020}" = "SmartFTP Copy Hook"
-> {HKLM...CLSID} = "SmartFTP Copy Hook"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\smarthook.dll" ["SmartSoft Ltd."]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play"
-> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Premium\shlext.dll" ["Avira GmbH"]
"{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}" = "SmartFTP ContextMenu"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{40FDFA48-5F4E-4627-A78E-6A49A3D4492F}" = "SmartFTP ShellDropHandler"
-> {HKLM...CLSID} = "SmartFTP ShellDropHandler Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}" = "SmartFTP Drop ShellIconOverlayHandler"
-> {HKLM...CLSID} = "SmartFTP Drop ShellIconOverlayHandler"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
"{39DD67E0-73B6-4a11-AF55-49E1EBBF72BE}" = "SmartFTP Favorites Namespace"
-> {HKLM...CLSID} = "SmartFTP FavoritesShellFolder Class"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFavoritesShellExtension.dll" ["SmartSoft Ltd."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
"AppInit_DLLs" = (value not set)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
<<!>> WRNotifier\DLLName = "WRLogonNTF.dll" [file not found]
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Premium\shlext.dll" ["Avira GmbH"]
SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}"
-> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Premium\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
Default executables:
--------------------
HKLM\SOFTWARE\Classes\.hta\(Default) = "htafile"
<<!>> HKLM\SOFTWARE\Classes\htafile\shell\open\command\(Default) = "NOTEPAD.EXE %1" [MS]
HKLM\SOFTWARE\Classes\.scr\(Default) = "scrfile"
<<!>> HKLM\SOFTWARE\Classes\scrfile\shell\open\command\(Default) = "NOTEPAD.EXE %1" [MS]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
"NoSharedDocuments" = (REG_DWORD) dword:0x00000001
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}
"NoRecentDocsMenu" = (REG_BINARY) hex:01 00 00 00
{unrecognized setting}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
"LinkResolveIgnoreLinkInfo" = (REG_DWORD) dword:0x00000000
{unrecognized setting}
"NoResolveSearch" = (REG_DWORD) dword:0x00000001
{unrecognized setting}
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"DisableRegistryTools" = (REG_DWORD) dword:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp"
Startup items in "Prox" & "All Users" startup folders:
------------------------------------------------------
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart
"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string]
Enabled Scheduled Tasks:
------------------------
"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."]
"Uniblue SpeedUpMyPC Nag" -> launches: "C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s" [file not found]
"Uniblue SpeedUpMyPC" -> launches: "C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s" [file not found]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
000000000005\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
Transport Service Providers
HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\CavEmLSP.dll ["COMODO"], 01 - 06, 23
%SystemRoot%\system32\mswsock.dll [MS], 07 - 09, 12 - 22
%SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11
Toolbars, Explorer Bars, Extensions:
------------------------------------
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."]
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search && Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
Miscellaneous IE Hijack Points
------------------------------
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\
<<H>> "Tabs" = "res://ieframe.dll/tabswelcome.htm" [file not found]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
AntiVir PersonalEdition Premium Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe"" ["Avira GmbH"]
AntiVir PersonalEdition Premium Scheduler, AntiVirScheduler, ""C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe"" ["Avira GmbH"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Odbiornik RIP, Iprip, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\iprip.dll" [MS]}
Usługa Pomocnik IPv6, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
---------- (launch time: 2008-02-20 12:12:37)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 83 seconds)
[ Dodano: Dzisiaj o 12:27 ]
ComboFix
ComboFix 08-02-20.2 - Prox 2008-02-20 12:16:48.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.290 [GMT 1:00]
Running from: C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\internet explorer\setup.exe
C:\WINDOWS\system32\babd8_g.dll
C:\WINDOWS\system32\Cache
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_IPRIP
-------\Iprip
((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.
2008-02-18 22:07 . 2008-02-18 22:08 <DIR> d---s---- C:\Program Files\HLSW
2008-02-18 22:07 . 2008-02-20 12:06 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\HLSW
2008-02-18 21:00 . 2008-02-18 21:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-18 13:26 . 2008-02-18 13:26 <DIR> d-------- C:\Program Files\BillP Studios
2008-02-18 13:26 . 2008-02-18 13:26 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\WinPatrol
2008-02-18 13:14 . 2008-02-18 13:14 <DIR> d-------- C:\Program Files\Sophos
2008-02-17 18:32 . 2008-02-17 18:32 504,312 --a------ C:\WINDOWS\system32\prfh0415.dat
2008-02-17 18:32 . 2008-02-17 18:32 91,470 --a------ C:\WINDOWS\system32\prfc0415.dat
2008-02-16 22:08 . 2001-07-13 13:56 14,976 --a------ C:\WINDOWS\system32\drivers\SBKUPNT.SYS
2008-02-16 22:08 . 1997-02-08 17:11 13,312 --a------ C:\WINDOWS\system32\DEVLOAD.EXE
2008-02-16 22:08 . 2005-11-26 19:45 2,799 --a------ C:\WINDOWS\SKLANG.INI
2008-02-16 21:37 . 2008-02-16 21:37 <DIR> d-------- C:\Program Files\Symantec
2008-02-16 20:53 . 2008-02-16 20:53 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-02-16 20:17 . 2008-02-16 20:17 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\DAEMON Tools
2008-02-16 20:17 . 2008-02-16 20:17 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-16 18:50 . 2008-01-21 17:43 13,576 --a------ C:\WINDOWS\system32\wnaspi32.dll
2008-02-16 18:49 . 2008-02-16 18:49 <DIR> d-------- C:\Program Files\Paragon Software
2008-02-16 12:06 . 2008-02-16 12:06 <DIR> d-------- C:\Documents and Settings\Irys\Dane aplikacji\stamina
2008-02-14 16:46 . 2008-02-20 12:01 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\The Bat!
2008-02-14 16:45 . 2008-02-14 16:45 <DIR> d-------- C:\Program Files\The Bat!
2008-02-13 22:23 . 2008-02-14 22:38 <DIR> d-------- C:\Program Files\SpeedFan
2008-02-13 22:07 . 2008-02-13 22:07 0 --a------ C:\WINDOWS\oodcnt.INI
2008-02-13 20:49 . 2008-02-13 20:56 <DIR> d-------- C:\Program Files\Motherboard Monitor 5
2008-02-13 20:37 . 2008-02-14 22:38 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-02-13 18:53 . 2008-02-18 10:59 42,456 --a------ C:\WINDOWS\system32\oodbs.lor
2008-02-13 16:35 . 2008-02-13 16:44 <DIR> d-------- C:\WINDOWS\system32\oodag
2008-02-13 16:32 . 2008-02-13 16:32 <DIR> d-------- C:\Program Files\OO Software
2008-02-13 16:17 . 2008-02-13 16:17 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-12 18:46 . 2008-02-12 18:46 <DIR> d-------- C:\Program Files\Avira
2008-02-11 14:52 . 2008-02-11 14:55 <DIR> d-------- C:\Program Files\PhotoZoom Pro 2
2008-02-11 14:52 . 2008-02-11 14:52 1,431 --a------ C:\WINDOWS\cgkcvt_k64.ini
2008-02-11 14:39 . 2008-02-11 14:39 <DIR> d-------- C:\Program Files\VikarPls
2008-02-11 14:25 . 2008-02-11 14:52 3,240 --a------ C:\WINDOWS\jpzgk_cr64.ini
2008-02-10 19:24 . 2008-02-10 19:24 <DIR> d-------- C:\Program Files\Comodo
2008-02-10 19:24 . 2008-02-10 19:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Comodo
2008-02-10 19:24 . 2008-02-10 19:24 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-02-10 19:24 . 2008-02-10 19:24 216,576 --a------ C:\WINDOWS\system32\monln.dll
2008-02-10 19:24 . 2008-02-10 19:24 73,728 --a------ C:\WINDOWS\system32\CavEmLSP.dll
2008-02-10 18:19 . 2008-02-10 18:19 36,924 --a------ C:\WINDOWS\system32\fwapi.dll
2008-02-10 17:56 . 2008-02-10 17:56 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Jetico Personal Firewall
2008-02-09 21:46 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-09 21:46 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-09 21:46 . 2008-02-08 23:55 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-09 21:46 . 2008-02-08 10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-09 21:46 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-09 21:46 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-09 21:46 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-09 21:46 . 2008-02-09 21:56 1,434 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-09 16:29 . 2008-02-09 16:29 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\atitray
2008-02-09 16:28 . 2008-02-09 16:30 <DIR> d-------- C:\Program Files\Ray Adams
2008-02-07 21:36 . 2008-02-07 21:36 <DIR> d-------- C:\Program Files\FERRO Software
2008-02-07 21:36 . 2008-02-07 21:36 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Ferro Software
2008-02-06 22:48 . 2007-12-31 15:52 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-02-06 22:48 . 2007-12-30 15:05 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-02-06 22:48 . 2007-12-30 16:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-02-06 22:48 . 2007-12-30 15:05 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-02-06 22:48 . 2007-12-30 15:05 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-02-06 22:48 . 2007-12-30 15:05 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-02-06 22:48 . 2007-12-30 15:05 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-02-06 19:40 . 2008-02-06 19:40 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Grisoft
2008-02-06 19:27 . 2008-02-06 19:27 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-06 16:28 . 2008-02-06 16:28 47,312 --a------ C:\WINDOWS\system32\drivers\MiniIcpt.sys
2008-02-06 13:23 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-06 13:23 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-06 13:17 . 2008-02-06 13:17 <DIR> d-------- C:\Program Files\FDRLab
2008-02-05 15:22 . 2008-02-05 15:22 <DIR> d-------- C:\Program Files\HLTooLz
2008-02-05 15:22 . 2008-02-05 15:22 249,856 --------- C:\WINDOWS\Setup1.exe
2008-02-05 15:22 . 2008-02-05 15:22 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-02-05 15:21 . 2008-02-05 15:21 <DIR> d-------- C:\Program Files\Robster Productions
2008-02-04 22:26 . 2008-02-17 14:40 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\skypePM
2008-02-04 22:26 . 2008-02-04 22:26 32 --a------ C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ezsid.dat
2008-02-04 22:24 . 2008-02-04 22:24 <DIR> d-------- C:\Program Files\Skype
2008-02-04 22:24 . 2008-02-04 22:24 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-02-04 22:24 . 2008-02-17 15:03 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Skype
2008-02-04 22:23 . 2008-02-04 22:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype
2008-02-03 17:48 . 2008-02-03 17:48 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-02-02 15:16 . 2008-02-06 12:44 <DIR> d-------- C:\Documents and Settings\Irys\Dane aplikacji\MegauploadToolbar
2008-01-31 23:11 . 2008-02-12 18:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Avira
2008-01-31 17:18 . 2008-02-10 19:24 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-01-31 17:18 . 2008-02-10 19:24 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-01-31 15:05 . 2008-02-04 15:39 <DIR> d-------- C:\Program Files\VirtualDJ
2008-01-31 15:05 . 2008-01-31 15:05 <DIR> d-------- C:\Program Files\V-dJ
2008-01-29 20:17 . 2008-01-29 20:17 <DIR> d-------- C:\WINDOWS\speech
2008-01-27 18:26 . 2008-02-18 20:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\RFA_Backups
2008-01-27 18:24 . 2008-01-27 18:24 <DIR> d-------- C:\Program Files\RFA
2008-01-27 17:19 . 2008-02-08 22:03 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Notepad++
2008-01-26 15:03 . 2008-02-08 22:03 <DIR> d-------- C:\Program Files\Notepad++
2008-01-26 15:03 . 2008-01-26 19:56 <DIR> d-------- C:\Documents and Settings\Irys\Dane aplikacji\Notepad++
2008-01-24 21:44 . 2008-02-08 18:39 <DIR> d-------- C:\Program Files\Valve
2008-01-24 13:30 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-01-24 13:28 . 2008-01-24 13:28 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Apple Computer
2008-01-22 00:44 . 2008-01-22 00:44 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\iolo
2008-01-21 20:03 . 2008-01-21 20:03 <DIR> d-------- C:\Documents and Settings\Irys\grenades_05
2008-01-20 17:53 . 2008-01-20 18:01 <DIR> d-------- C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Tibia
2008-01-20 11:56 . 2008-01-20 11:56 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Hagel Technologies
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-20 11:20 241,664 ----a-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-02-20 11:20 241,664 ----a-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2008-02-20 11:20 241,664 ----a-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-02-20 11:20 241,664 ----a-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2008-02-20 11:01 --------- d-----w C:\Program Files\MozdevMozilla2.0
2008-02-20 10:52 --------- d-----w C:\Program Files\foobar2000
2008-02-18 20:01 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2008-02-18 12:09 --------- d-----w C:\Program Files\Diablo II
2008-02-17 17:32 --------- d-----w C:\Program Files\SmartFTP Client
2008-02-16 19:56 --------- d-----w C:\Program Files\Bit Che
2008-02-16 18:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 20:15 630 ----a-w C:\WINDOWS\Fonts\InstLog.txt
2008-02-09 21:18 --------- d-----w C:\Program Files\cFosSpeed
2008-02-09 20:45 --------- d-----w C:\Program Files\Free Download Manager
2008-02-09 20:43 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\Free Download Manager
2008-02-09 20:41 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2008-02-09 15:21 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Free Download Manager
2008-02-08 16:08 --------- d-----w C:\Program Files\ESET
2008-02-06 12:42 --------- d-----w C:\Program Files\GoldWave
2008-02-05 22:56 --------- d-----w C:\Program Files\Usługi online
2008-02-05 22:56 --------- d-----w C:\Program Files\PowerStrip
2008-02-05 21:45 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Desktop Sidebar
2008-01-31 22:05 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\iolo
2008-01-29 15:55 --------- d-----w C:\Program Files\Konnekt
2008-01-27 18:27 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\OpenOffice.org2
2008-01-27 16:46 --------- d-----w C:\Program Files\RegVac Registry Cleaner
2008-01-20 16:53 --------- d-----w C:\Program Files\Tibia
2008-01-19 15:15 --------- d-----w C:\Program Files\Common Files\HTML Executable Viewer
2008-01-19 15:15 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\HTML Executable
2008-01-18 18:31 --------- d-----w C:\Program Files\downloader youtuba
2008-01-17 17:03 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\teamspeak2
2008-01-17 14:46 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\Apple Computer
2008-01-14 22:02 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Uniblue
2008-01-14 21:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\FreeDownloadManager.ORG
2008-01-13 23:24 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\teamspeak2
2008-01-12 18:54 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\ATI
2008-01-12 17:21 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\ATI
2008-01-12 11:42 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-09 15:34 67,645 ----a-w C:\WINDOWS\system32\drivers\pshook11.sys
2008-01-09 15:01 --------- d-----w C:\Program Files\HappyIcon
2008-01-09 14:52 --------- d-----w C:\Program Files\IconCool
2008-01-08 22:10 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\iolo
2008-01-08 21:40 --------- d-----w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\iolo
2008-01-08 21:40 --------- d-----w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\iolo
2008-01-08 21:40 --------- d-----w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\iolo
2008-01-07 22:08 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\OpenOffice.org2
2008-01-07 18:15 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\OpenOffice.org2
2008-01-07 14:28 --------- d-----w C:\Program Files\SilnikTT
2008-01-06 22:11 --------- d-----w C:\Program Files\Stardock
2008-01-06 22:11 --------- d-----w C:\Program Files\Common Files\Stardock
2008-01-05 22:10 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\ESET
2008-01-05 18:32 --------- d-----w C:\Program Files\QuickTime
2008-01-05 18:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer
2008-01-05 18:30 --------- d-----w C:\Program Files\Apple Software Update
2008-01-05 18:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple
2008-01-05 17:44 --------- d-----w C:\Program Files\No-IP
2008-01-05 14:29 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\ESET
2008-01-05 13:55 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\ESET
2008-01-05 13:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ESET
2008-01-04 14:22 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\Media Player Classic
2008-01-04 12:21 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\MSN6
2008-01-04 12:21 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\MSN6
2008-01-02 22:26 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\SmartFTP
2008-01-02 22:22 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Cream Software
2007-12-31 17:08 --------- d-----w C:\Program Files\RadioXpi
2007-12-31 15:37 167 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-31 14:14 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\SmartFTP
2007-12-31 13:00 --------- d-----w C:\Documents and Settings\Irys\Dane aplikacji\Talkback
2007-12-31 11:21 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\stamina
2007-12-31 10:59 --------- d-----w C:\Program Files\IrfanView
2007-12-31 10:55 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\Talkback
2007-12-31 10:44 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-30 23:22 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\GetRight
2007-12-30 23:13 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\stamina
2007-12-30 23:02 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\stamina
2007-12-30 20:50 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Lavasoft
2007-12-30 20:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-30 20:34 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Lavasoft
2007-12-30 18:58 --------- d-----w C:\Program Files\Trend Micro
2007-12-30 18:51 --------- d-----w C:\Program Files\C-Media
2007-12-30 17:08 --------- d-----w C:\Program Files\Java
2007-12-30 15:59 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Smart PC Solutions
2007-12-30 15:38 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Talkback
2007-12-30 15:38 --------- d-----w C:\Documents and Settings\Prox.PROX-DD28CKH3TD\Dane aplikacji\Search Settings
2007-12-30 15:32 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2007-12-30 15:21 --------- d-s---w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-12-30 15:21 --------- d-s---w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-12-30 15:21 --------- d-s---w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-12-30 15:21 --------- d-s---w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-12-29 13:00 --------- d-----w C:\Program Files\PeerGuardian2
2007-12-27 15:49 --------- d-----w C:\Documents and Settings\Rodzice\Dane aplikacji\Search Settings
2007-12-23 20:52 --------- d-----w C:\Program Files\Search Settings
2007-12-23 20:50 --------- d-----w C:\Program Files\Free Audio Pack
2006-12-19 17:07 2,208 ----a-w C:\Program Files\unins000.dat
2006-12-01 14:57 16,173,421 ----a-w C:\Program Files\Vi
2006-07-28 16:35 9 ----a-w C:\Program Files\version.wvd
2006-07-27 20:49 58 ----a-w C:\Program Files\font.ini
2006-07-27 20:49 57 ----a-w C:\Program Files\partition.inf
2006-01-10 08:52 70 ----a-w C:\Program Files\config.ini
2003-06-16 14:23 131,072 ----a-w C:\Program Files\T2DXi.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 14:03 2396160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 18:50 249896]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 06:38 316728]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
C:\Documents and Settings\Irys\Menu Start\Programy\Autostart\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-01-06 23:11:43 3450608]
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-05-06 19:38:33 962661]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Firefox Preloader.lnk]
backup=C:\WINDOWS\pss\Firefox Preloader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Mama^Menu Start^Programy^Autostart^Gadu-gadu.lnk]
path=C:\Documents and Settings\Mama\Pulpit\Gadu-gadu.lnk
backup=C:\WINDOWS\pss\Gadu-gadu.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Prox.PROX-DD28CKH3TD^Menu Start^Programy^Autostart^OpenOffice.org 2.3.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^Prox.PROX-DD28CKH3TD^Menu Start^Programy^Autostart^Stardock ObjectDock.lnk]
path=C:\Documents and Settings\Irys\Menu Start\Programy\Autostart\Stardock ObjectDock.lnk
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 08:20 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-01-02 16:41 45056 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMWizardAgent]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Ram Optimizer]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2006-02-17 14:03 2396160 C:\Program Files\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HakerzyNET MAV]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
--a------ 2005-05-24 22:41 503808 C:\Program Files\Konnekt\konnekt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Look 'n' Stop]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
--a------ 2007-05-11 02:08 2512392 C:\WINDOWS\system32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-02-04 18:23 1266936 c:\progra~1\valve\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TweakMASTER]
R2 SBKUPNT;SBKUPNT;C:\WINDOWS\system32\Drivers\SBKUPNT.SYS [2001-07-13 13:56]
S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
S3 p2psvc;Sieć równorzędna;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);C:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S4 AntiVirMailService;AntiVir PersonalEdition Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-02-12 18:50]
S4 AVEService;AntiVir PersonalEdition Premium MailGuard helper service;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-02-12 18:50]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
"2008-01-05 18:31:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-14 21:53:45 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-01-14 21:47:15 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 12:22:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-02-20 12:24:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-20 11:24:30
.
2008-02-13 15:17:41 --- E O F ---
