ComboFix 12-06-02.02 - xxx 2012-06-02  16:26:36.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1790.1186 [GMT 2:00]
Uruchomiony z: c:\documents and settings\xxx\Pulpit\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-1
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-19
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-2
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-20
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-3
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Bron.tok-15-4
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Kosong.Bron.Tok.txt
c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\ListHost15.txt
c:\windows\msmqinst.log
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\msxml4-KB973688-enu.LOG
c:\windows\system32\msvcsv60.dll
c:\windows\system32\SysInfo.dll
c:\windows\system32\TZLog.log
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2012-05-02 do 2012-06-02  )))))))))))))))))))))))))))))))
.
.
2012-06-02 13:10 . 2012-06-02 13:10	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-06-02 12:33 . 2012-06-02 12:33	--------	d-----w-	c:\windows\system32\wbem\Repository
2012-06-02 12:29 . 2012-06-02 12:29	--------	d-----w-	c:\documents and settings\xxx\Dane aplikacji\Media Player Classic
2012-06-02 12:25 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-06-02 12:25 . 2011-12-21 17:14	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-06-02 01:26 . 2012-06-02 12:29	--------	d-----w-	c:\windows\system32\Adobe
2012-06-02 01:19 . 2012-06-02 01:19	--------	d-----w-	c:\documents and settings\xxx\Dane aplikacji\Malwarebytes
2012-06-02 01:19 . 2012-06-02 01:19	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2012-06-01 22:05 . 2012-06-01 22:05	--------	d-----w-	c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Identities
2012-05-29 00:47 . 2012-03-06 23:03	337880	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-05-29 00:47 . 2012-03-06 23:01	20696	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-05-29 00:46 . 2012-03-06 23:02	35672	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2012-05-29 00:46 . 2012-03-06 23:03	612184	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-05-29 00:46 . 2012-03-06 23:01	53848	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-05-29 00:46 . 2012-03-06 23:01	95704	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2012-05-29 00:46 . 2012-03-06 23:01	89048	----a-w-	c:\windows\system32\drivers\aswmon.sys
2012-05-29 00:46 . 2012-03-06 22:58	24920	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2012-05-29 00:46 . 2012-03-06 23:15	41184	----a-w-	c:\windows\avastSS.scr
2012-05-29 00:45 . 2012-03-06 23:15	201352	----a-w-	c:\windows\system32\aswBoot.exe
2012-05-29 00:45 . 2012-05-29 00:45	--------	d-----w-	c:\program files\AVAST Software
2012-05-29 00:45 . 2012-05-29 00:45	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\AVAST Software
2012-05-27 20:53 . 2012-05-27 20:53	--------	d-----w-	c:\documents and settings\xxx\Dane aplikacji\ElevatedDiagnostics
2012-05-27 20:49 . 2012-05-27 20:49	--------	d-sh--w-	c:\documents and settings\xxx\PrivacIE
2012-05-25 09:16 . 2012-05-25 09:16	--------	d-----w-	c:\windows\system32\KB905474
2012-05-25 08:53 . 2008-04-14 20:51	221184	----a-w-	c:\windows\system32\wmpns.dll
2012-05-25 08:34 . 2012-05-25 08:34	--------	d-sh--w-	c:\documents and settings\xxx\IETldCache
2012-05-25 08:33 . 2012-05-25 08:33	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2012-05-24 22:28 . 2008-06-14 17:36	273024	-c----w-	c:\windows\system32\dllcache\bthport.sys
2012-05-24 22:28 . 2008-06-14 17:36	273024	------w-	c:\windows\system32\drivers\bthport.sys
2012-05-24 22:25 . 2011-07-15 13:29	456320	-c----w-	c:\windows\system32\dllcache\mrxsmb.sys
2012-05-24 22:19 . 2010-02-12 10:03	293376	------w-	c:\windows\system32\browserchoice.exe
2012-05-24 22:12 . 2012-05-24 22:15	--------	dc-h--w-	c:\windows\ie8
2012-05-24 22:03 . 2011-08-16 10:45	6144	-c----w-	c:\windows\system32\dllcache\iecompat.dll
2012-05-24 22:02 . 2012-04-11 13:55	2028032	-c----w-	c:\windows\system32\dllcache\ntkrpamp.exe
2012-05-24 22:02 . 2012-04-11 13:55	2070400	-c----w-	c:\windows\system32\dllcache\ntkrnlpa.exe
2012-05-24 22:02 . 2012-04-11 13:55	2149888	-c----w-	c:\windows\system32\dllcache\ntkrnlmp.exe
2012-05-24 22:02 . 2012-04-11 13:54	2193920	-c----w-	c:\windows\system32\dllcache\ntoskrnl.exe
2012-05-24 22:02 . 2012-03-01 10:59	602112	-c----w-	c:\windows\system32\dllcache\msfeeds.dll
2012-05-24 22:02 . 2012-03-01 10:59	55296	-c----w-	c:\windows\system32\dllcache\msfeedsbs.dll
2012-05-24 22:02 . 2012-03-01 10:59	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2012-05-24 22:02 . 2012-03-01 10:59	743424	-c----w-	c:\windows\system32\dllcache\iedvtool.dll
2012-05-24 22:02 . 2012-03-01 10:59	247808	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2012-05-24 22:02 . 2012-03-01 10:59	2000384	-c----w-	c:\windows\system32\dllcache\iertutil.dll
2012-05-24 22:02 . 2012-03-02 03:59	11082752	-c----w-	c:\windows\system32\dllcache\ieframe.dll
2012-05-24 22:01 . 2012-01-11 19:07	3072	-c----w-	c:\windows\system32\dllcache\iacenc.dll
2012-05-24 22:01 . 2012-01-11 19:07	3072	------w-	c:\windows\system32\iacenc.dll
2012-05-24 21:55 . 2012-05-26 01:11	--------	d--h--w-	c:\windows\$hf_mig$
2012-05-23 21:40 . 2006-10-26 17:56	33104	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2012-05-23 21:40 . 2006-10-26 17:56	32592	----a-w-	c:\windows\system32\msonpmon.dll
2012-05-23 21:40 . 2012-05-23 21:40	--------	d-----w-	c:\program files\Microsoft Works
2012-05-23 21:39 . 2012-05-23 21:39	--------	d-----w-	c:\program files\Microsoft.NET
2012-05-23 21:37 . 2012-05-23 21:37	--------	d-----w-	c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Microsoft Help
2012-05-23 21:34 . 2012-05-23 21:40	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2012-05-23 21:31 . 2012-05-23 21:31	--------	d-----r-	C:\MSOCache
2012-05-23 00:35 . 2012-05-29 00:40	--------	d-----w-	c:\program files\Portal
2012-05-22 23:03 . 2012-05-22 23:03	--------	d-----w-	c:\program files\WinPcap
2012-05-21 10:22 . 2012-05-21 10:22	--------	d-----w-	c:\documents and settings\xxx\Ustawienia lokalne\Dane aplikacji\Native Instruments
2012-05-21 10:21 . 2012-06-02 13:58	--------	dc-h--w-	c:\documents and settings\All Users\Dane aplikacji\{9327ACE9-CC82-4A33-9B33-291ACA1E267B}
2012-05-19 23:56 . 2012-05-19 23:56	--------	d-----w-	c:\program files\Freemake
2012-05-18 22:01 . 2008-06-24 08:31	835584	----a-r-	c:\windows\system32\Mam3Pan.exe
2012-05-18 22:01 . 2008-06-24 08:30	65536	----a-r-	c:\windows\system32\Mam3Asio.dll
2012-05-18 22:01 . 2008-06-24 08:30	28800	----a-r-	c:\windows\system32\drivers\Mam3.sys
2012-05-18 22:01 . 2008-06-24 08:30	22912	----a-r-	c:\windows\system32\drivers\Mam3Wdm.sys
2012-05-18 22:01 . 2005-08-08 16:39	49152	----a-r-	c:\windows\system32\Mam3Blk.exe
2012-05-16 21:16 . 2012-05-16 21:16	--------	d-----w-	c:\program files\EA SPORTS
2012-05-15 20:36 . 2012-05-15 20:36	--------	d-----w-	c:\program files\Lavalys
2012-05-11 21:37 . 2012-05-11 21:46	--------	d-----w-	c:\program files\RTEQ
2012-05-09 09:46 . 2012-05-09 09:46	--------	d-----w-	c:\program files\Ubisoft
2012-05-09 09:46 . 2012-05-09 09:46	282756	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2012-05-09 09:46 . 2012-05-09 09:46	163972	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2012-05-09 09:46 . 2003-02-27 14:12	696320	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2012-05-09 09:46 . 2002-12-05 12:10	155648	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2012-05-09 09:46 . 2002-12-02 13:22	5632	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2012-05-09 09:46 . 2002-12-02 11:33	57344	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2012-05-09 09:46 . 2002-12-02 11:33	237568	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2012-05-05 15:57 . 2012-05-05 15:57	--------	d-----w-	c:\documents and settings\xxx\Dane aplikacji\LolClient
2012-05-05 13:26 . 2012-05-05 13:26	4140192	----a-w-	c:\windows\system32\FlashPlayerInstaller.exe
2012-05-04 10:01 . 2012-05-04 10:01	--------	d-----w-	c:\program files\MU Online
2012-05-04 09:01 . 2012-05-04 09:01	--------	d-----w-	c:\program files\Fortress Network
2012-05-03 22:47 . 2012-05-03 22:47	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\ATI
2012-05-03 22:40 . 2011-12-20 07:39	100368	----a-w-	c:\windows\system32\drivers\AtihdXP3.sys
2012-05-03 22:37 . 2012-05-03 22:37	--------	d-----w-	C:\AMD
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 13:26 . 2012-04-01 19:29	419488	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-05-05 13:26 . 2012-02-20 17:51	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:55 . 2008-04-14 21:59	2028032	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:55 . 2008-04-14 19:59	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-04-11 13:54 . 2008-04-14 19:35	1862528	----a-w-	c:\windows\system32\win32k.sys
2012-04-06 09:23 . 2012-04-06 09:23	1214	----a-w-	c:\windows\system32\ealregsnapshot1.reg
2012-03-30 10:19 . 2012-03-28 14:23	17488	----a-w-	c:\windows\gdrv.sys
2012-03-23 21:02 . 2012-03-23 21:02	98304	----a-w-	c:\windows\system32\CmdLineExt.dll
2012-03-23 18:22 . 2012-03-23 18:22	271360	----a-w-	c:\windows\system32\drivers\atksgt.sys
2012-03-23 18:22 . 2012-03-23 18:22	18048	----a-w-	c:\windows\system32\drivers\lirsgt.sys
2012-03-21 14:22 . 2012-03-21 14:02	22328	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2012-03-21 14:22 . 2012-03-21 14:02	66872	----a-w-	c:\windows\system32\PnkBstrA.exe
2012-03-21 14:22 . 2012-03-21 14:02	103736	----a-w-	c:\windows\system32\PnkBstrB.exe
2012-03-21 14:02 . 2012-03-21 14:02	22328	----a-w-	c:\documents and settings\xxx\Dane aplikacji\PnkBstrK.sys
2012-03-20 15:31 . 2012-03-20 15:32	73728	----a-w-	c:\windows\system32\javacpl.cpl
2012-03-20 15:31 . 2012-03-20 15:32	472808	----a-w-	c:\windows\system32\deployJava1.dll
2012-04-25 01:26 . 2012-03-20 15:23	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15	123536	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-14 98304]
"RTHDCPL"="RTHDCPL.EXE" [2012-03-14 20065896]
"Mam3PAN.exe"="Mam3PAN.exe" [2008-06-24 835584]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\xxx\Menu Start\Programy\Autostart\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2012-4-28 576000]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-05-29 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-05-29 337880]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2012-03-28 21752]
R1 Mam3.sys;Service for ESI MAYA44 Audio Driver EWDM;c:\windows\system32\drivers\Mam3.sys [2012-05-19 28800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-05-29 20696]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2008-06-01 34064]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012-05-04 100368]
R3 Mam3WDM.sys;Service for ESI MAYA44 WDM;c:\windows\system32\drivers\Mam3Wdm.sys [2012-05-19 22912]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2012-03-20 402432]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2012-03-28 30392]
S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [2001-10-26 3584]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-05-15 1691480]
S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\drivers\mcvidrv.sys [2012-01-11 32000]
S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv.sys [2012-02-22 22400]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-25 129976]
S3 ZD1211U(ZyXEL);ZyAIR G-220 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyXEL);c:\windows\system32\drivers\ZD1211U.sys [2012-02-20 237568]
.
Zawartość folderu 'Zaplanowane zadania'
.
2012-06-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 13:26]
.
2012-06-02 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2012-05-25 20:18]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.gazeta.pl/0,0.html?p=135
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: line6.net
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\xxx\Dane aplikacji\Mozilla\Firefox\Profiles\np1m2nit.default\
FF - prefs.js: browser.search.selectedEngine - Google 
FF - prefs.js: browser.startup.homepage - google.pl
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Bbae00493-2235-456a-992f-7e77327b06ad%7D&mid=743c4f4ea56647d0a1c6d129f5d500f5-9aa8414d34739a5dbdf52bd81343c0e0972ef065&ds=st011&v=10.0.0.7&lang=pl&pr=sa&d=2012-03-21%2014%3A45%3A39&sap=ku&q=
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
HKCU-Run-ALLUpdate - c:\program files\ALLPlayer\ALLUpdate.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-02 16:30
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(1072)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Czas ukończenia: 2012-06-02  16:32:11
ComboFix-quarantined-files.txt  2012-06-02 14:32
.
Przed: 51 586 310 144 bajtów wolnych
Po: 51 925 184 512 bajtów wolnych
.
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 8F75F5DC3BB251E541B31E80175C4928