ComboFix 13-02-21.02 - Mono 2013-02-21  17:21:41.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.2038.1042 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Mono\Moje dokumenty\Pobieranie\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Dane aplikacji\Browse2save
c:\documents and settings\All Users\Dane aplikacji\Browse2save\51214b1b6e6e1.dll
c:\documents and settings\All Users\Dane aplikacji\Browse2save\51214b1b6e6e1.tlb
c:\documents and settings\All Users\Dane aplikacji\Browse2save\settings.ini
c:\documents and settings\All Users\Dane aplikacji\TEMP
c:\documents and settings\Mono\WINDOWS
c:\windows\msmqinst.log
c:\windows\system32\Cache
c:\windows\system32\Cache\26c630d098e22dd5.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\54634c82864ca44c.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\95f567698be8a182.fb
c:\windows\system32\Cache\9e7524de4194a892.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\bdd44701b28e70df.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\f5aca96eadbb8368.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2013-01-21 do 2013-02-21  )))))))))))))))))))))))))))))))
.
.
2013-02-17 21:16 . 2013-02-17 21:16	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\RightClick
2013-02-17 21:01 . 2013-02-17 21:01	--------	d-----w-	c:\documents and settings\Mono\Dane aplikacji\SendSpace
2013-02-17 21:00 . 2013-02-17 21:00	--------	d-----w-	c:\program files\WebSearch
2013-02-17 21:00 . 2013-02-18 17:43	--------	d-----w-	c:\program files\Optimizer Pro
2013-02-17 20:59 . 2013-02-19 19:31	--------	d-----w-	c:\program files\BrowseToSave
2013-02-17 20:58 . 2013-02-19 19:27	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\InstallMate
2013-02-03 19:15 . 2013-02-03 19:15	--------	d-----w-	c:\documents and settings\Mono\Ustawienia lokalne\Dane aplikacji\Unity
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-18 21:42 . 2012-11-01 16:53	33112	----a-w-	c:\windows\system32\drivers\avgtpx86.sys
2013-02-09 22:07 . 2012-11-02 19:50	697712	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-02-09 22:07 . 2012-10-31 19:09	74096	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-26 03:55 . 2004-08-03 23:44	552448	----a-w-	c:\windows\system32\oleaut32.dll
2013-01-07 17:42 . 2013-01-07 17:42	589	----a-w-	c:\windows\uninstallstickies.bat
2013-01-07 07:27 . 2007-03-10 01:32	2150400	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-01-07 07:26 . 2006-10-30 14:03	2029056	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:10 . 2007-03-10 01:32	1867520	----a-w-	c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2006-09-13 15:26	1295872	----a-w-	c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2004-08-03 23:44	148992	----a-w-	c:\windows\system32\mpg2splt.ax
2012-12-29 20:01 . 2012-12-29 20:01	466008	----a-w-	c:\windows\system32\drivers\sptd.sys
2012-12-27 10:31 . 2007-01-04 13:05	669696	----a-w-	c:\windows\system32\wininet.dll
2012-12-27 10:31 . 2004-08-03 21:59	61952	----a-w-	c:\windows\system32\tdc.ocx
2012-12-27 10:31 . 2012-11-04 11:03	81920	----a-w-	c:\windows\system32\ieencode.dll
2012-12-27 10:26 . 2004-08-03 23:36	370688	----a-w-	c:\windows\system32\html.iec
2012-12-25 18:20 . 2012-12-25 18:20	2829	----a-w-	c:\windows\War3Unin.pif
2012-12-25 18:20 . 2012-12-25 18:20	126976	----a-w-	c:\windows\War3Unin.exe
2012-12-25 18:13 . 2012-12-25 18:13	242240	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2012-12-16 12:23 . 2004-08-03 23:42	290560	----a-w-	c:\windows\system32\atmfd.dll
2012-12-13 21:58 . 2012-10-31 18:48	112640	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-13 21:57 . 2013-01-07 19:45	47616	----a-w-	c:\windows\system32\ff_acm.acm
2013-02-19 16:13 . 2013-02-19 16:12	263064	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2013-02-18 21:42	1929392	----a-w-	c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll" [2013-02-18 1929392]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2012-01-05 75624]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-02-18 1151152]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-13 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-15 2879488]
"SMSERIAL"="sm56hlpr.exe" [2006-01-18 544768]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-21 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-21 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-21 118784]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2008-04-14 208896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]
2013-01-23 12:34	2995712	----a-w-	c:\program files\ALLPlayer\ALLUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-11-06 10:46	3673728	----a-w-	c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
2012-10-13 00:54	1088424	----a-w-	c:\program files\Nokia\Nokia Suite\NokiaSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-11-09 10:27	17877168	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-09-17 11:41	254896	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SkypeUpdate"=2 (0x2)
"NAUpdate"=2 (0x2)
"McComponentHostService"=3 (0x3)
"AxAutoMntSrv"=2 (0x2)
"AdobeFlashPlayerUpdateSvc"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\Gadu-Gadu 10\\gg.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Warcraft III\\War3.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
"c:\\Documents and Settings\\Mono\\Pulpit\\Valve\\hl.exe"=
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-09-21 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-09-21 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-09-14 35552]
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2012-11-01 38400]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2012-09-13 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2012-09-21 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-10-02 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-09-21 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-11-01 33112]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-12-25 242240]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-02-18 968880]
S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys --> c:\windows\system32\DRIVERS\o2sd.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
S3 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2011-02-11 35088]
S4 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
S4 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2012-07-13 769432]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-11-09 160944]
.
Zawartość folderu 'Zaplanowane zadania'
.
2013-02-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-02 22:07]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://websearch.good-results.info/?pid=34&r=2013/02/17&hid=3058878192&lg=EN&cc=PL
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.v9.com/?utm_source=b&utm_medium=idg&from=idg&uid=WDC_WD2500BEKT-75PVMT0_WD-WX61A51J6988J6988&ts=1351860446
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
FF - ProfilePath - c:\documents and settings\Mono\Dane aplikacji\Mozilla\Firefox\Profiles\ti9x2vwv.default\
FF - ExtSQL: 2013-01-07 20:32; IplextoALL@ALLPlayer.org; c:\documents and settings\Mono\Dane aplikacji\Mozilla\Firefox\Profiles\ti9x2vwv.default\extensions\IplextoALL@ALLPlayer.org.xpi
FF - ExtSQL: 2013-02-17 22:26; 51214b1b6e545@51214b1b6e57e.com; c:\documents and settings\Mono\Dane aplikacji\Mozilla\Firefox\Profiles\ti9x2vwv.default\extensions\51214b1b6e545@51214b1b6e57e.com
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-BitTorrent - c:\program files\BitTorrent\BitTorrent.exe
MSConfigStartUp-SDP - c:\program files\FilesFrog Update Checker\update_checker.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-21 17:28
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
.
- - - - - - - > 'winlogon.exe'(1120)
c:\windows\system32\antiwpa.dll
.
Czas ukończenia: 2013-02-21  17:30:52
ComboFix-quarantined-files.txt  2013-02-21 16:30
.
Przed: 119 236 259 840 bajtów wolnych
Po: 119 978 229 760 bajtów wolnych
.
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - B0110A88A07BB35860E571431128BEAB