Logi - Sprawdzenie po usuwaniu

Proszę o sprawdzenie czy czegoś nie przeoczyłem:

ComboFix 08-07-24.6 - Piątek 2008-07-26  1:41:57.6 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.736 [GMT 2:00]
Running from: C:\Documents and Settings\Piątek\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-06-25 to 2008-07-25  )))))))))))))))))))))))))))))))
.

2008-07-25 22:36 . 2008-07-25 22:36	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-07-25 22:36 . 2008-07-25 22:36	1,409	--a------	C:\WINDOWS\QTFont.for
2008-07-25 17:33 . 2008-07-23 20:09	38,472	--a------	C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-22 21:49 . 2008-07-22 21:50	10,620,971	--a------	C:\ImportMotion_Portland_2003.3GP
2008-07-22 21:45 . 2008-07-22 21:46	13,040,300	--a------	C:\ImportLife2_Portland_2002.3GP
2008-07-05 21:03 . 2008-07-25 17:57	<DIR>	d-a------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-05 21:03 . 2005-08-25 19:18	118,784	--a------	C:\WINDOWS\system32\MSSTDFMT.DLL
2008-07-05 21:01 . 2008-07-05 21:14	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-07-01 17:40 . 2008-07-01 17:42	8,298,044	--a------	C:\Basshunter - Now You're Gone [2007][SkidVid]_XviD_002.3GP
2008-07-01 17:24 . 2008-07-01 17:24	<DIR>	d--------	C:\Program Files\Blaze Video Magic
2008-07-01 17:24 . 2008-07-01 17:24	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\BlazeVideo

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-25 15:33	---------	d-----w	C:\Program Files\Malwarebytes' Anti-Malware
2008-07-24 19:28	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-07-23 18:09	17,144	----a-w	C:\WINDOWS\system32\drivers\mbam.sys
2008-07-10 06:32	---------	d-----w	C:\Program Files\Common Files\Symantec Shared
2008-07-10 06:32	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-07-10 06:30	---------	d-----w	C:\Program Files\Symantec
2008-07-07 11:12	110,592	----a-w	C:\WINDOWS\system32\imm32.dll
2008-06-21 16:16	---------	d-----w	C:\Program Files\Analog Devices
2008-05-31 17:40	---------	d-----w	C:\Program Files\Unlocker
2008-05-31 17:37	---------	d-----w	C:\Documents and Settings\Piątek\Dane aplikacji\Desktopicon
2008-05-31 16:34	---------	d-----w	C:\Documents and Settings\Piątek\Dane aplikacji\Malwarebytes
2008-05-31 16:34	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
2008-05-31 16:32	---------	d-----w	C:\Program Files\Common Files\Download Manager
2008-04-26 12:15	107,888	----a-w	C:\WINDOWS\system32\CmdLineExt.dll
2006-06-23 06:48	32,768	----a-r	C:\WINDOWS\inf\UpdateUSB.exe
.

(((((((((((((((((((((((((((((   snapshot@2008-07-25_23.55.41.81   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-25 21:19:06	16,384	----atw	C:\WINDOWS\TEMP\Perflib_Perfdata_534.dat
+ 2008-07-25 23:25:22	16,384	----atw	C:\WINDOWS\TEMP\Perflib_Perfdata_534.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-11 00:03 8429568]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352]
"avast!"="C:\Programy\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.ac3filter"= ac3filter.acm
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
--------- 2006-11-22 21:10 151552 C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPlusManager]
--a------ 2007-08-29 11:10 385024 C:\Program Files\iPlus\iPlusChecker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]
-r------- 2006-10-30 14:44 1953792 C:\WINDOWS\system32\JMRaidSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
-r------- 2006-10-30 14:44 36864 C:\WINDOWS\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-05-11 00:03 81920 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMax]
--------- 2006-07-13 07:12 729088 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
-ra------ 2006-12-18 15:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Programy\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-05-11 00:03 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Gry\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=
"C:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
"C:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
"D:\\Gry\\FEAR\\FEAR.exe"=
"D:\\Gry\\FEAR\\FEARMP.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 14:46]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 GtDetectSc;GtDetectSc Service;C:\Program Files\iPlus\Drivers\driver2k\GTMax\GtDetectSc.exe [2007-08-29 11:10]
R2 GtFlashSwitch;GtFlashSwitch Service;C:\Program Files\iPlus\Drivers\driver2k\GTMax\GtFlashSwitch.exe [2007-08-29 11:10]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Programy\EVEREST Corporate Edition\kerneld.wnt [2007-10-17 00:00]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 23:10]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.pl/


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 01:42:30
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\C:\Programy\EVEREST Corporate Edition\kerneld.wnt"
.
Completion time: 2008-07-26  1:42:47
ComboFix-quarantined-files.txt  2008-07-25 23:42:45
ComboFix2.txt  2008-07-25 23:31:26
ComboFix3.txt  2008-07-25 23:21:43
ComboFix4.txt  2008-07-25 22:14:40
ComboFix5.txt  2008-07-25 23:41:53

Pre-Run: 3,701,153,792 bajtów wolnych
Post-Run: 3,692,597,248 bajtów wolnych

132	--- E O F ---	2008-04-13 14:03:29

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 23:10]

Raczej czysto.
Napisałem "raczej", bo powyższa usługa może być albo dobra, albo zła.
Opis "dobrej":
>http://www.bleepingcomputer.com/startups/npf.sys-16912.html
Opis "złej" (Trojan Delf-EQE):
>http://www.castlecops.com/o23list-2558.html
Trudno je odróżnić, bo ich pliki mają identyczne nazwy, ich usługi mają identyczne nazwy, ich ścieżki też są identyczne.

Jeśli chcesz, to możesz sprawdzić ten zaznaczony plik na -> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

ordynat

Sprawdziłem, ale nic nie wykryło. We wcześniejszych logach też występuje ten wpis i z nim jest ok (raczej .
Dzięki za poświęcony czas, pozdrawiam