[log] zamula internet

[ink4sent]

Witam,

Od kilku dni zauwazylem znaczne pogorszenie efektywnosci mojego internetu, strony dluugo sie laduja, zatrzymuja sie w pewnych procentach i za nic nie chca sie zaladowac do konca. Podejrzewam infekcje, antywirus wykryl kilka infekcji. Prosze o sprawdzenie logu.

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:32:07, on 2009-05-18
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\Konnekt\konnekt.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\Valve\Steam.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RAMDrive] "C:\Program Files\FarStone\VirtualDrive\VHD\RDTask.exe"
O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{CFE80E31-84BD-4646-A4B4-BD5A97FBF072}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7213 bytes


[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z OTListIt2

[ink4sent]

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by ankh on 2009-05-18 at 21:41

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-18 21:45:51
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:56,27,2b,32,ff,7d,9c,6e,0c,8d,5d,c3,e2,af,7d,29,b1,75,34,c9,db,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:43,18,91,88,43,2a,50,d4,99,ba,3e,48,be,2f,5e,82,83,7f,e5,2b,3a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:2a,89,ab,53,ff,6e,a6,19,40,2b,37,f5,a6,17,d7,72,c4,e5,2e,2f,5c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:56,27,2b,32,ff,7d,9c,6e,0c,8d,5d,c3,e2,af,7d,29,b1,75,34,c9,db,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000002
"hdf12"=hex:43,18,91,88,43,2a,50,d4,99,ba,3e,48,be,2f,5e,82,83,7f,e5,2b,3a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:2a,89,ab,53,ff,6e,a6,19,40,2b,37,f5,a6,17,d7,72,c4,e5,2e,2f,5c,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Konnekt\\konnekt.exe"="D:\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"="C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu"
"D:\\Valve\\steamapps\\ron_del\\counter-strike\\hl.exe"="D:\\Valve\\steamapps\\ron_del\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Opera\\opera.exe"="C:\\Program Files\\Opera\\opera.exe:*:Enabled:Opera Internet Browser"
"C:\\Documents and Settings\\ankh\\Pulpit\\azereus_4.49_gameback\\gback\\azereus.exe"="C:\\Documents and Settings\\ankh\\Pulpit\\azereus_4.49_gameback\\gback\\azereus.exe:*:Enabled:azereus"
"C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Fri 15 May 2009    10,053,112 A..H. --- "C:\Program Files\Google\Picasa3\setup.exe"

[b]Finished![/b]



Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-05-18 21:48:17 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = C:\Documents and Settings\ankh\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1023,49 Mb Total Physical Memory | 636,54 Mb Available Physical Memory | 62,19% Memory free
2,40 Gb Paging File | 2,15 Gb Available in Paging File | 89,54% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 15,00 Gb Total Space | 5,27 Gb Free Space | 35,17% Space Free | Partition Type: NTFS
Drive D: | 15,00 Gb Total Space | 11,87 Gb Free Space | 79,11% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 0,91 Gb Free Space | 9,05% Space Free | Partition Type: NTFS
Drive F: | 59,05 Gb Total Space | 1,03 Gb Free Space | 1,75% Space Free | Partition Type: NTFS
Drive G: | 30,00 Gb Total Space | 10,55 Gb Free Space | 35,18% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANKH-17B82CD191
Current User Name: ankh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009-03-19 11:44:50 | 00,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009-04-30 23:31:00 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2005-02-24 07:32:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2008-04-14 22:51:32 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\NOTEPAD.EXE
PRC - [2004-06-03 20:51:54 | 00,131,072 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
PRC - [2009-04-30 23:31:00 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009-03-19 11:44:28 | 02,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2005-05-24 23:41:09 | 00,503,808 | ---- | M] (Stamina) -- D:\Konnekt\konnekt.exe
PRC - [2006-12-03 01:14:03 | 00,310,784 | ---- | M] (http://autoconnect.prv.pl) -- C:\Program Files\AutoConnect\AutoConnect.exe
PRC - [2004-02-26 14:43:16 | 00,962,661 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
PRC - [2009-02-06 12:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2009-02-26 10:49:18 | 00,099,328 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2009-05-18 21:48:05 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ankh\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Disabled | Stopped])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009-03-19 11:48:08 | 00,020,680 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv [On_Demand | Stopped])
SRV - [2009-03-19 11:44:50 | 00,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn [Auto | Running])
SRV - [2009-04-26 22:16:56 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2008-11-20 21:18:52 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-04-30 23:31:00 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2006-10-27 00:47:54 | 00,065,824 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service [On_Demand | Stopped])
SRV - [2005-02-24 07:32:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2006-10-26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2008-11-11 09:38:06 | 00,620,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2003-07-17 16:48:44 | 00,046,167 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\adildr.sys -- (ADILOADER [Auto | Stopped])
DRV - [2003-06-24 13:55:56 | 00,127,497 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\DRIVERS\adiusbaw.sys -- (adiusbaw [On_Demand | Running])
DRV - File not found --  -- (catchme [On_Demand | Running])
DRV - [2009-03-19 11:41:38 | 00,113,960 | ---- | M] (ESET) -- C:\WINDOWS\system32\DRIVERS\eamon.sys -- (eamon [Auto | Running])
DRV - [2009-03-19 11:44:34 | 00,107,256 | ---- | M] (ESET) -- C:\WINDOWS\system32\DRIVERS\ehdrv.sys -- (ehdrv [System | Running])
DRV - [2009-03-19 11:45:38 | 00,093,848 | ---- | M] (ESET) -- C:\WINDOWS\system32\DRIVERS\epfwtdir.sys -- (epfwtdir [System | Running])
DRV - [2005-02-24 07:32:00 | 03,454,144 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2004-06-03 10:40:46 | 00,079,360 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus [Boot | Running])
DRV - [2004-05-25 15:58:02 | 00,048,640 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax [On_Demand | Running])
DRV - [2004-05-25 15:58:04 | 00,396,032 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce [On_Demand | Running])
DRV - [2004-04-02 15:40:00 | 00,021,760 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp [Boot | Running])
DRV - [2008-08-26 09:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008-11-20 21:19:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Stopped])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2008-05-02 08:48:55 | 00,062,208 | ---- | M] (Silicon Image, Inc.) -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112 [Boot | Running])
DRV - [2009-05-15 14:59:06 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\usbser.sys -- (usbser [On_Demand | Stopped])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-04-30 23:31:00 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD [2009-05-14 17:04:31 | 00,000,000 | ---D | M]


O1 HOSTS File: (686 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe File not found
O4 - HKLM..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice (ESET)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install File not found
O4 - HKLM..\Run: [RAMDrive] "C:\Program Files\FarStone\VirtualDrive\VHD\RDTask.exe" File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" ()
O4 - HKCU..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe (http://autoconnect.prv.pl)
O4 - HKCU..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart (Stamina)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 768
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 (Google Inc.)
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 (Microsoft Corporation)
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm (www.BitComet.com)
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm (www.BitComet.com)
O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm (www.BitComet.com)
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-04-08 18:54:21 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\AutoRun\command - "" = K:\
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\explore\Command - "" = K:\RECYCLER\INFO.exe -- File not found
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\open\Command - "" = K:\RECYCLER\INFO.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-05-03 13:08:46 | 00,000,000 | ---D | M]

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009-05-18 21:44:04 | 00,000,000 | ---D | C] -- C:\Program Files\xerox
[2009-05-18 21:43:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2009-05-18 21:43:56 | 00,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2009-05-18 21:43:55 | 10,732,74880 | -HS- | C] () -- C:\hiberfil.sys
[2009-05-18 21:41:30 | 00,580,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\user32.dll
[2009-05-18 21:40:07 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2009-05-18 21:36:49 | 00,000,000 | ---D | C] -- C:\SDFix
[2009-05-18 19:03:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2009-05-18 17:31:53 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\HijackThis.lnk
[2009-05-18 17:31:50 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009-05-18 17:07:09 | 05,715,739 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\Fizyka2.rar
[2009-05-18 17:04:36 | 00,282,459 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\Fizyka.rar
[2009-05-16 19:30:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\Dolphin_3089
[2009-05-16 19:03:26 | 04,951,610 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\Dolphin_3089.zip
[2009-05-16 17:17:20 | 00,000,063 | -H-- | C] () -- C:\Documents and Settings\ankh\Moje dokumenty\.picasa.ini
[2009-05-16 17:17:05 | 00,408,287 | ---- | C] () -- C:\Documents and Settings\ankh\Moje dokumenty\Zdjęcie014.jpg
[2009-05-16 16:52:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009-05-16 16:19:35 | 00,000,000 | -H-- | C] () -- C:\Documents and Settings\ankh\Moje dokumenty\Default.rdp
[2009-05-16 16:01:21 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro2
[2009-05-16 13:03:08 | 00,000,678 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\jv16 PowerTools 2009.lnk
[2009-05-16 13:02:53 | 00,000,000 | ---D | C] -- C:\Program Files\jv16 PowerTools 2009
[2009-05-16 12:52:48 | 00,000,022 | ---- | C] () -- C:\WINDOWS\Wininit.ini
[2009-05-16 12:52:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\FarStone
[2009-05-16 12:03:34 | 00,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job
[2009-05-16 12:03:34 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2009-05-15 23:50:34 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009-05-15 23:40:40 | 00,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009-05-15 23:25:51 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2009-05-15 23:24:27 | 00,000,000 | ---D | C] -- C:\Instalki
[2009-05-15 23:20:21 | 00,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-15 15:46:08 | 00,000,000 | ---- | C] () -- C:\WINDOWS\dvdcreator.INI
[2009-05-15 15:44:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\FarStone
[2009-05-15 15:41:20 | 00,000,261 | ---- | C] () -- C:\inVHDDrvLog.dat
[2009-05-15 15:38:36 | 00,000,000 | ---D | C] -- C:\Program Files\FarStone
[2009-05-15 15:37:14 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\unVHDDrvExe.exe
[2009-05-15 15:37:14 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\inVHDDrvExe.exe
[2009-05-15 15:01:34 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar
[2009-05-15 13:56:09 | 00,000,000 | ---D | C] -- C:\Program Files\Alcohol Soft
[2009-05-14 22:58:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\kuman
[2009-05-14 22:39:03 | 00,018,808 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\kuman.rar
[2009-05-14 17:04:30 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009-05-14 16:53:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Eset
[2009-05-14 15:27:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\skany chemia calepolrocze
[2009-05-14 15:23:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\Skany odpowiedzi Zbior Zadan kl II
[2009-05-14 13:58:59 | 00,000,000 | ---D | C] -- C:\Dev-Cpp
[2009-05-13 17:40:49 | 00,000,000 | ---D | C] -- C:\ftp
[2009-05-13 17:19:07 | 00,000,000 | ---D | C] -- C:\DREW
[2009-05-13 17:18:31 | 00,000,376 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-13 17:17:54 | 00,001,137 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\UC.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\RAR.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\PKZIP.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\PKUNZIP.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\NOCLOSE.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\LHA.PIF
[2009-05-13 17:17:54 | 00,000,545 | ---- | C] () -- C:\WINDOWS\ARJ.PIF
[2009-05-13 17:17:54 | 00,000,000 | ---D | C] -- C:\totalcmd
[2009-05-12 09:28:06 | 00,000,000 | ---D | C] -- C:\Program Files\NAPI-PROJEKT
[2009-05-12 09:28:04 | 00,000,000 | ---D | C] -- C:\Program Files\ALLPlayer
[2009-05-05 19:02:51 | 20,036,627 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\CZBH vs ZK de_train Lan#1 final.dem
[2009-05-03 22:48:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\dekoder_4.49
[2009-05-03 19:58:36 | 00,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2009-05-03 19:46:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\AZEREUS GAME BACK
[2009-05-02 23:21:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\NoNameScript
[2009-05-02 23:20:14 | 00,000,000 | ---D | C] -- C:\Program Files\mIRC
[2009-05-02 23:20:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\mIRC
[2009-04-30 23:30:57 | 00,000,000 | ---D | C] -- C:\Program Files\Java
[2009-04-30 23:29:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\Sun
[2009-04-30 16:48:09 | 00,000,000 | ---D | C] -- C:\Program Files\PuTTY
[2009-04-29 22:23:11 | 00,093,271 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\Sciaga historia.docx
[2009-04-28 20:17:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Pulpit\Skany Fizyka Piszczalka
[2009-04-28 18:57:55 | 00,367,145 | ---- | C] () -- C:\Documents and Settings\ankh\Pulpit\plan001.jpg
[2009-04-26 22:59:28 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009-04-26 22:23:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
[2009-04-26 22:21:25 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009-04-26 22:16:56 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2009-04-26 14:00:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\Ventrilo
[2009-04-26 14:00:20 | 00,000,000 | ---D | C] -- C:\Program Files\VentriloMIX
[2009-04-26 14:00:05 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\hattric
[2009-04-25 16:09:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Ustawienia lokalne\Apps
[2009-04-25 13:17:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\teamspeak2
[2009-04-25 13:17:11 | 00,034,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\lhacm.acm
[2009-04-25 13:17:09 | 00,000,000 | ---D | C] -- C:\Program Files\Teamspeak2_RC2
[2009-04-23 18:15:03 | 00,584,704 | ---- | C] () -- C:\Documents and Settings\ankh\Moje dokumenty\Oprogramowanie CMS do zarządzania treścią strony internetowej biura.ppt
[2009-04-23 16:16:55 | 00,032,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msonpmon.dll
[2009-04-23 16:15:23 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2009-04-23 16:15:16 | 00,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2009-04-23 16:14:59 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2009-04-23 16:14:59 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2009-04-23 16:14:29 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2009-04-23 16:12:48 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8
[2009-04-23 16:12:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2009-04-23 16:12:11 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2009-04-23 16:12:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
[2009-04-23 16:11:58 | 00,000,000 | RH-D | C] -- C:\MSOCache
[2009-04-23 15:10:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Dane aplikacji\Obsidium
[2009-04-23 15:03:05 | 01,009,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Mschrt20.ocx
[2009-04-23 15:03:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ankh\Moje dokumenty\eXtreme Movie Manager
[2009-04-23 14:59:09 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009-04-23 14:58:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009-04-23 13:40:26 | 00,000,030 | ---- | C] () -- C:\WINDOWS\RefreshLock.ini
[2009-04-18 03:07:16 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-04-16 19:24:06 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009-04-08 19:09:40 | 00,000,154 | ---- | C] () -- C:\WINDOWS\adidsl.ini
[2009-04-08 19:09:40 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini
[2009-04-08 19:09:35 | 00,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll
[2009-04-08 19:09:35 | 00,000,998 | ---- | C] () -- C:\WINDOWS\adiras.ini
[2009-04-08 19:09:34 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\adadix16.dll
[2008-05-03 09:24:01 | 00,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005-02-24 07:32:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2001-07-22 00:16:20 | 00,000,730 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009-05-18 21:47:05 | 00,021,828 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-05-18 21:44:31 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2009-05-18 21:43:59 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-05-18 21:43:57 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\ankh\Ustawienia lokalne\desktop.ini
[2009-05-18 21:43:56 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-05-18 21:43:55 | 10,732,74880 | -HS- | M] () -- C:\hiberfil.sys
[2009-05-18 21:42:11 | 00,000,686 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS
[2009-05-18 21:41:30 | 00,580,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\user32.dll
[2009-05-18 17:31:53 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\HijackThis.lnk
[2009-05-18 17:07:54 | 05,715,739 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\Fizyka2.rar
[2009-05-18 17:04:36 | 00,282,459 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\Fizyka.rar
[2009-05-18 15:13:01 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-16 19:07:40 | 04,951,610 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\Dolphin_3089.zip
[2009-05-16 17:21:11 | 00,011,776 | -HS- | M] () -- C:\Documents and Settings\ankh\Moje dokumenty\Thumbs.db
[2009-05-16 17:18:48 | 00,000,063 | -H-- | M] () -- C:\Documents and Settings\ankh\Moje dokumenty\.picasa.ini
[2009-05-16 16:19:35 | 00,000,000 | -H-- | M] () -- C:\Documents and Settings\ankh\Moje dokumenty\Default.rdp
[2009-05-16 16:17:46 | 00,000,730 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-05-16 16:17:46 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-05-16 16:17:46 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-05-16 13:03:08 | 00,000,678 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\jv16 PowerTools 2009.lnk
[2009-05-16 12:52:48 | 00,000,022 | ---- | M] () -- C:\WINDOWS\Wininit.ini
[2009-05-15 23:40:40 | 00,009,728 | ---- | M] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009-05-15 23:20:21 | 00,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-15 15:46:08 | 00,000,000 | ---- | M] () -- C:\WINDOWS\dvdcreator.INI
[2009-05-15 15:42:12 | 00,000,261 | ---- | M] () -- C:\inVHDDrvLog.dat
[2009-05-15 14:59:06 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-05-15 00:04:35 | 00,001,137 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-05-15 00:04:08 | 00,000,376 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-14 22:39:03 | 00,018,808 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\kuman.rar
[2009-05-12 09:24:28 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009-05-08 16:55:53 | 00,104,584 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\050509200057.jpg
[2009-05-07 09:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009-05-05 19:05:27 | 20,036,627 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\CZBH vs ZK de_train Lan#1 final.dem
[2009-04-29 22:23:11 | 00,093,271 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\Sciaga historia.docx
[2009-04-28 18:57:55 | 00,367,145 | ---- | M] () -- C:\Documents and Settings\ankh\Pulpit\plan001.jpg
[2009-04-24 12:40:32 | 00,266,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-04-23 18:15:04 | 00,584,704 | ---- | M] () -- C:\Documents and Settings\ankh\Moje dokumenty\Oprogramowanie CMS do zarządzania treścią strony internetowej biura.ppt
[2009-04-23 18:09:55 | 00,065,024 | -HS- | M] () -- C:\Documents and Settings\ankh\Pulpit\Thumbs.db
[2009-04-23 15:01:13 | 00,865,792 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-04-23 15:01:13 | 00,448,004 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-04-23 15:01:13 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-04-23 15:01:13 | 00,074,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-04-23 15:01:13 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-04-23 13:40:26 | 00,000,030 | ---- | M] () -- C:\WINDOWS\RefreshLock.ini
< End of report >


Kod: Zaznacz wszystko

OTListIt Extras logfile created on: 2009-05-18 21:48:17 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = C:\Documents and Settings\ankh\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1023,49 Mb Total Physical Memory | 636,54 Mb Available Physical Memory | 62,19% Memory free
2,40 Gb Paging File | 2,15 Gb Available in Paging File | 89,54% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 15,00 Gb Total Space | 5,27 Gb Free Space | 35,17% Space Free | Partition Type: NTFS
Drive D: | 15,00 Gb Total Space | 11,87 Gb Free Space | 79,11% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 0,91 Gb Free Space | 9,05% Space Free | Partition Type: NTFS
Drive F: | 59,05 Gb Total Space | 1,03 Gb Free Space | 1,75% Space Free | Partition Type: NTFS
Drive G: | 30,00 Gb Total Space | 10,55 Gb Free Space | 35,18% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANKH-17B82CD191
Current User Name: ankh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[color=orange]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"7304:TCP" = 7304:TCP:*:Enabled:BitComet 7304 TCP
"7304:UDP" = 7304:UDP:*:Enabled:BitComet 7304 UDP

[color=orange]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
[2005-05-24 23:41:09 | 00,503,808 | ---- | M] (Stamina) -- D:\Konnekt\konnekt.exe:*:Enabled:Konnekt - Core
[2009-03-09 11:32:34 | 02,564,408 | ---- | M] (www.BitComet.com) -- C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client
[2009-04-10 11:12:58 | 09,818,728 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu
[2009-05-17 13:23:49 | 00,086,077 | ---- | M] (Valve) -- D:\Valve\steamapps\ron_del\counter-strike\hl.exe:*:Enabled:Half-Life Launcher
[2006-10-27 15:16:48 | 12,813,096 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
[2006-10-27 15:37:44 | 00,338,216 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove
[2006-10-27 15:03:04 | 01,018,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote
[2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[2008-08-08 11:25:06 | 02,808,832 | ---- | M] (mIRC Co. Ltd.) -- C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC
[2009-02-26 10:49:18 | 00,099,328 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser
File not found -- C:\Documents and Settings\ankh\Pulpit\azereus_4.49_gameback\gback\azereus.exe:*:Enabled:azereus
[2008-07-29 07:04:00 | 01,091,768 | ---- | M] (C. Ghisler & Co.) -- C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows

[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C8199EC-A8A1-4F73-B5AC-753E9D23E2F6}" = Adobe Setup
"{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840
"{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2}" = Adobe Asset Services CS3
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7C3D7061-338F-445A-AF6A-4BF5AC6DDCB5}" = ESET NOD32 Antivirus
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (Polish) 12
"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007
"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007
"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007
"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007
"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007
"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007
"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007
"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007
"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007
"{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2EF591E-90FE-4501-B890-9C664F657674}" = Adobe Dreamweaver CS3
"{AC76BA86-7AD7-1045-7B44-A91000000001}" = Adobe Reader 9.1 - Polish
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{D848D140-41C3-4A53-86D8-E866A100B4CD}" = PC Connectivity Solution
"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"504244733D18C8F63FF584AEB290E3904E791693" = Pakiet sterowników systemu Windows - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_f600d30aaa4d8375e3b195bdb240047" = Adobe Dreamweaver CS3
"ALLPlayer_is1" = ALLPlayer V3.X
"AutoConnect" = AutoConnect v0.1.3.1
"BitComet" = BitComet 1.10
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HijackThis" = HijackThis 2.0.2
"jv16 PowerTools 2009_is1" = jv16 PowerTools 2009
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"mIRC" = mIRC
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"Nowe Gadu-Gadu" = Nowe Gadu-Gadu
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"PuTTY_is1" = PuTTY version 0.60
"RealAlt_is1" = Real Alternative 1.9.0
"Skuteczne Uwodzenie 2_is1" = Skuteczne Uwodzenie 2
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Totalcmd" = Total Commander (Remove or Repair)
"VentriloMIX" = VentriloMIX
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WinRAR archiver" = WinRAR archiver
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5

[color=orange]========== HKEY_CURRENT_USER Uninstall List ==========[/color]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"NoNameScript" = NNScript

[color=orange]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2009-05-16 06:51:59 | Computer Name = ANKH-17B82CD191 | Source = MsiInstaller | ID = 11704
Description = Product: VirtualDrive Pro -- Error 1704.An installation for Nokia
Connectivity Cable Driver is currently suspended.  You must undo the changes made
by that installation to continue.  Do you want to undo those changes?

[ System Events ]
Error - 2009-05-16 06:54:03 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%1058

Error - 2009-05-16 06:54:05 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   Cdrom  FVXSCSI  Imapi  PxHelp20  redbook

Error - 2009-05-16 10:40:04 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%1058

Error - 2009-05-16 10:40:06 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   Cdrom  FVXSCSI  Imapi  PxHelp20  redbook

Error - 2009-05-16 10:58:24 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%1058

Error - 2009-05-16 10:58:25 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   Cdrom  FVXSCSI  Imapi  PxHelp20  redbook

Error - 2009-05-16 11:00:27 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%1058

Error - 2009-05-16 11:00:29 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   Cdrom  FVXSCSI  Imapi  PxHelp20  redbook

Error - 2009-05-17 05:23:22 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys)
z powodu następującego błędu:   %%1058

Error - 2009-05-17 05:23:24 | Computer Name = ANKH-17B82CD191 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   Cdrom  FVXSCSI  Imapi  PxHelp20  redbook


< End of report >


[wojtas]

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe File not found
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\AutoRun\command - "" = K:\
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\explore\Command - "" = K:\RECYCLER\INFO.exe -- File not found
O33 - MountPoints2\{9f75cf7e-408a-11de-b128-4d6564696130}\Shell\open\Command - "" = K:\RECYCLER\INFO.exe -- File not found

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .


1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

Malwarebytes Anti-Malware.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

[piotrplenzler]

TEMAT USUNIĘTY

[wojtas]

czysty sadze

[ink4sent]

Reszte logow wrzuce jutro.
steampowered.com ..

[piotrplenzler]

jabym sprowdził internetowym skanerem

Dodano 20 Maj 2009 17:03:
np. KASPERSKY

Dodano 13 Cze 2009 08:13:
http://www.eset.pl/onlinescan
MASZ TU SKANER I WEZ PRZESKANUJ CAŁY KOMPUTER
MUSISZ URUCHOMIĆ W IE