Problem z zfixowaniem w hijackthis i odnawianym się plikiem

**Posty:** 71 · przez **maly814** 09 Cze 2009, 12:43

Mam problem nie mogę zfixować jednego wpisu w HijackThis
Wpis ten jest wirusem(sprawdzałem nie jednym antywirem)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:19:11, on 2009-06-09 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Kerio\Personal Firewall\persfw.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /S O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{EF8864C3-CC95-4588-B2DF-53F57961FB67}: NameServer = 213.241.79.37 83.238.255.76 O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe -- End of file - 4567 bytes

Mianowicie chodzi mi o wpis :
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
Plik wowfx.dll jest zawirusowany i za każdym razem co cenzura! go z kompa pojawia się on po ponownym uruchomieniu
Próbowałem takimi programami jak :Spybot,Ad-aware,Nod 32 2,5,Mks Skaner Online
Na starcie systemu uruchamiają mi się różne procesy(niechciane)

Gdy odznaczyłem procesy żeby nie uruchamiały się na starcie Windowsa było wszystko ok
ale po paru włączeniach kompa wchodzę w Start>>>Uruchom>>>msconfig to wszystko wygląda tak jak by nikt tego nigdy nie ruszał

Kolorem czerwonym zaznaczyłem potencjalne wirusy
A czarnym zbędne wpisy
Proszę o pomoc bo nie chce robić formata

**Posty:** 18165 · przez **wojtas** 09 Cze 2009, 12:53

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z OTL

**Posty:** 71 · przez **maly814** 09 Cze 2009, 16:28

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Marcin on 2009-06-09 at 15:56 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Resetting SecurityProviders Value Resetting AppInit_DLLs value Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Program Files\altcmd\uninstall.bat - Deleted C:\WINDOWS\system32\wowfx.dll - Deleted Folder C:\Program Files\altcmd - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-09 15:59:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:ad,a2,79,64,d5,f5,4d,31,82,2a,cd,43,43,46,86,23,ce,05,6c,76,d3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,32,c7,12,46,6b,17,ae,a8,ce,21,45,f7,32,c6,11,02,84,.. "khjeh"=hex:7a,6b,b5,e8,cf,ed,a7,99,ca,4f,11,cb,a5,8f,f4,e7,5e,34,55,a9,57,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:0a,dc,c2,88,d1,d7,6f,d7,b8,01,77,1a,14,ba,e0,c1,28,fc,8d,6c,7c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:d1,b1,da,dd,e2,3e,4e,98,44,85,72,9c,67,ec,41,c6,ac,72,91,1e,f9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:ad,a2,79,64,d5,f5,4d,31,82,2a,cd,43,43,46,86,23,ce,05,6c,76,d3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,32,c7,12,46,6b,17,ae,a8,ce,21,45,f7,32,c6,11,02,84,.. "khjeh"=hex:7a,6b,b5,e8,cf,ed,a7,99,ca,4f,11,cb,a5,8f,f4,e7,5e,34,55,a9,57,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:0a,dc,c2,88,d1,d7,6f,d7,b8,01,77,1a,14,ba,e0,c1,28,fc,8d,6c,7c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:d1,b1,da,dd,e2,3e,4e,98,44,85,72,9c,67,ec,41,c6,ac,72,91,1e,f9,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Disabled:Apache HTTP Server" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Disabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Disabled:hpoews01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Disabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Disabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Disabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Disabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Disabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Disabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Disabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Disabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Disabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Disabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Disabled:hpzwiz01.exe" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "D:\\Gry\\Pes 09\\pes2009.exe"="D:\\Gry\\Pes 09\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "D:\\Gry\\FM09\\fm.exe"="D:\\Gry\\FM09\\fm.exe:*:Enabled:Football Manager 2009" "D:\\Gry\\Pro Evolution Soccer 2009\\pes2009.exe"="D:\\Gry\\Pro Evolution Soccer 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "D:\\Gry\\Wadca Piercienia-Bitwa o —r˘dziemie\\game.dat"="D:\\Gry\\Wadca Piercienia-Bitwa o —r˘dziemie\\game.dat:*:Enabled:Bitwa o —r˘dziemie (tm)" "D:\\Gry\\KONAMI\\PES 2009\\pes2009.exe"="D:\\Gry\\KONAMI\\PES 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Disabled:Internet Explorer" "C:\\WINDOWS\\system32\\nvsvc32.exe"="C:\\WINDOWS\\system32\\nvsvc32.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\services.exe"="C:\\WINDOWS\\system32\\services.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"="C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe"="C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\lsass.exe"="C:\\WINDOWS\\system32\\lsass.exe:*:Enabled:@xpsp2res.dll,-22019" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:Enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:@xpsp2res.dll,-22019" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\nvsvc32.exe"="C:\\WINDOWS\\system32\\nvsvc32.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\services.exe"="C:\\WINDOWS\\system32\\services.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"="C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe"="C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\lsass.exe"="C:\\WINDOWS\\system32\\lsass.exe:*:Enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sun 17 May 2009 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 26 May 2009 2,451,968 ..SH. --- "C:\Documents and Settings\Marcin\Pulpit\GgU6E7_cfdg.exe" Sat 30 May 2009 2,451,968 ..SH. --- "C:\Documents and Settings\Marcin\Pulpit\QbK4Hq_cfdg.exe" Thu 5 Feb 2009 2,451,968 A.SH. --- "C:\Documents and Settings\Marcin\Pulpit\YiI157_cfdg.exe" Sun 17 May 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sat 6 Jun 2009 2,158 ...HR --- "C:\Documents and Settings\Marcin\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" [b]Finished![/b]

Dodano 09.06.2009 15:28:59:

Kod: Zaznacz wszystko: OTL logfile created on: 2009-06-09 16:13:41 - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,23 Mb Total Physical Memory | 564,34 Mb Available Physical Memory | 55,15% Memory free 2,40 Gb Paging File | 2,05 Gb Available in Paging File | 85,49% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 14,65 Gb Total Space | 5,71 Gb Free Space | 38,98% Space Free | Partition Type: NTFS Drive D: | 97,13 Gb Total Space | 28,03 Gb Free Space | 28,86% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KOMPUTER Current User Name: Marcin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2009-05-28 19:53:37 | 01,005,904 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe PRC - [2008-04-14 23:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-03-04 18:35:55 | 00,507,904 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe PRC - [2009-03-27 10:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2003-05-13 03:38:52 | 00,401,408 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall\persfw.exe PRC - [2009-03-04 18:35:55 | 00,921,600 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32kui.exe PRC - [2009-05-28 19:53:38 | 00,518,488 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2009-03-05 17:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PRC - [2008-04-14 23:51:46 | 00,139,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\taskmgr.exe PRC - [2007-02-13 17:20:50 | 01,205,840 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe PRC - [2001-10-26 17:30:04 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe PRC - [2008-04-14 23:51:52 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2008-04-14 23:51:52 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2009-04-28 18:57:03 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-06-09 16:13:31 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2006-10-20 22:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2008-04-14 23:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2006-10-30 04:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2009-05-28 19:53:37 | 01,005,904 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Auto | Running]) SRV - [2006-04-24 15:25:44 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Disabled | Stopped]) SRV - [2006-10-30 04:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2009-03-04 18:35:55 | 00,507,904 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn [Auto | Running]) SRV - [2009-03-27 10:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [Disabled | Stopped]) SRV - [2003-05-13 03:38:52 | 00,401,408 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall\persfw.exe -- (PersFw [Auto | Running]) SRV - [2004-09-29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12 [Disabled | Stopped]) SRV - [2009-06-06 21:52:07 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Disabled | Stopped]) SRV - [2009-05-07 12:11:11 | 00,183,112 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB [Disabled | Stopped]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2006-07-02 00:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2007-06-29 14:47:34 | 00,034,304 | ---- | M] (AMD, Inc.) -- C:\WINDOWS\system32\DRIVERS\AmdLLD.sys -- (AmdLLD [On_Demand | Running]) DRV - [2009-03-04 18:35:55 | 00,502,368 | ---- | M] (Eset ) -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON [Auto | Running]) DRV - [2006-10-17 18:00:00 | 00,012,664 | R--- | M] () -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO [System | Running]) DRV - [2006-11-10 15:08:50 | 00,024,064 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\ATITool.sys -- (ATITool [System | Stopped]) DRV - [2007-01-04 14:47:48 | 00,069,656 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\e4ldr.sys -- (E4LOADER [Auto | Stopped]) DRV - [2007-01-04 14:48:04 | 00,104,344 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Running]) DRV - [2008-09-17 15:14:00 | 00,027,672 | R--- | M] (EnTech Taiwan) -- C:\WINDOWS\system32\DRIVERS\ENTECH.sys -- (ENTECH [On_Demand | Stopped]) DRV - [2002-04-15 13:28:32 | 00,102,912 | ---- | M] () -- C:\WINDOWS\system32\Drivers\fwdrv.sys -- (fwdrv [System | Running]) DRV - [2009-02-26 22:12:43 | 00,025,280 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\system32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Running]) DRV - [2008-04-13 23:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2005-03-08 06:43:25 | 00,051,120 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped]) DRV - [2005-03-08 06:43:26 | 00,016,496 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped]) DRV - [2005-03-08 06:43:27 | 00,021,744 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped]) DRV - [2007-07-10 03:56:00 | 04,449,280 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2009-04-21 22:33:26 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd [Boot | Running]) DRV - [2004-08-12 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2009-03-27 10:03:00 | 06,280,416 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2006-10-18 10:31:38 | 00,105,472 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2007-05-21 04:43:08 | 00,046,080 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Stopped]) DRV - [2007-05-21 04:43:12 | 00,019,968 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2009-05-07 12:11:32 | 00,138,184 | ---- | M] () -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK [On_Demand | Stopped]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-08-20 19:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2009-02-25 19:55:00 | 00,009,088 | ---- | M] () -- C:\Program Files\RivaTuner v2.24\RivaTuner32.sys -- (RivaTuner32 [On_Demand | Running]) DRV - [2008-04-13 23:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2005-08-10 14:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running]) DRV - [2005-05-16 15:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running]) DRV - [2005-08-10 16:06:28 | 00,019,968 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02 [Boot | Running]) DRV - [2005-11-03 16:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running]) DRV - [2009-01-13 20:10:37 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://www.wyborcza.pl/0,0.html?p=007" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-01-13 20:36:35 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-04-29 08:48:33 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-05-23 15:47:37 | 00,000,000 | ---D | M] [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\0pfjf1bo.default\extensions [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\0pfjf1bo.default\extensions\{b66bc4c3-6d25-4a10-8c59-01daa9063051} [2009-06-09 00:31:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\992nji21.default\extensions [2009-01-13 20:29:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\992nji21.default\extensions\{b66bc4c3-6d25-4a10-8c59-01daa9063051} [2009-01-13 20:29:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\b1mppx8z.default\extensions [2009-01-13 20:29:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\d5w67h3p.default\extensions [2009-01-13 20:29:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\uy19nzv6.default\extensions [2009-06-09 00:31:57 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-04-28 18:57:03 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-01-13 20:36:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009-05-24 02:16:31 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009-04-28 18:57:03 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-04-28 18:57:03 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2006-06-03 18:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: (686 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE (Eset ) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /S () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\imon.dll (Eset ) O15 - HKLM\..Trusted Domains: 51 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control) O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O29 - HKLM SecurityProviders - (snapapi32.dll) - File not found O29 - HKLM SecurityProviders - (digest32.dll) - C:\WINDOWS\system32\digest32.dll () O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-01-13 15:43:47 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-06-09 16:13:31 | 00,000,000 | ---D | M] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [2009-06-09 16:13:08 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-06-09 15:42:00 | 00,000,000 | ---D | C] -- C:\SDFix [2009-06-09 09:24:51 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\xlib254.dll [2009-06-09 09:24:51 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\append.dll [2009-06-07 12:46:50 | 00,962,612 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc42d.dll [2009-06-07 12:46:50 | 00,434,252 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCRTD.DLL [2009-06-07 12:46:48 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll [2009-06-07 12:46:47 | 00,012,664 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2009-06-07 12:46:44 | 00,000,000 | ---D | C] -- C:\Program Files\ASUS [2009-06-04 18:20:20 | 00,000,640 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Mp3 Knife.lnk [2009-06-04 18:20:19 | 00,609,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comctl32.ocx [2009-06-04 18:20:19 | 00,152,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comdlg32.ocx [2009-06-04 18:20:18 | 00,000,000 | ---D | C] -- C:\Program Files\Mp3 Knife [2009-06-03 11:28:17 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0 [2009-06-03 07:27:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2009-05-31 23:21:24 | 00,033,792 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Thumbs.db [2009-05-31 23:20:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Dane aplikacji\VSO [2009-05-31 23:19:21 | 00,000,773 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\VSO Image Resizer.lnk [2009-05-31 23:19:13 | 00,000,000 | ---D | C] -- C:\Program Files\VSO [2009-05-30 10:28:16 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\QbK4Hq_cfdg.exe [2009-05-29 16:36:32 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys [2009-05-29 16:36:32 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbser.sys [2009-05-29 16:36:15 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01007.Wdf [2009-05-29 16:36:14 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2009-05-29 16:36:08 | 00,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll [2009-05-29 16:31:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Nokia [2009-05-29 16:30:58 | 00,091,136 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcls.dll [2009-05-29 16:28:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-05-27 21:55:07 | 00,042,496 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Allegro.doc [2009-05-26 21:08:25 | 00,000,000 | ---D | C] -- C:\WINDOWS\.jagex_cache_32 [2009-05-26 11:07:18 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\GgU6E7_cfdg.exe [2009-05-24 14:51:06 | 25,702,352 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\103 ciasta siostry Anastazji.pdf [2009-05-24 02:04:26 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\digest32.dll [2009-05-23 15:47:16 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe [2009-05-21 21:03:34 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Moja muzyka [2009-05-14 21:44:58 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Moje obrazy [2009-05-14 20:32:26 | 02,210,304 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Radogoszcz.doc [2009-05-13 21:10:24 | 00,770,048 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CDDBUISony.dll [2009-05-13 21:10:24 | 00,589,824 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CddbMusicIDSony.dll [2009-05-13 21:10:24 | 00,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll [2009-05-13 21:10:24 | 00,073,728 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CddbLinkSony.dll [2009-05-13 21:10:23 | 00,655,360 | ---- | C] (Gracenote, Inc.) -- C:\WINDOWS\System32\CDDBControlSony.dll [2009-05-13 21:09:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sony Corporation [2009-05-13 21:08:50 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Sony Shared [2009-05-13 15:41:10 | 00,000,009 | ---- | C] () -- C:\WINDOWS\nfsc_patch.ini [2009-05-12 12:31:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Wos [2009-05-07 01:30:12 | 00,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-04-27 19:54:50 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-04-13 19:55:32 | 00,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys [2009-04-04 13:12:02 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009-03-27 10:03:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2009-03-27 10:03:00 | 01,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2009-03-27 10:03:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2009-03-27 10:03:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2009-03-22 22:40:27 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\Alphablending.dll [2009-03-16 14:55:50 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\drivers\FWDRV.SYS [2009-03-10 15:46:44 | 00,000,039 | ---- | C] () -- C:\WINDOWS\TDEVXCW60.DLL [2009-03-10 15:46:44 | 00,000,039 | ---- | C] () -- C:\WINDOWS\System32\TEVPXCW60.DLL [2009-03-10 15:46:44 | 00,000,038 | ---- | C] () -- C:\WINDOWS\iltwain.ini [2009-02-06 11:25:10 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-02-06 11:25:01 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-02-06 11:25:01 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-02-06 11:25:01 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-02-06 11:24:52 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-02-06 11:24:52 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-01-18 13:22:16 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-01-17 19:15:47 | 00,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\NVStrap.sys [2009-01-13 23:30:45 | 00,000,035 | ---- | C] () -- C:\WINDOWS\A4W.INI [2009-01-13 20:32:46 | 00,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini [2009-01-13 20:32:46 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini [2009-01-13 20:32:40 | 00,000,990 | ---- | C] () -- C:\WINDOWS\adiras.ini [2009-01-13 20:32:37 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-01-13 20:32:37 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-01-13 20:10:36 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-01-13 18:38:12 | 00,015,382 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini [2009-01-13 18:37:54 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2009-01-13 18:37:53 | 00,015,133 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-01-13 18:37:44 | 00,012,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-10-07 10:13:30 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2008-10-07 10:13:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll [2008-01-09 16:01:48 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini [2006-11-10 15:08:50 | 00,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys [2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001-07-21 22:16:20 | 00,000,737 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2001-07-06 16:30:02 | 00,003,234 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI [1996-04-03 21:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [2009-06-09 16:13:31 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-06-09 16:11:35 | 00,215,383 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-06-09 16:11:02 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\desktop.ini [2009-06-09 16:10:54 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-06-09 16:10:06 | 00,000,737 | ---- | M] () -- C:\WINDOWS\win.ini [2009-06-09 16:10:06 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-06-09 16:10:06 | 00,000,223 | RHS- | M] () -- C:\boot.ini [2009-06-09 15:56:24 | 00,000,686 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS [2009-06-09 09:07:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-06-07 12:45:35 | 00,015,133 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini [2009-06-06 21:52:07 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe [2009-06-06 19:07:25 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-06-05 22:57:14 | 00,307,163 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090608-001420.backup [2009-06-04 20:44:42 | 00,000,048 | ---- | M] () -- C:\WINDOWS\System32\imon1.dat [2009-06-04 18:20:20 | 00,000,640 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Mp3 Knife.lnk [2009-06-02 22:20:52 | 00,001,620 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\RivaTuner.lnk [2009-06-01 18:11:10 | 00,000,620 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Dune 2000.lnk [2009-05-31 23:24:33 | 00,033,792 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Thumbs.db [2009-05-31 23:19:21 | 00,000,773 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\VSO Image Resizer.lnk [2009-05-30 10:28:16 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\QbK4Hq_cfdg.exe [2009-05-29 16:38:07 | 00,484,978 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-05-29 16:38:07 | 00,427,728 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-05-29 16:38:07 | 00,082,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-05-29 16:38:07 | 00,066,512 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-05-29 16:38:06 | 01,074,524 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-05-29 16:36:15 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01007.Wdf [2009-05-29 16:36:14 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2009-05-28 23:38:43 | 00,042,496 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Allegro.doc [2009-05-28 20:10:49 | 00,306,753 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090605-225714.backup [2009-05-28 19:54:15 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe [2009-05-26 11:07:18 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\GgU6E7_cfdg.exe [2009-05-24 14:54:27 | 25,702,352 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\103 ciasta siostry Anastazji.pdf [2009-05-24 02:19:39 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-21 20:18:30 | 00,306,475 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090528-201049.backup [2009-05-15 23:52:06 | 00,000,386 | ---- | M] () -- C:\WINDOWS\tasks\NSSstub.job [2009-05-14 23:05:29 | 02,210,304 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Radogoszcz.doc [2009-05-14 00:20:41 | 00,306,116 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090521-201830.backup [2009-05-13 15:41:10 | 00,000,009 | ---- | M] () -- C:\WINDOWS\nfsc_patch.ini [2009-05-13 15:07:33 | 00,000,594 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\pes2009.lnk [color=orange]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:CB0AACC9 < End of report >

Dodano 09.06.2009 15:29:48:
Gdy system się załadował wcisnąłem Ctrl+Alt+delete i niechciane procesy są nadal

**Posty:** 18165 · przez **wojtas** 09 Cze 2009, 18:48

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O29 - HKLM SecurityProviders - (snapapi32.dll) - File not found
O29 - HKLM SecurityProviders - (digest32.dll) - C:\WINDOWS\system32\digest32.dll ()

:Files
C:\WINDOWS\System32\xlib254.dll
C:\WINDOWS\System32\append.dll
C:\WINDOWS\system32\digest32.dll

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 71 · przez **maly814** 09 Cze 2009, 19:08

Kod: Zaznacz wszystko: ========== OTL ========== Process explorer.exe killed successfully! Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:snapapi32.dll deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:digest32.dll deleted successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\digest32.dll C:\WINDOWS\system32\digest32.dll NOT unregistered. C:\WINDOWS\system32\digest32.dll moved successfully. ========== FILES ========== C:\WINDOWS\System32\xlib254.dll moved successfully. C:\WINDOWS\System32\append.dll moved successfully. File\Folder C:\WINDOWS\system32\digest32.dll not found. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\"SecurityProviders"|"msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" /E : value set successfully! ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Marcin\Ustawienia lokalne\Temp\etilqs_QrNCMVluAiBUxG9CfziC scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_6f8.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06092009_190358 Files moved on Reboot... File C:\Documents and Settings\Marcin\Ustawienia lokalne\Temp\etilqs_QrNCMVluAiBUxG9CfziC not found! File C:\WINDOWS\temp\Perflib_Perfdata_6f8.dat not found! Registry entries deleted on Reboot...

Dodano 09.06.2009 18:08:43:

Kod: Zaznacz wszystko: OTL logfile created on: 2009-06-09 19:06:53 - Run 2 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,23 Mb Total Physical Memory | 611,94 Mb Available Physical Memory | 59,80% Memory free 2,40 Gb Paging File | 2,10 Gb Available in Paging File | 87,41% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 14,65 Gb Total Space | 5,71 Gb Free Space | 38,98% Space Free | Partition Type: NTFS Drive D: | 97,13 Gb Total Space | 26,02 Gb Free Space | 26,79% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KOMPUTER Current User Name: Marcin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2009-05-28 19:53:37 | 01,005,904 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe PRC - [2008-04-14 23:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-03-04 18:35:55 | 00,507,904 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe PRC - [2009-03-27 10:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2003-05-13 03:38:52 | 00,401,408 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall\persfw.exe PRC - [2001-10-26 17:30:04 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe PRC - [2008-04-14 23:51:52 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008-04-14 23:51:52 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2008-04-14 23:51:52 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2008-04-14 23:51:32 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe PRC - [2009-03-04 18:35:55 | 00,921,600 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32kui.exe PRC - [2009-05-28 19:53:38 | 00,518,488 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2009-03-05 17:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PRC - [2007-02-13 17:20:50 | 01,205,840 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe PRC - [2009-06-09 19:03:14 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2006-10-20 22:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2008-04-14 23:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2006-10-30 04:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2009-05-28 19:53:37 | 01,005,904 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Auto | Running]) SRV - [2006-04-24 15:25:44 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Disabled | Stopped]) SRV - [2006-10-30 04:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2009-03-04 18:35:55 | 00,507,904 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn [Auto | Running]) SRV - [2009-03-27 10:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [Disabled | Stopped]) SRV - [2003-05-13 03:38:52 | 00,401,408 | ---- | M] (Kerio Technologies) -- C:\Program Files\Kerio\Personal Firewall\persfw.exe -- (PersFw [Auto | Running]) SRV - [2004-09-29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12 [Disabled | Stopped]) SRV - [2009-06-06 21:52:07 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Disabled | Stopped]) SRV - [2009-05-07 12:11:11 | 00,183,112 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB [Disabled | Stopped]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2006-07-02 00:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2007-06-29 14:47:34 | 00,034,304 | ---- | M] (AMD, Inc.) -- C:\WINDOWS\system32\DRIVERS\AmdLLD.sys -- (AmdLLD [On_Demand | Running]) DRV - [2009-03-04 18:35:55 | 00,502,368 | ---- | M] (Eset ) -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON [Auto | Running]) DRV - [2006-10-17 18:00:00 | 00,012,664 | R--- | M] () -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO [System | Running]) DRV - [2006-11-10 15:08:50 | 00,024,064 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\ATITool.sys -- (ATITool [System | Stopped]) DRV - [2007-01-04 14:47:48 | 00,069,656 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\e4ldr.sys -- (E4LOADER [Auto | Stopped]) DRV - [2007-01-04 14:48:04 | 00,104,344 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Running]) DRV - [2008-09-17 15:14:00 | 00,027,672 | R--- | M] (EnTech Taiwan) -- C:\WINDOWS\system32\DRIVERS\ENTECH.sys -- (ENTECH [On_Demand | Stopped]) DRV - [2002-04-15 13:28:32 | 00,102,912 | ---- | M] () -- C:\WINDOWS\system32\Drivers\fwdrv.sys -- (fwdrv [System | Running]) DRV - [2009-02-26 22:12:43 | 00,025,280 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\system32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Running]) DRV - [2008-04-13 23:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2005-03-08 06:43:25 | 00,051,120 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped]) DRV - [2005-03-08 06:43:26 | 00,016,496 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped]) DRV - [2005-03-08 06:43:27 | 00,021,744 | R--- | M] (HP) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped]) DRV - [2007-07-10 03:56:00 | 04,449,280 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2009-04-21 22:33:26 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd [Boot | Running]) DRV - [2004-08-12 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2009-03-27 10:03:00 | 06,280,416 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2006-10-18 10:31:38 | 00,105,472 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2007-05-21 04:43:08 | 00,046,080 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Stopped]) DRV - [2007-05-21 04:43:12 | 00,019,968 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2009-05-07 12:11:32 | 00,138,184 | ---- | M] () -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK [On_Demand | Stopped]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-08-20 19:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2009-02-25 19:55:00 | 00,009,088 | ---- | M] () -- C:\Program Files\RivaTuner v2.24\RivaTuner32.sys -- (RivaTuner32 [On_Demand | Running]) DRV - [2008-04-13 23:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2005-08-10 14:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running]) DRV - [2005-05-16 15:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running]) DRV - [2005-08-10 16:06:28 | 00,019,968 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02 [Boot | Running]) DRV - [2005-11-03 16:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running]) DRV - [2009-01-13 20:10:37 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://www.wyborcza.pl/0,0.html?p=007" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-01-13 20:36:35 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-04-29 08:48:33 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-05-23 15:47:37 | 00,000,000 | ---D | M] [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\0pfjf1bo.default\extensions [2009-01-13 20:29:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\0pfjf1bo.default\extensions\{b66bc4c3-6d25-4a10-8c59-01daa9063051} [2009-06-09 00:31:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\992nji21.default\extensions [2009-01-13 20:29:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\992nji21.default\extensions\{b66bc4c3-6d25-4a10-8c59-01daa9063051} [2009-01-13 20:29:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\b1mppx8z.default\extensions [2009-01-13 20:29:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\d5w67h3p.default\extensions [2009-01-13 20:29:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\uy19nzv6.default\extensions [2009-06-09 00:31:57 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-04-28 18:57:03 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-01-13 20:36:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009-05-24 02:16:31 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009-04-28 18:57:03 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-04-28 18:57:03 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2006-06-03 18:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: (686 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE (Eset ) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /S () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\imon.dll (Eset ) O15 - HKLM\..Trusted Domains: 51 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control) O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-01-13 15:43:47 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-06-09 19:03:09 | 00,000,000 | ---D | M] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-06-09 19:03:58 | 00,000,000 | ---D | C] -- C:\_OTL [2009-06-09 19:02:46 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-06-07 12:46:50 | 00,962,612 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc42d.dll [2009-06-07 12:46:50 | 00,434,252 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCRTD.DLL [2009-06-07 12:46:48 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll [2009-06-07 12:46:47 | 00,012,664 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2009-06-07 12:46:44 | 00,000,000 | ---D | C] -- C:\Program Files\ASUS [2009-06-04 18:20:20 | 00,000,640 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Mp3 Knife.lnk [2009-06-04 18:20:19 | 00,609,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comctl32.ocx [2009-06-04 18:20:19 | 00,152,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comdlg32.ocx [2009-06-04 18:20:18 | 00,000,000 | ---D | C] -- C:\Program Files\Mp3 Knife [2009-06-03 07:27:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2009-05-31 23:21:24 | 00,046,080 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Thumbs.db [2009-05-31 23:20:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Dane aplikacji\VSO [2009-05-31 23:19:21 | 00,000,773 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\VSO Image Resizer.lnk [2009-05-31 23:19:13 | 00,000,000 | ---D | C] -- C:\Program Files\VSO [2009-05-30 10:28:16 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\QbK4Hq_cfdg.exe [2009-05-29 16:36:32 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys [2009-05-29 16:36:32 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbser.sys [2009-05-29 16:36:15 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01007.Wdf [2009-05-29 16:36:14 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2009-05-29 16:36:08 | 00,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll [2009-05-29 16:31:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Nokia [2009-05-29 16:30:58 | 00,091,136 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcls.dll [2009-05-29 16:28:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-05-27 21:55:07 | 00,042,496 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Allegro.doc [2009-05-26 21:08:25 | 00,000,000 | ---D | C] -- C:\WINDOWS\.jagex_cache_32 [2009-05-26 11:07:18 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Marcin\Pulpit\GgU6E7_cfdg.exe [2009-05-24 14:51:06 | 25,702,352 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\103 ciasta siostry Anastazji.pdf [2009-05-23 15:47:16 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe [2009-05-21 21:03:34 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Moja muzyka [2009-05-14 21:44:58 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Moje obrazy [2009-05-14 20:32:26 | 02,210,304 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Radogoszcz.doc [2009-05-13 21:10:24 | 00,770,048 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CDDBUISony.dll [2009-05-13 21:10:24 | 00,589,824 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CddbMusicIDSony.dll [2009-05-13 21:10:24 | 00,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll [2009-05-13 21:10:24 | 00,073,728 | ---- | C] (Gracenote) -- C:\WINDOWS\System32\CddbLinkSony.dll [2009-05-13 21:10:23 | 00,655,360 | ---- | C] (Gracenote, Inc.) -- C:\WINDOWS\System32\CDDBControlSony.dll [2009-05-13 21:09:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sony Corporation [2009-05-13 21:08:50 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Sony Shared [2009-05-13 15:41:10 | 00,000,009 | ---- | C] () -- C:\WINDOWS\nfsc_patch.ini [2009-05-12 12:31:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Wos [2009-05-07 01:30:12 | 00,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-04-27 19:54:50 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-04-13 19:55:32 | 00,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys [2009-04-04 13:12:02 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009-03-27 10:03:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2009-03-27 10:03:00 | 01,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2009-03-27 10:03:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2009-03-27 10:03:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2009-03-22 22:40:27 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\Alphablending.dll [2009-03-16 14:55:50 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\drivers\FWDRV.SYS [2009-03-10 15:46:44 | 00,000,039 | ---- | C] () -- C:\WINDOWS\TDEVXCW60.DLL [2009-03-10 15:46:44 | 00,000,039 | ---- | C] () -- C:\WINDOWS\System32\TEVPXCW60.DLL [2009-03-10 15:46:44 | 00,000,038 | ---- | C] () -- C:\WINDOWS\iltwain.ini [2009-02-06 11:25:10 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-02-06 11:25:01 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-02-06 11:25:01 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-02-06 11:25:01 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-02-06 11:24:52 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-02-06 11:24:52 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-01-18 13:22:16 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-01-17 19:15:47 | 00,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\NVStrap.sys [2009-01-13 23:30:45 | 00,000,035 | ---- | C] () -- C:\WINDOWS\A4W.INI [2009-01-13 20:32:46 | 00,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini [2009-01-13 20:32:46 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini [2009-01-13 20:32:40 | 00,000,990 | ---- | C] () -- C:\WINDOWS\adiras.ini [2009-01-13 20:32:37 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-01-13 20:32:37 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-01-13 20:10:36 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-01-13 18:38:12 | 00,015,382 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini [2009-01-13 18:37:54 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2009-01-13 18:37:53 | 00,015,133 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-01-13 18:37:44 | 00,012,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-10-07 10:13:30 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2008-10-07 10:13:22 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll [2008-10-07 10:13:20 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll [2008-01-09 16:01:48 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini [2006-11-10 15:08:50 | 00,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys [2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001-07-21 22:16:20 | 00,000,737 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2001-07-06 16:30:02 | 00,003,234 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI [1996-04-03 21:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [2009-06-09 19:06:40 | 00,215,383 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-06-09 19:05:33 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\desktop.ini [2009-06-09 19:05:24 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-06-09 19:03:14 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-06-09 17:50:38 | 00,046,080 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Thumbs.db [2009-06-09 16:10:06 | 00,000,737 | ---- | M] () -- C:\WINDOWS\win.ini [2009-06-09 16:10:06 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-06-09 16:10:06 | 00,000,223 | RHS- | M] () -- C:\boot.ini [2009-06-09 15:56:24 | 00,000,686 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS [2009-06-09 09:07:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-06-07 12:45:35 | 00,015,133 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini [2009-06-06 21:52:07 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe [2009-06-06 19:07:25 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-06-05 22:57:14 | 00,307,163 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090608-001420.backup [2009-06-04 20:44:42 | 00,000,048 | ---- | M] () -- C:\WINDOWS\System32\imon1.dat [2009-06-04 18:20:20 | 00,000,640 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Mp3 Knife.lnk [2009-06-02 22:20:52 | 00,001,620 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\RivaTuner.lnk [2009-06-01 18:11:10 | 00,000,620 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Dune 2000.lnk [2009-05-31 23:19:21 | 00,000,773 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\VSO Image Resizer.lnk [2009-05-30 10:28:16 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\QbK4Hq_cfdg.exe [2009-05-29 16:38:07 | 00,484,978 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-05-29 16:38:07 | 00,427,728 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-05-29 16:38:07 | 00,082,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-05-29 16:38:07 | 00,066,512 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-05-29 16:38:06 | 01,074,524 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-05-29 16:36:15 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01007.Wdf [2009-05-29 16:36:14 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2009-05-28 23:38:43 | 00,042,496 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Allegro.doc [2009-05-28 20:10:49 | 00,306,753 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090605-225714.backup [2009-05-28 19:54:15 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe [2009-05-26 11:07:18 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Marcin\Pulpit\GgU6E7_cfdg.exe [2009-05-24 14:54:27 | 25,702,352 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\103 ciasta siostry Anastazji.pdf [2009-05-24 02:19:39 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-21 20:18:30 | 00,306,475 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090528-201049.backup [2009-05-15 23:52:06 | 00,000,386 | ---- | M] () -- C:\WINDOWS\tasks\NSSstub.job [2009-05-14 23:05:29 | 02,210,304 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Radogoszcz.doc [2009-05-14 00:20:41 | 00,306,116 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090521-201830.backup [2009-05-13 15:41:10 | 00,000,009 | ---- | M] () -- C:\WINDOWS\nfsc_patch.ini [2009-05-13 15:07:33 | 00,000,594 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\pes2009.lnk [color=orange]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:CB0AACC9 < End of report >

**Posty:** 18165 · przez **wojtas** 09 Cze 2009, 19:25

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

**Posty:** 71 · przez **maly814** 10 Cze 2009, 10:38

1.Wykonane
2.Wykonane
3.Wykonane
4.Wykonane-Znalezione 3 wirusy
5.Wykonane-Nic nie znaleziono

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 środa, 10 czerwiec 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 3 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Wednesday, June 10, 2009 03:28:40 Liczba wpisów: 2333111 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ E:\ F:\ G:\ Statystyki skanowania: Przeskanowanych plików: 46789 Nazwa zagrożenia: 0 Zainfekowanych obiektów: 0 Podejrzanych obiektów: 0 Czas skanowania: 01:22:42 Nie wykryto zagrożeń. Obszar skanowania jest czysty. Wybrany obszar został przeskanowany.

Muszę powiedzieć że jest dużo lepiej ale...
Gdy komputer dobrze działał to po pełnym załadowaniu systemu miałem uruchomionych 29 procesów
Nic nowego nie instalowałem a w auto uruchamianiu jest to co było

Malwarebytes Anti-Malware-Znalazł 3 wpisy
Adobe zaktualizowany

**Posty:** 18165 · przez **wojtas** 10 Cze 2009, 12:45

wszystkie procesy są dobre

_ pozdro

Autor postu otrzymał pochwałę

**Posty:** 71 · przez **maly814** 10 Cze 2009, 15:43

Dzięki dzięki :lol:

Pobawiłem się jeszcze troszkę i ustabilizowałem procesy

PoZdRo i jeszcze raz dzięki