[@Blade@]

Kosmetycznie Fix w HijackThis:

Kod:

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file) O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

Nic już więcej nie ma, czysto

[Trojan na kompie :/]

Zeby nie tworzyc juz nowych tematow to napisze tu.
Na poczatku chcialbym podziekowac za pomoc jaka otrzymalem ostatnio mam nadzieje, ze i tym razem mi pomozecie.
Otoz strasznie muli mi net.
Przy wysylaniu plikow na serwer ftp normalna predkosc zawsze byla w granicch 15 kb/s!
Teraz czasem skacze do 8 kb/s ale bardzo zrzadko czesto wyswietla 300 b/s...
To samo dzieje sie przy nie ktorych grach internetowych!
Moj net to neo watpie zeby byl to wirus ale daje wam loga:

Kod:

Logfile of HijackThis v1.99.1 Scan saved at 09:35:41, on 2009-10-17 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\loader.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Skype\Phone\Skype.exe D:\gry\steam\steam.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\lsasz.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\xampp\apache\bin\apache.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\System32\FTRTSVC.exe C:\xampp\apache\bin\apache.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\xampp\mysql\bin\mysqld-nt.exe C:\Program Files\No-IP\DUC20.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Total comm\TC PowerPack\totalcmd.exe C:\Documents and Settings\Marcin\Pulpit\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Marcin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [menustart] c:\loader.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Steam] "d:\gry\steam\steam.exe" -silent O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: lsasz.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International O17 - HKLM\System\CCS\Services\Tcpip\..\{EFB2F32A-A6CB-4166-81A2-3074C3A3C16C}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apache2.2 - Unknown owner - C:\xampp\apache\bin\apache.exe" -k runservice (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - c:\xampp\FileZillaFTP\FileZillaServer.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: XAMPP Service (XAMPP) - Unknown owner - C:\Documents and Settings\Marcin\Pulpit\xampp\service.exe

[@Blade@]

Pobierz The Avenger w pole Input script here wklej poniższy tekst:

Kod:

Files to delete: C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\lsasz.exe C:\loader.exe

klikasz Execute Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu wklej raport na forum C:\avenger.txt

Następnie podaj log z OTL http://www.instalki.pl/pr...spyware/OTL.php

[Trojan na kompie :/]

Ten loader i sasz pochodzi od bota tibia bot ng on jest oryginalny i znany. Myslisz ze net mi muli przez niego?

[@Blade@]

Możliwe, usuń to i się okaże. Podaj też log, o który prosiłem

[Trojan na kompie :/]

Zrobilem tak jak powiedziales...
Otls zwrocil dwa logi extras.txt i otl.txt...
Nie wiem czy nie sa tqkie same ale lap obydwa...
otl.txt:

Kod:

OTL logfile created on: 2009-10-18 19:51:57 - Run 1 OTL by OldTimer - Version 3.0.21.0     Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd   2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]   %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 29,30 Gb Total Space | 8,87 Gb Free Space | 30,27% Space Free | Partition Type: NTFS Drive D: | 214,84 Gb Total Space | 98,13 Gb Free Space | 45,68% Space Free | Partition Type: NTFS Drive E: | 221,62 Gb Total Space | 171,59 Gb Free Space | 77,43% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded   Computer Name: MEISSNER-62CCEE Current User Name: Marcin Logged in as Administrator.   Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard   [color=#E56717]========== Processes (SafeList) ==========[/color]   PRC - [2009-10-17 11:19:08 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe PRC - [2009-09-12 13:35:23 | 01,172,992 | ---- | M] (Vitalwerks LLC) -- C:\Program Files\No-IP\DUC20.exe PRC - [2009-08-05 21:02:22 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009-06-12 15:22:12 | 01,217,784 | ---- | M] (Valve Corporation) -- D:\gry\steam\steam.exe PRC - [2009-06-11 22:04:34 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009-03-02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2009-02-12 20:09:05 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe PRC - [2009-02-06 12:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2008-06-03 11:09:36 | 00,552,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2008-04-14 19:21:50 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe PRC - [2008-04-14 19:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2008-02-13 21:07:30 | 04,653,056 | ---- | M] () -- C:\xampp\mysql\bin\mysqld-nt.exe PRC - [2008-01-18 01:37:26 | 00,024,635 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\apache.exe PRC - [2006-12-03 01:14:03 | 00,310,784 | ---- | M] (http://autoconnect.prv.pl) -- C:\Program Files\AutoConnect\AutoConnect.exe PRC - [2005-06-21 00:10:30 | 00,053,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2004-08-23 13:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [1999-12-13 02:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE   [color=#E56717]========== Win32 Services (SafeList) ==========[/color]   SRV - [2009-09-12 13:35:23 | 01,172,992 | ---- | M] (Vitalwerks LLC) -- C:\Program Files\No-IP\DUC20.exe -- (NoIPDUCService [Auto | Running]) SRV - [2009-08-05 21:02:22 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running]) SRV - [2009-07-09 20:11:04 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped]) SRV - [2009-06-11 22:04:34 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running]) SRV - [2009-02-12 20:09:05 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe -- (PnkBstrA [Auto | Running]) SRV - [2008-07-29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2008-07-29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2008-07-29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2008-07-25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2008-07-25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2008-06-03 11:09:36 | 00,552,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running]) SRV - [2008-06-02 21:05:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped]) SRV - [2008-04-14 19:20:44 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2008-02-13 21:07:30 | 04,653,056 | ---- | M] () -- C:\xampp\mysql\bin\mysqld-nt.exe -- (mysql [Auto | Running]) SRV - [2008-01-18 01:37:26 | 00,024,635 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\apache.exe -- (Apache2.2 [Auto | Running]) SRV - [2007-12-25 23:25:50 | 00,586,240 | ---- | M] (FileZilla Project) -- c:\xampp\FileZillaFTP\FileZillaServer.exe -- (FileZilla Server [On_Demand | Stopped]) SRV - [2007-12-21 04:01:02 | 00,060,928 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\xampp\service.exe -- (XAMPP [Auto | Stopped]) SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2005-06-21 00:10:30 | 00,053,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) SRV - [2004-08-23 13:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [1999-12-13 02:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE -- (Creative Service for CDROM Access [Auto | Running])   [color=#E56717]========== Driver Services (SafeList) ==========[/color]   DRV - [2009-08-05 21:02:22 | 00,055,656 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running]) DRV - [2009-06-14 17:45:16 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) DRV - [2009-06-12 09:11:46 | 00,025,280 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped]) DRV - [2009-06-11 22:04:34 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running]) DRV - [2009-03-30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System | Running]) DRV - [2009-02-13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running]) DRV - [2008-12-20 12:20:49 | 00,022,368 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped]) DRV - [2008-12-20 12:20:49 | 00,010,976 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggflt.sys -- (ggflt [On_Demand | Stopped]) DRV - [2008-09-04 15:31:29 | 00,278,984 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\atksgt.sys -- (atksgt [Auto | Running]) DRV - [2008-09-04 15:30:45 | 00,025,416 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\lirsgt.sys -- (lirsgt [Auto | Running]) DRV - [2008-06-03 14:20:54 | 03,100,160 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running]) DRV - [2008-05-29 12:33:10 | 00,027,672 | R--- | M] (EnTech Taiwan) -- C:\WINDOWS\System32\DRIVERS\ENTECH.sys -- (ENTECH [On_Demand | Stopped]) DRV - [2008-05-19 09:46:30 | 00,150,568 | R--- | M] (Marvell Semiconductor, Inc.) -- C:\WINDOWS\system32\DRIVERS\mv61xx.sys -- (mv61xx [Boot | Running]) DRV - [2008-04-13 20:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\usb8023.sys -- (USB_RNDIS [On_Demand | Stopped]) DRV - [2008-04-13 18:39:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running]) DRV - [2008-04-13 18:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2008-03-26 20:37:26 | 04,713,472 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2008-02-02 17:54:00 | 00,036,864 | R--- | M] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\DRIVERS\l1e51x86.sys -- (L1e [On_Demand | Running]) DRV - [2007-12-17 11:14:06 | 00,012,400 | R--- | M] () -- C:\WINDOWS\System32\drivers\AsIO.sys -- (AsIO [System | Running]) DRV - [2007-11-14 21:48:20 | 00,084,992 | R--- | M] (ATI Research Inc.) -- C:\WINDOWS\System32\drivers\AtiHdmi.sys -- (AtiHdmiService [On_Demand | Running]) DRV - [2007-10-29 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2006-11-30 15:11:28 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46unic.sys -- (se46unic [On_Demand | Stopped]) DRV - [2006-11-30 15:11:22 | 00,086,432 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46obex.sys -- (se46obex [On_Demand | Stopped]) DRV - [2006-11-30 15:11:18 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46nd5.sys -- (se46nd5 [On_Demand | Stopped]) DRV - [2006-11-30 15:11:16 | 00,088,624 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mgmt.sys -- (se46mgmt [On_Demand | Stopped]) DRV - [2006-11-30 15:11:12 | 00,097,088 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mdm.sys -- (se46mdm [On_Demand | Stopped]) DRV - [2006-11-30 15:11:10 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mdfl.sys -- (se46mdfl [On_Demand | Stopped]) DRV - [2006-11-30 15:11:04 | 00,061,536 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46bus.sys -- (se46bus [On_Demand | Stopped]) DRV - [2006-11-10 18:24:06 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se2Eunic.sys -- (se2Eunic [On_Demand | Stopped]) DRV - [2006-11-10 18:23:58 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Eobex.sys -- (SE2Eobex [On_Demand | Stopped]) DRV - [2006-11-10 18:23:56 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se2End5.sys -- (se2End5 [On_Demand | Stopped]) DRV - [2006-11-10 18:23:54 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emgmt.sys -- (SE2Emgmt [On_Demand | Stopped]) DRV - [2006-11-10 18:23:50 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emdm.sys -- (SE2Emdm [On_Demand | Stopped]) DRV - [2006-11-10 18:23:48 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys -- (SE2Emdfl [On_Demand | Stopped]) DRV - [2006-11-10 18:23:42 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Ebus.sys -- (SE2Ebus [On_Demand | Stopped]) DRV - [2006-09-18 14:59:08 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se27unic.sys -- (se27unic [On_Demand | Stopped]) DRV - [2006-09-18 14:59:02 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27obex.sys -- (SE27obex [On_Demand | Stopped]) DRV - [2006-09-18 14:59:00 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se27nd5.sys -- (se27nd5 [On_Demand | Stopped]) DRV - [2006-09-18 14:58:58 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mgmt.sys -- (SE27mgmt [On_Demand | Stopped]) DRV - [2006-09-18 14:58:54 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mdm.sys -- (SE27mdm [On_Demand | Stopped]) DRV - [2006-09-18 14:58:52 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mdfl.sys -- (SE27mdfl [On_Demand | Stopped]) DRV - [2006-09-18 14:58:48 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27bus.sys -- (SE27bus [On_Demand | Stopped]) DRV - [2006-05-25 15:28:44 | 00,684,265 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\torususb.sys -- (TaurusUsb [On_Demand | Running]) DRV - [2004-08-13 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2003-08-12 14:51:00 | 00,060,255 | ---- | M] (STMicroelectronics              ) -- C:\WINDOWS\System32\DRIVERS\stmatm.sys -- (Stmatm [On_Demand | Running]) DRV - [2003-08-04 13:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2002-09-16 17:14:32 | 00,004,228 | ---- | M] (PowerQuest Corporation) -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv [System | Running])   [color=#E56717]========== Standard Registry (SafeList) ==========[/color]     [color=#E56717]========== Internet Explorer ==========[/color]   IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm   IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0   [color=#E56717]========== FireFox ==========[/color]   FF - prefs.js..browser.search.defaultenginename: "Ask" FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" FF - prefs.js..browser.search.order.1: "Ask" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.pl" FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.10.1 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3 FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q="   FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009-08-25 09:09:51 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-10-17 20:34:18 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-09-27 09:48:37 | 00,000,000 | ---D | M]   [2008-08-15 01:16:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions [2008-08-15 01:16:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-10-17 20:30:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions [2009-07-02 12:23:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2009-08-25 13:21:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009-07-02 12:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2009-07-18 11:29:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009-09-16 22:06:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\SQLiteManager@mrinalkant.blogspot(2).com [2009-07-18 12:09:24 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\ask.xml [2009-06-14 17:48:04 | 00,002,399 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\daemon-search.xml [2009-07-02 12:23:55 | 00,001,196 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\winamp-search.xml [2009-10-18 17:12:31 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-09-27 09:48:37 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-01-05 18:47:04 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED} [2008-08-16 11:57:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009-08-24 22:23:38 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-08-24 22:23:38 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007-04-10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2009-08-24 22:23:38 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2009-08-24 21:19:13 | 00,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2009-08-24 21:19:13 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2009-08-24 21:19:13 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009-08-24 21:19:13 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2009-08-24 21:19:13 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2009-08-24 21:19:13 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2009-08-24 21:19:13 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml   O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1       localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Marcin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [AdslTaskBar] C:\WINDOWS\System32\stmctrl.DLL (STMicroelectronics              ) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [menustart] c:\loader.exe File not found O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\neostrada tp\Watch.exe (France Télécom R&D) O4 - HKCU..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe (http://autoconnect.prv.pl) O4 - HKCU..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) O4 - HKCU..\Run: [Steam] d:\gry\steam\steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-03-20 17:42:25 | 00,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{99800221-6d3d-11dd-b2cb-00221517b36e}\Shell\AutoRun\command - "" = I:\8rcahp.exe -- File not found O33 - MountPoints2\{99800221-6d3d-11dd-b2cb-00221517b36e}\Shell\open\Command - "" = I:\8rcahp.exe -- File not found O33 - MountPoints2\{99800222-6d3d-11dd-b2cb-00221517b36e}\Shell\AutoRun\command - "" = J:\8rcahp.exe -- File not found O33 - MountPoints2\{99800222-6d3d-11dd-b2cb-00221517b36e}\Shell\open\Command - "" = J:\8rcahp.exe -- File not found O33 - MountPoints2\{d3e77024-24e2-11de-b42f-00221517b36e}\Shell\AutoRun\command - "" = I:\8rcahp.exe -- File not found O33 - MountPoints2\{d3e77024-24e2-11de-b42f-00221517b36e}\Shell\open\Command - "" = I:\8rcahp.exe -- File not found O34 - HKLM BootExecute: (autocheck) -  File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) -  File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found   [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]   [6 C:\WINDOWS\*.tmp files] [2009-10-01 12:16:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Blizzard Entertainment [2009-10-10 18:07:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2009-10-10 19:42:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Silver_Squirrel_Software_ [2009-10-17 20:40:04 | 00,000,000 | ---D | C] -- C:\Program Files\HyCam2 [2009-09-26 17:30:34 | 00,000,000 | ---D | C] -- C:\Program Files\Ronots Client [2009-10-10 19:38:53 | 00,000,000 | ---D | C] -- C:\Program Files\Tibiacast [2009-10-18 19:50:23 | 00,000,000 | ---D | C] -- C:\Avenger [2009-10-18 17:11:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b [2009-10-18 13:12:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070 [2009-10-17 21:42:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\BlackBlue [2009-10-17 12:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\lol [2009-10-17 11:21:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\avenger [2009-10-17 11:19:00 | 00,521,216 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-10-16 20:33:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\stronka [2009-10-15 20:01:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Ikonki [2009-10-11 16:20:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Programowanie [2009-10-11 16:14:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2 [2009-10-03 21:25:02 | 03,912,190 | ---- | C] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.1.exe [2009-10-03 21:14:19 | 03,907,973 | ---- | C] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.0.exe [2009-09-27 08:41:15 | 08,777,416 | ---- | C] (Mozilla) -- C:\Documents and Settings\Marcin\Pulpit\Firefox Setup 3.5.3.exe [2009-09-26 17:25:54 | 15,331,166 | ---- | C] (RonOTS                                                      ) -- C:\Documents and Settings\Marcin\Pulpit\RonotsClient84.exe [2009-09-26 10:59:58 | 00,000,000 | -HSD | C] -- C:\RECYCLER [2009-09-24 21:48:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp [2009-09-24 21:40:28 | 00,000,000 | RHSD | C] -- C:\cmdcons [2009-09-24 17:48:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009-09-24 15:57:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\CSC [2009-09-21 17:39:37 | 00,000,000 | ---D | C] -- C:\xampp [2009-09-20 15:27:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\xampp   [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]   [1 C:\WINDOWS\System32\*.tmp files] [6 C:\WINDOWS\*.tmp files] [2009-10-18 19:51:29 | 00,000,442 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics [2009-10-18 19:51:26 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-10-18 19:50:46 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-10-18 19:50:44 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-10-18 19:47:49 | 01,278,650 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-10-18 19:47:49 | 00,563,540 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-10-18 19:47:49 | 00,500,286 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-10-18 19:47:49 | 00,109,936 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-10-18 19:47:49 | 00,088,828 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-10-18 18:19:17 | 02,359,350 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\de_kabul0000.bmp [2009-10-18 17:10:50 | 02,349,477 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b.rar [2009-10-18 13:12:12 | 00,976,454 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070.zip [2009-10-17 21:39:27 | 01,046,414 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\BlackBlue.zip [2009-10-17 21:15:12 | 20,661,068 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\demko0001.avi [2009-10-17 20:49:05 | 00,000,671 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Teamspeak 2 RC2.lnk [2009-10-17 20:48:52 | 05,862,994 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\ts2_client_rc2_2032.exe [2009-10-17 20:41:05 | 00,763,358 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\clip0001.avi [2009-10-17 20:38:10 | 00,722,048 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\HC2Setup.exe [2009-10-17 18:14:05 | 00,031,232 | ---- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-17 16:58:49 | 00,002,069 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Steam.lnk [2009-10-17 11:20:24 | 00,724,952 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\avenger.zip [2009-10-17 11:19:08 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-10-16 22:49:38 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009-10-16 19:34:09 | 00,002,279 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Remere's Map Editor.lnk [2009-10-14 20:34:23 | 02,083,999 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\phpBB_modified_by_Przemo.zip [2009-10-11 22:43:01 | 03,704,444 | -H-- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-10-11 22:33:07 | 00,475,166 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\BezNazwy1.exe [2009-10-11 17:04:38 | 01,032,582 | ---- | M] () -- C:\WINDOWS\System32\alleg42.dll [2009-10-11 16:13:39 | 06,589,225 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2.zip [2009-10-10 15:29:58 | 09,326,468 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\devcpp-4.9.9.2_setup.exe [2009-10-07 06:47:35 | 00,000,187 | ---- | M] () -- C:\1.cmd [2009-10-07 06:47:35 | 00,000,098 | ---- | M] () -- C:\1 [2009-10-03 21:26:55 | 00,000,639 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\TibiaBot NG.lnk [2009-10-03 21:26:05 | 03,912,190 | ---- | M] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.1.exe [2009-10-03 21:15:26 | 03,907,973 | ---- | M] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.0.exe [2009-10-02 20:01:57 | 25,198,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009-09-27 09:48:38 | 00,001,608 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-09-27 08:44:57 | 08,777,416 | ---- | M] (Mozilla) -- C:\Documents and Settings\Marcin\Pulpit\Firefox Setup 3.5.3.exe [2009-09-26 17:35:50 | 00,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2009-09-26 17:30:23 | 15,331,166 | ---- | M] (RonOTS                                                      ) -- C:\Documents and Settings\Marcin\Pulpit\RonotsClient84.exe [2009-09-26 11:01:56 | 00,000,206 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110155.reg [2009-09-26 11:01:47 | 00,000,206 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110145.reg [2009-09-26 11:01:37 | 00,004,582 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110134.reg [2009-09-26 11:01:20 | 00,002,380 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110117.reg [2009-09-26 11:00:58 | 00,012,884 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110054.reg [2009-09-26 11:00:45 | 00,358,010 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110036.reg [2009-09-26 10:57:32 | 00,001,554 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\CCleaner.lnk [2009-09-24 21:46:57 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-09-24 21:46:32 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009-09-24 21:40:33 | 00,000,425 | RHS- | M] () -- C:\boot.ini [2009-09-24 17:27:51 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak [2009-09-22 18:33:23 | 00,020,808 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-09-21 17:52:38 | 00,000,544 | ---- | M] () -- C:\WINDOWS\my.ini [2009-09-21 17:40:46 | 00,000,357 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\XAMPP Control Panel.lnk   [color=#E56717]========== Files - No Company Name ==========[/color] [2009-10-18 18:18:10 | 02,359,350 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\de_kabul0000.bmp [2009-10-18 17:10:13 | 02,349,477 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b.rar [2009-10-18 13:11:54 | 00,976,454 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070.zip [2009-10-17 21:39:08 | 01,046,414 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\BlackBlue.zip [2009-10-17 21:14:37 | 20,661,068 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\demko0001.avi [2009-10-17 20:49:05 | 00,000,671 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Teamspeak 2 RC2.lnk [2009-10-17 20:47:01 | 05,862,994 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\ts2_client_rc2_2032.exe [2009-10-17 20:40:41 | 00,763,358 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\clip0001.avi [2009-10-17 20:37:56 | 00,722,048 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\HC2Setup.exe [2009-10-17 11:20:12 | 00,724,952 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\avenger.zip [2009-10-16 22:47:29 | 00,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2009-10-14 20:33:52 | 02,083,999 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\phpBB_modified_by_Przemo.zip [2009-10-11 22:32:25 | 00,475,166 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\BezNazwy1.exe [2009-10-11 16:12:22 | 01,032,582 | ---- | C] () -- C:\WINDOWS\System32\alleg42.dll [2009-10-11 16:12:02 | 06,589,225 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2.zip [2009-10-10 15:27:38 | 09,326,468 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\devcpp-4.9.9.2_setup.exe [2009-10-07 06:47:35 | 00,000,187 | ---- | C] () -- C:\1.cmd [2009-10-07 06:47:35 | 00,000,098 | ---- | C] () -- C:\1 [2009-09-26 17:30:37 | 00,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2009-09-26 11:01:55 | 00,000,206 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110155.reg [2009-09-26 11:01:46 | 00,000,206 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110145.reg [2009-09-26 11:01:35 | 00,004,582 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110134.reg [2009-09-26 11:01:19 | 00,002,380 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110117.reg [2009-09-26 11:00:56 | 00,012,884 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110054.reg [2009-09-26 11:00:39 | 00,358,010 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110036.reg [2009-09-26 10:57:32 | 00,001,554 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\CCleaner.lnk [2009-09-24 21:40:29 | 00,262,400 | ---- | C] () -- C:\cmldr [2009-09-24 17:49:47 | 00,229,888 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009-09-24 17:27:52 | 00,013,646 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak [2009-09-21 17:40:46 | 00,000,357 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\XAMPP Control Panel.lnk [2009-06-18 21:35:54 | 01,867,776 | ---- | C] () -- C:\WINDOWS\System32\python24.dll [2009-06-12 16:34:48 | 00,045,936 | ---- | C] () -- C:\WINDOWS\php.ini [2009-06-12 16:34:48 | 00,000,544 | ---- | C] () -- C:\WINDOWS\my.ini [2009-04-25 19:41:39 | 00,135,168 | ---- | C] () -- C:\WINDOWS\System32\12kCUusd.dll [2008-11-28 09:12:28 | 00,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2008-11-22 22:29:35 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-09-18 16:36:34 | 00,020,808 | ---- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\GDIPFONTCACHEV1.DAT [2008-08-18 20:02:08 | 00,000,161 | ---- | C] () -- C:\WINDOWS\DSLSetup.ini [2008-08-18 20:02:07 | 00,684,265 | ---- | C] () -- C:\WINDOWS\System32\drivers\torususb.sys [2008-08-18 11:23:50 | 00,278,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2008-08-18 11:23:49 | 00,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2008-08-17 19:03:14 | 00,000,427 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-08-17 17:13:59 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-08-17 17:13:59 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2008-08-17 17:13:57 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008-08-17 17:13:57 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-08-17 17:13:57 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-08-17 17:13:56 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-08-17 17:13:56 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-08-16 15:17:28 | 00,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008-08-16 15:17:28 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\PnkBstrK.sys [2008-08-16 14:49:46 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008-08-16 14:45:51 | 00,031,232 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-08-16 08:37:57 | 00,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys [2008-08-14 16:37:17 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini [2008-08-14 16:07:39 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll [2008-08-14 16:07:39 | 00,012,400 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2008-08-14 16:07:37 | 00,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys [2008-08-14 16:07:37 | 00,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys [2008-08-14 15:43:17 | 00,036,025 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini [2008-08-14 15:43:12 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008-08-14 15:43:02 | 00,035,634 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-08-14 15:43:02 | 00,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-08-14 15:37:57 | 03,704,444 | -H-- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\IconCache.db [2008-08-14 15:21:44 | 00,020,808 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2008-08-14 15:12:51 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\desktop.ini [2007-10-29 14:00:00 | 00,000,627 | ---- | C] () -- C:\WINDOWS\win.ini [2007-10-29 14:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini   [color=#E56717]========== Alternate Data Streams ==========[/color]   @Alternate Data Stream - 294 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:E41EAF13 @Alternate Data Stream - 143 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B @Alternate Data Stream - 120 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:4EE74317 < End of report >

[Trojan na kompie :/]

extras.txt:

Kod:

OTL Extras logfile created on: 2009-10-18 19:51:57 - Run 1 OTL by OldTimer - Version 3.0.21.0     Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd   2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]   %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 29,30 Gb Total Space | 8,87 Gb Free Space | 30,27% Space Free | Partition Type: NTFS Drive D: | 214,84 Gb Total Space | 98,13 Gb Free Space | 45,68% Space Free | Partition Type: NTFS Drive E: | 221,62 Gb Total Space | 171,59 Gb Free Space | 77,43% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded   Computer Name: MEISSNER-62CCEE Current User Name: Marcin Logged in as Administrator.   Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard   [color=#E56717]========== Extra Registry (SafeList) ==========[/color]     [color=#E56717]========== File Associations ==========[/color]   [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)   [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)   [color=#E56717]========== Shell Spawning ==========[/color]   [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found chm.file [open] -- "%SYSTEMROOT%\hh.exe" %1 (Microsoft Corporation) cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)   [color=#E56717]========== Security Center Settings ==========[/color]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724   [color=#E56717]========== Authorized Applications List ==========[/color]   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA -- () "C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB -- () "D:\GRY\crysis\Bin32\Crysis.exe" = D:\GRY\crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32 -- (Crytek GmbH) "D:\GRY\crysis\Bin32\CrysisDedicatedServer.exe" = D:\GRY\crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32 -- (Crytek GmbH) "C:\Program Files\BearShare\BearShare.exe" = C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare -- (Free Peers, Inc.) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "D:\GRY\cl4\Civilization4.exe" = D:\GRY\cl4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 -- (Firaxis Games) "D:\GRY\Metin2\metin2.bin" = D:\GRY\Metin2\metin2.bin:*:Enabled:metin2 -- () "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\RecWar\RecWar.exe" = C:\RecWar\RecWar.exe:*:Disabled:RecWar -- () "D:\GRY\cl4\Warlords\Civ4Warlords.exe" = D:\GRY\cl4\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords -- (Firaxis Games) "D:\GRY\cl4\Warlords\Civ4Warlords_PitBoss.exe" = D:\GRY\cl4\Warlords\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss -- (Firaxis Games) "D:\GRY\Setlersi\bin\settlershok.exe" = D:\GRY\Setlersi\bin\settlershok.exe:*:Enabled:THE SETTLERS - Heritage of Kings -- (Blue Byte Software) "D:\GRY\steam\steamapps\zdzisieq\counter-strike\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "D:\GRY\steam\steamapps\zdzisieq\half-life\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\half-life\hl.exe:*:Disabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\steamapps\zdzisieq\day of defeat\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\day of defeat\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\steamapps\zdzisieq\opposing force\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\opposing force\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\steamapps\zdzisieq\team fortress classic\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\team fortress classic\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\steamapps\zdzisieq\ricochet\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\ricochet\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\steamapps\zdzisieq\deathmatch classic\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\deathmatch classic\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\steam\Steam.exe" = D:\GRY\steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation) "D:\GRY\wow\World of Warcraft\BackgroundDownloader.exe" = D:\GRY\wow\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "C:\Program Files\Nowe Gadu-Gadu\gg.exe" = C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- (GG Network S.A.) "D:\HLSW\hlsw.exe" = D:\HLSW\hlsw.exe:*:Enabled:HLSW Application -- (Stripf Software) "D:\GRY\nonsteam\hl.exe" = D:\GRY\nonsteam\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "D:\GRY\CS  S\Counter-Strike Source\hl2.exe" = D:\GRY\CS  S\Counter-Strike Source\hl2.exe:*:Enabled:hl2 -- () "C:\Program Files\WebServ\ftp\WebServ(ftp).exe" = C:\Program Files\WebServ\ftp\WebServ(ftp).exe:*:Enabled:WebServ(ftp) -- () "C:\Program Files\WebServ\WebServ.exe" = C:\Program Files\WebServ\WebServ.exe:*:Enabled:WebServ -- (WebServ.PL) "D:\GRY\steam\steamapps\zdzisieq\half-life blue shift\hl.exe" = D:\GRY\steam\steamapps\zdzisieq\half-life blue shift\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "C:\Program Files\WebServ\mysql\bin\WebServ(mysqld).exe" = C:\Program Files\WebServ\mysql\bin\WebServ(mysqld).exe:*:Enabled:WebServ(mysqld) -- () "C:\Program Files\WebServ\apache2\bin\WebServ(apache).exe" = C:\Program Files\WebServ\apache2\bin\WebServ(apache).exe:*:Enabled:Apache HTTP Server -- (Apache Software Foundation) "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\TFS\theforgottenserver-v0.2-win32gui\The Forgotten Server.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\TFS\theforgottenserver-v0.2-win32gui\The Forgotten Server.exe:*:Enabled:The Forgotten Server -- () "C:\Program Files\NAPI-PROJEKT\napisy.exe" = C:\Program Files\NAPI-PROJEKT\napisy.exe:*:Enabled:Napi-projekt -- () "D:\GRY\wow\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe" = D:\GRY\wow\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "D:\GRY\Metin Chinski\metin_longjuyt2_server2.exe" = D:\GRY\Metin Chinski\metin_longjuyt2_server2.exe:*:Enabled:metin_longjuyt2_server2 -- () "D:\Total comm\TC PowerPack\TOTALCMD.EXE" = D:\Total comm\TC PowerPack\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows -- (C. Ghisler & Co.) "C:\Documents and Settings\Marcin\Pulpit\NTSD2.4\NTSD2.4\NTSD.exe" = C:\Documents and Settings\Marcin\Pulpit\NTSD2.4\NTSD2.4\NTSD.exe:*:Enabled:NTSD -- () "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\Darkness Otserv 0.5.3\Darkness Otserv 0.5.3\Darkness Otserv 0.5.3 - Gui.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\Darkness Otserv 0.5.3\Darkness Otserv 0.5.3\Darkness Otserv 0.5.3 - Gui.exe:*:Enabled:The Forgotten Server -- () "D:\GRY\wow\World of Warcraft\WoW-3.2.0-enGB-downloader.exe" = D:\GRY\wow\World of Warcraft\WoW-3.2.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "C:\WINDOWS\system32\ftp.exe" = C:\WINDOWS\system32\ftp.exe:*:Disabled:Program do transferu plików -- (Microsoft Corporation) "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\backup\cryingdamson5-console\Crying Damson.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\backup\cryingdamson5-console\Crying Damson.exe:*:Enabled:The Forgotten Server -- (OtLand.net) "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\cryingdamson5console\cryingdamson5-console\Crying Damson.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\cryingdamson5console\cryingdamson5-console\Crying Damson.exe:*:Enabled:The Forgotten Server -- (OtLand.net) "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\cryingdamson5-gui\Crying Damson.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\cryingdamson5-gui\Crying Damson.exe:*:Enabled:The Forgotten Server -- (OtLand.net) "E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\theforgottenserver-v0.2.5-win32gui\Mystic Spirit\The Forgotten Server.exe" = E:\ze starego kompa\cały dysk D\Film,Piosenki i Rysunki Marcina\Tibia\OTS\theforgottenserver-v0.2.5-win32gui\Mystic Spirit\The Forgotten Server.exe:*:Enabled:The Forgotten Server -- (http://otland.net) "C:\xampp\apache\bin\apache.exe" = C:\xampp\apache\bin\apache.exe:*:Enabled:Apache HTTP Server -- (Apache Software Foundation) "D:\GRY\wow\World of Warcraft\Launcher.exe" = D:\GRY\wow\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment) "D:\GRY\wow\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe" = D:\GRY\wow\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "D:\GRY\wow\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe" = D:\GRY\wow\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "D:\GRY\wow\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe" = D:\GRY\wow\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment) "C:\Program Files\Tibiacast\Tibiacast Client.exe" = C:\Program Files\Tibiacast\Tibiacast Client.exe:*:Enabled:Tibiacast Client -- (Silver Squirrel Software HB) "D:\GRY\Metin2\metin2client.bin" = D:\GRY\Metin2\metin2client.bin:*:Enabled:metin2client -- () "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)     [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R) "{044146E4-A924-458A-9948-4B9C7C7D9321}" = LightScribe  1.4.31.1 "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0 "{11F6F2C9-4215-4CDF-8763-4BBDDDEAD601}" = Remere's Map Editor "{20ABD466-5B0D-4846-84BA-9C97D49A593D}_is1" = Ronots Client v3.1 "{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09 "{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "{2DF7B278-D3B6-40A4-B25C-0E7149F439EA}" = 3DMark05 "{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113 Gigabit/Fast Ethernet Driver "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{3E4B349F-10B5-4586-9D99-489A90A8B228}" = Sid Meier's Civilization 4 - Warlords "{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4 "{56B83336-FBC1-4C46-8613-90A9E3B440D6}" = Six Engine "{5B2029A4-1854-42BC-96B6-4ACE5F5414BD}" = ArtRage 2 Starter Edition "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype&#8482; 3.8 "{61F6F81B-7013-42AC-9CC6-4BCD63BA95FC}" = Tibiacast "{64EEA791-0271-4B53-00AC-2BF05F5FBEF6}" = The Sims&#8482; Historie z bezludnej wyspy "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic "{71D182CD-2E7B-4994-9937-6562CF2BFFFC}_is1" = Pokemon Word Online 1.0 "{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs "{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer "{90280415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional z programem FrontPage "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A415977E-42F8-46A1-A9F0-514DA5F2960B}" = Norton Ghost "{AC76BA86-7AD7-1045-7B44-A70000000000}" = Adobe Reader 7.0 - Polish "{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0 "{BF4846B3-568C-4C17-A951-D0D0080FB4B2}" = DBConvert for MS Access and MySQL "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4 "{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas "{E0F07676-2C60-4465-A727-20DE3BFCABAC}" = Tony Hawks Pro Skater 4 "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}" = Need for Speed&#8482; Undercover "{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0 "{EE5BC0BB-9EDA-423C-8276-48857B735D68}" = Prince of Persia Warrior Within "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FC906D5C-91F9-4DA4-A765-6DCBB669F317}" = Sony Ericsson PC Suite "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "AMX Mod X Installer" = AMX Mod X Installer 1.76 "ATI Display Driver" = ATI Display Driver "AutoConnect" = AutoConnect v0.1.3.1 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "CCleaner" = CCleaner (remove only) "CSS FULL DZ [Oct 15 2007]" = CSS FULL DZ [Oct 15 2007] v18.1 "Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2) "eMusic Promotion" = 50 FREE MP3s +1 Free Audiobook! "ezHTML_doklejki_is1" = Edytor Znaczników HTML 2.0PR1 Alef "HighGrow 4.2 Polish Version - www.highgrow.prv.pl" = HighGrow 4.2 Polish Version - www.highgrow.prv.pl "HijackThis" = HijackThis 1.99.1 "HLSW_is1" = HLSW v1.3.1 "HyperCam 2" = HyperCam 2 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "LiveReg" = LiveReg (Symantec Corporation) "LiveUpdate1.6" = LiveUpdate 1.6 (Symantec Corporation) "Metin2.us_is1" = Metin2.us "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Moje Gimnazjum 2009 Profil Matematyczno-Przyrodniczy1.0" = Moje Gimnazjum 2009 Profil Matematyczno-Przyrodniczy "Mozilla Firefox (3.5.3)" = Mozilla Firefox (3.5.3) "MUSTEK 1200 CU v2.0a" = MUSTEK 1200 CU v2.0a "MuVo Driver" = Creative Mass Storage Drivers "NeoKwinto" = NeoKwinto "neostradatp.exe" = neostrada tp "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "No-IP.com DUC" = No-IP.com DUC (remove only) "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "PunkBusterSvc" = PunkBuster Services "Red Alert 2" = Command & Conquer Red Alert 2 "Rzeźnik MPEGów 1.1.99_is1" = Rzeźnik MPEGów 1.1.99 "SA-MP version changer by nechcinick" = SA-MP version changer by nechcinick "Silkroad" = Silkroad "Steam App 10" = Counter-Strike "Steam App 130" = Half-Life: Blue Shift "Steam App 20" = Team Fortress Classic "Steam App 30" = Day of Defeat "Steam App 40" = Deathmatch Classic "Steam App 50" = Opposing Force "Steam App 60" = Ricochet "StmAdsl" = ADSL Modem "TC PowerPack" = TC PowerPack 1.7 "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "Testy gimnazjalne - Humanistyczne (wersja demonstracyjna)" = Testy gimnazjalne - Humanistyczne (wersja demonstracyjna) "Testy gimnazjalne Mat-przyrodnicze (wersja demonstracyjna)" = Testy gimnazjalne Mat-przyrodnicze (wersja demonstracyjna) "Tibia Auto" = NSIS Example2 "Tibia_is1" = Tibia "TibiaBot NG_is1" = TibiaBot NG 4.9.1 "Update Service" = Update Service "VentriloMIX" = VentriloMIX "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Winamp" = Winamp "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = Archiwizator WinRAR "xampp" = XAMPP 1.6.6a   [color=#E56717]========== Last 10 Event Log Errors ==========[/color]   [ Application Events ] Error - 2009-10-11 11:16:44 | Computer Name = MEISSNER-62CCEE | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca Projekt1.exe, wersja 0.0.0.0, moduł zawieszenia  hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.   Error - 2009-10-11 13:44:15 | Computer Name = MEISSNER-62CCEE | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd projekt1.exe, wersja 0.0.0.0, moduł powodujący  błąd projekt1.exe, wersja 0.0.0.0, adres błędu 0x00015170.   Error - 2009-10-13 11:05:15 | Computer Name = MEISSNER-62CCEE | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd romet.exe, wersja 0.0.0.0, moduł powodujący  błąd romet.exe, wersja 0.0.0.0, adres błędu 0x00001fd7.   Error - 2009-10-13 11:10:37 | Computer Name = MEISSNER-62CCEE | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd romet.exe, wersja 0.0.0.0, moduł powodujący  błąd romet.exe, wersja 0.0.0.0, adres błędu 0x000024c7.   Error - 2009-10-13 11:12:35 | Computer Name = MEISSNER-62CCEE | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd romet.exe, wersja 0.0.0.0, moduł powodujący  błąd romet.exe, wersja 0.0.0.0, adres błędu 0x00001d9b.   Error - 2009-10-13 11:13:34 | Computer Name = MEISSNER-62CCEE | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd romet.exe, wersja 0.0.0.0, moduł powodujący  błąd romet.exe, wersja 0.0.0.0, adres błędu 0x0000173b.   Error - 2009-10-17 12:21:02 | Computer Name = MEISSNER-62CCEE | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.5512, moduł zawieszenia  hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.   Error - 2009-10-17 12:22:28 | Computer Name = MEISSNER-62CCEE | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.5512, moduł zawieszenia  hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.   Error - 2009-10-17 12:22:32 | Computer Name = MEISSNER-62CCEE | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.5512, moduł zawieszenia  hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.   Error - 2009-10-17 12:22:45 | Computer Name = MEISSNER-62CCEE | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.5512, moduł zawieszenia  hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.   [ System Events ] Error - 2009-10-17 12:47:09 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:47:44 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:47:49 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:47:58 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:48:04 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:48:09 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-17 12:48:16 | Computer Name = MEISSNER-62CCEE | Source = Cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok.   Error - 2009-10-18 05:34:44 | Computer Name = MEISSNER-62CCEE | Source = ipnathlp | ID = 31008 Description = Agent proxy DNS nie może odczytać z Rejestru  lokalnej listy serwerów  rozpoznawania nazw.  Dane zawierają kod błędu.   Error - 2009-10-18 11:05:23 | Computer Name = MEISSNER-62CCEE | Source = ipnathlp | ID = 31008 Description = Agent proxy DNS nie może odczytać z Rejestru  lokalnej listy serwerów  rozpoznawania nazw.  Dane zawierają kod błędu.   Error - 2009-10-18 13:50:58 | Computer Name = MEISSNER-62CCEE | Source = sr | ID = 1 Description = Filtr Przywracania systemu napotkał nieoczekiwany błąd '0xC0000001'  podczas przetwarzania pliku '' w woluminie 'HarddiskVolume1'. W rezultacie zostało  zatrzymane monitorowanie woluminu.     < End of report >

[@Blade@]

Znasz ten plik:

Kod:

C:\1.cmd

oraz ten folder

Kod:

C:\1

???

[Trojan na kompie :/]

Sprawdzilem obydwa to pliki ale zadnego nie kojaze...

[@Blade@]

W takim razie w OTL wklej:

Cytat:

:OTL PRC - [2008-04-14 19:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE FF - prefs.js..browser.search.defaultenginename: "Ask" FF - prefs.js..browser.search.order.1: "Ask" FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=" [2009-07-18 12:09:24 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\ask.xml O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found. O4 - HKLM..\Run: [menustart] c:\loader.exe File not found :Files C:\1.cmd C:\1 D:\1.cmd E:\1.cmd D:\1 E:\1 :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp] [start explorer] [Reboot]

Klikasz Run Fix. Dajesz log z usuwania + nowy log z OTL

[Trojan na kompie :/]

Log z czyszczenia logi ze scana za chwile...

Kod:

All processes killed ========== OTL ========== Process Explorer.EXE killed successfully! Prefs.js: "Ask" removed from browser.search.defaultenginename Prefs.js: "Ask" removed from browser.search.order.1 Prefs.js: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=" removed from keyword.URL C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\ask.xml moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{37B85A29-692B-4205-9CAD-2626E4993404} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\menustart deleted successfully. ========== FILES ========== C:\1.cmd moved successfully. C:\1 moved successfully. File\Folder D:\1.cmd not found. File\Folder E:\1.cmd not found. File\Folder D:\1 not found. File\Folder E:\1 not found. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully. ========== COMMANDS ==========   [EMPTYTEMP]   User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes   User: All Users   User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes   User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes   User: Marcin ->Temp folder emptied: 2470559 bytes File delete failed. C:\Documents and Settings\Marcin\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 25427455 bytes ->Java cache emptied: 2497720 bytes ->FireFox cache emptied: 141074636 bytes   User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes   %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2241921 bytes %systemroot%\System32 .tmp files removed: 2596 bytes Windows Temp folder emptied: 5641 bytes RecycleBin emptied: 0 bytes   Total Files Cleaned = 165,77 mb     OTL by OldTimer - Version 3.0.21.0 log created on 10192009_162507 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Chcialbym jeszcze dodac ze mam cholerne lagi w WoW'ie

[Trojan na kompie :/]

Tym razem dostalem tylko 1 log...

Kod:

OTL logfile created on: 2009-10-19 16:31:19 - Run 2 OTL by OldTimer - Version 3.0.21.0     Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd   2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]   %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 29,30 Gb Total Space | 9,01 Gb Free Space | 30,75% Space Free | Partition Type: NTFS Drive D: | 214,84 Gb Total Space | 98,13 Gb Free Space | 45,68% Space Free | Partition Type: NTFS Drive E: | 221,62 Gb Total Space | 171,59 Gb Free Space | 77,43% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded   Computer Name: MEISSNER-62CCEE Current User Name: Marcin Logged in as Administrator.   Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard   [color=#E56717]========== Processes (SafeList) ==========[/color]   PRC - [2009-10-17 11:19:08 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe PRC - [2009-09-12 13:35:23 | 01,172,992 | ---- | M] (Vitalwerks LLC) -- C:\Program Files\No-IP\DUC20.exe PRC - [2009-08-24 22:23:38 | 00,908,280 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-05 21:02:22 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009-06-11 22:04:34 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009-03-02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2009-02-12 20:09:05 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe PRC - [2009-02-06 12:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2008-06-03 11:09:36 | 00,552,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2008-04-14 19:21:50 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe PRC - [2008-04-14 19:21:49 | 00,196,608 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\WBEM\WMIADAP.EXE PRC - [2008-04-14 19:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2008-04-14 19:21:12 | 00,010,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dumprep.exe PRC - [2008-02-13 21:07:30 | 04,653,056 | ---- | M] () -- C:\xampp\mysql\bin\mysqld-nt.exe PRC - [2008-01-18 01:37:26 | 00,024,635 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\apache.exe PRC - [2006-12-03 01:14:03 | 00,310,784 | ---- | M] (http://autoconnect.prv.pl) -- C:\Program Files\AutoConnect\AutoConnect.exe PRC - [2005-06-21 00:10:30 | 00,053,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2004-08-23 13:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [1999-12-13 02:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE   [color=#E56717]========== Win32 Services (SafeList) ==========[/color]   SRV - [2009-09-12 13:35:23 | 01,172,992 | ---- | M] (Vitalwerks LLC) -- C:\Program Files\No-IP\DUC20.exe -- (NoIPDUCService [Auto | Running]) SRV - [2009-08-05 21:02:22 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running]) SRV - [2009-07-09 20:11:04 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped]) SRV - [2009-06-11 22:04:34 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running]) SRV - [2009-02-12 20:09:05 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe -- (PnkBstrA [Auto | Running]) SRV - [2008-07-29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2008-07-29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2008-07-29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2008-07-25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2008-07-25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2008-06-03 11:09:36 | 00,552,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running]) SRV - [2008-06-02 21:05:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped]) SRV - [2008-04-14 19:20:44 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2008-02-13 21:07:30 | 04,653,056 | ---- | M] () -- C:\xampp\mysql\bin\mysqld-nt.exe -- (mysql [Auto | Running]) SRV - [2008-01-18 01:37:26 | 00,024,635 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\apache.exe -- (Apache2.2 [Auto | Running]) SRV - [2007-12-25 23:25:50 | 00,586,240 | ---- | M] (FileZilla Project) -- c:\xampp\FileZillaFTP\FileZillaServer.exe -- (FileZilla Server [On_Demand | Stopped]) SRV - [2007-12-21 04:01:02 | 00,060,928 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\xampp\service.exe -- (XAMPP [Auto | Stopped]) SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2005-06-21 00:10:30 | 00,053,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) SRV - [2004-08-23 13:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [1999-12-13 02:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE -- (Creative Service for CDROM Access [Auto | Running])   [color=#E56717]========== Driver Services (SafeList) ==========[/color]   DRV - [2009-08-05 21:02:22 | 00,055,656 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running]) DRV - [2009-06-14 17:45:16 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) DRV - [2009-06-12 09:11:46 | 00,025,280 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped]) DRV - [2009-06-11 22:04:34 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running]) DRV - [2009-03-30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System | Running]) DRV - [2009-02-13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running]) DRV - [2008-12-20 12:20:49 | 00,022,368 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped]) DRV - [2008-12-20 12:20:49 | 00,010,976 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggflt.sys -- (ggflt [On_Demand | Stopped]) DRV - [2008-09-04 15:31:29 | 00,278,984 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\atksgt.sys -- (atksgt [Auto | Running]) DRV - [2008-09-04 15:30:45 | 00,025,416 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\lirsgt.sys -- (lirsgt [Auto | Running]) DRV - [2008-06-03 14:20:54 | 03,100,160 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running]) DRV - [2008-05-29 12:33:10 | 00,027,672 | R--- | M] (EnTech Taiwan) -- C:\WINDOWS\System32\DRIVERS\ENTECH.sys -- (ENTECH [On_Demand | Stopped]) DRV - [2008-05-19 09:46:30 | 00,150,568 | R--- | M] (Marvell Semiconductor, Inc.) -- C:\WINDOWS\system32\DRIVERS\mv61xx.sys -- (mv61xx [Boot | Running]) DRV - [2008-04-13 20:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\usb8023.sys -- (USB_RNDIS [On_Demand | Stopped]) DRV - [2008-04-13 18:39:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running]) DRV - [2008-04-13 18:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2008-03-26 20:37:26 | 04,713,472 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2008-02-02 17:54:00 | 00,036,864 | R--- | M] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\DRIVERS\l1e51x86.sys -- (L1e [On_Demand | Running]) DRV - [2007-12-17 11:14:06 | 00,012,400 | R--- | M] () -- C:\WINDOWS\System32\drivers\AsIO.sys -- (AsIO [System | Running]) DRV - [2007-11-14 21:48:20 | 00,084,992 | R--- | M] (ATI Research Inc.) -- C:\WINDOWS\System32\drivers\AtiHdmi.sys -- (AtiHdmiService [On_Demand | Running]) DRV - [2007-10-29 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2006-11-30 15:11:28 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46unic.sys -- (se46unic [On_Demand | Stopped]) DRV - [2006-11-30 15:11:22 | 00,086,432 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46obex.sys -- (se46obex [On_Demand | Stopped]) DRV - [2006-11-30 15:11:18 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46nd5.sys -- (se46nd5 [On_Demand | Stopped]) DRV - [2006-11-30 15:11:16 | 00,088,624 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mgmt.sys -- (se46mgmt [On_Demand | Stopped]) DRV - [2006-11-30 15:11:12 | 00,097,088 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mdm.sys -- (se46mdm [On_Demand | Stopped]) DRV - [2006-11-30 15:11:10 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46mdfl.sys -- (se46mdfl [On_Demand | Stopped]) DRV - [2006-11-30 15:11:04 | 00,061,536 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se46bus.sys -- (se46bus [On_Demand | Stopped]) DRV - [2006-11-10 18:24:06 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se2Eunic.sys -- (se2Eunic [On_Demand | Stopped]) DRV - [2006-11-10 18:23:58 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Eobex.sys -- (SE2Eobex [On_Demand | Stopped]) DRV - [2006-11-10 18:23:56 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se2End5.sys -- (se2End5 [On_Demand | Stopped]) DRV - [2006-11-10 18:23:54 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emgmt.sys -- (SE2Emgmt [On_Demand | Stopped]) DRV - [2006-11-10 18:23:50 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emdm.sys -- (SE2Emdm [On_Demand | Stopped]) DRV - [2006-11-10 18:23:48 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys -- (SE2Emdfl [On_Demand | Stopped]) DRV - [2006-11-10 18:23:42 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE2Ebus.sys -- (SE2Ebus [On_Demand | Stopped]) DRV - [2006-09-18 14:59:08 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se27unic.sys -- (se27unic [On_Demand | Stopped]) DRV - [2006-09-18 14:59:02 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27obex.sys -- (SE27obex [On_Demand | Stopped]) DRV - [2006-09-18 14:59:00 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\se27nd5.sys -- (se27nd5 [On_Demand | Stopped]) DRV - [2006-09-18 14:58:58 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mgmt.sys -- (SE27mgmt [On_Demand | Stopped]) DRV - [2006-09-18 14:58:54 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mdm.sys -- (SE27mdm [On_Demand | Stopped]) DRV - [2006-09-18 14:58:52 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27mdfl.sys -- (SE27mdfl [On_Demand | Stopped]) DRV - [2006-09-18 14:58:48 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\SE27bus.sys -- (SE27bus [On_Demand | Stopped]) DRV - [2006-05-25 15:28:44 | 00,684,265 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\torususb.sys -- (TaurusUsb [On_Demand | Running]) DRV - [2004-08-13 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2003-08-12 14:51:00 | 00,060,255 | ---- | M] (STMicroelectronics              ) -- C:\WINDOWS\System32\DRIVERS\stmatm.sys -- (Stmatm [On_Demand | Running]) DRV - [2003-08-04 13:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2002-09-16 17:14:32 | 00,004,228 | ---- | M] (PowerQuest Corporation) -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv [System | Running])   [color=#E56717]========== Standard Registry (SafeList) ==========[/color]     [color=#E56717]========== Internet Explorer ==========[/color]   IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm   IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0   [color=#E56717]========== FireFox ==========[/color]   FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.pl" FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.10.1 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.3   FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009-08-25 09:09:51 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-10-17 20:34:18 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-09-27 09:48:37 | 00,000,000 | ---D | M]   [2008-08-15 01:16:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions [2008-08-15 01:16:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-10-18 21:52:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions [2009-07-02 12:23:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2009-08-25 13:21:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009-07-02 12:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2009-07-18 11:29:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009-09-16 22:06:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\mozilla\Firefox\Profiles\8v8pxpyb.default\extensions\SQLiteManager@mrinalkant.blogspot(2).com [2009-06-14 17:48:04 | 00,002,399 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\daemon-search.xml [2009-07-02 12:23:55 | 00,001,196 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\8v8pxpyb.default\searchplugins\winamp-search.xml [2009-10-19 16:28:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-09-27 09:48:37 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-01-05 18:47:04 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED} [2008-08-16 11:57:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009-08-24 22:23:38 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-08-24 22:23:38 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007-04-10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2009-08-24 22:23:38 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2009-08-24 21:19:13 | 00,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2009-08-24 21:19:13 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2009-08-24 21:19:13 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009-08-24 21:19:13 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2009-08-24 21:19:13 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2009-08-24 21:19:13 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2009-08-24 21:19:13 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml   O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1       localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Marcin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [AdslTaskBar] C:\WINDOWS\System32\stmctrl.DLL (STMicroelectronics              ) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\neostrada tp\Watch.exe (France Télécom R&D) O4 - HKCU..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe (http://autoconnect.prv.pl) O4 - HKCU..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) O4 - HKCU..\Run: [Steam] d:\gry\steam\steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-03-20 17:42:25 | 00,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) -  File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) -  File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found   [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]   [2009-10-01 12:16:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Blizzard Entertainment [2009-10-10 18:07:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2009-10-10 19:42:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Silver_Squirrel_Software_ [2009-10-17 20:40:04 | 00,000,000 | ---D | C] -- C:\Program Files\HyCam2 [2009-09-26 17:30:34 | 00,000,000 | ---D | C] -- C:\Program Files\Ronots Client [2009-10-10 19:38:53 | 00,000,000 | ---D | C] -- C:\Program Files\Tibiacast [2009-10-19 16:25:07 | 00,000,000 | ---D | C] -- C:\_OTL [2009-10-18 19:50:23 | 00,000,000 | ---D | C] -- C:\Avenger [2009-10-18 17:11:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b [2009-10-18 13:12:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070 [2009-10-17 21:42:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\BlackBlue [2009-10-17 12:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\lol [2009-10-17 11:21:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\avenger [2009-10-17 11:19:00 | 00,521,216 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-10-16 20:33:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\stronka [2009-10-15 20:01:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Ikonki [2009-10-11 16:20:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Programowanie [2009-10-11 16:14:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2 [2009-10-03 21:25:02 | 03,912,190 | ---- | C] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.1.exe [2009-10-03 21:14:19 | 03,907,973 | ---- | C] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.0.exe [2009-09-27 08:41:15 | 08,777,416 | ---- | C] (Mozilla) -- C:\Documents and Settings\Marcin\Pulpit\Firefox Setup 3.5.3.exe [2009-09-26 17:25:54 | 15,331,166 | ---- | C] (RonOTS                                                      ) -- C:\Documents and Settings\Marcin\Pulpit\RonotsClient84.exe [2009-09-26 10:59:58 | 00,000,000 | -HSD | C] -- C:\RECYCLER [2009-09-24 21:48:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp [2009-09-24 21:40:28 | 00,000,000 | RHSD | C] -- C:\cmdcons [2009-09-24 17:48:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009-09-24 15:57:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\CSC [2009-09-21 17:39:37 | 00,000,000 | ---D | C] -- C:\xampp [2009-09-20 15:27:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\xampp   [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]   [2009-10-19 16:31:32 | 01,278,650 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-10-19 16:31:32 | 00,563,540 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-10-19 16:31:32 | 00,500,286 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-10-19 16:31:32 | 00,109,936 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-10-19 16:31:32 | 00,088,828 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-10-19 16:27:39 | 00,000,442 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics [2009-10-19 16:27:35 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-10-19 16:26:54 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-10-19 16:26:52 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-10-18 22:16:51 | 00,000,091 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\index.html [2009-10-18 18:19:17 | 02,359,350 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\de_kabul0000.bmp [2009-10-18 17:10:50 | 02,349,477 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b.rar [2009-10-18 13:12:12 | 00,976,454 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070.zip [2009-10-17 21:15:12 | 20,661,068 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\demko0001.avi [2009-10-17 20:49:05 | 00,000,671 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Teamspeak 2 RC2.lnk [2009-10-17 20:48:52 | 05,862,994 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\ts2_client_rc2_2032.exe [2009-10-17 20:41:05 | 00,763,358 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\clip0001.avi [2009-10-17 20:38:10 | 00,722,048 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\HC2Setup.exe [2009-10-17 18:14:05 | 00,031,232 | ---- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-17 16:58:49 | 00,002,069 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Steam.lnk [2009-10-17 11:20:24 | 00,724,952 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\avenger.zip [2009-10-17 11:19:08 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2009-10-16 22:49:38 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009-10-16 19:34:09 | 00,002,279 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Remere's Map Editor.lnk [2009-10-14 20:34:23 | 02,083,999 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\phpBB_modified_by_Przemo.zip [2009-10-11 22:43:01 | 03,704,444 | -H-- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-10-11 22:33:07 | 00,475,166 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\BezNazwy1.exe [2009-10-11 17:04:38 | 01,032,582 | ---- | M] () -- C:\WINDOWS\System32\alleg42.dll [2009-10-11 16:13:39 | 06,589,225 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2.zip [2009-10-10 15:29:58 | 09,326,468 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\devcpp-4.9.9.2_setup.exe [2009-10-03 21:26:55 | 00,000,639 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\TibiaBot NG.lnk [2009-10-03 21:26:05 | 03,912,190 | ---- | M] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.1.exe [2009-10-03 21:15:26 | 03,907,973 | ---- | M] (NGSoft, LLC                                                 ) -- C:\Documents and Settings\Marcin\Pulpit\setup-4.9.0.exe [2009-10-02 20:01:57 | 25,198,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009-09-27 09:48:38 | 00,001,608 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-09-27 08:44:57 | 08,777,416 | ---- | M] (Mozilla) -- C:\Documents and Settings\Marcin\Pulpit\Firefox Setup 3.5.3.exe [2009-09-26 17:35:50 | 00,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2009-09-26 17:30:23 | 15,331,166 | ---- | M] (RonOTS                                                      ) -- C:\Documents and Settings\Marcin\Pulpit\RonotsClient84.exe [2009-09-26 11:01:56 | 00,000,206 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110155.reg [2009-09-26 11:01:47 | 00,000,206 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110145.reg [2009-09-26 11:01:37 | 00,004,582 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110134.reg [2009-09-26 11:01:20 | 00,002,380 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110117.reg [2009-09-26 11:00:58 | 00,012,884 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110054.reg [2009-09-26 11:00:45 | 00,358,010 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110036.reg [2009-09-26 10:57:32 | 00,001,554 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\CCleaner.lnk [2009-09-24 21:46:57 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-09-24 21:46:32 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009-09-24 21:40:33 | 00,000,425 | RHS- | M] () -- C:\boot.ini [2009-09-24 17:27:51 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak [2009-09-22 18:33:23 | 00,020,808 | ---- | M] () -- C:\Documents and Settings\Marcin\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-09-21 17:52:38 | 00,000,544 | ---- | M] () -- C:\WINDOWS\my.ini [2009-09-21 17:40:46 | 00,000,357 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\XAMPP Control Panel.lnk   [color=#E56717]========== Files - No Company Name ==========[/color] [2009-10-18 22:16:51 | 00,000,091 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\index.html [2009-10-18 18:18:10 | 02,359,350 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\de_kabul0000.bmp [2009-10-18 17:10:13 | 02,349,477 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\webSPELL4.2.1b.rar [2009-10-18 13:11:54 | 00,976,454 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\webspellpl_ver1070.zip [2009-10-17 21:14:37 | 20,661,068 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\demko0001.avi [2009-10-17 20:49:05 | 00,000,671 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Teamspeak 2 RC2.lnk [2009-10-17 20:47:01 | 05,862,994 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\ts2_client_rc2_2032.exe [2009-10-17 20:40:41 | 00,763,358 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\clip0001.avi [2009-10-17 20:37:56 | 00,722,048 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\HC2Setup.exe [2009-10-17 11:20:12 | 00,724,952 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\avenger.zip [2009-10-16 22:47:29 | 00,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2009-10-14 20:33:52 | 02,083,999 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\phpBB_modified_by_Przemo.zip [2009-10-11 22:32:25 | 00,475,166 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\BezNazwy1.exe [2009-10-11 16:12:22 | 01,032,582 | ---- | C] () -- C:\WINDOWS\System32\alleg42.dll [2009-10-11 16:12:02 | 06,589,225 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\allegro-mingw-4.2.2.zip [2009-10-10 15:27:38 | 09,326,468 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\devcpp-4.9.9.2_setup.exe [2009-09-26 17:30:37 | 00,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2009-09-26 11:01:55 | 00,000,206 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110155.reg [2009-09-26 11:01:46 | 00,000,206 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110145.reg [2009-09-26 11:01:35 | 00,004,582 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110134.reg [2009-09-26 11:01:19 | 00,002,380 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110117.reg [2009-09-26 11:00:56 | 00,012,884 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110054.reg [2009-09-26 11:00:39 | 00,358,010 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\cc_20090926_110036.reg [2009-09-26 10:57:32 | 00,001,554 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\CCleaner.lnk [2009-09-24 21:40:29 | 00,262,400 | ---- | C] () -- C:\cmldr [2009-09-24 17:49:47 | 00,229,888 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009-09-24 17:27:52 | 00,013,646 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak [2009-09-21 17:40:46 | 00,000,357 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\XAMPP Control Panel.lnk [2009-06-18 21:35:54 | 01,867,776 | ---- | C] () -- C:\WINDOWS\System32\python24.dll [2009-06-12 16:34:48 | 00,045,936 | ---- | C] () -- C:\WINDOWS\php.ini [2009-06-12 16:34:48 | 00,000,544 | ---- | C] () -- C:\WINDOWS\my.ini [2009-04-25 19:41:39 | 00,135,168 | ---- | C] () -- C:\WINDOWS\System32\12kCUusd.dll [2008-11-28 09:12:28 | 00,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2008-11-22 22:29:35 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-09-18 16:36:34 | 00,020,808 | ---- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\GDIPFONTCACHEV1.DAT [2008-08-18 20:02:08 | 00,000,161 | ---- | C] () -- C:\WINDOWS\DSLSetup.ini [2008-08-18 20:02:07 | 00,684,265 | ---- | C] () -- C:\WINDOWS\System32\drivers\torususb.sys [2008-08-18 11:23:50 | 00,278,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2008-08-18 11:23:49 | 00,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2008-08-17 19:03:14 | 00,000,427 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-08-17 17:13:59 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-08-17 17:13:59 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2008-08-17 17:13:57 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008-08-17 17:13:57 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-08-17 17:13:57 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-08-17 17:13:56 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-08-17 17:13:56 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-08-16 15:17:28 | 00,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008-08-16 15:17:28 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\PnkBstrK.sys [2008-08-16 14:49:46 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008-08-16 14:45:51 | 00,031,232 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-08-16 08:37:57 | 00,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys [2008-08-14 16:37:17 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini [2008-08-14 16:07:39 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll [2008-08-14 16:07:39 | 00,012,400 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2008-08-14 16:07:37 | 00,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys [2008-08-14 16:07:37 | 00,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys [2008-08-14 15:43:17 | 00,036,025 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini [2008-08-14 15:43:12 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008-08-14 15:43:02 | 00,035,634 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-08-14 15:43:02 | 00,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-08-14 15:37:57 | 03,704,444 | -H-- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\IconCache.db [2008-08-14 15:21:44 | 00,020,808 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2008-08-14 15:12:51 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Marcin\Dane aplikacji\desktop.ini [2007-10-29 14:00:00 | 00,000,627 | ---- | C] () -- C:\WINDOWS\win.ini [2007-10-29 14:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini   [color=#E56717]========== Alternate Data Streams ==========[/color]   @Alternate Data Stream - 294 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:E41EAF13 @Alternate Data Stream - 143 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B @Alternate Data Stream - 120 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:4EE74317 < End of report >

[@Blade@]

No nic tu więcej nie widzę, ale podaj jeszcze dla pewności log z GMER http://www.gmer.net/

[Trojan na kompie :/]

Kod:

GMER 1.0.15.15163 - http://www.gmer.net Rootkit scan 2009-10-19 20:21:35 Windows 5.1.2600 Dodatek Service Pack 3 Running: dsxb1dwh.exe; Driver: C:\DOCUME~1\Marcin\USTAWI~1\Temp\awpdqfow.sys ---- System - GMER 1.0.15 ---- SSDT      BA7A4C76                                                                                                             ZwCreateKey SSDT      BA7A4C6C                                                                                                             ZwCreateThread SSDT      BA7A4C7B                                                                                                             ZwDeleteKey SSDT      BA7A4C85                                                                                                             ZwDeleteValueKey SSDT      spea.sys                                                                                                             ZwEnumerateKey [0xB9EC5CA4] SSDT      spea.sys                                                                                                             ZwEnumerateValueKey [0xB9EC6032] SSDT      BA7A4C8A                                                                                                             ZwLoadKey SSDT      spea.sys                                                                                                             ZwOpenKey [0xB9EA70C0] SSDT      BA7A4C58                                                                                                             ZwOpenProcess SSDT      BA7A4C5D                                                                                                             ZwOpenThread SSDT      spea.sys                                                                                                             ZwQueryKey [0xB9EC610A] SSDT      spea.sys                                                                                                             ZwQueryValueKey [0xB9EC5F8A] SSDT      BA7A4C94                                                                                                             ZwReplaceKey SSDT      BA7A4C8F                                                                                                             ZwRestoreKey SSDT      BA7A4C80                                                                                                             ZwSetValueKey SSDT      BA7A4C67                                                                                                             ZwTerminateProcess INT 0x63  ?                                                                                                                    8AF58BF8 INT 0x63  ?                                                                                                                    8AF58BF8 INT 0x63  ?                                                                                                                    8AF58BF8 INT 0x63  ?                                                                                                                    8AF58BF8 INT 0x63  ?                                                                                                                    8A08CBF8 INT 0x83  ?                                                                                                                    8AF5BBF8 INT 0x83  ?                                                                                                                    8A08CBF8 INT 0x83  ?                                                                                                                    8AF5BBF8 INT 0x84  ?                                                                                                                    8A08CBF8 INT 0xA4  ?                                                                                                                    8A08CBF8 INT 0xA4  ?                                                                                                                    8A08CBF8 INT 0xA4  ?                                                                                                                    8A08CBF8 INT 0xA4  ?                                                                                                                    8A08CBF8 INT 0xB4  ?                                                                                                                    8A08CBF8 ---- Kernel code sections - GMER 1.0.15 ---- ?         spea.sys                                                                                                             Nie można odnaleźć określonego pliku. ! .text     USBPORT.SYS!DllUnload                                                                                                B8F678AC 5 Bytes  JMP 8A08C1D8 .text     ahy8ulli.SYS                                                                                                         B8EF4386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...] .text     ahy8ulli.SYS                                                                                                         B8EF43AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...] .text     ahy8ulli.SYS                                                                                                         B8EF43C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH} .text     ahy8ulli.SYS                                                                                                         B8EF43C9 1 Byte  [30] .text     ahy8ulli.SYS                                                                                                         B8EF43C9 11 Bytes  [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL} .text     ...                                                                                                                  ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT       atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                   [B9EA8042] spea.sys IAT       atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                           [B9EA813E] spea.sys IAT       atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [B9EA80C0] spea.sys IAT       atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [B9EA8800] spea.sys IAT       atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [B9EA86D6] spea.sys IAT       \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                   [B9EB7E9C] spea.sys IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KfAcquireSpinLock]                                                 18C4830E IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!READ_PORT_UCHAR]                                                   1C8D9E88 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KeGetCurrentIrql]                                                  9E880000 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KfRaiseIrql]                                                       00001CA9 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KfLowerIrql]                                                       0E798366 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!HalGetInterruptVector]                                             74AAB000 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!HalTranslateBusAddress]                                            8186C636 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KeStallExecutionProcessor]                                         1A00001C IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!KfReleaseSpinLock]                                                 1C8386C6 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                           C6020000 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!READ_PORT_USHORT]                                                  001C8E86 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                          86C60200 IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                  00001CAA IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[WMILIB.SYS!WmiSystemControl]                                               8800001C IAT       \SystemRoot\System32\Drivers\ahy8ulli.SYS[WMILIB.SYS!WmiCompleteRequest]                                             001CB19E ---- Devices - GMER 1.0.15 ---- Device    \FileSystem\Ntfs \Ntfs                                                                                               8AFC81F8 Device    \Driver\usbuhci \Device\USBPDO-0                                                                                     8A08B1F8 Device    \Driver\dmio \Device\DmControl\DmIoDaemon                                                                            8AFCA1F8 Device    \Driver\dmio \Device\DmControl\DmConfig                                                                              8AFCA1F8 Device    \Driver\dmio \Device\DmControl\DmPnP                                                                                 8AFCA1F8 Device    \Driver\dmio \Device\DmControl\DmInfo                                                                                8AFCA1F8 Device    \Driver\usbuhci \Device\USBPDO-1                                                                                     8A08B1F8 Device    \Driver\usbuhci \Device\USBPDO-2                                                                                     8A08B1F8 Device    \Driver\usbehci \Device\USBPDO-3                                                                                     8A04F1F8 Device    \Driver\usbuhci \Device\USBPDO-4                                                                                     8A08B1F8 Device    \Driver\usbuhci \Device\USBPDO-5                                                                                     8A08B1F8 Device    \Driver\usbuhci \Device\USBPDO-6                                                                                     8A08B1F8 Device    \Driver\Ftdisk \Device\HarddiskVolume1                                                                               8AF591F8 Device    \Driver\usbehci \Device\USBPDO-7                                                                                     8A04F1F8 Device    \Driver\Ftdisk \Device\HarddiskVolume2                                                                               8AF591F8 Device    \Driver\Cdrom \Device\CdRom0                                                                                         8A02D1F8 Device    \Driver\Ftdisk \Device\HarddiskVolume3                                                                               8AF591F8 Device    \Driver\Cdrom \Device\CdRom1                                                                                         8A02D1F8 Device    \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                          [B9DFAB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device    \Driver\atapi \Device\Ide\IdePort0                                                                                   [B9DFAB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device    \Driver\atapi \Device\Ide\IdePort1                                                                                   [B9DFAB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device    \Driver\atapi \Device\Ide\IdePort2                                                                                   [B9DFAB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device    \Driver\atapi \Device\Ide\IdePort3                                                                                   [B9DFAB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device    \Driver\Cdrom \Device\CdRom2                                                                                         8A02D1F8 Device    \Driver\NetBT \Device\NetBt_Wins_Export                                                                              88F0C1F8 Device    \Driver\sptd \Device\554244522                                                                                       spea.sys Device    \Driver\NetBT \Device\NetBT_Tcpip_{EFB2F32A-A6CB-4166-81A2-3074C3A3C16C}                                             88F0C1F8 Device    \Driver\NetBT \Device\NetbiosSmb                                                                                     88F0C1F8 Device    \Driver\PCI_PNP4522 \Device\0000004d                                                                                 spea.sys Device    \Driver\usbuhci \Device\USBFDO-0                                                                                     8A08B1F8 Device    \Driver\usbuhci \Device\USBFDO-1                                                                                     8A08B1F8 Device    \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    88ED31F8 Device    \Driver\usbuhci \Device\USBFDO-2                                                                                     8A08B1F8 Device    \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          88ED31F8 Device    \Driver\usbehci \Device\USBFDO-3                                                                                     8A04F1F8 Device    \Driver\usbuhci \Device\USBFDO-4                                                                                     8A08B1F8 Device    \Driver\Ftdisk \Device\FtControl                                                                                     8AF591F8 Device    \Driver\usbuhci \Device\USBFDO-5                                                                                     8A08B1F8 Device    \Driver\NetBT \Device\NetBT_Tcpip_{39EBE09F-16AB-4F67-821C-1FF83098E3E6}                                             88F0C1F8 Device    \Driver\usbuhci \Device\USBFDO-6                                                                                     8A08B1F8 Device    \Driver\usbehci \Device\USBFDO-7                                                                                     8A04F1F8 Device    \Driver\mv61xx \Device\Scsi\mv61xx1Port4Path0Target14Lun0                                                            8AFC91F8 Device    \Driver\ahy8ulli \Device\Scsi\ahy8ulli1                                                                              89F751F8 Device    \Driver\mv61xx \Device\Scsi\mv61xx1Port4Path0Target1Lun0                                                             8AFC91F8 Device    \Driver\mv61xx \Device\Scsi\mv61xx1                                                                                  8AFC91F8 Device    \Driver\ahy8ulli \Device\Scsi\ahy8ulli1Port5Path0Target0Lun0                                                         89F751F8 Device    \Driver\mv61xx \Device\Scsi\mv61xx1Port4Path0Target0Lun0                                                             8AFC91F8 Device    \FileSystem\Cdfs \Cdfs                                                                                               89FF6500 ---- Registry - GMER 1.0.15 ---- Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                   771343423 Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                   285507792 Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                   2 Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                      Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                  C:\Program Files\DAEMON Tools Lite\ Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                  1 Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                               0x46 0xC9 0x42 0xFE ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                            Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                         0x20 0x01 0x00 0x00 ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                      0x66 0x4F 0x94 0x3C ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                        Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                 0x36 0xC9 0xEB 0xE1 ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                      Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0 Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x2B 0xC0 0x33 0x80 ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x32 0x22 0xE9 0xB9 ... Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x76 0xA6 0xFD 0x71 ... Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                  Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\ Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0 Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xA9 0xE9 0x22 0x01 ... Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ... Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x32 0x22 0xE9 0xB9 ... Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xB9 0x1A 0x57 0xB6 ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                  Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                      C:\Program Files\DAEMON Tools Lite\ Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                      1 Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                   0x46 0xC9 0x42 0xFE ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)        Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                             0x20 0x01 0x00 0x00 ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                          0x66 0x4F 0x94 0x3C ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)    Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                     0x36 0xC9 0xEB 0xE1 ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                  Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0 Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x2B 0xC0 0x33 0x80 ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x32 0x22 0xE9 0xB9 ... Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x76 0xA6 0xFD 0x71 ... ---- EOF - GMER 1.0.15 ----

[@Blade@]

Tu też nic nie ma.

W OTL kliknij CleanUp

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport