[crooleeck]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51:01, on 2009-11-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Brother\Brmfcmon\brmfcwnd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\4.0.255.0\npchrome_tab.dll
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.co...oUploader55.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com...ows-i586-jc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.c...Plus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2391A5F8-7541-4215-B559-D5ED9B628B10}: NameServer = 213.241.79.37,213.241.79.38,195.114.161.61,195.114.181.130
O18 - Protocol hijack: cf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E}
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MySql - Unknown owner - c:\krasnal/MYSQL/bin/mysqld.exe
O23 - Service: NanoServiceMain - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6293 bytes


Panda Cloud Antivirus daje do kwarantanny plik C:\WINDOWS\system32\sfc_os.dll ale nie radzi sobie z nim - pliczek się "odradza".

[@Blade@]

Podaj logi z OTL (klikasz Run Scan i czekasz aż powstanie log) oraz GMER

Przeskanuj ten plik na http://virusscan.jotti.org/ i podaj wyniki

[crooleeck]

OTL logfile created on: 2009-11-28 13:51:41 - Run 1
OTL by OldTimer - Version 3.1.11.1 Folder = H:\Instalki
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1,50 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 67,64% Memory free
3,35 Gb Paging File | 2,99 Gb Available in Paging File | 89,22% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 20,00 Gb Total Space | 5,30 Gb Free Space | 26,52% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 120,00 Gb Total Space | 29,85 Gb Free Space | 24,88% Space Free | Partition Type: NTFS
Drive G: | 30,01 Gb Total Space | 2,72 Gb Free Space | 9,07% Space Free | Partition Type: NTFS
Drive H: | 62,88 Gb Total Space | 0,72 Gb Free Space | 1,14% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: TOMEK
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009-11-28 13:50:37 | 00,535,040 | ---- | M] (OldTimer Tools) -- H:\Instalki\OTL.exe
PRC - [2009-10-30 17:29:56 | 00,136,448 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
PRC - [2009-10-30 17:29:01 | 00,361,728 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
PRC - [2009-09-27 18:19:46 | 00,172,100 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2009-09-25 15:28:47 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2009-08-25 07:51:48 | 03,548,560 | ---- | M] (Maxthon International ltd.) -- C:\Program Files\Maxthon2\Maxthon.exe
PRC - [2009-05-20 11:45:10 | 00,103,912 | ---- | M] () -- C:\Program Files\Spik\Spik.exe
PRC - [2009-02-25 15:47:50 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2008-03-20 11:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2007-07-13 23:42:04 | 00,974,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2005-04-23 18:12:00 | 00,802,816 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
PRC - [2005-03-17 13:25:54 | 00,057,393 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2004-08-04 01:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2002-04-11 23:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001-12-12 23:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe


========== Modules (SafeList) ==========

MOD - [2009-11-28 13:50:37 | 00,535,040 | ---- | M] (OldTimer Tools) -- H:\Instalki\OTL.exe
MOD - [2009-05-20 10:43:14 | 00,008,192 | ---- | M] () -- C:\Program Files\Spik\idlehk.dll
MOD - [2008-07-25 11:17:20 | 00,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2006-08-25 09:51:14 | 01,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (CiSvc)
SRV - [2009-10-30 17:29:56 | 00,136,448 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)
SRV - [2009-09-27 18:19:46 | 00,172,100 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (nvsvc)
SRV - [2009-09-25 15:28:47 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate) Google Update Service (gupdate)
SRV - [2009-02-25 15:47:50 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2008-12-12 20:10:51 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2005-04-03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003-09-14 21:08:14 | 02,928,700 | ---- | M] () -- c:\krasnal/MYSQL/bin/mysqld.exe -- (MySql)
SRV - [2003-07-28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2002-04-11 23:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service)


========== Driver Services (SafeList) ==========

DRV - [2009-10-30 16:18:01 | 00,146,952 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\system32\drivers\PSINAflt.sys -- (PSINAflt)
DRV - [2009-10-13 15:50:55 | 00,101,512 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\system32\drivers\PSINProc.sys -- (PSINProc)
DRV - [2009-10-13 15:50:54 | 00,114,312 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\system32\drivers\PSINKNC.sys -- (PSINKNC)
DRV - [2009-10-13 15:50:54 | 00,095,880 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\system32\drivers\PSINFile.sys -- (PSINFile)
DRV - [2009-09-27 16:12:22 | 07,655,872 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009-02-17 18:11:30 | 00,024,232 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2008-07-08 18:19:05 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2007-07-28 02:15:52 | 00,062,208 | ---- | M] (Silicon Image, Inc.) -- C:\WINDOWS\system32\drivers\si3112.sys -- (Si3112)
DRV - [2007-06-19 08:51:20 | 00,107,304 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816mdm.sys -- (s816mdm)
DRV - [2007-06-19 08:51:18 | 00,099,112 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816mgmt.sys -- (s816mgmt) Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM)
DRV - [2007-06-19 08:51:18 | 00,097,704 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\s816unic.sys -- (s816unic) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM)
DRV - [2007-06-19 08:51:18 | 00,097,320 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816obex.sys -- (s816obex)
DRV - [2007-06-19 08:51:18 | 00,021,928 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816nd5.sys -- (s816nd5) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS)
DRV - [2007-06-19 08:51:18 | 00,013,864 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816mdfl.sys -- (s816mdfl)
DRV - [2007-06-19 08:51:16 | 00,081,832 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s816bus.sys -- (s816bus) Sony Ericsson Device 816 driver (WDM)
DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2006-04-06 06:23:52 | 00,081,664 | R--- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2006-03-29 07:49:26 | 00,009,856 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2005-07-07 09:14:30 | 01,389,056 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\P17.sys -- (P17)
DRV - [2005-01-10 11:15:30 | 00,106,496 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2005-01-10 11:15:24 | 00,138,752 | R--- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2004-10-15 11:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)
DRV - [2004-08-13 03:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004-07-17 12:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2002-09-16 16:14:32 | 00,004,228 | ---- | M] (PowerQuest Corporation) -- C:\WINDOWS\system32\drivers\PQNTDRV.sys -- (PQNTDrv)
DRV - [2001-08-18 00:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Disable Script Debugger Default = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,DisableScriptDebuggerIE Default = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-10-30 10:50:02 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-10-29 10:47:05 | 00,000,000 | ---D | M]

[2008-07-07 12:37:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions
[2009-11-25 18:08:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\nwv0s9hk.default\extensions
[2009-04-16 11:21:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\nwv0s9hk.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-11-25 18:08:49 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009-02-25 15:48:00 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009-05-20 11:26:29 | 00,077,824 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npwpk.dll
[2009-07-22 22:16:44 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2008-04-03 18:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2007-03-31 18:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2006-06-03 17:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2008-03-28 22:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2007-01-05 12:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\4.0.255.0\npchrome_tab.dll (@COMPANY_FULLNAME@)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PSUNMain] C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTProAgent.exe File not found
O4 - HKCU..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft...922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.co...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com...ows-i586-jc.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macrome...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.c...Plus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\4.0.255.0\npchrome_tab.dll (@COMPANY_FULLNAME@)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wpmsg {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Bieżąca strona główna) - About:Home
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-07-07 12:10:52 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008-07-30 15:43:17 | 00,000,000 | ---D | M] - H:\Auto -- [ NTFS ]
O33 - MountPoints2\{d0bccec0-7aca-11dd-b46b-0017318c1228}\Shell\AutoRun\command - "" = K:\hx.exe -- File not found
O33 - MountPoints2\{d0bccec0-7aca-11dd-b46b-0017318c1228}\Shell\open\Command - "" = K:\hx.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009-11-28 12:49:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\gombrowicz_witold_–_ferdydurke.rtf
[2009-11-28 02:33:02 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2009-11-25 21:02:12 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Pulpit\Zagadnienia
[2009-11-25 17:16:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\angielski
[2009-11-24 17:26:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Updater
[2009-11-24 17:19:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Nowy folder (3)
[2009-11-23 01:51:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)
[2009-11-19 17:39:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Testy makro
[2009-11-16 21:04:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Zeszyt od historii technikum
[2009-11-16 00:25:03 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server
[2009-11-16 00:24:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Visual Studio 2008
[2009-11-16 00:24:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft Help
[2009-11-16 00:20:20 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 9.0
[2009-11-16 00:20:20 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Merge Modules
[2009-11-16 00:20:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
[2009-11-16 00:19:11 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft SDKs
[2009-11-16 00:16:26 | 00,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2009-11-16 00:05:56 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009-11-14 16:58:46 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2009-11-11 14:24:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Panda Security
[2009-11-11 14:20:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security
[2009-11-08 20:38:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Wojna
[2009-11-07 18:21:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Blue-Guilty-2003-ApoLLo_INT
[2009-11-07 12:35:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\prezentacja
[2009-11-05 23:24:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Jason Walker
[2009-11-05 19:16:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\codeblocks
[2009-11-05 18:00:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Tracing
[2009-11-03 20:38:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\.designer
[2009-11-03 16:39:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Nokia
[2009-11-03 16:38:46 | 00,000,000 | ---D | C] -- C:\Qt
[2009-11-01 13:04:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\My Virtual Machines
[2009-10-30 16:18:03 | 00,365,824 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\PSUNCpl.cpl
[2009-10-30 16:18:01 | 00,146,952 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\PSINAflt.sys
[2002-04-11 02:41:06 | 00,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[4 C:\WINDOWS\System32\*.tmp files C:\WINDOWS\System32\*.tmp ]
[3 C:\WINDOWS\*.tmp files C:\WINDOWS\*.tmp ]
[3 C:\Documents and Settings\Administrator\Pulpit\*.tmp files C:\Documents and Settings\Administrator\Pulpit\*.tmp ]
[1 C:\Documents and Settings\Administrator\*.tmp files C:\Documents and Settings\Administrator\*.tmp ]

========== Files - Modified Within 30 Days ==========

[2009-11-28 12:20:19 | 00,253,748 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2009-11-28 12:20:07 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-11-28 02:33:11 | 05,242,880 | -H-- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT
[2009-11-28 01:39:13 | 00,021,504 | ---- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-11-26 18:06:17 | 04,988,096 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Chrola & Szurpik-Bielyje rozy.mp3
[2009-11-25 14:46:30 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-11-23 18:56:41 | 00,091,545 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\konsultacje.pdf
[2009-11-21 17:12:18 | 03,540,563 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\sandra%20-%20everlasting%20love[1].mp3
[2009-11-19 18:54:45 | 00,015,838 | ---- | M] () -- C:\Documents and Settings\Administrator\.recently-used.xbel
[2009-11-19 09:53:39 | 00,443,793 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\regulamin.pdf
[2009-11-18 18:02:44 | 00,340,539 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\regulamin_rekrutacji_pokl.pdf
[2009-11-18 01:29:44 | 00,000,624 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Spis filmów.lnk
[2009-11-16 22:26:00 | 00,029,696 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Hista Matii.doc
[2009-11-16 12:27:11 | 00,195,368 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-11-16 02:16:42 | 00,050,288 | ---- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
[2009-11-16 00:15:37 | 01,065,376 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-11-16 00:15:37 | 00,498,918 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-11-16 00:15:37 | 00,439,288 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-11-16 00:15:37 | 00,087,740 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-11-16 00:15:37 | 00,070,464 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-11-13 20:06:19 | 00,000,049 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009-11-11 14:21:02 | 00,000,264 | ---- | M] () -- C:\WINDOWS\System32\PSUNCpl.dat
[2009-11-08 19:57:50 | 03,550,938 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Neat_Image_Pro__v5.8_crack.rar
[2009-11-03 20:38:24 | 00,000,144 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\test.cpp
[2009-11-03 12:29:56 | 00,064,337 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Harmonogram_ZSE_Kielce_dla_Grupy_2.pdf
[2009-11-02 08:22:24 | 00,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1ca5b8d3974915c.job
[2009-10-30 16:18:03 | 00,365,824 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\System32\PSUNCpl.cpl
[2009-10-30 16:18:01 | 00,146,952 | ---- | M] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\PSINAflt.sys
[4 C:\WINDOWS\System32\*.tmp files C:\WINDOWS\System32\*.tmp ]
[3 C:\WINDOWS\*.tmp files C:\WINDOWS\*.tmp ]
[3 C:\Documents and Settings\Administrator\Pulpit\*.tmp files C:\Documents and Settings\Administrator\Pulpit\*.tmp ]
[1 C:\Documents and Settings\Administrator\*.tmp files C:\Documents and Settings\Administrator\*.tmp ]

========== Files Created - No Company Name ==========

[2009-11-26 18:05:45 | 04,988,096 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Chrola & Szurpik-Bielyje rozy.mp3
[2009-11-23 18:56:38 | 00,091,545 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\konsultacje.pdf
[2009-11-21 17:13:01 | 03,540,563 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\sandra%20-%20everlasting%20love[1].mp3
[2009-11-19 18:54:45 | 00,015,838 | ---- | C] () -- C:\Documents and Settings\Administrator\.recently-used.xbel
[2009-11-18 18:02:36 | 00,340,539 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\regulamin_rekrutacji_pokl.pdf
[2009-11-18 18:00:20 | 00,443,793 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\regulamin.pdf
[2009-11-18 01:29:44 | 00,000,624 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Spis filmów.lnk
[2009-11-16 20:57:10 | 00,029,696 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Hista Matii.doc
[2009-11-11 14:21:02 | 00,000,264 | ---- | C] () -- C:\WINDOWS\System32\PSUNCpl.dat
[2009-11-08 19:56:04 | 03,550,938 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Neat_Image_Pro__v5.8_crack.rar
[2009-11-03 20:36:19 | 00,000,144 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\test.cpp
[2009-11-02 08:22:24 | 00,001,032 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1ca5b8d3974915c.job
[2009-09-19 16:08:03 | 00,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-09-19 16:08:03 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-06-13 16:04:28 | 00,000,079 | ---- | C] () -- C:\WINDOWS\winDecrypt.INI
[2009-06-13 15:54:54 | 00,000,119 | ---- | C] () -- C:\WINDOWS\ConverterCore.INI
[2009-06-13 15:51:49 | 00,021,240 | ---- | C] () -- C:\WINDOWS\System32\solidlocalmon.dll
[2009-06-13 15:51:49 | 00,013,560 | ---- | C] () -- C:\WINDOWS\System32\solidlocalui.dll
[2009-05-18 22:10:41 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Route.INI
[2009-02-04 15:16:17 | 00,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-02-04 15:16:17 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-02-02 20:22:39 | 00,000,067 | ---- | C] () -- C:\WINDOWS\DVDRegionFree.INI
[2009-02-02 20:16:40 | 00,000,085 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\.zreglib
[2008-11-15 20:45:08 | 00,000,771 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\coreavc.ini
[2008-11-07 20:29:25 | 00,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2008-10-11 13:54:17 | 00,000,279 | ---- | C] () -- C:\WINDOWS\game.ini
[2008-09-27 10:50:09 | 00,002,528 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\$_hpcst$.hpc
[2008-07-31 10:51:22 | 00,000,138 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
[2008-07-26 12:27:36 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-07-10 12:06:18 | 00,000,462 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2008-07-10 12:06:18 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008-07-10 12:06:17 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2008-07-10 12:03:24 | 00,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2008-07-10 12:00:20 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2008-07-08 18:16:30 | 00,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008-07-08 18:14:15 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008-07-07 16:21:39 | 00,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008-07-07 16:21:38 | 00,021,504 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008-07-07 12:41:25 | 00,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2008-07-07 12:41:25 | 00,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2008-07-07 12:17:15 | 00,018,239 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008-07-07 12:17:14 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2008-07-07 12:17:11 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005-05-03 12:38:42 | 00,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll
[2004-07-17 12:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2003-10-02 11:48:18 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2002-03-04 09:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
< End of report >

==========================================================
==========================================================

OTL zrobił jeszcze Extras.Txt:
OTL Extras logfile created on: 2009-11-28 13:51:41 - Run 1
OTL by OldTimer - Version 3.1.11.1 Folder = H:\Instalki
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1,50 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 67,64% Memory free
3,35 Gb Paging File | 2,99 Gb Available in Paging File | 89,22% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 20,00 Gb Total Space | 5,30 Gb Free Space | 26,52% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 120,00 Gb Total Space | 29,85 Gb Free Space | 24,88% Space Free | Partition Type: NTFS
Drive G: | 30,01 Gb Total Space | 2,72 Gb Free Space | 9,07% Space Free | Partition Type: NTFS
Drive H: | 62,88 Gb Total Space | 0,72 Gb Free Space | 1,14% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: TOMEK
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- "%SYSTEMROOT%\hh.exe" %1
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "%SYSTEMROOT%\hh.exe" %1 File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" File not found

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
""SubEdit-Player"" = "SubEdit-Player"
"{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK
"{044F9133-B8D7-4d11-BF39-803FA20F5C8B}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
"{0D0DF551-7546-4682-A18E-B5716C211209}" = PowerArchiver 2007 Polish
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}" = Sound Blaster Audigy
"{1F126EDC-DA29-4D5B-80DF-735252475FEE}" = Pro Evolution Soccer 2010 DEMO
"{236BB7C4-4419-42FD-0415-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{786C5747-1437-443D-B06E-79A00FE45110}" = Adobe Stock Photos 1.0
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer
"{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0
"{BB9AC6BF-71B6-42A4-9689-C17D9F44E79A}" = Brother MFL-Pro Suite
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C98BBC25-490C-4F3F-81D8-5D12C11732DF}" = Panda Cloud Antivirus
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D8087907-E255-3A41-A46D-D0F798709C71}" = Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter_is1" = AC3Filter 1.62b
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0415-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Applian FLV Player2.0.24" = Applian FLV Player
"CDex" = CDex extraction audio
"CloneDVD2" = CloneDVD2
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"dBpoweramp Windows Media Audio 10 Codec" = dBpoweramp Windows Media Audio 10 Codec
"DVD Shrink_is1" = DVD Shrink 3.2
"ffdshow_is1" = ffdshow [rev 3029] [2009-07-10]
"Foxit Reader" = Foxit Reader
"Gadu-Gadu" = Gadu-Gadu 7.7
"Google Chrome Frame" = Google Chrome Frame
"HaaliMkx" = Haali Media Splitter
"HijackThis" = HijackThis 2.0.2
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"Mapa Polski 2001" = Mapa Polski 2001
"Maxthon2" = Maxthon2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual C++ 2008 Express Edition with SP1 - ENU" = Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
"MoorHunt_is1" = MoorHunt 0.6.1.0
"Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15)
"NAPIPROJEKT_is1" = NAPIPROJEKT 1.0.6.2
"Nero - Burning Rom!UninstallKey" = Nero 6
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Panda Cloud Antivirus" = Panda Cloud Antivirus
"Peer2Mail" = Peer2Mail (remove only)
"PhotomatixPro3Betax32_is1" = Photomatix Pro version 3.2
"RealAlt_is1" = Real Alternative 1.51 Lite
"Spik" = Spik
"The KMPlayer" = The KMPlayer (remove only)
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinRAR archiver" = Archiwizator WinRAR
"x2VCD" = Super DVD Ripper (remove only)
"xp-AntiSpy" = xp-AntiSpy 3.96-8
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Xvid_is1" = Xvid 1.2.2 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"OpenP2M for Java 1.6" = OpenP2M for Java 1.6

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2008-10-16 09:51:58 | Computer Name = KOMPUTER | Source = MsiInstaller | ID = 11606
Description = Product: Java(TM) 6 Update 7 -- Error 1606.Could not access network
location http://javadl.sun.com/web...6/ja160000.cab.

Error - 2009-09-25 17:21:49 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-09-25 17:34:48 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-10-14 14:21:55 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-10-29 10:47:09 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-10-29 16:47:08 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-10-31 10:46:28 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-11-13 11:18:32 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

Error - 2009-11-15 19:06:39 | Computer Name = TOMEK | Source = MsiInstaller | ID = 10005
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Wystąpił problem
z tym pakietem Instalatora Windows. Więcej informacji można znaleźć w dzienniku
instalacji.

Error - 2009-11-25 14:54:37 | Computer Name = TOMEK | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 2009-11-27 13:35:39 | Computer Name = TOMEK | Source = SideBySide | ID = 16842784
Description = Nie można odnaleźć zestawu zależnego Microsoft.VC80.CRT; ostatni błąd:
Odnośny zestaw nie jest zainstalowany w tym systemie.

Error - 2009-11-27 13:35:39 | Computer Name = TOMEK | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC80.CRT. Odpowiedni
komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie. .

Error - 2009-11-27 13:35:39 | Computer Name = TOMEK | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\Program Files\Spik\sms\sms_plus.dll.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie. .

Error - 2009-11-27 15:24:44 | Computer Name = TOMEK | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego: nvport

Error - 2009-11-27 15:24:45 | Computer Name = TOMEK | Source = Service Control Manager | ID = 7034
Description = Usługa MySql niespodziewanie zakończyła pracę. Wystąpiło to razy:
1.

Error - 2009-11-28 07:20:46 | Computer Name = TOMEK | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego: nvport

Error - 2009-11-28 07:20:46 | Computer Name = TOMEK | Source = Service Control Manager | ID = 7034
Description = Usługa MySql niespodziewanie zakończyła pracę. Wystąpiło to razy:
1.

Error - 2009-11-28 08:04:01 | Computer Name = TOMEK | Source = SideBySide | ID = 16842784
Description = Nie można odnaleźć zestawu zależnego Microsoft.VC80.CRT; ostatni błąd:
Odnośny zestaw nie jest zainstalowany w tym systemie.

Error - 2009-11-28 08:04:01 | Computer Name = TOMEK | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC80.CRT. Odpowiedni
komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie. .

Error - 2009-11-28 08:04:01 | Computer Name = TOMEK | Source = SideBySide | ID = 16842811
Description = Generate Activation Context nie powiodło się dla C:\Program Files\Spik\sms\sms_plus.dll.
Odpowiedni
komunikat o błędzie: Operacja ukończona pomyślnie. .


< End of report >

==========================================================
==========================================================

Z tej stronki:
Nazwa pliku: sfc_os.dll
Stan: Skanowanie zakończone. 10 z 21 skanerów zgłaszają wirusy.

==========================================================
==========================================================

W GMER'ze zaznaczyłem wszystkie partycje i kliknąłem Start, nie wiem ile proces trwał, bo odszedłem od kompa po pięciu minutach, w każdym razie po godzinie zastałem system całkiem zawieszony, nawet na CTRL+ALT+DEL nie było reakcji. Po za GMER'em w tym czasie była otwarta tylko przeglądarka w tle z zaufanymi stronami, więc to jego uznaję za winowajcę.

[@Blade@]

W logach praktycznie nic nie ma.

Uruchom OTL w oknie Custom Scans/Fixes wklej:

Cytat:

:OTL PRC - [2007-07-13 23:42:04 | 00,974,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTProAgent.exe File not found O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O33 - MountPoints2\{d0bccec0-7aca-11dd-b46b-0017318c1228}\Shell\AutoRun\command - "" = K:\hx.exe -- File not found O33 - MountPoints2\{d0bccec0-7aca-11dd-b46b-0017318c1228}\Shell\open\Command - "" = K:\hx.exe -- File not found :Commands [emptytemp] [start explorer]

Klikasz Run Fix. Po wykonaniu w OTL kliknij CleanUp.

A plik do podmiany (jest to plik systemowy, więc nie można go usunąć). Pobierz czystą kopię stąd http://hotfile.com/dl/189...sfc_os.dll.html i umieść bezpośrednio na dysku C. Następnie podmień go za pomocą Replacera http://www.searchengines.pl/Replacer-t89288.html do lokalizacji C:\Windows\system32\sfc_os.dll

[crooleeck]

Nazwa pliku: sfc_os.dll
Stan: Skanowanie zakończone. 0 z 21 skanerów zgłaszają wirusy.


Coś dziwnego się stało. Miałem GMER'a i OTL na dysku i wcięło je

[@Blade@]

Skoro plik podmieniony to powinno być ok.

Cytat:

Coś dziwnego się stało. Miałem GMER'a i OTL na dysku i wcięło je

Nic się dziwnego nie stało, po kliknięciu CleanUp zostają usunięte wszelkie narzędzia typu OTL, GMER, Combofix, Avenger itp.

[crooleeck]

[@Blade@]

Dlatego, że często w folderach przywracania znajdują się kopie szkodników. Wyłączenie przywracania systemu opróżnia te foldery. I to cała filozofia