Forum komputerowe PC Town :: Zobacz temat

Forum PC Town

Strona Główna

FAQ

Szukaj

Użytkownicy

Grupy

Rejestracja

Zaloguj

Forum komputerowe PC Town Strona Główna » Kompiradło » Bezpieczeństwo w sieci » Analiza logów » Mam Keyllogera?

Poprzedni temat :: Następny temat

Mam Keyllogera?

Autor

Wiadomość

Banan
Gość

Wysłany: 2010-07-10, 15:03 Mam Keyllogera?

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 15:54:42, on 2010-07-10 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Windows\zold32.exe C:\WINDOWS\services.exe c:\dos32.pif C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Logitech Vid\vid.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\wnr1.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Ventrilo\Ventrilo.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=22028 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: XfireXO Toolbar - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll F3 - REG:win.ini: load=C:\WINDOWS\ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: XfireXO Toolbar - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: XfireXO Toolbar - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [PCClear_Plus] "C:\Program Files\PCClear_Plus\PCclear_Plus.exe" /shide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [qazxswdfdf] c:\osowsys16.pif O4 - HKLM\..\Run: [zold32] C:\Windows\zold32.exe O4 - HKLM\..\Run: [Windows] C:\WINDOWS\services.exe O4 - HKLM\..\Run: [crack.exe] C:\WINDOWS\crack.exe O4 - HKLM\..\Run: [1] c:\dos32.pif O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\vid.exe" -bootmode O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [windows] C:\WINDOWS\svchost.exe O4 - HKCU\..\Run: [Jing] C:\Program Files\TechSmith\Jing\Jing.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu 10] "C:\Program Files\Gadu-Gadu 10\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: spoolsvcs.exe O4 - Startup: w301.exe O4 - Startup: wnr1.dll O4 - Startup: wnr1.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: bwrd.lnk = C:\jxlservice.exe O4 - Global Startup: Gamma Loader.lnk = C:\adboe.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: LogonInit - logonInit.dll (file missing) O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe -- End of file - 8722 bytes

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-10, 17:51

Owszem masz, ale nie tylko. W tym przypadku użyj ComboFix i daj log z niego.
_________________

Banan
Gość

Wysłany: 2010-07-10, 21:21

ComboFix 10-07-10.01 - Paweł 2010-07-10 22:05:36.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.511 [GMT 2:00] Uruchomiony z: c:\documents and settings\Paweł\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1229 [VPS 100331-0] On-access scanning disabled (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Paweł\Menu Start\Programy\Autostart\wnr1.dll c:\documents and settings\Paweł\Menu Start\Programy\Autostart\wnr1.exe C:\dos32.pif c:\program files\HTV c:\program files\HTV\htv.001 c:\program files\HTV\HTV.002 c:\program files\HTV\HTV.003 c:\program files\HTV\HTV.005 c:\program files\HTV\HTV.006 c:\program files\HTV\HTV.009 c:\program files\HTV\HTV.chm c:\program files\HTV\HTV.exe c:\program files\HTV\menu.gif c:\program files\HTV\qs.html c:\program files\HTV\tray.gif c:\program files\HTV\Uninstall.exe c:\windows\services.exe c:\windows\svchost c:\windows\svchost.exe c:\windows\system32\28463 c:\windows\system32\28463\AKV.exe c:\windows\system32\28463\OFBE.001 c:\windows\system32\28463\OFBE.002 c:\windows\system32\28463\OFBE.005 c:\windows\system32\28463\OFBE.006 c:\windows\system32\28463\OFBE.007 c:\windows\system32\28463\OFBE.009 c:\windows\system32\28463\OFBE.009.tmp c:\windows\system32\28463\OFBE.exe c:\windows\system32\28463\PGIQ.001 c:\windows\system32\28463\PGIQ.002 c:\windows\system32\28463\PGIQ.005 c:\windows\system32\28463\PGIQ.006 c:\windows\system32\28463\PGIQ.007 c:\windows\system32\28463\PGIQ.exe c:\windows\system32\28463\TMVC.001 c:\windows\system32\28463\TMVC.002 c:\windows\system32\28463\TMVC.005 c:\windows\system32\28463\TMVC.006 c:\windows\system32\28463\TMVC.007 c:\windows\system32\28463\TMVC.exe c:\windows\system32\Bifrost c:\windows\system32\bifrost\server.exe c:\windows\system32\sknc.dll c:\windows\TEMP\logishrd\LVPrcInj02.dll Zainfekowana kopia c:\windows\system32\ws2_32.dll została znaleziona. Problem naprawiono Plik odzyskano z - c:\windows\system32\dllcache\ws2_32.dll . ((((((((((((((((((((((((( Pliki utworzone od 2010-06-10 do 2010-07-10 ))))))))))))))))))))))))))))))) . 2010-07-08 06:32 . 2010-07-08 06:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10 2010-07-08 06:31 . 2010-07-08 06:31 -------- d-----w- c:\program files\Gadu-Gadu 10 2010-07-07 14:15 . 2010-07-08 20:15 518144 ----a-w- c:\windows\crack.exe 2010-07-04 19:35 . 2010-07-08 20:09 -------- d-----w- c:\program files\Tibia Auto 2010-07-04 16:07 . 2010-07-09 07:18 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2010-07-03 09:26 . 2010-07-08 07:40 439808 ----a-w- C:\jxlservice.exe 2010-07-02 18:44 . 2010-07-02 18:44 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NexonEU 2010-07-02 15:54 . 2010-07-02 18:49 -------- d-----w- C:\Download 2010-07-02 15:54 . 2010-07-02 18:44 -------- d-----w- C:\Nexon 2010-07-02 15:54 . 2010-07-02 15:54 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe 2010-06-22 14:12 . 2010-07-08 17:26 -------- d-----w- c:\program files\Valve 2010-06-22 08:58 . 2010-07-09 09:51 -------- d-----w- c:\program files\Tibia 2010-06-17 07:34 . 2010-07-09 17:21 -------- d-----w- c:\program files\Ronots Client 2010-06-13 07:48 . 2010-06-13 07:52 439808 ----a-w- C:\adboe.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-10 20:15 . 2010-02-11 20:48 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-07-10 20:14 . 2010-02-11 21:28 -------- d-----w- c:\program files\PCClear_Plus 2010-07-10 13:53 . 2010-02-21 14:53 365 ----a-w- c:\program files\Common Files\userInit.dll 2010-07-10 13:51 . 2010-02-11 20:05 -------- d-----w- c:\program files\Trend Micro 2010-07-10 11:14 . 2010-02-14 13:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM 2010-07-08 20:14 . 2010-02-15 15:46 -------- d-----w- c:\program files\ElfBot NG 2010-07-07 08:46 . 2010-07-07 08:46 393216 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.3.dll 2010-07-07 08:46 . 2010-07-07 08:46 364544 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll 2010-07-02 18:44 . 2010-07-02 18:44 98304 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\nxgameeu.dll 2010-07-02 18:44 . 2010-07-02 18:44 81920 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll 2010-07-02 18:44 . 2010-07-02 18:44 532480 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGMDll.dll 2010-07-02 18:44 . 2010-07-02 18:44 331776 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGMResource.dll 2010-07-02 18:44 . 2010-07-02 18:44 258352 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\unicows.dll 2010-07-02 18:44 . 2010-07-02 18:44 155648 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe 2010-06-23 20:55 . 2001-10-26 18:15 83660 ----a-w- c:\windows\system32\perfc015.dat 2010-06-23 20:55 . 2001-10-26 18:15 490284 ----a-w- c:\windows\system32\perfh015.dat 2010-06-22 14:09 . 2010-02-11 19:47 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-06-16 15:46 . 2010-06-02 15:18 -------- d-----w- c:\program files\TechSmith 2010-06-02 15:17 . 2010-02-22 14:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-06-02 15:12 . 2010-06-02 15:11 -------- d-----w- c:\program files\Xfire 2010-06-02 15:12 . 2010-06-02 15:12 -------- d-----w- c:\program files\Conduit 2010-06-02 15:12 . 2010-06-02 15:12 -------- d-----w- c:\program files\XfireXO 2010-05-28 00:04 . 2010-05-28 00:04 41872 ----a-w- c:\windows\system32\xfcodec.dll 2010-05-26 18:10 . 2010-05-26 18:10 -------- d-----w- c:\program files\Hexprobe 2010-05-23 19:37 . 2010-05-23 19:37 -------- d-----w- c:\program files\MSBuild 2010-05-23 19:37 . 2010-05-23 19:37 -------- d-----w- c:\program files\Reference Assemblies 2010-05-22 11:58 . 2010-05-22 11:58 -------- d-----w- c:\program files\EjoyStudio 2010-05-22 11:48 . 2010-05-22 11:48 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-05-02 08:09 . 2008-04-14 19:35 1851520 ----a-w- c:\windows\system32\win32k.sys 2010-04-26 16:07 . 2010-05-16 13:04 571904 ----a-w- c:\windows\intldate.dll 2010-04-26 16:07 . 2010-05-16 13:04 13824 ----a-w- c:\windows\zold32.exe 2010-04-20 05:34 . 2008-04-14 20:30 285696 ----a-w- c:\windows\system32\atmfd.dll 2010-04-16 16:09 . 2008-04-14 20:50 669696 ----a-w- c:\windows\system32\wininet.dll 2010-04-16 16:08 . 2008-04-14 20:50 81920 ----a-w- c:\windows\system32\ieencode.dll 2010-02-21 10:42 . 2010-02-21 10:42 27958 ----a-w- c:\program files\Common Files\logonInit.dll 2009-09-04 17:00 . 2009-09-04 17:00 916430 ----a-w- c:\program files\Apr2006_MDX1_x86.cab 2010-02-11 20:08 . 2010-02-11 20:08 56 --sh--r- c:\windows\system32\1C0543800E.sys 2010-02-11 20:08 . 2010-02-11 20:08 1890 --sha-w- c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . Uwaga puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888] "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] 2010-05-20 13:35 2675296 ----a-w- c:\program files\XfireXO\tbXfir.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520] "Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2010-07-07 12382816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-04-26 589824] "pccguide.exe"="c:\program files\Trend Micro\PC-cillin 2002\pccguide.exe" [2003-03-26 258048] "PCCClient.exe"="c:\program files\Trend Micro\PC-cillin 2002\PCCClient.exe" [2003-03-26 462848] "Pop3trap.exe"="c:\program files\Trend Micro\PC-cillin 2002\Pop3trap.exe" [2003-03-26 315458] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "PCClear_Plus"="c:\program files\PCClear_Plus\PCclear_Plus.exe" [2009-03-26 2105344] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-02-11 98304] "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504] "zold32"="c:\windows\zold32.exe" [2010-04-26 13824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\ spoolsvcs.exe [2010-7-6 281904] w301.exe [2010-7-3 47616] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696] bwrd.lnk - C:\jxlservice.exe [2010-7-3 439808] Gamma Loader.lnk - C:\adboe.exe [2010-6-13 439808] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2010-2-11 925696] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Documents and Settings\\Paweł\\Moje dokumenty\\Pobieranie\\hl.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"= "c:\nexon\Combat Arms EU\CombatArms.exe"= c:\nexon\Combat Arms EU\CombatArms.exe:Enabled:CombatArms.exe "c:\nexon\Combat Arms EU\Engine.exe"= c:\nexon\Combat Arms EU\Engine.exe:Enabled:Engine.exe "c:\\Program Files\\Gadu-Gadu 10\\gg.exe"= "c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-02-11 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-02-11 20560] R2 PCC_PFW;PC-Cillin Personal Firewall;c:\windows\system32\drivers\PCC_PFW.sys [2003-03-26 56796] R2 PCCPFW;PC-cillin PersonalFirewall;c:\program files\Trend Micro\PC-cillin 2002\PCCPFW.exe [2003-03-26 163840] R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\TmXPFlt.sys [2003-01-25 174720] R2 Tmntsrv;Trend NT Realtime Service;c:\program files\Trend Micro\PC-cillin 2002\Tmntsrv.exe [2003-03-26 176128] R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2003-01-25 18432] R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2010-02-11 402432] . Zawartość folderu 'Zaplanowane zadania' 2010-07-10 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2010-02-11 21:18] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html FF - ProfilePath - c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\FFExternalAlert.dll FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\RadioWMPCore.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPOKER.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-Jing - c:\program files\TechSmith\Jing\Jing.exe HKCU-Run-Steam - c:\program files\Steam\Steam.exe HKLM-Run-qazxswdfdf - c:\osowsys16.pif HKLM-Run-OFBE Agent - c:\windows\system32\28463\OFBE.exe Notify-LogonInit - logonInit.dll ActiveSetup-{8A1643B6-9D47-FD1D-4539-8B7621AF0DAC} - c:\windows\system32\Bifrost\server.exe AddRemove-TibiaBot NG_is1 - c:\program files\TibiaBot NG\unins000.exe AddRemove-{C326C1A5-6784-4C88-A51A-818581DEFBD8}_is1 - c:\program files\InfernaOTS Klient\unins000.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-07-10 22:14 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ********************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2900) c:\windows\TEMP\logishrd\LVPrcInj01.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe c:\documents and settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe c:\documents and settings\Paweł\Menu Start\Programy\Autostart\w301.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\windows\system32\wdfmgr.exe . ************************************************************************ . Czas ukończenia: 2010-07-10 22:19:57 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-07-10 20:19 Przed: 24 717 475 840 bajtów wolnych Po: 25 359 859 712 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 224078CF5920BAE6CBC3D9F153950D93 Prosze o pomoc

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-10, 22:22

Odinstaluj Winamp Toolbar

Wklej do notatnika:

Cytat:

File::
c:\windows\crack.exe
c:\jxlservice.exe
c:\adboe.exe
c:\program files\Common Files\userInit.dll
c:\windows\zold32.exe
c:\windows\intldate.dll
c:\program files\Common Files\logonInit.dll
c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\spoolsvcs.exe
c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\w301.exe
c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
c:\documents and settings\All Users\Menu Start\Programy\Autostart\bwrd.lnk
c:\documents and settings\All Users\Menu Start\Programy\Autostart\Gamma Loader.lnk
c:\windows\Tasks\WGASetup.job
c:\windows\TEMP\logishrd\LVPrcInj01.dll

Folder::
c:\program files\Conduit
c:\windows\TEMP

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"=-
"WinampAgent"=-
"QuickTime Task"=-
"SunJavaUpdateSched"=-
"zold32"=-

Plik

zapisz jako

CFScript.txt
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Rozpocznie się usuwanie i powstanie log, który dajesz na forum.

Cytat:

c:\program files\ElfBot NG

Odinstaluj to dziadostwo jak najszybciej oraz inne tego typu programy i usuń instalator, gdyż to jest właśnie między innymi źródło tej góry syfu na Twoim kompie.

_________________

Banan
Gość

Wysłany: 2010-07-11, 08:54

ComboFix 10-07-10.01 - Paweł 2010-07-11 9:40.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.255 [GMT 2:00] Uruchomiony z: c:\documents and settings\Paweł\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Paweł\Pulpit\CFScript.txt AV: avast! antivirus 4.8.1229 [VPS 100331-0] On-access scanning disabled (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\adboe.exe" "c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk" "c:\documents and settings\All Users\Menu Start\Programy\Autostart\bwrd.lnk" "c:\documents and settings\All Users\Menu Start\Programy\Autostart\Gamma Loader.lnk" "c:\documents and settings\Pawe^\Menu Start\Programy\Autostart\spoolsvcs.exe" "c:\documents and settings\Pawe^\Menu Start\Programy\Autostart\w301.exe" "c:\jxlservice.exe" "c:\program files\Common Files\logonInit.dll" "c:\program files\Common Files\userInit.dll" "c:\windows\crack.exe" "c:\windows\intldate.dll" "c:\windows\Tasks\WGASetup.job" "c:\windows\TEMP\logishrd\LVPrcInj01.dll" "c:\windows\zold32.exe" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\adboe.exe c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk c:\documents and settings\All Users\Menu Start\Programy\Autostart\bwrd.lnk c:\documents and settings\All Users\Menu Start\Programy\Autostart\Gamma Loader.lnk c:\jxlservice.exe c:\program files\Common Files\logonInit.dll c:\program files\Common Files\userInit.dll c:\program files\Conduit c:\program files\Conduit\Community Alerts\Alert.dll c:\windows\crack.exe c:\windows\intldate.dll c:\windows\Tasks\WGASetup.job c:\windows\TEMP\logishrd\LVPrcInj01.dll c:\windows\zold32.exe . ((((((((((((((((((((((((( Pliki utworzone od 2010-06-11 do 2010-07-11 ))))))))))))))))))))))))))))))) . 2010-07-08 06:32 . 2010-07-08 06:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10 2010-07-08 06:31 . 2010-07-08 06:31 -------- d-----w- c:\program files\Gadu-Gadu 10 2010-07-07 08:46 . 2010-07-07 08:46 393216 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.3.dll 2010-07-07 08:46 . 2010-07-07 08:46 364544 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll 2010-07-04 19:35 . 2010-07-08 20:09 -------- d-----w- c:\program files\Tibia Auto 2010-07-04 16:07 . 2010-07-09 07:18 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2010-07-02 18:44 . 2010-07-02 18:44 98304 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\nxgameeu.dll 2010-07-02 18:44 . 2010-07-02 18:44 81920 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll 2010-07-02 18:44 . 2010-07-02 18:44 532480 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGMDll.dll 2010-07-02 18:44 . 2010-07-02 18:44 331776 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGMResource.dll 2010-07-02 18:44 . 2010-07-02 18:44 258352 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\unicows.dll 2010-07-02 18:44 . 2010-07-02 18:44 155648 ----a-w- c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe 2010-07-02 18:44 . 2010-07-02 18:44 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NexonEU 2010-07-02 15:54 . 2010-07-02 18:49 -------- d-----w- C:\Download 2010-07-02 15:54 . 2010-07-02 18:44 -------- d-----w- C:\Nexon 2010-07-02 15:54 . 2010-07-02 15:54 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe 2010-06-22 14:12 . 2010-07-08 17:26 -------- d-----w- c:\program files\Valve 2010-06-22 08:58 . 2010-07-09 09:51 -------- d-----w- c:\program files\Tibia 2010-06-17 07:34 . 2010-07-09 17:21 -------- d-----w- c:\program files\Ronots Client . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-11 07:48 . 2010-02-11 20:48 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-07-11 07:47 . 2010-02-11 21:28 -------- d-----w- c:\program files\PCClear_Plus 2010-07-10 13:51 . 2010-02-11 20:05 -------- d-----w- c:\program files\Trend Micro 2010-07-10 11:14 . 2010-02-14 13:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM 2010-06-23 20:55 . 2001-10-26 18:15 83660 ----a-w- c:\windows\system32\perfc015.dat 2010-06-23 20:55 . 2001-10-26 18:15 490284 ----a-w- c:\windows\system32\perfh015.dat 2010-06-22 14:09 . 2010-02-11 19:47 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-06-16 15:46 . 2010-06-02 15:18 -------- d-----w- c:\program files\TechSmith 2010-06-02 15:17 . 2010-02-22 14:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-06-02 15:12 . 2010-06-02 15:11 -------- d-----w- c:\program files\Xfire 2010-06-02 15:12 . 2010-06-02 15:12 -------- d-----w- c:\program files\XfireXO 2010-05-28 00:04 . 2010-05-28 00:04 41872 ----a-w- c:\windows\system32\xfcodec.dll 2010-05-26 18:10 . 2010-05-26 18:10 -------- d-----w- c:\program files\Hexprobe 2010-05-23 19:37 . 2010-05-23 19:37 -------- d-----w- c:\program files\MSBuild 2010-05-23 19:37 . 2010-05-23 19:37 -------- d-----w- c:\program files\Reference Assemblies 2010-05-22 11:58 . 2010-05-22 11:58 -------- d-----w- c:\program files\EjoyStudio 2010-05-22 11:48 . 2010-05-22 11:48 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-05-02 08:09 . 2008-04-14 19:35 1851520 ----a-w- c:\windows\system32\win32k.sys 2010-04-20 05:34 . 2008-04-14 20:30 285696 ----a-w- c:\windows\system32\atmfd.dll 2010-04-16 16:09 . 2008-04-14 20:50 669696 ----a-w- c:\windows\system32\wininet.dll 2010-04-16 16:08 . 2008-04-14 20:50 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-09-04 17:00 . 2009-09-04 17:00 916430 ----a-w- c:\program files\Apr2006_MDX1_x86.cab 2010-02-11 20:08 . 2010-02-11 20:08 56 --sh--r- c:\windows\system32\1C0543800E.sys 2010-02-11 20:08 . 2010-02-11 20:08 1890 --sha-w- c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( SnapShot@2010-07-10_20.13.44 ))))))))))))))))))))))))))))))))))))))))) . + 2010-07-11 07:48 . 2010-07-11 07:48 16384 c:\windows\Temp\Perflib_Perfdata_148.dat + 2010-07-10 20:22 . 2010-07-10 20:22 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe - 2010-02-22 14:12 . 2010-02-22 14:12 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . Uwaga puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888] "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] 2010-05-20 13:35 2675296 ----a-w- c:\program files\XfireXO\tbXfir.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}"= "c:\program files\XfireXO\tbXfir.dll" [2010-05-20 2675296] [HKEY_CLASSES_ROOT\clsid\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520] "Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2010-07-07 12382816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "pccguide.exe"="c:\program files\Trend Micro\PC-cillin 2002\pccguide.exe" [2003-03-26 258048] "PCCClient.exe"="c:\program files\Trend Micro\PC-cillin 2002\PCCClient.exe" [2003-03-26 462848] "Pop3trap.exe"="c:\program files\Trend Micro\PC-cillin 2002\Pop3trap.exe" [2003-03-26 315458] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "PCClear_Plus"="c:\program files\PCClear_Plus\PCclear_Plus.exe" [2009-03-26 2105344] "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\ spoolsvcs.exe [2010-7-6 281904] w301.exe [2010-7-3 47616] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2010-2-11 925696] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Documents and Settings\\Paweł\\Moje dokumenty\\Pobieranie\\hl.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"= "c:\nexon\Combat Arms EU\CombatArms.exe"= c:\nexon\Combat Arms EU\CombatArms.exe:Enabled:CombatArms.exe "c:\nexon\Combat Arms EU\Engine.exe"= c:\nexon\Combat Arms EU\Engine.exe:Enabled:Engine.exe "c:\\Program Files\\Gadu-Gadu 10\\gg.exe"= "c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-02-11 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-02-11 20560] R2 PCC_PFW;PC-Cillin Personal Firewall;c:\windows\system32\drivers\PCC_PFW.sys [2003-03-26 56796] R2 PCCPFW;PC-cillin PersonalFirewall;c:\program files\Trend Micro\PC-cillin 2002\PCCPFW.exe [2003-03-26 163840] R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\TmXPFlt.sys [2003-01-25 174720] R2 Tmntsrv;Trend NT Realtime Service;c:\program files\Trend Micro\PC-cillin 2002\Tmntsrv.exe [2003-03-26 176128] R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2003-01-25 18432] R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2010-02-11 402432] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html FF - ProfilePath - c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\FFExternalAlert.dll FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\RadioWMPCore.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPOKER.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); . - - - - USUNIĘTO PUSTE WPISY - - - - AddRemove-ElfBot NG_is1 - c:\program files\ElfBot NG\unins000.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-07-11 09:48 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ********************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(1468) c:\windows\TEMP\logishrd\LVPrcInj01.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\documents and settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe c:\documents and settings\Paweł\Menu Start\Programy\Autostart\w301.exe c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\windows\system32\wdfmgr.exe . ************************************************************************ . Czas ukończenia: 2010-07-11 09:51:48 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-07-11 07:51 ComboFix2.txt 2010-07-10 20:19 Przed: 25 356 931 072 bajtów wolnych Po: 25 345 490 944 bajtów wolnych - - End Of File - - 72D03B62FFF5ADA5F598C7E3DDD5C11F

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-11, 10:17

Jeszcze nie wszystko zeszło. Zrób porządek z tym toolbarem. Odinstaluj też program PC-cillin 2002, bo to stare próchno oraz ten wynalazek PCClear_Plus.

Pobierz The Avenger w pole Input script here wklej poniższy tekst:

Kod:

Files to delete:
c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\spoolsvcs.exe
c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\w301.exe

klikasz Execute

Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu wklej raport na forum C:\avenger.txt

Następnie podaj logi z OTL

_________________

Banan
Gość

Wysłany: 2010-07-11, 12:42

Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ***************** Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger *************** Beginning to process script file: Rootkit scan active. No rootkits found! Error: could not open file "c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\spoolsvcs.exe" Deletion of file "c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\spoolsvcs.exe" failed! Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND) bad path / the parent directory does not exist Error: could not open file "c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\w301.exe" Deletion of file "c:\documents and settings\Paweˆ\Menu Start\Programy\Autostart\w301.exe" failed! Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND) bad path / the parent directory does not exist Completed script processing. ***************** Finished! Terminate.

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-11, 12:45

Ok, ale podaj jeszcze te logi z OTL, o które prosiłem bo trzeba sprawdzić, czy coś jeszcze nie zostało.
_________________

Banan
Gość

Wysłany: 2010-07-11, 12:47

OTL Extras logfile created on: 2010-07-11 13:43:57 - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 \| Country: Polska \| Language: PLK \| Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory \| 452,00 Mb Available Physical Memory \| 44,00% Memory free 2,00 Gb Paging File \| 2,00 Gb Available in Paging File \| 80,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 37,26 Gb Total Space \| 23,62 Gb Free Space \| 63,40% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BANACH-5727753B Current User Name: Paweł Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_USERS\S-1-5-21-1229272821-1993962763-1644491937-1003\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 1 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:Enabled:CombatArms.exe -- (Nexon) "C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:Enabled:Engine.exe -- (Nexon) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\hl.exe" = C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\hl.exe::Enabled:Half-Life Launcher -- (Valve) "C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe::Enabled:NEXON_EU_Downloader_Engine.exe -- () "C:\Documents and Settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe" = C:\Documents and Settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe::Enabled:Nexon Game Manager -- (Nexon) "C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:Enabled:CombatArms.exe -- (Nexon) "C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:Enabled:Engine.exe -- (Nexon) "C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe::Enabled:Gadu-Gadu 10 -- (GG Network S.A.) "C:\Program Files\Logitech\Logitech Vid\Vid.exe" = C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Enabled:Logitech Vid -- (Logitech Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{20ABD466-5B0D-4846-84BA-9C97D49A593D}_is1" = Ronots Client v4.2 "{20ABD466-5B0D-4846-84BA-9C97D49A593E}_is1" = Swordia Client v4.1 "{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18 "{2ED60C17-4568-4CD5-830A-03C4688B09A1}" = Sagem Wi-Fi 11g USB adapter (driver) "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{42F0F402-D23B-4D57-8C34-1FFB46A6AB8D}" = Remere's Map Editor "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid "{59E5F42B-D992-4DBA-B54D-7BD9B67B5DA7}" = oRipa Screen Recorder "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars "{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{AAFD22B6-A6C7-4134-AF4E-080BCBCD3493}" = Sagem Wi-Fi 11g USB adapter (utility) "{AC76BA86-7AD7-1045-7B44-A70500000002}" = Adobe Reader 7.0.5 - Polish "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{EBB05CE8-52DF-4B7C-BDF4-ECC6BB0C3BB1}" = Taksi Desktop Video Recorder "{F6158B29-CBD5-4235-ADF7-06D76F8BDBA1}" = Jing "{FC7DDAAE-7F2B-4270-9BFD-5A130B667E9E}" = livebox tp "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V2.X" = ALLPlayer V2.X "avast!" = avast! Antivirus "Combat Arms EU" = Combat Arms EU "DBGO" = DBGO "eMusic Promotion" = 50 FREE MP3s +1 Free Audiobook! "Gadu-Gadu 10" = Gadu-Gadu 10 "GameDesire-Bingo" = GameDesire-Bingo "GameDesire-Poker" = GameDesire-Poker "GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker "Hexprobe_is1" = Hexprobe 4.31 "InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager "KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.7.0 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "NimoCorp" = Nimo Codecs Pack v5.0 (Remove Only) "QuickTime" = QuickTime "RealAlt_is1" = Real Alternative 1.28 "Tasker_is1" = Tasker version 3.13 "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "Tibia Auto" = NSIS Example2 "Tibia_is1" = Tibia "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "WinRAR archiver" = Archiwizator WinRAR "Xfire" = Xfire (remove only) "XfireXO Toolbar" = XfireXO Toolbar ========== Last 10 Event Log Errors ========== [ Antivirus Events ] Error - 2010-05-16 09:16:15 \| Computer Name = BANACH-5727753B \| Source = avast! \| ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. [ Application Events ] Error - 2010-06-25 09:34:42 \| Computer Name = BANACH-5727753B \| Source = Application Error \| ID = 1000 Description = Aplikacja powodująca błąd pcclear_plus.exe, wersja 1.5.5.9, moduł powodujący błąd pcclear_plus.exe, wersja 1.5.5.9, adres błędu 0x0005101f. Error - 2010-06-26 07:41:10 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-06-26 07:41:35 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2005 Description = Nie można odczytać danych wydajności z usługi Server. W tej próbce nie zostaną zwrócone dane wydajności usługi Server. Zwrócony kod stanu to dane DWORD 0, IOSB.Status to dane DWORD 1 a IOSB.Information to dane DWORD 2. Error - 2010-06-26 07:41:35 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2006 Description = Nie można odczytać danych wydajności z usługi Server Queue. W tej próbce nie zostaną zwrócone dane wydajności usługi Server Queue. Zwrócony kod stanu to dane DWORD 0, IOSB.Status to dane DWORD 1 a IOSB.Information to dane DWORD 2. Error - 2010-06-26 07:44:04 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-06-26 07:49:21 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-06-26 08:01:42 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-06-26 09:16:40 \| Computer Name = BANACH-5727753B \| Source = Application Error \| ID = 1000 Description = Aplikacja powodująca błąd tibia.exe, wersja 8.5.5.0, moduł powodujący błąd logoninit.dll, wersja 0.0.0.0, adres błędu 0x00002121. Error - 2010-06-26 11:22:30 \| Computer Name = BANACH-5727753B \| Source = Application Error \| ID = 1000 Description = Aplikacja powodująca błąd pcclear_plus.exe, wersja 1.5.5.9, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x3e6bc03e. Error - 2010-06-26 14:07:54 \| Computer Name = BANACH-5727753B \| Source = PerfNet \| ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. [ System Events ] Error - 2010-05-08 02:54:26 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC90.CRT. Odpowiedni komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie. . Error - 2010-05-08 02:54:26 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Generate Activation Context nie powiodło się dla C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll. Odpowiedni komunikat o błędzie: Operacja ukończona pomyślnie. . Error - 2010-05-08 02:55:06 \| Computer Name = BANACH-5727753B \| Source = Service Control Manager \| ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Antivirus. Error - 2010-05-08 02:55:06 \| Computer Name = BANACH-5727753B \| Source = Service Control Manager \| ID = 7000 Description = Nie można uruchomić usługi avast! Antivirus z powodu następującego błędu: %%1053 Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842784 Description = Nie można odnaleźć zestawu zależnego Microsoft.VC90.CRT; ostatni błąd: Odnośny zestaw nie jest zainstalowany w tym systemie. Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC90.CRT. Odpowiedni komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie. . Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Generate Activation Context nie powiodło się dla C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll. Odpowiedni komunikat o błędzie: Operacja ukończona pomyślnie. . Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842784 Description = Nie można odnaleźć zestawu zależnego Microsoft.VC90.CRT; ostatni błąd: Odnośny zestaw nie jest zainstalowany w tym systemie. Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Resolve Partial Assembly nie powiodło się dla Microsoft.VC90.CRT. Odpowiedni komunikat o błędzie: Odnośny zestaw nie jest zainstalowany w tym systemie. . Error - 2010-05-08 13:23:57 \| Computer Name = BANACH-5727753B \| Source = SideBySide \| ID = 16842811 Description = Generate Activation Context nie powiodło się dla C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll. Odpowiedni komunikat o błędzie: Operacja ukończona pomyślnie. . < End of report >

Banan
Gość

Wysłany: 2010-07-11, 12:48

OTL logfile created on: 2010-07-11 13:43:57 - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 \| Country: Polska \| Language: PLK \| Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory \| 452,00 Mb Available Physical Memory \| 44,00% Memory free 2,00 Gb Paging File \| 2,00 Gb Available in Paging File \| 80,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 37,26 Gb Total Space \| 23,62 Gb Free Space \| 63,40% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BANACH-5727753B Current User Name: Paweł Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2011-01-02 19:47:11 \| 000,910,296 \| ---- \| M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2010-07-11 13:42:56 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-07-07 10:47:34 \| 000,537,184 \| ---- \| M] () -- C:\Program Files\Gadu-Gadu 10\open-fm.exe PRC - [2010-07-06 04:24:19 \| 000,281,904 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe PRC - [2010-07-03 18:54:36 \| 000,047,616 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe PRC - [2009-10-14 14:36:56 \| 002,793,304 \| ---- \| M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe PRC - [2009-10-14 14:34:18 \| 000,560,472 \| ---- \| M] () -- C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe PRC - [2009-10-07 02:47:34 \| 000,154,136 \| ---- \| M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe PRC - [2009-07-16 16:35:42 \| 005,458,704 \| ---- \| M] (Logitech Inc.) -- C:\Program Files\Logitech\Logitech Vid\Vid.exe PRC - [2008-07-19 17:25:06 \| 000,016,056 \| ---- \| M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-04-14 22:51:18 \| 001,035,264 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006-01-19 17:54:34 \| 000,925,696 \| ---- \| M] ( ) -- C:\Program Files\SAGEM WiFi manager\WLANUTL.EXE PRC - [2003-12-22 16:36:14 \| 000,561,152 \| ---- \| M] () -- C:\Program Files\Ventrilo\Ventrilo.exe ========== Modules (SafeList) ========== MOD - [2010-07-11 13:42:56 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\OTL.exe MOD - [2008-04-14 22:50:36 \| 000,586,240 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\mlang.dll MOD - [2008-04-14 22:46:34 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled \| Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-10-07 02:47:34 \| 000,154,136 \| ---- \| M] (Logitech Inc.) [Auto \| Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008-07-23 17:25:45 \| 000,348,344 \| ---- \| M] (ALWIL Software) [On_Demand \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2008-07-19 17:38:28 \| 000,147,640 \| ---- \| M] (ALWIL Software) [Auto \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2008-07-19 17:38:04 \| 000,250,040 \| ---- \| M] (ALWIL Software) [On_Demand \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2008-07-19 17:25:06 \| 000,016,056 \| ---- \| M] (ALWIL Software) [Auto \| Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\ZDCndis5.SYS -- (ZDCndis5) DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5) DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT) DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\ComboFix\catchme.sys -- (catchme) DRV - [2009-10-07 02:46:36 \| 000,025,752 \| ---- \| M] () [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2009-04-30 23:56:32 \| 000,495,768 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\system32\drivers\LV561AV.SYS -- (PID_0928) Logitech QuickCam Express(PID_0928) DRV - [2008-07-19 17:37:42 \| 000,020,560 \| ---- \| M] (ALWIL Software) [File_System \| Auto \| Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2008-07-19 17:37:21 \| 000,094,416 \| ---- \| M] (ALWIL Software) [File_System \| Auto \| Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2008-07-19 17:35:18 \| 000,078,416 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2008-07-19 17:33:42 \| 000,023,152 \| ---- \| M] (ALWIL Software) [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2008-07-19 17:32:36 \| 000,042,912 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2008-07-19 17:32:15 \| 000,026,944 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2006-01-18 15:09:40 \| 000,017,664 \| ---- \| M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\ZDPSp50.sys -- (ZDPSp50) DRV - [2005-12-22 15:45:18 \| 000,402,432 \| ---- \| M] (ZyDAS Technology Corporation) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\WlanBZXP.sys -- (SG762_XP) DRV - [2005-05-18 11:50:30 \| 002,319,680 \| R--- \| M] (Realtek Semiconductor Corp.) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.) IE - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Winamp Search" FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.google.pl" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:2.7.0.14 FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-01-03 13:27:15 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-01-02 19:47:19 \| 000,000,000 \| ---D \| M] [2010-02-11 22:24:43 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Extensions [2010-06-02 18:07:59 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions [2010-02-11 22:30:12 \| 000,000,000 \| ---D \| M] (Winamp Toolbar) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010-05-25 16:18:13 \| 000,000,000 \| ---D \| M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-02 17:12:24 \| 000,000,000 \| ---D \| M] (XfireXO Toolbar) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} [2010-06-02 09:57:42 \| 000,000,917 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\conduit.xml [2010-02-11 22:32:53 \| 000,001,196 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\winamp-search.xml [2010-06-02 18:07:59 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox\extensions [2010-02-15 18:50:42 \| 000,120,296 \| ---- \| M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll [2010-02-15 11:58:52 \| 000,603,648 \| ---- \| M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll [2010-03-22 16:16:37 \| 000,002,767 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-22 16:16:37 \| 000,001,406 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-22 16:16:37 \| 000,000,917 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-22 16:16:37 \| 000,000,858 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-22 16:16:37 \| 000,001,183 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-22 16:16:37 \| 000,001,683 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2010-07-11 09:47:22 \| 000,000,027 \| ---- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\Toolbar\ShellBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe () O4 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = C:\Program Files\SAGEM WiFi manager\WLANUTL.EXE ( ) O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe () O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedi...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-02-11 21:23:18 \| 000,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35 - HKLM\..comfile [open] -- "%1" % O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011-04-21 14:22:31 \| 017,054,598 \| ---- \| C] (RonOTS ) -- C:\Documents and Settings\Paweł\Pulpit\RonotsClient855.exe [2010-07-11 13:38:15 \| 000,000,000 \| ---D \| C] -- C:\Avenger [2010-07-11 13:31:04 \| 000,000,000 \| -HSD \| C] -- C:\Config.Msi [2010-07-11 09:55:45 \| 000,000,000 \| -HSD \| C] -- C:\RECYCLER [2010-07-11 09:39:03 \| 000,000,000 \| ---D \| C] -- C:\ComboFix [2010-07-10 22:04:55 \| 000,000,000 \| RHSD \| C] -- C:\cmdcons [2010-07-10 22:03:04 \| 000,212,480 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010-07-10 22:03:04 \| 000,161,792 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010-07-10 22:03:04 \| 000,136,704 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010-07-10 22:03:04 \| 000,031,232 \| ---- \| C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010-07-10 22:02:55 \| 000,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2010-07-10 22:02:35 \| 000,000,000 \| ---D \| C] -- C:\Qoobox [2010-07-08 22:13:23 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\lolol [2010-07-08 16:09:54 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\tibiasoft_com_python24(2) [2010-07-08 09:48:23 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\elfbot [2010-07-08 09:48:01 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\elfbot854 [2010-07-08 09:41:21 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\Elf [2010-07-08 08:32:12 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Gadu-Gadu 10 [2010-07-08 08:32:11 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-07-08 08:31:30 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Gadu-Gadu 10 [2010-07-04 21:35:37 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Tibia Auto [2010-07-04 18:07:09 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2010-07-04 18:06:06 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\scripts [2010-07-04 18:06:06 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\playerinfo [2010-07-04 18:06:06 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\minimaps [2010-07-04 18:06:04 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\sounds [2010-07-04 18:06:04 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\skins [2010-07-04 18:06:04 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\elfsettings [2010-07-02 20:44:30 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\NexonEU [2010-07-02 17:54:37 \| 000,000,000 \| ---D \| C] -- C:\Download [2010-07-02 17:54:16 \| 000,000,000 \| ---D \| C] -- C:\Nexon [2010-07-02 17:54:15 \| 000,421,888 \| ---- \| C] (NEXON Inc.) -- C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe [2010-07-02 12:15:07 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\server [2010-06-22 16:19:11 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\cstrike [2010-06-22 16:12:45 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Valve [2010-06-22 10:58:34 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Tibia [2010-06-22 10:52:19 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie [2010-06-17 09:34:48 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Ronots Client [2010-06-16 13:12:03 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files [2010-06-16 13:11:26 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Paweł\Moje dokumenty\Moje wideo [3 C:\WINDOWS\.tmp files C:\WINDOWS\.tmp ] [1 C:\WINDOWS\System32\.tmp files C:\WINDOWS\System32\.tmp ] ========== Files - Modified Within 30 Days ========== [2011-04-21 14:25:02 \| 017,054,598 \| ---- \| M] (RonOTS ) -- C:\Documents and Settings\Paweł\Pulpit\RonotsClient855.exe [2010-07-11 13:39:28 \| 000,000,664 \| ---- \| M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-07-11 13:39:27 \| 000,002,163 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Ventrilo.lnk [2010-07-11 13:39:06 \| 000,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2010-07-11 13:38:33 \| 000,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2010-07-11 13:37:49 \| 003,145,728 \| -H-- \| M] () -- C:\Documents and Settings\Paweł\NTUSER.DAT [2010-07-11 13:37:49 \| 000,000,188 \| -HS- \| M] () -- C:\Documents and Settings\Paweł\ntuser.ini [2010-07-11 13:37:45 \| 004,271,650 \| -H-- \| M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-07-11 09:47:34 \| 000,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2010-07-11 09:47:22 \| 000,000,027 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010-07-10 22:05:02 \| 000,000,281 \| RHS- \| M] () -- C:\boot.ini [2010-07-10 22:01:47 \| 003,738,393 \| R--- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe [2010-07-10 15:51:03 \| 000,001,980 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\HiJackThis.lnk [2010-07-10 14:09:30 \| 002,634,652 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\elfbot.rar [2010-07-10 13:41:58 \| 000,002,267 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-07-09 19:21:28 \| 000,000,698 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2010-07-09 11:59:05 \| 003,932,214 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\asgasg.bmp [2010-07-09 11:51:53 \| 000,000,638 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk [2010-07-09 09:58:50 \| 000,001,645 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike 1.6.lnk [2010-07-09 09:43:35 \| 000,001,607 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Counter Strike 1.6 Non Steam.lnk [2010-07-09 09:43:35 \| 000,001,587 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Dedicated Server.lnk [2010-07-08 22:09:36 \| 000,001,573 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia Auto.lnk [2010-07-08 22:08:16 \| 003,670,224 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\TibiaAutoSetup_2_5_1.exe [2010-07-08 19:33:47 \| 001,588,224 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\SteamInstall.msi [2010-07-08 15:45:48 \| 000,694,916 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\tibiasoft_com_python24(2).rar [2010-07-08 15:37:07 \| 002,433,024 \| ---- \| M] (CipSoft GmbH) -- C:\Documents and Settings\Paweł\Pulpit\Tibia.exe [2010-07-08 15:36:43 \| 043,323,028 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia.spr [2010-07-08 15:35:22 \| 000,304,788 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia.dat [2010-07-08 15:35:20 \| 000,114,688 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Patch.exe [2010-07-08 08:33:24 \| 000,000,763 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\OpenFM.lnk [2010-07-08 08:33:24 \| 000,000,734 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Gadu-Gadu 10.lnk [2010-07-06 21:57:33 \| 000,000,416 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\na war.ini [2010-07-06 16:09:03 \| 000,028,219 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\paszcur.jpeg [2010-07-06 04:24:19 \| 000,281,904 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe [2010-07-04 18:04:18 \| 002,604,873 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\elfbot854.rar [2010-07-04 12:18:17 \| 000,000,516 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Mage boomb.ini [2010-07-04 10:51:42 \| 000,148,413 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\MegaMageBomb8.54(2).rar [2010-07-04 10:25:10 \| 000,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2010-07-03 20:23:07 \| 003,932,214 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\zlo.bmp [2010-07-03 18:54:36 \| 000,047,616 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe [2010-07-02 20:49:43 \| 000,001,524 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Combat Arms EU.lnk [2010-07-02 17:54:15 \| 000,421,888 \| ---- \| M] (NEXON Inc.) -- C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe [2010-07-01 15:53:24 \| 003,932,214 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\asf.bmp [2010-07-01 14:52:33 \| 003,932,214 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\skelet.bmp [2010-06-30 13:54:59 \| 000,038,487 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\a01f26470000f8784c26288a.jpeg [2010-06-29 10:19:43 \| 000,054,156 \| -H-- \| M] () -- C:\WINDOWS\QTFont.qfn [2010-06-29 10:19:43 \| 000,001,409 \| ---- \| M] () -- C:\WINDOWS\QTFont.for [2010-06-28 22:09:36 \| 001,440,054 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20004.bmp [2010-06-28 22:09:34 \| 001,440,054 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20003.bmp [2010-06-28 22:09:30 \| 001,440,054 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20001.bmp [2010-06-28 22:09:28 \| 001,440,054 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20000.bmp [2010-06-28 13:14:40 \| 002,359,350 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\poi.bmp [2010-06-23 22:55:20 \| 001,042,454 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-06-23 22:55:20 \| 000,490,284 \| ---- \| M] () -- C:\WINDOWS\System32\perfh015.dat [2010-06-23 22:55:20 \| 000,432,356 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2010-06-23 22:55:20 \| 000,083,660 \| ---- \| M] () -- C:\WINDOWS\System32\perfc015.dat [2010-06-23 22:55:20 \| 000,067,312 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2010-06-22 14:55:20 \| 052,093,226 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\FragbaseMapPack.zip [2010-06-22 14:48:58 \| 021,408,277 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\cs16patch_full_v21_2.zip [2010-06-18 19:01:29 \| 002,359,350 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\asd.bmp [2010-06-18 12:02:26 \| 006,260,733 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\2010-06-18_1202.swf [2010-06-16 17:48:29 \| 011,060,066 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\2010-06-16_1748.swf [2010-06-16 13:12:15 \| 000,000,696 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do moviemk.lnk [2010-06-12 19:10:39 \| 000,000,087 \| ---- \| M] () -- C:\Documents and Settings\Paweł\jagex_runescape_preferences2.dat [2010-06-12 19:09:50 \| 000,000,045 \| ---- \| M] () -- C:\Documents and Settings\Paweł\jagex_runescape_preferences.dat [2010-06-11 15:28:10 \| 000,096,664 \| ---- \| M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [3 C:\WINDOWS\.tmp files C:\WINDOWS\.tmp ] [1 C:\WINDOWS\System32\.tmp files C:\WINDOWS\System32\.tmp ] ========== Files Created - No Company Name ========== [2011-04-21 14:33:08 \| 002,634,652 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\elfbot.rar [2010-07-10 22:05:02 \| 000,000,211 \| ---- \| C] () -- C:\Boot.bak [2010-07-10 22:04:58 \| 000,262,400 \| ---- \| C] () -- C:\cmldr [2010-07-10 22:03:04 \| 000,256,512 \| ---- \| C] () -- C:\WINDOWS\PEV.exe [2010-07-10 22:03:04 \| 000,098,816 \| ---- \| C] () -- C:\WINDOWS\sed.exe [2010-07-10 22:03:04 \| 000,080,412 \| ---- \| C] () -- C:\WINDOWS\grep.exe [2010-07-10 22:03:04 \| 000,077,312 \| ---- \| C] () -- C:\WINDOWS\MBR.exe [2010-07-10 22:03:04 \| 000,068,096 \| ---- \| C] () -- C:\WINDOWS\zip.exe [2010-07-10 22:01:17 \| 003,738,393 \| R--- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe [2010-07-10 15:51:03 \| 000,001,980 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\HiJackThis.lnk [2010-07-09 11:59:04 \| 003,932,214 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\asgasg.bmp [2010-07-09 11:51:53 \| 000,000,638 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk [2010-07-08 21:28:21 \| 000,001,607 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Counter Strike 1.6 Non Steam.lnk [2010-07-08 21:16:11 \| 002,036,392 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\de_nuke.bsp [2010-07-08 21:15:38 \| 000,001,645 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike 1.6.lnk [2010-07-08 19:33:36 \| 001,588,224 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\SteamInstall.msi [2010-07-08 16:49:47 \| 000,001,573 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia Auto.lnk [2010-07-08 16:48:45 \| 001,867,776 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\python24.dll [2010-07-08 16:42:28 \| 003,670,224 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\TibiaAutoSetup_2_5_1.exe [2010-07-08 15:45:43 \| 000,694,916 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\tibiasoft_com_python24(2).rar [2010-07-08 09:31:01 \| 000,047,616 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe [2010-07-08 09:29:34 \| 000,281,904 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe [2010-07-08 08:33:24 \| 000,000,763 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\OpenFM.lnk [2010-07-08 08:33:24 \| 000,000,734 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Gadu-Gadu 10.lnk [2010-07-06 21:53:57 \| 000,000,416 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\na war.ini [2010-07-06 15:59:28 \| 000,028,219 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\paszcur.jpeg [2010-07-04 12:11:58 \| 000,000,516 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Mage boomb.ini [2010-07-04 10:51:38 \| 000,148,413 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\MegaMageBomb8.54(2).rar [2010-07-03 20:14:42 \| 003,932,214 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\zlo.bmp [2010-07-02 20:49:43 \| 000,001,524 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Combat Arms EU.lnk [2010-07-01 15:53:23 \| 003,932,214 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\asf.bmp [2010-07-01 14:52:32 \| 003,932,214 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\skelet.bmp [2010-06-30 13:54:58 \| 000,038,487 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\a01f26470000f8784c26288a.jpeg [2010-06-29 10:19:43 \| 000,054,156 \| -H-- \| C] () -- C:\WINDOWS\QTFont.qfn [2010-06-29 10:19:43 \| 000,001,409 \| ---- \| C] () -- C:\WINDOWS\QTFont.for [2010-06-28 22:09:36 \| 001,440,054 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20004.bmp [2010-06-28 22:09:34 \| 001,440,054 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20003.bmp [2010-06-28 22:09:30 \| 001,440,054 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20001.bmp [2010-06-28 22:09:28 \| 001,440,054 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\de_dust20000.bmp [2010-06-28 13:14:39 \| 002,359,350 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\poi.bmp [2010-06-22 16:14:01 \| 000,001,587 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Dedicated Server.lnk [2010-06-22 14:38:10 \| 052,093,226 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\FragbaseMapPack.zip [2010-06-22 14:36:21 \| 021,408,277 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\cs16patch_full_v21_2.zip [2010-06-18 19:01:28 \| 002,359,350 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\asd.bmp [2010-06-18 12:02:44 \| 006,260,733 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\2010-06-18_1202.swf [2010-06-16 17:48:43 \| 011,060,066 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\2010-06-16_1748.swf [2010-06-16 13:12:15 \| 000,000,696 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do moviemk.lnk [2010-06-13 09:48:48 \| 000,000,041 \| ---- \| C] () -- C:\set.ini [2010-05-28 02:04:46 \| 000,041,872 \| ---- \| C] () -- C:\WINDOWS\System32\xfcodec.dll [2010-02-21 17:30:37 \| 000,000,038 \| ---- \| C] () -- C:\WINDOWS\avisplitter.ini [2010-02-21 17:30:32 \| 000,881,664 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2010-02-21 17:30:32 \| 000,205,824 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2010-02-21 17:30:31 \| 003,596,288 \| ---- \| C] () -- C:\WINDOWS\System32\qt-dx331.dll [2010-02-21 17:30:27 \| 000,085,504 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll [2010-02-21 17:30:27 \| 000,000,547 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2010-02-11 22:08:36 \| 000,001,890 \| -HS- \| C] () -- C:\WINDOWS\System32\KGyGaAvL.sys [2010-02-11 22:08:36 \| 000,000,056 \| RHS- \| C] () -- C:\WINDOWS\System32\1C0543800E.sys [2010-02-11 22:03:21 \| 000,001,599 \| ---- \| C] () -- C:\WINDOWS\Ascd_tmp.ini [2010-02-11 22:03:20 \| 000,005,824 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2010-02-11 21:58:23 \| 000,000,164 \| R--- \| C] () -- C:\WINDOWS\avrack.ini [2010-02-11 21:58:15 \| 000,156,672 \| R--- \| C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2010-02-11 21:47:24 \| 000,114,688 \| ---- \| C] () -- C:\WINDOWS\System32\WLANUTL.dll [2009-10-07 02:46:36 \| 000,025,752 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2009-10-07 02:23:08 \| 000,013,584 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll [2009-04-30 23:39:36 \| 000,082,289 \| ---- \| C] () -- C:\WINDOWS\System32\lvcoinst.ini [2002-12-03 23:47:16 \| 000,172,032 \| ---- \| C] () -- C:\WINDOWS\System32\lame_enc.dll [2002-10-16 00:54:04 \| 000,153,088 \| ---- \| C] () -- C:\WINDOWS\System32\unrar.dll [2002-10-06 20:42:58 \| 000,237,568 \| ---- \| C] () -- C:\WINDOWS\System32\OggDS.dll [2002-10-05 01:04:26 \| 000,921,600 \| ---- \| C] () -- C:\WINDOWS\System32\VorbisEnc.dll [2002-10-05 01:04:26 \| 000,188,416 \| ---- \| C] () -- C:\WINDOWS\System32\vorbis.dll [2002-10-05 01:04:18 \| 000,045,056 \| ---- \| C] () -- C:\WINDOWS\System32\ogg.dll [2002-05-16 02:38:40 \| 000,091,136 \| ---- \| C] () -- C:\WINDOWS\System32\mp4fil32.dll [2002-05-04 16:19:00 \| 000,049,152 \| ---- \| C] () -- C:\WINDOWS\System32\avisynthEx.dll [2002-04-19 17:23:26 \| 000,106,137 \| ---- \| C] () -- C:\WINDOWS\System32\libpostproc.dll [2002-04-19 16:51:04 \| 000,211,760 \| ---- \| C] () -- C:\WINDOWS\System32\libavcodec.dll [2001-06-22 14:06:02 \| 000,167,936 \| ---- \| C] () -- C:\WINDOWS\System32\MPEG2DEC.dll ========== LOP Check ========== [2010-07-08 08:32:11 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-07-02 20:44:30 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Dane aplikacji\NexonEU [2010-07-10 13:14:14 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2010-07-09 09:18:33 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2010-07-08 08:32:32 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Gadu-Gadu 10 [2010-03-15 20:32:12 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\GanymedeNet [2010-02-14 20:41:35 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Leadertech [2010-12-31 16:38:38 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Nowe Gadu-Gadu [2010-02-14 15:52:09 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\OpenFM [2010-06-05 11:01:36 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Remere's Map Editor [2010-07-09 20:08:45 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Tibia ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 226 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:4EE74317 @Alternate Data Stream - 169 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-11, 15:48

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Cytat:

:Processes
killallprocesses

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\ZDCndis5.SYS -- (ZDCndis5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
IE - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..extensions.enabledItems: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:2.7.0.14
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q="
[2010-02-11 22:30:12 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010-06-02 17:12:24 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2010-06-02 09:57:42 | 000,000,917 | ---- | M] () -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\conduit.xml
[2010-02-11 22:32:53 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\winamp-search.xml
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\Toolbar\ShellBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1229272821-1993962763-1644491937-1003\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe ()
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe ()
[2011-04-21 14:33:08 | 002,634,652 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\elfbot.rar

:Commands
[clearallrestorepoints]
[emptytemp]
[reboot]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

_________________

Banan
Gość

Wysłany: 2010-07-11, 17:03

All processes killed ========== PROCESSES ========== ========== OTL ========== Service ZDCndis5 stopped successfully! Service ZDCndis5 deleted successfully! File C:\WINDOWS\System32\ZDCndis5.SYS not found. Service catchme stopped successfully! Service catchme deleted successfully! File C:\ComboFix\catchme.sys not found. Registry value HKEY_USERS\S-1-5-21-1229272821-1993962763-1644491937-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ deleted successfully. C:\Program Files\XfireXO\tbXfir.dll moved successfully. Prefs.js: "Winamp Search" removed from browser.search.defaultenginename Prefs.js: "XfireXO Customized Web Search" removed from browser.search.defaultthis.engineName Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl Prefs.js: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 removed from extensions.enabledItems Prefs.js: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:2.7.0.14 removed from extensions.enabledItems Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" removed from keyword.URL C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\META-INF folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\chrome folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\searchplugin folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\META-INF folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\lib folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\defaults folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\chrome folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} folder moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\conduit.xml moved successfully. C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\searchplugins\winamp-search.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found. File C:\Program Files\XfireXO\tbXfir.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found. File C:\Program Files\XfireXO\tbXfir.dll not found. Registry value HKEY_USERS\S-1-5-21-1229272821-1993962763-1644491937-1003\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}\ not found. File C:\Program Files\XfireXO\tbXfir.dll not found. Registry value HKEY_USERS\S-1-5-21-1229272821-1993962763-1644491937-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}\ not found. File C:\Program Files\XfireXO\tbXfir.dll not found. C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\spoolsvcs.exe moved successfully. C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\w301.exe moved successfully. C:\Documents and Settings\Paweł\Pulpit\elfbot.rar moved successfully. ========== COMMANDS ========== Restore points cleared and new OTL Restore Point set! [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Paweł ->Temp folder emptied: 1180804 bytes ->Temporary Internet Files folder emptied: 4573521 bytes ->Java cache emptied: 3302131 bytes ->FireFox cache emptied: 93274422 bytes ->Flash cache emptied: 32802 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2352022 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 109080 bytes RecycleBin emptied: 694916 bytes Total Files Cleaned = 101,00 mb OTL by OldTimer - Version 3.2.9.0 log created on 07112010_175738 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-11, 17:35

Ok, podaj jeszcze nowy log robiony opcją Skanuj.
_________________

Banan
Gość

Wysłany: 2010-07-11, 18:12

OTL logfile created on: 2010-07-11 19:07:26 - Run 2 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 \| Country: Polska \| Language: PLK \| Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory \| 557,00 Mb Available Physical Memory \| 54,00% Memory free 2,00 Gb Paging File \| 2,00 Gb Available in Paging File \| 82,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 37,26 Gb Total Space \| 24,68 Gb Free Space \| 66,25% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BANACH-5727753B Current User Name: Paweł Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2011-01-02 19:47:11 \| 000,910,296 \| ---- \| M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2010-07-11 15:31:51 \| 002,433,024 \| ---- \| M] (CipSoft GmbH) -- C:\Program Files\Tibia\Tibia.exe PRC - [2010-07-11 13:42:56 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-07-02 06:53:18 \| 000,512,000 \| ---- \| M] ( ) -- C:\Program Files\Tibia Auto\tibiaauto.exe PRC - [2009-10-14 14:36:56 \| 002,793,304 \| ---- \| M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe PRC - [2009-10-14 14:34:18 \| 000,560,472 \| ---- \| M] () -- C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe PRC - [2009-10-07 02:47:34 \| 000,154,136 \| ---- \| M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe PRC - [2009-07-16 16:35:42 \| 005,458,704 \| ---- \| M] (Logitech Inc.) -- C:\Program Files\Logitech\Logitech Vid\Vid.exe PRC - [2008-07-19 17:25:06 \| 000,016,056 \| ---- \| M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-04-14 22:51:36 \| 000,216,064 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\osk.exe PRC - [2008-04-14 22:51:18 \| 001,035,264 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006-01-19 17:54:34 \| 000,925,696 \| ---- \| M] ( ) -- C:\Program Files\SAGEM WiFi manager\WLANUTL.EXE PRC - [2004-02-10 12:30:44 \| 000,081,920 \| ---- \| M] (Valve) -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\hl.exe PRC - [2003-12-22 16:36:14 \| 000,561,152 \| ---- \| M] () -- C:\Program Files\Ventrilo\Ventrilo.exe PRC - [2001-10-26 21:29:58 \| 000,006,656 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\msswchx.exe ========== Modules (SafeList) ========== MOD - [2010-07-11 13:42:56 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie\OTL.exe MOD - [2008-04-14 22:50:36 \| 000,586,240 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\mlang.dll MOD - [2008-04-14 22:46:34 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled \| Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-10-07 02:47:34 \| 000,154,136 \| ---- \| M] (Logitech Inc.) [Auto \| Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008-07-23 17:25:45 \| 000,348,344 \| ---- \| M] (ALWIL Software) [On_Demand \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2008-07-19 17:38:28 \| 000,147,640 \| ---- \| M] (ALWIL Software) [Auto \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2008-07-19 17:38:04 \| 000,250,040 \| ---- \| M] (ALWIL Software) [On_Demand \| Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2008-07-19 17:25:06 \| 000,016,056 \| ---- \| M] (ALWIL Software) [Auto \| Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\ZDPNDIS5.SYS -- (ZDPNDIS5) DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5) DRV - File not found [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT) DRV - [2009-10-07 02:46:36 \| 000,025,752 \| ---- \| M] () [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2009-04-30 23:56:32 \| 000,495,768 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\system32\drivers\LV561AV.SYS -- (PID_0928) Logitech QuickCam Express(PID_0928) DRV - [2008-07-19 17:37:42 \| 000,020,560 \| ---- \| M] (ALWIL Software) [File_System \| Auto \| Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2008-07-19 17:37:21 \| 000,094,416 \| ---- \| M] (ALWIL Software) [File_System \| Auto \| Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2008-07-19 17:35:18 \| 000,078,416 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2008-07-19 17:33:42 \| 000,023,152 \| ---- \| M] (ALWIL Software) [Kernel \| On_Demand \| Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2008-07-19 17:32:36 \| 000,042,912 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2008-07-19 17:32:15 \| 000,026,944 \| ---- \| M] (ALWIL Software) [Kernel \| System \| Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2006-01-18 15:09:40 \| 000,017,664 \| ---- \| M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\ZDPSp50.sys -- (ZDPSp50) DRV - [2005-12-22 15:45:18 \| 000,402,432 \| ---- \| M] (ZyDAS Technology Corporation) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\WlanBZXP.sys -- (SG762_XP) DRV - [2005-05-18 11:50:30 \| 002,319,680 \| R--- \| M] (Realtek Semiconductor Corp.) [Kernel \| On_Demand \| Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.google.pl" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-01-03 13:27:15 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-01-02 19:47:19 \| 000,000,000 \| ---D \| M] [2010-02-11 22:24:43 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Extensions [2010-07-11 18:02:15 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions [2010-05-25 16:18:13 \| 000,000,000 \| ---D \| M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\t0dg05u1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-02 18:07:59 \| 000,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox\extensions [2010-02-15 18:50:42 \| 000,120,296 \| ---- \| M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll [2010-02-15 11:58:52 \| 000,603,648 \| ---- \| M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll [2010-03-22 16:16:37 \| 000,002,767 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-22 16:16:37 \| 000,001,406 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-22 16:16:37 \| 000,000,917 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-22 16:16:37 \| 000,000,858 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-22 16:16:37 \| 000,001,183 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-22 16:16:37 \| 000,001,683 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2010-07-11 09:47:22 \| 000,000,027 \| ---- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe () O4 - HKCU..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = C:\Program Files\SAGEM WiFi manager\WLANUTL.EXE ( ) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/updat...indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedi...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-02-11 21:23:18 \| 000,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35 - HKLM\..comfile [open] -- "%1" % O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010-07-11 17:57:38 \| 000,000,000 \| ---D \| C] -- C:\_OTL [2010-07-11 13:55:53 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Pulpit\cs [2010-07-11 13:52:19 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Paweł\Pulpit\Screeny [2010-07-11 13:38:15 \| 000,000,000 \| ---D \| C] -- C:\Avenger [2010-07-11 09:55:45 \| 000,000,000 \| -HSD \| C] -- C:\RECYCLER [2010-07-11 09:39:03 \| 000,000,000 \| ---D \| C] -- C:\ComboFix [2010-07-10 22:04:55 \| 000,000,000 \| RHSD \| C] -- C:\cmdcons [2010-07-10 22:03:04 \| 000,212,480 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010-07-10 22:03:04 \| 000,161,792 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010-07-10 22:03:04 \| 000,136,704 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010-07-10 22:03:04 \| 000,031,232 \| ---- \| C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010-07-10 22:02:55 \| 000,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2010-07-10 22:02:35 \| 000,000,000 \| ---D \| C] -- C:\Qoobox [2010-07-08 08:32:12 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Gadu-Gadu 10 [2010-07-08 08:32:11 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-07-08 08:31:30 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Gadu-Gadu 10 [2010-07-04 21:35:37 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Tibia Auto [2010-07-04 18:07:09 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2010-07-02 20:44:30 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Dane aplikacji\NexonEU [2010-07-02 17:54:37 \| 000,000,000 \| ---D \| C] -- C:\Download [2010-07-02 17:54:16 \| 000,000,000 \| ---D \| C] -- C:\Nexon [2010-07-02 17:54:15 \| 000,421,888 \| ---- \| C] (NEXON Inc.) -- C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe [2010-06-22 16:12:45 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Valve [2010-06-22 10:58:34 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Tibia [2010-06-22 10:52:19 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Moje dokumenty\Pobieranie [2010-06-17 09:34:48 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Ronots Client [2010-06-16 13:12:03 \| 000,000,000 \| ---D \| C] -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files [2010-06-16 13:11:26 \| 000,000,000 \| R--D \| C] -- C:\Documents and Settings\Paweł\Moje dokumenty\Moje wideo ========== Files - Modified Within 30 Days ========== [2010-07-11 19:07:20 \| 000,009,003 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Rook.xml [2010-07-11 18:09:14 \| 003,145,728 \| -H-- \| M] () -- C:\Documents and Settings\Paweł\NTUSER.DAT [2010-07-11 18:00:52 \| 000,002,163 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Ventrilo.lnk [2010-07-11 18:00:32 \| 000,000,664 \| ---- \| M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-07-11 18:00:02 \| 000,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2010-07-11 17:59:30 \| 000,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2010-07-11 17:58:43 \| 000,000,188 \| -HS- \| M] () -- C:\Documents and Settings\Paweł\ntuser.ini [2010-07-11 15:37:32 \| 000,001,573 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia Auto.lnk [2010-07-11 15:35:07 \| 003,670,224 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\TibiaAutoSetup_2_5_1.exe [2010-07-11 13:37:45 \| 004,271,650 \| -H-- \| M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-07-11 09:47:34 \| 000,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2010-07-11 09:47:22 \| 000,000,027 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010-07-10 22:05:02 \| 000,000,281 \| RHS- \| M] () -- C:\boot.ini [2010-07-10 22:01:47 \| 003,738,393 \| R--- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe [2010-07-10 15:51:03 \| 000,001,980 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\HiJackThis.lnk [2010-07-10 13:41:58 \| 000,002,267 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-07-09 19:21:28 \| 000,000,698 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Ronots Client.lnk [2010-07-09 11:51:53 \| 000,000,638 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk [2010-07-09 09:58:50 \| 000,001,645 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike 1.6.lnk [2010-07-08 15:37:07 \| 002,433,024 \| ---- \| M] (CipSoft GmbH) -- C:\Documents and Settings\Paweł\Pulpit\Tibia.exe [2010-07-08 08:33:24 \| 000,000,763 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\OpenFM.lnk [2010-07-08 08:33:24 \| 000,000,734 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\Gadu-Gadu 10.lnk [2010-07-04 18:04:18 \| 002,604,873 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\elfbot854.rar [2010-07-04 10:51:42 \| 000,148,413 \| ---- \| M] () -- C:\Documents and Settings\Paweł\Pulpit\MegaMageBomb8.54(2).rar [2010-07-04 10:25:10 \| 000,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2010-07-02 20:49:43 \| 000,001,524 \| ---- \| M] () -- C:\Documents and Settings\All Users\Pulpit\Combat Arms EU.lnk [2010-07-02 17:54:15 \| 000,421,888 \| ---- \| M] (NEXON Inc.) -- C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe [2010-06-29 10:19:43 \| 000,054,156 \| -H-- \| M] () -- C:\WINDOWS\QTFont.qfn [2010-06-29 10:19:43 \| 000,001,409 \| ---- \| M] () -- C:\WINDOWS\QTFont.for [2010-06-23 22:55:20 \| 001,042,454 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-06-23 22:55:20 \| 000,490,284 \| ---- \| M] () -- C:\WINDOWS\System32\perfh015.dat [2010-06-23 22:55:20 \| 000,432,356 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2010-06-23 22:55:20 \| 000,083,660 \| ---- \| M] () -- C:\WINDOWS\System32\perfc015.dat [2010-06-23 22:55:20 \| 000,067,312 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2010-06-12 19:10:39 \| 000,000,087 \| ---- \| M] () -- C:\Documents and Settings\Paweł\jagex_runescape_preferences2.dat [2010-06-12 19:09:50 \| 000,000,045 \| ---- \| M] () -- C:\Documents and Settings\Paweł\jagex_runescape_preferences.dat ========== Files Created - No Company Name ========== [2010-07-11 19:07:15 \| 000,009,003 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Rook.xml [2010-07-11 15:37:32 \| 000,001,573 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Tibia Auto.lnk [2010-07-11 15:37:06 \| 001,867,776 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\python24.dll [2010-07-11 15:34:38 \| 003,670,224 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\TibiaAutoSetup_2_5_1.exe [2010-07-10 22:05:02 \| 000,000,211 \| ---- \| C] () -- C:\Boot.bak [2010-07-10 22:04:58 \| 000,262,400 \| ---- \| C] () -- C:\cmldr [2010-07-10 22:03:04 \| 000,256,512 \| ---- \| C] () -- C:\WINDOWS\PEV.exe [2010-07-10 22:03:04 \| 000,098,816 \| ---- \| C] () -- C:\WINDOWS\sed.exe [2010-07-10 22:03:04 \| 000,080,412 \| ---- \| C] () -- C:\WINDOWS\grep.exe [2010-07-10 22:03:04 \| 000,077,312 \| ---- \| C] () -- C:\WINDOWS\MBR.exe [2010-07-10 22:03:04 \| 000,068,096 \| ---- \| C] () -- C:\WINDOWS\zip.exe [2010-07-10 22:01:17 \| 003,738,393 \| R--- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\ComboFix.exe [2010-07-10 15:51:03 \| 000,001,980 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\HiJackThis.lnk [2010-07-09 11:51:53 \| 000,000,638 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk [2010-07-08 21:15:38 \| 000,001,645 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike 1.6.lnk [2010-07-08 08:33:24 \| 000,000,763 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\OpenFM.lnk [2010-07-08 08:33:24 \| 000,000,734 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\Gadu-Gadu 10.lnk [2010-07-04 10:51:38 \| 000,148,413 \| ---- \| C] () -- C:\Documents and Settings\Paweł\Pulpit\MegaMageBomb8.54(2).rar [2010-07-02 20:49:43 \| 000,001,524 \| ---- \| C] () -- C:\Documents and Settings\All Users\Pulpit\Combat Arms EU.lnk [2010-06-29 10:19:43 \| 000,054,156 \| -H-- \| C] () -- C:\WINDOWS\QTFont.qfn [2010-06-29 10:19:43 \| 000,001,409 \| ---- \| C] () -- C:\WINDOWS\QTFont.for [2010-06-13 09:48:48 \| 000,000,041 \| ---- \| C] () -- C:\set.ini [2010-05-28 02:04:46 \| 000,041,872 \| ---- \| C] () -- C:\WINDOWS\System32\xfcodec.dll [2010-02-21 17:30:37 \| 000,000,038 \| ---- \| C] () -- C:\WINDOWS\avisplitter.ini [2010-02-21 17:30:32 \| 000,881,664 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2010-02-21 17:30:32 \| 000,205,824 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2010-02-21 17:30:31 \| 003,596,288 \| ---- \| C] () -- C:\WINDOWS\System32\qt-dx331.dll [2010-02-21 17:30:27 \| 000,085,504 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll [2010-02-21 17:30:27 \| 000,000,547 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2010-02-11 22:08:36 \| 000,001,890 \| -HS- \| C] () -- C:\WINDOWS\System32\KGyGaAvL.sys [2010-02-11 22:08:36 \| 000,000,056 \| RHS- \| C] () -- C:\WINDOWS\System32\1C0543800E.sys [2010-02-11 22:03:21 \| 000,001,599 \| ---- \| C] () -- C:\WINDOWS\Ascd_tmp.ini [2010-02-11 22:03:20 \| 000,005,824 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2010-02-11 21:58:23 \| 000,000,164 \| R--- \| C] () -- C:\WINDOWS\avrack.ini [2010-02-11 21:58:15 \| 000,156,672 \| R--- \| C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2010-02-11 21:47:24 \| 000,114,688 \| ---- \| C] () -- C:\WINDOWS\System32\WLANUTL.dll [2009-10-07 02:46:36 \| 000,025,752 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2009-10-07 02:23:08 \| 000,013,584 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll [2009-04-30 23:39:36 \| 000,082,289 \| ---- \| C] () -- C:\WINDOWS\System32\lvcoinst.ini [2002-12-03 23:47:16 \| 000,172,032 \| ---- \| C] () -- C:\WINDOWS\System32\lame_enc.dll [2002-10-16 00:54:04 \| 000,153,088 \| ---- \| C] () -- C:\WINDOWS\System32\unrar.dll [2002-10-06 20:42:58 \| 000,237,568 \| ---- \| C] () -- C:\WINDOWS\System32\OggDS.dll [2002-10-05 01:04:26 \| 000,921,600 \| ---- \| C] () -- C:\WINDOWS\System32\VorbisEnc.dll [2002-10-05 01:04:26 \| 000,188,416 \| ---- \| C] () -- C:\WINDOWS\System32\vorbis.dll [2002-10-05 01:04:18 \| 000,045,056 \| ---- \| C] () -- C:\WINDOWS\System32\ogg.dll [2002-05-16 02:38:40 \| 000,091,136 \| ---- \| C] () -- C:\WINDOWS\System32\mp4fil32.dll [2002-05-04 16:19:00 \| 000,049,152 \| ---- \| C] () -- C:\WINDOWS\System32\avisynthEx.dll [2002-04-19 17:23:26 \| 000,106,137 \| ---- \| C] () -- C:\WINDOWS\System32\libpostproc.dll [2002-04-19 16:51:04 \| 000,211,760 \| ---- \| C] () -- C:\WINDOWS\System32\libavcodec.dll [2001-06-22 14:06:02 \| 000,167,936 \| ---- \| C] () -- C:\WINDOWS\System32\MPEG2DEC.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 226 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:4EE74317 @Alternate Data Stream - 169 bytes C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

@Blade@

Pomógł: 8 razy

Wysłany: 2010-07-11, 18:19

Ok, więcej nic nie widać. W OTL kliknij Sprzątanie Przeczyść dysk oraz rejestr CCleaner Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz) http://www.instalki.pl/pr...lorer_8_XP.html Usuń Avasta tym narzędziem http://download838.avast....g/aswclear5.exe (uruchamiasz go w trybie awaryjnym), a następnie zainstaluj najnowszą wersję Avasta http://www.instalki.pl/pr..._Antivirus.html
_________________

Forum komputerowe PC Town Strona Główna » Kompiradło » Bezpieczeństwo w sieci » Analiza logów » Mam Keyllogera?

Możesz pisać nowe tematy
Możesz odpowiadać w tematach
Nie możesz zmieniać swoich postów
Nie możesz usuwać swoich postów
Nie możesz głosować w ankietach
Nie możesz załączać plików na tym forum
Możesz ściągać załączniki na tym forum

Dodaj temat do Ulubionych
Wersja do druku

system walidacji dla gości opracował Petermechanic Forum komputerowe

Strona wygenerowana w 0,51 sekundy. Zapytań do SQL: 9