Antimalware wykrył infekcje i wyskakujące ruskie okienka

**Posty:** 250 · przez **tenzin** 25 Lis 2009, 11:06

witam,
Antimalware wykrył infekcję:
Nie wiem czy wystarczy zwyczajnie użyć opcji usuń, ponieważ są i inne problemy z kompem, dlatego wrzucam na forum:
Z góry dziękuję!.

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.41 Wersja bazy definicji: 3217 Windows 5.1.2600 Dodatek Service Pack 2 2009-11-25 09:33:44 mbam-log-2009-11-25 (09-33-24).txt Typ skanowania: Szybkie skanowanie Przeskanowane obiekty: 101021 Upłynęło: 7 minute(s), 34 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 2 Zainfekowane foldery: 0 Zainfekowane pliki: 2 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe logon.exe) Good: (Explorer.exe) -> No action taken. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\Documents and Settings\x\Dane aplikacji\wiaserva.log (Malware.Trace) -> No action taken. C:\WINDOWS\system32\logon.exe (Backdoor.Bot) -> No action taken.

Log
http://wklej.org/id/215335/

Extras
http://wklej.org/id/215336/

OTL
http://wklej.org/id/215338/

Pojawił się również nowy, dziwny wpis w zakładce uruchamianie.

Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 25 Lis 2009, 11:44

Zaraz to usuniemy przez OTL

Uruchom ponownie program OTL
W okienku na dole Custom Scans / Fixes wklej to, co poniżej w ramce:
Kod: Zaznacz wszystko
:Processes explorer.exe :OTL O4 - Startup: C:\Documents and Settings\x\Menu Start\Programy\Autostart\ukssys32.exe (Moore Computer Consultants, Inc.) O20 - HKLM Winlogon: Shell - (logon.exe) - C:\WINDOWS\System32\logon.exe () :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Shell"=- "Shell"="C:\Windows\Explorer.exe" :Commands [purity] [emptytemp] [clearrestorepoints] [start explorer] [reboot]
Upewnij się, że wszystkie inne okna, programy, komunikatory są wyłączone.
Kliknij przycisk Run Fix i poczekaj cierpliwie. To może chwilę potrwać!
Na prośbę komputera o restart zgódź się.
Po restarcie program automatycznie wyświetli raport z czyszczenia, który należy zapisać i wkleić w poście w tagach [code], lub na stronie http://www.wklej.org
Wykonaj także nowego loga OTL.txt z OTL z opcji Run Scan i także go dołącz. Plik extras.txt nie będzie potrzebny.

**Posty:** 250 · przez **tenzin** 25 Lis 2009, 12:08

Dziękuję za szybką odpowiedź!
Uruchomiłem OTLa zgodnie ze wskazówki, niestety przy ponownym uruchomieniu komp zawiesił się w trakcie zamykania systemu, więc musiałem go zresetować. Po ponownym uruchomienia kompa, program uruchomił się i wygenerował loga:

Kod: Zaznacz wszystko: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== OTL ========== C:\Documents and Settings\x\Menu Start\Programy\Autostart\ukssys32.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:logon.exe deleted successfully. File move failed. C:\WINDOWS\system32\logon.exe scheduled to be moved on reboot. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"Shell"|"C:\Windows\Explorer.exe" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: x ->Temp folder emptied: 6728535 bytes ->Temporary Internet Files folder emptied: 23554697 bytes ->Java cache emptied: 21444 bytes ->FireFox cache emptied: 72707900 bytes ->Google Chrome cache emptied: 0 bytes ->Opera cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 98,29 mb Error: Unable to interpret <[clearrestorepoints]> in the current context! OTL by OldTimer - Version 3.1.10.0 log created on 11252009_105746 Files\Folders moved on Reboot... C:\WINDOWS\system32\logon.exe moved successfully. Registry entries deleted on Reboot...

Nowy log z OTLa

Kod: Zaznacz wszystko: OTL logfile created on: 2009-11-25 11:04:46 - Run 5 OTL by OldTimer - Version 3.1.10.0 Folder = C:\Documents and Settings\x\Pulpit\problem Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,48 Mb Total Physical Memory | 202,32 Mb Available Physical Memory | 39,56% Memory free 1,22 Gb Paging File | 0,96 Gb Available in Paging File | 78,65% Paging File free Paging file location(s): D:\pagefile.sys 766 1500 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 4,31 Gb Total Space | 0,60 Gb Free Space | 13,91% Space Free | Partition Type: NTFS Drive D: | 14,36 Gb Total Space | 0,34 Gb Free Space | 2,39% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: XXX Current User Name: x Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-11-25 09:51:26 | 00,531,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Pulpit\problem\OTL.exe PRC - [2009-11-07 17:39:26 | 00,908,248 | ---- | M] (Mozilla Corporation) -- D:\Programy\Firefox2\firefox.exe PRC - [2009-05-21 10:34:05 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2007-03-14 15:42:48 | 00,321,088 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe PRC - [2006-11-10 16:18:42 | 00,859,136 | ---- | M] (Nero AG) -- D:\Programy\nero\Nero 7\InCD\InCDsrv.exe PRC - [2006-07-07 16:15:12 | 00,348,160 | ---- | M] (Leadtek Research Inc.) -- C:\Program Files\WinFast\WFTVFM\WFWIZ.exe PRC - [2005-08-07 13:54:00 | 00,167,936 | ---- | M] () -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe PRC - [2005-07-20 20:07:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2004-12-13 03:34:32 | 00,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe PRC - [2004-08-11 00:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe PRC - [2004-08-03 23:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2004-08-03 23:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2001-10-26 17:29:52 | 00,024,064 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\devldr32.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-11-25 09:51:26 | 00,531,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Pulpit\problem\OTL.exe MOD - [2004-08-03 23:43:58 | 00,185,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll MOD - [2004-08-03 23:42:34 | 01,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-05-21 10:34:05 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-03-14 15:42:48 | 00,321,088 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe -- (nmservice) SRV - [2007-03-14 15:42:22 | 00,012,800 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe -- (nmraapache) SRV - [2006-12-23 16:54:04 | 00,262,144 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2006-11-10 16:18:42 | 00,859,136 | ---- | M] (Nero AG) -- D:\Programy\nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv) SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2005-08-07 13:54:00 | 00,167,936 | ---- | M] () -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- (RichVideo) Cyberlink RichVideo Service(CRVS) SRV - [2005-07-20 20:07:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2004-12-13 03:34:32 | 00,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) SRV - [2004-08-11 00:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf) SRV - [2004-08-03 23:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc) SRV - [2004-08-03 23:44:02 | 00,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\irmon.dll -- (Irmon) SRV - [2001-10-26 18:29:32 | 00,066,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ipxsap.dll -- (NwSapAgent) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-02-15 10:50:52 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2009-01-16 18:42:27 | 00,114,048 | ---- | M] (Acronis) -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman) DRV - [2008-05-16 11:33:12 | 00,089,256 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM) DRV - [2007-03-14 22:55:18 | 00,026,944 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis) DRV - [2007-03-14 22:55:02 | 00,025,792 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp) DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2006-11-10 15:17:50 | 00,033,792 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm) DRV - [2006-11-10 15:16:34 | 00,031,360 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass) DRV - [2006-11-10 15:15:44 | 00,102,912 | ---- | M] (Nero AG) -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs) DRV - [2005-10-09 04:26:40 | 00,019,034 | R--- | M] (Kingsun Corporation) -- C:\WINDOWS\system32\drivers\KS-959.sys -- (KS-959) DRV - [2005-08-16 11:23:10 | 00,038,422 | ---- | M] (Generic) -- C:\WINDOWS\system32\drivers\StMp3Rec.sys -- (StMp3Rec) DRV - [2005-07-20 20:07:00 | 03,198,368 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2005-06-28 08:24:00 | 00,163,584 | ---- | M] (Leadtek Research Inc.) -- C:\WINDOWS\system32\drivers\cx88vid.sys -- (CX23880) DRV - [2005-06-28 08:22:00 | 00,030,976 | ---- | M] (Leadtek Research Inc.) -- C:\WINDOWS\system32\drivers\cx88tune.sys -- (CXTUNE) DRV - [2005-06-28 08:21:00 | 00,009,728 | ---- | M] (Leadtek Research Inc.) -- C:\WINDOWS\system32\drivers\cxavxbar.sys -- (CXAVXBAR) DRV - [2005-01-06 15:55:38 | 00,009,446 | ---- | M] (Leadtek Research Inc.) -- C:\Program Files\WinFast\WFTVFM\WFIOCTL.sys -- (WFIOCTL) DRV - [2004-08-03 22:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-03 22:04:34 | 00,012,672 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS) DRV - [2004-08-03 22:03:36 | 00,088,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx) DRV - [2004-08-03 21:59:44 | 00,095,360 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\atapi.sys -- (atapi) DRV - [2004-04-30 08:37:02 | 00,160,640 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\a347bus.sys -- (a347bus) DRV - [2004-04-30 08:33:00 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi) DRV - [2004-03-08 11:55:50 | 00,013,567 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\drivers\CDRBSDRV.SYS -- (cdrbsdrv) DRV - [2001-08-17 22:54:18 | 00,063,232 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb) DRV - [2001-08-17 22:54:18 | 00,055,936 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001-08-17 22:00:04 | 00,002,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401) DRV - [2001-08-17 20:19:34 | 00,036,480 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Sterownik Creative SoundFont Manager (WDM) DRV - [2001-08-17 20:19:28 | 00,006,912 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Sterownik Creative Interface Manager (WDM) DRV - [2001-08-17 20:19:26 | 00,283,904 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM) DRV - [2001-08-17 20:19:20 | 00,003,712 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk) DRV - [2001-08-17 20:11:06 | 00,066,591 | ---- | M] (3Com Corporation) -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (el90xbc) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14 FF - prefs.js..extensions.enabledItems: {3502a070-ea2f-11dd-ba2f-0800200c9a66}:1.5 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.5 FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.75 FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-06-23 16:54:49 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: D:\Programy\Firefox2\components [2007-05-07 20:29:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: D:\Programy\Firefox2\plugins [2007-05-07 20:29:22 | 00,000,000 | ---D | M] [2008-12-05 15:25:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2008-12-05 15:25:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-11-24 14:45:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\extensions [2009-10-31 14:39:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb} [2009-11-20 10:32:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\extensions\{3502a070-ea2f-11dd-ba2f-0800200c9a66} [2007-07-31 20:31:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} [2009-08-29 16:44:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\i7g7mm11.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} O1 HOSTS File: (686 bytes) - C:\WINDOWS\system32\drivers\etc\HOSTS O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Adobe\Acrobat 7\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] D:\Program2\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe () O4 - HKLM..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe (Leadtek Research Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsMenu = 1 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.228.7.228 89.228.6.83 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp3.dll (Pure Networks, Inc.) O20 - HKLM Winlogon: Shell - (C:\Windows\Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007-05-04 21:42:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-01-28 16:08:50 | 00,000,000 | ---D | M] - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009-01-28 16:08:52 | 00,000,000 | ---D | M] - D:\autorun.inf -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-11-21 10:13:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Temp [2009-11-18 12:40:57 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2009-11-03 18:11:35 | 00,000,000 | ---D | C] -- C:\_OTL [2009-11-03 10:57:30 | 00,000,000 | ---D | C] -- C:\rsit [2008-05-03 16:30:28 | 00,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys [2008-05-03 16:30:28 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys [1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-11-25 11:01:48 | 00,029,204 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-11-25 11:01:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-11-25 11:01:10 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-11-25 11:01:08 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys [2009-11-25 10:59:15 | 07,340,032 | -H-- | M] () -- C:\Documents and Settings\x\NTUSER.DAT [2009-11-25 10:59:15 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\x\ntuser.ini [2009-11-24 14:44:51 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-11-23 21:00:10 | 04,986,014 | -H-- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-11-20 20:31:44 | 00,000,061 | ---- | M] () -- C:\WINDOWS\popcinfo.dat [2009-11-18 12:48:42 | 00,023,968 | ---- | M] () -- C:\Documents and Settings\x\Moje dokumenty\cc_20091118_124823.reg [2009-11-04 08:17:59 | 00,000,741 | ---- | M] () -- C:\WINDOWS\win.ini [2009-11-04 08:17:59 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-11-04 08:17:59 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-11-02 07:43:26 | 00,233,576 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-11-01 19:40:53 | 00,060,064 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-11-01 18:55:14 | 00,109,568 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-31 15:23:41 | 00,000,456 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-11-23 16:47:48 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\x\Dane aplikacji\wiaserva.log [2009-11-18 12:48:25 | 00,023,968 | ---- | C] () -- C:\Documents and Settings\x\Moje dokumenty\cc_20091118_124823.reg [2009-10-31 15:23:41 | 00,000,456 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-08-29 20:02:10 | 04,986,014 | -H-- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-02-06 17:52:05 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Pool.INI [2009-02-05 20:35:02 | 00,000,094 | -H-- | C] () -- C:\WINDOWS\System32\spv1_WCssg.ini [2009-01-05 10:32:07 | 00,000,091 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008-01-07 12:54:36 | 00,000,056 | ---- | C] () -- C:\WINDOWS\Kulki.ini [2007-09-06 18:43:52 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007-07-16 14:52:33 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI [2007-07-10 12:50:04 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2007-06-26 18:51:40 | 00,000,021 | ---- | C] () -- C:\WINDOWS\FH_setup.ini [2007-05-31 18:27:36 | 00,000,239 | ---- | C] () -- C:\WINDOWS\WINCMD.INI [2007-05-19 19:57:44 | 00,172,032 | R--- | C] () -- C:\WINDOWS\ESUSDX.DLL [2007-05-19 19:57:44 | 00,077,824 | R--- | C] () -- C:\WINDOWS\ESUSD.DLL [2007-05-16 19:31:28 | 00,000,054 | ---- | C] () -- C:\WINDOWS\JascCmdFile.INI [2007-05-10 21:29:48 | 00,109,568 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007-05-07 20:39:19 | 00,000,427 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007-05-07 18:29:01 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2007-05-04 22:46:30 | 00,060,064 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2007-05-04 22:33:05 | 00,763,990 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2007-05-04 22:33:04 | 00,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2007-05-04 22:32:39 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini [2007-05-04 21:59:11 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2007-05-04 21:46:08 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\x\Dane aplikacji\desktop.ini [2007-05-04 21:42:04 | 00,000,000 | ---- | C] () -- C:\WINDOWS\control.ini [2007-05-04 21:38:44 | 00,000,059 | ---- | C] () -- C:\WINDOWS\vbaddin.ini [2007-05-04 21:38:44 | 00,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini [2007-05-04 21:38:06 | 00,026,717 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini [2007-05-04 21:38:04 | 00,003,813 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini [2005-10-14 10:56:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005-10-14 10:56:50 | 00,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll [2005-10-14 10:56:50 | 00,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2005-10-14 10:56:50 | 00,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll [2005-10-14 10:56:50 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2005-10-14 10:56:50 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2005-10-14 10:56:50 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2005-07-20 20:07:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2002-09-20 17:04:42 | 00,270,848 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll [2002-09-20 17:03:48 | 00,186,368 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll [2002-09-20 17:03:38 | 00,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll [2002-08-29 00:27:50 | 00,095,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atapi.sys [2002-08-28 20:23:06 | 00,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys [2002-08-28 20:22:36 | 00,033,936 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys [2001-10-26 18:29:42 | 00,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll [2001-10-26 18:29:40 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll [2001-10-26 18:29:36 | 00,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll [2001-10-26 18:29:32 | 00,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll [2001-10-26 18:29:26 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll [2001-10-26 18:28:44 | 00,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll [2001-10-26 18:28:34 | 00,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll [2001-10-26 18:27:02 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll [2001-10-26 17:15:04 | 00,027,898 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys [2001-10-26 17:14:52 | 00,004,976 | ---- | C] () -- C:\WINDOWS\System32\himem.sys [2001-10-26 17:14:32 | 00,009,043 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys [2001-10-26 17:12:52 | 00,000,359 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini [2001-10-26 16:45:26 | 00,016,024 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini [2001-10-26 16:45:26 | 00,006,074 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini [2001-10-26 16:45:24 | 00,013,819 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini [2001-10-26 16:42:08 | 00,020,629 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini [2001-10-26 16:42:08 | 00,002,992 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini [2001-10-26 16:42:08 | 00,002,890 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini [2001-10-26 16:42:08 | 00,001,295 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini [2001-08-17 22:31:56 | 00,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys [2001-08-17 22:31:56 | 00,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys [2001-08-17 22:31:50 | 00,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys [2001-08-17 22:31:46 | 00,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys [2001-08-17 22:31:46 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys [2001-08-17 22:31:44 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys [2001-08-17 22:31:38 | 00,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys [2001-08-17 22:31:38 | 00,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys [2001-08-17 22:31:36 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys [2001-08-17 22:31:36 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys [2001-08-17 22:13:24 | 00,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv [2001-08-17 20:55:06 | 01,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini [2001-07-31 08:17:12 | 00,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [2001-07-22 04:43:48 | 00,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini [2001-07-22 03:25:18 | 00,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini [2001-07-21 23:16:20 | 00,000,741 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 23:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2001-07-21 23:15:50 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll [1999-01-22 17:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=#E56717]========== LOP Check ==========[/color] [2007-05-24 17:26:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ABBYY [2009-01-16 19:04:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Acronis [2007-05-19 20:18:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2009-05-07 19:59:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AlawarWrapper [2009-06-11 16:50:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Color Wheel Pro [2007-08-25 18:29:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink [2009-02-05 19:52:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\EA [2007-05-16 19:04:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield [2008-09-12 08:11:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab [2007-08-25 09:30:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files [2009-02-03 20:37:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2007-05-15 06:14:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft [2008-05-28 07:04:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\n7-89-o9-3r-4t-r9 [2007-09-06 15:59:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Nero [2009-05-02 17:11:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA [2009-05-02 17:11:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles [2009-02-20 10:27:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Pure Networks [2008-02-15 20:58:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Real [2009-02-05 20:44:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games [2007-12-06 09:44:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SBT [2009-10-17 16:53:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2008-05-19 13:42:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2007-09-10 17:07:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems [2007-05-24 17:17:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\ABBYY [2008-10-08 08:02:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Adobe [2007-05-26 20:51:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\AdobeUM [2007-09-06 16:17:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Ahead [2008-05-05 10:31:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Alawar [2007-06-26 18:52:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\ArcSoft [2009-06-10 17:56:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\avidemux [2009-10-01 09:25:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\BESTplayer [2008-05-07 17:00:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Big Fish Games [2007-09-06 18:41:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\CyberLink [2009-11-18 16:32:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\dvdcss [2007-05-10 21:09:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\FUJIFILM [2007-05-08 07:16:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Gadu-Gadu [2008-06-13 12:40:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\GameHouse [2007-05-21 18:27:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Help [2007-05-04 21:46:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Identities [2009-02-05 20:24:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Incredible Ink [2007-05-16 19:03:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Jasc Software Inc [2009-09-17 13:07:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Macromedia [2009-02-03 20:37:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Malwarebytes [2008-02-15 20:57:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Media Player Classic [2008-06-24 18:51:55 | 00,000,000 | --SD | M] -- C:\Documents and Settings\x\Dane aplikacji\Microsoft [2007-05-07 20:35:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Microsoft Web Folders [2009-05-07 15:19:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\MobileAction [2008-12-05 15:25:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Mozilla [2009-06-19 08:58:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Opera [2008-02-15 20:58:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Real [2008-08-03 14:36:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Skype [2008-08-28 12:43:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Sun [2007-09-06 12:01:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\SUPERAntiSpyware.com [2007-05-07 19:29:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Talkback [2008-01-04 10:48:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\TC PowerPack [2009-10-20 18:23:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Thinstall [2007-06-22 08:56:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Thunderbird [2009-01-28 16:24:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\U3 [2009-11-25 10:31:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\vlc [2009-09-23 11:44:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\VSO [2007-12-12 18:00:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Winamp [2008-12-27 22:51:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Winamp5 [2001-07-21 23:17:50 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini [2009-11-25 11:01:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT [color=#E56717]========== Purity Check ==========[/color] < End of report >

Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 25 Lis 2009, 12:17

Wyczyszczone

W ramach sprzątania wykonać:

Pobierz program OTC
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Wciśnij przycisk Clean Up!
Na pytanie "Begin cleanup Process?" wciśnij Yes.
Jeśli padnie prośba o restart - zgódź się.

Pobierz program TFC
Zamknij wszystkie otwarte programy - inaczej TFC zrobi to za Ciebie
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij przycisk Start
Czyszczenie lokalizacji tymczasowych może chwilę potrwać (ale znowu bez przesady), uzbrój się w cierpliwość.
Jeśli padnie prośba o restart - zgódź się.

Czyszczenie punktów przywracania systemu jest konieczne, ponieważ w backupach Windowsa znajdują się także kopie szkodników.

Wyłączenie przywracania systemu
- Na pulpicie => prawoklik na Mój Komputer
- opcja Właściwości
- zakładka Przywracanie systemu
- Zaznaczyć opcję Wyłącz przywracanie systemu
- Kliknąć Zastosuj, a potem OK.
Zrestartować komputer!
Włączanie przywracania systemu
- Na pulpicie => prawoklik na Mój Komputer
- opcja Właściwości
- zakładka Przywracanie systemu
- Odznaczyć opcję Wyłącz przywracanie systemu
- Kliknąć Zastosuj, a potem OK.

Autor postu otrzymał pochwałę

**Posty:** 250 · przez **tenzin** 25 Lis 2009, 12:31

Dziękuję!