Wyskakujące okienka pod kursorem myszki na youtube

**Posty:** 11 · przez **releks** 11 Paź 2013, 23:19

Witam,

problem polega na tym, ze na stronie np youtube, gdy najezdzam kursorem na film, pojawia sie małe "okienko" z reklamą. Reklamy nie zawsze są takie same. A okienka nie są kolejnymi wyskakującymi oknami firefoksa; gdy odjadę kursorem od filmu, to znikaja.

Nie wiem czy uda się zamiescić zrzut ekranu. Oto on:

Dodano Dzisiaj, 22:26:
Coś źle kliknąłem, wiec teraz dodaję pliki z logami.

Dziękuję za pomoc.

**Posty:** 681 · przez **XMan 1** 11 Paź 2013, 23:32

Podaj linki do filmów z YT.
W dzisiejszych czasach jest wszystko oparte na reklamach - biznes...

**Posty:** 14516 · przez **ToServeAndProtect** 12 Paź 2013, 00:09

Zainstaluj AdBlock Plus. Pozbedziesz się reklam na amen

**Posty:** 4765 · przez **ordynat** 12 Paź 2013, 08:28

Dodam tylko, że w logach nie ma niczego podejrzanego.

**Posty:** 11 · przez **releks** 12 Paź 2013, 10:39

to dziwne, bo w IE ten problem nie występuje....

a w logu z gmera znajduje się taka pozycja:
"
---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys

"

ona nie jest podejrzana?

**Posty:** 4765 · przez **ordynat** 12 Paź 2013, 11:07

ona nie jest podejrzana?

Nie, nie jest podejrzana.

Autor postu otrzymał pochwałę

**Posty:** 11 · przez **releks** 13 Paź 2013, 13:58

zainstalowanie tego dodatku faktycznie pomaga - dzięki.

Niemniej uważam, ze komputer jest jakoś zainfekowany, bo na drugim kompie te reklamy nie wyskakują, a dodatku blokującego nie posiadam.

Dodano Dzisiaj, 18:17:
Przed wykonaniem logów sprawdzałem, czy nie posiadam programów Alcohol 52% i 120%, PowerISO,Active ISO Burner, Deamon Tools + plik sptd.sys - nie posiadam. Wykonałem tez poszukiwanie pliku sptd.sys programem SPTDinst - tez nie było.

Tym razem użyłem Defogger i jeszcze raz wykonałem skanowanie. Oto logi:

Gmer:

Kod: Zaznacz wszystko: GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-10-13 18:43:38 Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2080BH rev.00000029 74,53GB Running: 14i7bo1e.exe; Driver: C:\DOCUME~1\Marcin\USTAWI~1\Temp\kfrcrpow.sys ---- System - GMER 2.1 ---- SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys ZwQueryValueKey [0xA78FA1EA] ---- Kernel code sections - GMER 2.1 ---- .text ntoskrnl.exe!_abnormal_termination + 310 804E28E4 4 Bytes [EA, A1, 8F, A7] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01D20EDE .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 01D210D6 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01D21193 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01D16C62 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01D16DCA .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01D25802 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 01D1857D .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WS2_32.dll!send 71A54C27 5 Bytes JMP 01D185B5 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 01D185D6 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01D17DA0 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01D17F6F .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01D18024 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01D17F2C .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01D17FF8 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01D17D4C .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01D17FAE .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01D17E90 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[208] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01D17DF4 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00DA0EDE .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00DA10D6 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00DA1193 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00D96C62 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00D96DCA .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00D97DA0 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00D97F6F .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00D98024 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00D97F2C .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00D97FF8 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00D97D4C .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00D97FAE .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00D97E90 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00D97DF4 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00DA5802 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00D9857D .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WS2_32.dll!send 71A54C27 5 Bytes JMP 00D985B5 .text C:\Program Files\Samsung\Kies\KiesTrayAgent.exe[216] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00D985D6 .text C:\Program Files\PDF24\pdf24.exe[224] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01230EDE .text C:\Program Files\PDF24\pdf24.exe[224] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 012310D6 .text C:\Program Files\PDF24\pdf24.exe[224] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01231193 .text C:\Program Files\PDF24\pdf24.exe[224] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01226C62 .text C:\Program Files\PDF24\pdf24.exe[224] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01226DCA .text C:\Program Files\PDF24\pdf24.exe[224] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 0122857D .text C:\Program Files\PDF24\pdf24.exe[224] WS2_32.dll!send 71A54C27 5 Bytes JMP 012285B5 .text C:\Program Files\PDF24\pdf24.exe[224] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 012285D6 .text C:\Program Files\PDF24\pdf24.exe[224] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01235802 .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01227DA0 .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01227F6F .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01228024 .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01227F2C .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01227FF8 .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01227D4C .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01227FAE .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01227E90 .text C:\Program Files\PDF24\pdf24.exe[224] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01227DF4 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01A80EDE .text C:\Program Files\Microsoft Security Client\msseces.exe[408] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 01A810D6 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01A81193 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01A76C62 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01A76DCA .text C:\Program Files\Microsoft Security Client\msseces.exe[408] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01A85802 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01A77DA0 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01A77F6F .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01A78024 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01A77F2C .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01A77FF8 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01A77D4C .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01A77FAE .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01A77E90 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01A77DF4 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 01A7857D .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WS2_32.dll!send 71A54C27 5 Bytes JMP 01A785B5 .text C:\Program Files\Microsoft Security Client\msseces.exe[408] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 01A785D6 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01450EDE .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 014510D6 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01451193 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01446C62 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01446DCA .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01455802 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01447DA0 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01447F6F .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01448024 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01447F2C .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01447FF8 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01447D4C .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01447FAE .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01447E90 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01447DF4 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] ws2_32.dll!closesocket 71A53E2B 5 Bytes JMP 0144857D .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] ws2_32.dll!send 71A54C27 5 Bytes JMP 014485B5 .text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[440] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 014485D6 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00BE0EDE .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00BE10D6 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00BE1193 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00BD6C62 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00BD6DCA .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00BD7DA0 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00BD7F6F .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00BD8024 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00BD7F2C .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00BD7FF8 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00BD7D4C .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00BD7FAE .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00BD7E90 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00BD7DF4 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00BD857D .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WS2_32.dll!send 71A54C27 5 Bytes JMP 00BD85B5 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00BD85D6 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[460] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00BE5802 .text C:\WINDOWS\system32\ctfmon.exe[988] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00C00EDE .text C:\WINDOWS\system32\ctfmon.exe[988] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00C010D6 .text C:\WINDOWS\system32\ctfmon.exe[988] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00C01193 .text C:\WINDOWS\system32\ctfmon.exe[988] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00BF6C62 .text C:\WINDOWS\system32\ctfmon.exe[988] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00BF6DCA .text C:\WINDOWS\system32\ctfmon.exe[988] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00BF857D .text C:\WINDOWS\system32\ctfmon.exe[988] WS2_32.dll!send 71A54C27 5 Bytes JMP 00BF85B5 .text C:\WINDOWS\system32\ctfmon.exe[988] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00BF85D6 .text C:\WINDOWS\system32\ctfmon.exe[988] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00C05802 .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00BF7DA0 .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00BF7F6F .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00BF8024 .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00BF7F2C .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00BF7FF8 .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00BF7D4C .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00BF7FAE .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00BF7E90 .text C:\WINDOWS\system32\ctfmon.exe[988] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00BF7DF4 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 039C0EDE .text C:\Program Files\Samsung\Kies\Kies.exe[1132] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 039C10D6 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] KERNEL32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 039C1193 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 039B6C62 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 039B6DCA .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 039B857D .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WS2_32.dll!send 71A54C27 5 Bytes JMP 039B85B5 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 039B85D6 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 039C5802 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 039B7DA0 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 039B7F6F .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 039B8024 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 039B7F2C .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 039B7FF8 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 039B7D4C .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 039B7FAE .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 039B7E90 .text C:\Program Files\Samsung\Kies\Kies.exe[1132] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 039B7DF4 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] ntdll.dll!DbgBreakPoint 7C90120E 1 Byte [C3] .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01DA0EDE .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 01DA10D6 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] ntdll.dll!DbgUiRemoteBreakin 7C9520EC 5 Bytes JMP 7C9225C8 C:\WINDOWS\system32\ntdll.dll .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01DA1193 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01D96C62 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01D96DCA .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 01D9857D .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WS2_32.dll!send 71A54C27 5 Bytes JMP 01D985B5 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 01D985D6 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01D97DA0 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01D97F6F .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01D98024 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01D97F2C .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01D97FF8 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01D97D4C .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01D97FAE .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01D97E90 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01D97DF4 .text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01DA5802 .text C:\WINDOWS\Explorer.EXE[1780] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 023D0EDE .text C:\WINDOWS\Explorer.EXE[1780] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 023D10D6 .text C:\WINDOWS\Explorer.EXE[1780] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 023D1193 .text C:\WINDOWS\Explorer.EXE[1780] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 023C6C62 .text C:\WINDOWS\Explorer.EXE[1780] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 023C6DCA .text C:\WINDOWS\Explorer.EXE[1780] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 023D5802 .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 023C7DA0 .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 023C7F6F .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 023C8024 .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 023C7F2C .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 023C7FF8 .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 023C7D4C .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 023C7FAE .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 023C7E90 .text C:\WINDOWS\Explorer.EXE[1780] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 023C7DF4 .text C:\WINDOWS\Explorer.EXE[1780] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 023C857D .text C:\WINDOWS\Explorer.EXE[1780] WS2_32.dll!send 71A54C27 5 Bytes JMP 023C85B5 .text C:\WINDOWS\Explorer.EXE[1780] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 023C85D6 .text C:\WINDOWS\system32\igfxtray.exe[1928] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 011B0EDE .text C:\WINDOWS\system32\igfxtray.exe[1928] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 011B10D6 .text C:\WINDOWS\system32\igfxtray.exe[1928] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 011B1193 .text C:\WINDOWS\system32\igfxtray.exe[1928] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 011A6C62 .text C:\WINDOWS\system32\igfxtray.exe[1928] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 011A6DCA .text C:\WINDOWS\system32\igfxtray.exe[1928] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 011A857D .text C:\WINDOWS\system32\igfxtray.exe[1928] WS2_32.dll!send 71A54C27 5 Bytes JMP 011A85B5 .text C:\WINDOWS\system32\igfxtray.exe[1928] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 011A85D6 .text C:\WINDOWS\system32\igfxtray.exe[1928] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 011B5802 .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 011A7DA0 .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 011A7F6F .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 011A8024 .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 011A7F2C .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 011A7FF8 .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 011A7D4C .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 011A7FAE .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 011A7E90 .text C:\WINDOWS\system32\igfxtray.exe[1928] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 011A7DF4 .text C:\WINDOWS\system32\hkcmd.exe[1936] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 010C0EDE .text C:\WINDOWS\system32\hkcmd.exe[1936] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 010C10D6 .text C:\WINDOWS\system32\hkcmd.exe[1936] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 010C1193 .text C:\WINDOWS\system32\hkcmd.exe[1936] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 010B6C62 .text C:\WINDOWS\system32\hkcmd.exe[1936] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 010B6DCA .text C:\WINDOWS\system32\hkcmd.exe[1936] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 010B857D .text C:\WINDOWS\system32\hkcmd.exe[1936] WS2_32.dll!send 71A54C27 5 Bytes JMP 010B85B5 .text C:\WINDOWS\system32\hkcmd.exe[1936] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 010B85D6 .text C:\WINDOWS\system32\hkcmd.exe[1936] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 010C5802 .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 010B7DA0 .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 010B7F6F .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 010B8024 .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 010B7F2C .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 010B7FF8 .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 010B7D4C .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 010B7FAE .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 010B7E90 .text C:\WINDOWS\system32\hkcmd.exe[1936] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 010B7DF4 .text C:\WINDOWS\system32\igfxpers.exe[1944] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01040EDE .text C:\WINDOWS\system32\igfxpers.exe[1944] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 010410D6 .text C:\WINDOWS\system32\igfxpers.exe[1944] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 01041193 .text C:\WINDOWS\system32\igfxpers.exe[1944] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 01036C62 .text C:\WINDOWS\system32\igfxpers.exe[1944] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 01036DCA .text C:\WINDOWS\system32\igfxpers.exe[1944] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 0103857D .text C:\WINDOWS\system32\igfxpers.exe[1944] WS2_32.dll!send 71A54C27 5 Bytes JMP 010385B5 .text C:\WINDOWS\system32\igfxpers.exe[1944] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 010385D6 .text C:\WINDOWS\system32\igfxpers.exe[1944] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 01045802 .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 01037DA0 .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 01037F6F .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 01038024 .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 01037F2C .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 01037FF8 .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 01037D4C .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 01037FAE .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 01037E90 .text C:\WINDOWS\system32\igfxpers.exe[1944] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 01037DF4 .text C:\WINDOWS\SOUNDMAN.EXE[1956] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00C10EDE .text C:\WINDOWS\SOUNDMAN.EXE[1956] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00C110D6 .text C:\WINDOWS\SOUNDMAN.EXE[1956] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00C11193 .text C:\WINDOWS\SOUNDMAN.EXE[1956] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00C06C62 .text C:\WINDOWS\SOUNDMAN.EXE[1956] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00C06DCA .text C:\WINDOWS\SOUNDMAN.EXE[1956] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00C15802 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00C0857D .text C:\WINDOWS\SOUNDMAN.EXE[1956] WS2_32.dll!send 71A54C27 5 Bytes JMP 00C085B5 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00C085D6 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00C07DA0 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00C07F6F .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00C08024 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00C07F2C .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00C07FF8 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00C07D4C .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00C07FAE .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00C07E90 .text C:\WINDOWS\SOUNDMAN.EXE[1956] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00C07DF4 .text C:\WINDOWS\sm56hlpr.exe[2024] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00D30EDE .text C:\WINDOWS\sm56hlpr.exe[2024] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 00D310D6 .text C:\WINDOWS\sm56hlpr.exe[2024] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00D31193 .text C:\WINDOWS\sm56hlpr.exe[2024] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00D26C62 .text C:\WINDOWS\sm56hlpr.exe[2024] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00D26DCA .text C:\WINDOWS\sm56hlpr.exe[2024] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00D2857D .text C:\WINDOWS\sm56hlpr.exe[2024] WS2_32.dll!send 71A54C27 5 Bytes JMP 00D285B5 .text C:\WINDOWS\sm56hlpr.exe[2024] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00D285D6 .text C:\WINDOWS\sm56hlpr.exe[2024] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00D35802 .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00D27DA0 .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00D27F6F .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00D28024 .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00D27F2C .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00D27FF8 .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00D27D4C .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00D27FAE .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00D27E90 .text C:\WINDOWS\sm56hlpr.exe[2024] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00D27DF4 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00140EDE .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 001410D6 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] kernel32.dll!GetFileAttributesExW 7C81166D 5 Bytes JMP 00141193 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] USER32.dll!TranslateMessage 7E368BF6 5 Bytes JMP 00136C62 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] USER32.dll!GetClipboardData 7E380DBA 5 Bytes JMP 00136DCA .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 0013857D .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WS2_32.dll!send 71A54C27 5 Bytes JMP 001385B5 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 001385D6 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] CRYPT32.dll!PFXImportCertStore 77AE012F 5 Bytes JMP 00145802 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!HttpSendRequestA 3FD07021 5 Bytes JMP 00137DA0 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!InternetReadFile 3FD0F5EB 5 Bytes JMP 00137F6F .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!HttpQueryInfoA 3FD1182D 5 Bytes JMP 00138024 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!InternetCloseHandle 3FD12128 1 Byte [E9] .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!InternetCloseHandle 3FD12128 5 Bytes JMP 00137F2C .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!InternetQueryDataAvailable 3FD15023 5 Bytes JMP 00137FF8 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!HttpSendRequestW 3FD18B5E 5 Bytes JMP 00137D4C .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!InternetReadFileExA 3FD22C09 5 Bytes JMP 00137FAE .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!HttpSendRequestExA 3FD7ABA6 5 Bytes JMP 00137E90 .text C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe[3604] WININET.dll!HttpSendRequestExW 3FD7ABFF 5 Bytes JMP 00137DF4 ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate@LastRestorePointSetTime 2013-10-12 14:05:50 ---- Files - GMER 2.1 ---- File C:\Documents and Settings\LocalService\Cookies\XS5LWIM5.txt 72 bytes ---- EOF - GMER 2.1 ----

OTL:

Kod: Zaznacz wszystko: OTL logfile created on: 2013-10-13 18:50:11 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1007,36 Mb Total Physical Memory | 301,60 Mb Available Physical Memory | 29,94% Memory free 2,37 Gb Paging File | 1,82 Gb Available in Paging File | 76,70% Paging File free Paging file location(s): C:\pagefile.sys 1512 3024 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 74,52 Gb Total Space | 22,85 Gb Free Space | 30,66% Space Free | Partition Type: NTFS Computer Name: SUPERKOMP | User Name: Marcin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013-10-13 15:38:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe PRC - [2013-10-02 19:57:02 | 000,274,840 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2013-08-12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe PRC - [2013-08-12 10:11:20 | 000,995,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe PRC - [2013-07-24 08:05:08 | 000,182,184 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe PRC - [2013-03-28 11:32:38 | 001,106,288 | ---- | M] (Samsung) -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2013-03-28 11:32:34 | 000,310,640 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe PRC - [2013-03-28 11:32:32 | 001,511,792 | ---- | M] (Samsung) -- C:\Program Files\Samsung\Kies\Kies.exe PRC - [2013-03-20 10:07:18 | 000,233,472 | ---- | M] (Teruten) -- C:\WINDOWS\system32\FsUsbExService.Exe PRC - [2013-02-13 04:37:16 | 001,263,952 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe PRC - [2012-05-22 08:38:56 | 000,160,872 | ---- | M] (Geek Software GmbH) -- C:\Program Files\PDF24\pdf24.exe PRC - [2012-01-31 10:46:56 | 000,019,232 | ---- | M] (Autodesk, Inc.) -- C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe PRC - [2011-12-21 16:40:56 | 000,578,264 | ---- | M] (Pandora.TV) -- C:\Program Files\PANDORA.TV\PanService\PandoraService.exe PRC - [2011-05-27 16:23:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\Scrybe\Service\ScrybeUpdater.exe PRC - [2008-04-14 19:21:16 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2005-09-21 10:24:02 | 000,086,016 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SoundMan.exe PRC - [2005-08-12 11:09:32 | 000,552,960 | ---- | M] (Motorola Inc.) -- C:\WINDOWS\sm56hlpr.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013-10-09 21:45:13 | 000,611,840 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePodcast\65d680217322d5cea59b2aed5b54c0a2\DevicePodcast.ni.dll MOD - [2013-10-09 21:45:11 | 000,294,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceVideo\4f4b5d84950170c21e2653c46c1d6ac2\DeviceVideo.ni.dll MOD - [2013-10-09 21:45:10 | 000,349,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePhoto\b1de5d922aa2ec6ccaaa917399340ebf\DevicePhoto.ni.dll MOD - [2013-10-09 21:44:43 | 000,583,680 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\88444141a42c8e766e59801e479de864\Kies.Common.DeviceServiceLib.FileService.ni.dll MOD - [2013-10-09 21:44:36 | 000,701,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceCommonLib\cee65d91e5a5eb01d27b18e8e0404591\DeviceCommonLib.ni.dll MOD - [2013-10-09 21:43:43 | 001,926,656 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.UI\26bebcd8501c9d7ce97704c68ee9488c\Kies.UI.ni.dll MOD - [2013-10-02 19:56:31 | 003,279,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2013-09-03 15:54:22 | 000,300,544 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.POL MOD - [2013-08-15 08:32:38 | 017,490,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Theme\110c0e74a7c6cc65e6cb9ee4c6b859e0\Kies.Theme.ni.dll MOD - [2013-08-15 08:32:36 | 000,307,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DummyStorePlugin\89b6cc40401f6fc0f923286fd5c041d4\DummyStorePlugin.ni.dll MOD - [2013-08-15 08:32:11 | 000,232,960 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\6c2268d21092027249488bb1b5b0b75f\ASF_cSharpAPI.ni.dll MOD - [2013-08-15 08:31:19 | 000,187,904 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\842386cbc5afe62d1bc2b7d0225943f2\Kies.Common.DeviceServiceLib.Interface.ni.dll MOD - [2013-08-15 08:30:55 | 000,079,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\6dc8737ff73e1377fdfe6ee0227f9992\Kies.MVVM.ni.dll MOD - [2013-07-22 10:48:16 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\3a35d4f336b5717818b87cce642c3376\Kies.Common.DeviceServiceLib.FirmwareUpdate.FirmwareUpdateAgentHelper.ni.dll MOD - [2013-02-13 04:38:06 | 000,100,688 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2013-02-13 04:37:16 | 001,263,952 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe MOD - [2012-10-22 11:21:42 | 001,277,952 | ---- | M] () -- C:\Program Files\PANDORA.TV\PanService\avformat-53.dll MOD - [2012-07-09 17:57:30 | 002,090,496 | ---- | M] () -- C:\Program Files\PANDORA.TV\PanService\avcodec-53.dll MOD - [2012-03-23 10:07:34 | 000,224,768 | ---- | M] () -- C:\Program Files\PANDORA.TV\PanService\libupnp.dll MOD - [2011-12-06 16:19:48 | 000,133,632 | ---- | M] () -- C:\Program Files\PANDORA.TV\PanService\avutil-51.dll MOD - [2005-08-12 11:09:34 | 000,049,152 | ---- | M] () -- C:\WINDOWS\sm56cht.dll MOD - [2005-08-12 11:09:34 | 000,049,152 | ---- | M] () -- C:\WINDOWS\sm56chs.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56spn.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56itl.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56ger.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56fra.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56eng.dll MOD - [2005-08-12 11:09:32 | 000,069,632 | ---- | M] () -- C:\WINDOWS\sm56brz.dll MOD - [2005-08-12 11:09:32 | 000,053,248 | ---- | M] () -- C:\WINDOWS\sm56jpn.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013-10-09 01:39:40 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013-10-02 19:57:01 | 000,118,680 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013-08-12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2013-07-24 08:05:08 | 000,182,184 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2013-03-20 10:07:18 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\WINDOWS\system32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2013-02-28 19:09:08 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012-07-26 23:42:16 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012-01-31 10:46:56 | 000,019,232 | ---- | M] (Autodesk, Inc.) [Auto | Running] -- C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service) SRV - [2011-12-21 16:40:56 | 000,578,264 | ---- | M] (Pandora.TV) [Auto | Running] -- C:\Program Files\PANDORA.TV\PanService\PandoraService.exe -- (PanService) SRV - [2011-05-27 16:23:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) [Auto | Running] -- C:\Program Files\Synaptics\Scrybe\Service\ScrybeUpdater.exe -- (ScrybeUpdater) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\Marcin\USTAWI~1\Temp\kfrcrpow.sys -- (kfrcrpow) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2013-03-20 10:07:16 | 000,037,344 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2013-02-22 09:17:04 | 000,181,912 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudserd.sys -- (ssudserd) DRV - [2013-02-22 09:17:04 | 000,181,784 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudmdm.sys -- (ssudmdm) DRV - [2013-02-22 09:17:04 | 000,083,864 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudbus.sys -- (dg_ssudbus) DRV - [2012-11-08 19:02:18 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp) DRV - [2012-05-23 18:49:30 | 000,020,032 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dgderdrv.sys -- (dgderdrv) DRV - [2005-09-23 18:56:28 | 003,966,976 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) DRV - [2005-09-12 10:49:44 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) DRV - [2005-08-12 11:16:30 | 000,845,356 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-04 11:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKU\S-1-5-21-1417001333-789336058-725345543-1006\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1417001333-789336058-725345543-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1417001333-789336058-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.useDBForOrder: "false" FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledAddons: player%40vividas.com:4.1.3 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21 FF - prefs.js..extensions.enabledAddons: artur.dubovoy%40gmail.com:4.0.0 FF - prefs.js..extensions.enabledAddons: WebSiteRecommendation%40weliketheweb.com:1.0.6 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013-10-02 19:56:16 | 000,000,000 | ---D | M] [2012-06-15 21:41:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Extensions [2013-10-12 11:04:25 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions [2013-08-26 21:46:39 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012-09-02 08:21:18 | 000,000,000 | ---D | M] (Vividas player plugin) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions\player@vividas.com [2013-10-08 12:36:38 | 000,000,000 | ---D | M] ("WebSite Recommendation") -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions\WebSiteRecommendation@weliketheweb.com [2013-10-08 12:33:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profilesgsrn67w8.default\extensions [2013-10-08 12:33:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profilesgsrn67w8.default\extensions\staged [2013-10-04 19:32:23 | 000,333,354 | ---- | M] () (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions\artur.dubovoy@gmail.com.xpi [2013-10-12 11:04:25 | 000,915,554 | ---- | M] () (No name found) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\gsrn67w8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-02 19:56:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2013-10-02 19:56:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-10-02 19:56:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2013-10-02 19:57:03 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2012-05-31 14:25:34 | 000,190,664 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npVividasPlayer.dll O1 HOSTS File: ([2004-08-04 14:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\alcwzrd.exe (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (Autodesk, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe () O4 - HKLM..\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.) O4 - HKU\S-1-5-21-1417001333-789336058-725345543-1006..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) O4 - HKU\S-1-5-21-1417001333-789336058-725345543-1006..\Run: [{FE5AB64A-98F4-EAB1-11B8-4F4EE8AE6D4D}] C:\Documents and Settings\Marcin\Dane aplikacji\Hoyrn\ahbix.exe (KMPlayer) O4 - HKU\S-1-5-21-1417001333-789336058-725345543-1006..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) O4 - HKU\S-1-5-21-1417001333-789336058-725345543-1006..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = O7 - HKU\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 1 O7 - HKU\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 1 O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1347779373234 (MUWebControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 95.160.170.92 88.156.222.92 82.139.8.40 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A66DDDA0-8C7B-44E4-8A6E-28DFEB98A990}: DhcpNameServer = 95.160.170.92 88.156.222.92 82.139.8.40 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012-06-11 13:15:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013-10-13 15:48:23 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Marcin\Recent [2013-10-13 15:42:11 | 000,000,000 | ---D | C] -- C:\AdwCleaner [2013-10-13 15:38:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2013-10-11 19:27:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2013-10-09 14:03:34 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hidparse.sys [2013-10-09 14:03:14 | 000,060,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbaudio.sys [2013-10-09 14:03:13 | 000,123,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbvideo.sys [2013-10-09 14:01:37 | 000,005,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbd.sys [2013-10-09 14:01:36 | 000,144,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbport.sys [2013-10-09 14:01:36 | 000,030,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbehci.sys [2013-10-08 17:34:11 | 000,000,000 | ---D | C] -- C:\Program Files\LoveChess Age Of Egypt [2013-10-08 15:29:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\prosto z lasu [2013-10-07 20:32:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Ostoja [2013-10-02 19:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013-10-02 19:12:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\wesele [2013-09-15 19:55:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\extra wawa [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013-10-13 18:38:03 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013-10-13 16:31:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013-10-13 16:31:28 | 1056,362,496 | -HS- | M] () -- C:\hiberfil.sys [2013-10-13 16:13:30 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Marcin\defogger_reenable [2013-10-13 15:41:23 | 001,048,960 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\AdwCleaner.exe [2013-10-13 15:38:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2013-10-13 15:36:41 | 000,377,856 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe [2013-10-13 15:34:20 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Defogger.exe [2013-10-12 20:44:21 | 000,000,372 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\spider.sav [2013-10-12 14:47:11 | 000,346,608 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013-10-12 11:23:53 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif [2013-10-11 18:58:57 | 000,166,827 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\zrzut.JPG [2013-10-11 12:01:51 | 000,105,763 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\1385471_522165064541597_57017886_n.jpg [2013-10-10 19:38:57 | 000,059,904 | ---- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013-10-10 11:36:14 | 000,005,284 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\2013-10-09_EX1328220909407.pdf [2013-10-09 01:39:38 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2013-10-09 01:39:37 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2013-09-23 23:55:10 | 011,113,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll [2013-09-23 20:25:12 | 000,920,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll [2013-09-23 20:25:11 | 001,215,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll [2013-09-23 20:25:11 | 000,759,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll [2013-09-23 20:25:11 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll [2013-09-23 20:25:11 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll [2013-09-23 20:25:11 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll [2013-09-23 20:25:11 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll [2013-09-23 20:25:11 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll [2013-09-23 20:25:11 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll [2013-09-23 20:25:10 | 006,017,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll [2013-09-23 20:25:09 | 002,006,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll [2013-09-23 20:25:09 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl [2013-09-23 20:25:09 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl [2013-09-23 20:25:09 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll [2013-09-23 20:25:09 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll [2013-09-23 20:25:09 | 000,522,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll [2013-09-23 20:25:09 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll [2013-09-23 20:25:09 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll [2013-09-23 20:25:09 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll [2013-09-23 20:25:09 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll [2013-09-23 20:25:09 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll [2013-09-23 20:25:09 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll [2013-09-23 20:25:08 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll [2013-09-23 20:25:08 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll [2013-09-23 20:25:06 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll [2013-09-23 20:25:06 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll [2013-09-23 20:25:06 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll [2013-09-23 20:25:06 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\corpol.dll [2013-09-23 20:25:06 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\corpol.dll [2013-09-23 20:07:42 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe [2013-09-23 20:07:42 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe [2013-09-23 20:07:41 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013-10-13 16:13:30 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Marcin\defogger_reenable [2013-10-13 15:41:21 | 001,048,960 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\AdwCleaner.exe [2013-10-13 15:36:43 | 000,377,856 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\14i7bo1e.exe [2013-10-13 15:34:31 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Defogger.exe [2013-10-11 20:13:40 | 1056,362,496 | -HS- | C] () -- C:\hiberfil.sys [2013-10-11 18:58:56 | 000,166,827 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\zrzut.JPG [2013-10-11 12:01:27 | 000,105,763 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\1385471_522165064541597_57017886_n.jpg [2013-10-10 11:36:22 | 000,005,284 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\2013-10-09_EX1328220909407.pdf [2013-07-24 08:19:34 | 000,799,054 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1417001333-789336058-725345543-1006-0.dat [2013-05-04 22:21:47 | 000,308,558 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2013-04-04 20:29:42 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll [2013-04-04 20:29:42 | 000,037,344 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys [2012-07-26 21:54:24 | 000,000,147 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft.SqlServer.Compact.351.32.bc [2012-07-22 22:01:07 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012-07-19 19:02:44 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll [2012-07-08 09:41:53 | 000,000,034 | ---- | C] () -- C:\WINDOWS\iltwain.ini [2012-06-17 17:30:47 | 000,059,904 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012-06-11 19:29:02 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012-06-11 14:54:08 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2012-06-11 14:52:47 | 000,346,608 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012-06-11 13:42:59 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2012-06-11 13:42:59 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2012-06-11 13:40:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2012-06-11 13:40:57 | 000,053,248 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2012-06-11 13:40:57 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2012-06-11 13:40:57 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2012-06-11 13:23:43 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2012-06-11 13:19:14 | 000,001,112 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2012-06-11 13:12:57 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2012-05-23 18:49:34 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe [2012-05-23 18:49:32 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll [2012-05-23 18:49:32 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll [2012-05-23 18:49:32 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll [2012-05-23 18:49:32 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2012-06-11 13:34:10 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2012-02-28 20:49:56 | 001,510,400 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009-02-09 12:53:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-14 19:20:57 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2012-11-08 22:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\TuneUp Software [2012-08-17 00:08:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\.Beniamin [2012-07-27 00:06:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk [2012-11-04 12:28:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVG [2012-07-28 14:05:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Common Files [2012-08-12 23:02:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2012-12-03 22:43:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\MFAData [2012-06-18 21:31:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Samsung [2012-06-15 23:43:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Synaptics [2012-07-27 00:15:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2012-11-04 12:26:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F} [2012-11-08 22:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\TuneUp Software [2012-07-27 00:06:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Autodesk [2012-11-04 12:27:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\AVG [2013-07-01 22:06:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\foobar2000 [2012-08-12 23:10:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Gadu-Gadu 10 [2013-07-27 08:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Hoyrn [2012-07-08 09:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\InterTrust [2013-08-03 06:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Leaw [2012-07-07 20:52:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\OpenOffice.ux.pl [2013-07-22 13:27:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Samsung [2012-06-15 23:42:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Synaptics [2012-11-04 11:32:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\TuneUp Software [2013-10-10 19:20:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\uTorrent [2013-02-01 18:18:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Windows Search [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:A1EDB939 @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:D1B5B4F1 < End of report >

Extras:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2013-10-13 18:50:11 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1007,36 Mb Total Physical Memory | 301,60 Mb Available Physical Memory | 29,94% Memory free 2,37 Gb Paging File | 1,82 Gb Available in Paging File | 76,70% Paging File free Paging file location(s): C:\pagefile.sys 1512 3024 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 74,52 Gb Total Space | 22,85 Gb Free Space | 30,66% Space Free | Partition Type: NTFS Computer Name: SUPERKOMP | User Name: Marcin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* [HKEY_USERS\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 1 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "5985:TCP" = 5985:TCP:*:Disabled:Zdalne zarządzanie systemem Windows "80:TCP" = 80:TCP:*:Disabled:Zdalne zarządzanie systemem Windows — tryb zgodności (ruch przychodzący HTTP) "50248:TCP" = 50248:TCP:*:Enabled:Autodesk Content Service [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.) "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe:*:Enabled:Gadu-Gadu 10 -- (GG Network S.A.) "C:\Program Files\AVG\AVG2013\avgmfapx.exe" = C:\Program Files\AVG\AVG2013\avgmfapx.exe:*:Enabled:Instalator AVG "C:\WINDOWS\system32\msiexec.exe" = C:\WINDOWS\system32\msiexec.exe:*:Generic Host Process -- (Microsoft Corporation) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.) "C:\WINDOWS\system32\svchost.exe" = C:\WINDOWS\system32\svchost.exe:*:Generic Host Process -- (Microsoft Corporation) "C:\Program Files\PANDORA.TV\PanService\PandoraService.exe" = C:\Program Files\PANDORA.TV\PanService\PandoraService.exe:*:Enabled:PandoraService -- (Pandora.TV) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{011B5F12-F1CB-4C14-A99E-62C55831D78A}" = OpenOffice.ux.pl 3.4 "{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}" = Autodesk Material Library 2013 "{147DFAD8-34C3-4DE1-9FCA-ACEFDE9EF810}" = Synaptics Gesture Suite featuring SYNAPTICS | Scrybe "{153DB567-6FF3-49AD-AC4F-86F8A3CCFDFB}" = Autodesk Design Review 2013 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4D24F198-A2CB-46B5-BB16-41B69C644B6C}" = Microsoft Security Client "{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3 "{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01) "{5783F2D7-B001-0000-0002-0060B0CE6BBA}" = AutoCAD 2013 - English "{5783F2D7-B001-0409-1002-0060B0CE6BBA}" = AutoCAD 2013 Language Pack - English "{5783F2D7-B001-0409-2002-0060B0CE6BBA}" = AutoCAD 2013 - English "{606E12B9-641F-4644-A22A-FF38AE980AFD}" = Autodesk Material Library Base Resolution Image Library 2013 "{62F029AB-85F2-0000-866A-9FC0DD99DDBC}" = Autodesk Content Service "{62F029AB-85F2-0001-866A-9FC0DD99DDBC}" = Autodesk Content Service Language Pack "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies "{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.6.0 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom "{AC76BA86-7AD7-1045-7B44-AA1000000001}" = Adobe Reader X (10.1.8) - Polish "{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones "{E0A160F1-127B-43AC-AF96-EBB6319B01C7}" = Google SketchUp Pro 8 "{EC3B598C-1151-4191-B5B4-A9072ADE6259}_is1" = ZipGenius 6.3 "{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}" = Autodesk Sync "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FFF5619F-2013-0032-A85E-9994F70A9E5D}" = Autodesk Inventor Fusion 2013 "4F6D5E84-5826-4394-9F40-3A9A19165651_is1" = KMP Service "Adobe Acrobat 5.0" = Adobe Acrobat 5.0 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AutoCAD 2013 - English" = AutoCAD 2013 - English "Autodesk Content Service" = Autodesk Content Service "Autodesk Design Review 2013" = Autodesk Design Review 2013 "Autodesk Inventor Fusion 2013" = Autodesk Inventor Fusion 2013 "CCleaner" = CCleaner "CDisplay_is1" = CDisplay 1.7 "DivX Setup" = DivX Setup "FastStone Image Viewer" = FastStone Image Viewer 4.6 "foobar2000" = foobar2000 v1.2.5 "Gadu-Gadu 10" = Gadu-Gadu 10 "ie8" = Windows Internet Explorer 8 "InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft Security Client" = Microsoft Security Essentials "Mozilla Firefox 24.0 (x86 pl)" = Mozilla Firefox 24.0 (x86 pl) "MozillaMaintenanceService" = Mozilla Maintenance Service "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "SMSERIAL" = Motorola SM56 Data Fax Modem "SynTPDeinstKey" = Synaptics Pointing Device Driver "The KMPlayer" = The KMPlayer (remove only) "uTorrent" = µTorrent "VLC media player" = VLC media player 2.0.5 "Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR 4.11 (32-bitowy) "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1417001333-789336058-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 2013-10-11 14:55:54 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-11 14:55:56 | Computer Name = SUPERKOMP | Source = crypt32 | ID = 131083 Description = Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. Error - 2013-10-12 02:17:14 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-12 06:10:02 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-12 08:49:54 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-12 09:25:03 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-13 09:48:35 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-13 10:18:55 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-13 10:25:48 | Computer Name = SUPERKOMP | Source = .NET Runtime | ID = 0 Description = Error - 2013-10-13 11:06:45 | Computer Name = SUPERKOMP | Source = MPSampleSubmission | ID = 5000 Description = EventType mptelemetry, P1 80070490, P2 remediation, P3 remediationfailuretelemetry, P4 1.1.9901.0, P5 mpengine, P6 0, P7 unspecified, P8 NIL, P9 NIL, P10 NIL. [ System Events ] Error - 2013-10-13 10:59:07 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 10:59:23 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:01:41 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:02:22 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:03:26 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:03:40 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:04:13 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:06:13 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 11:06:45 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2013-10-13 12:35:28 | Computer Name = SUPERKOMP | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort0 nie odpowiedziało w ramach ustalonego limitu czasu. < End of report >

**Posty:** 4765 · przez **ordynat** 14 Paź 2013, 19:31

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
O4 - HKU\S-1-5-21-1417001333-789336058-725345543-1006..\Run: [{FE5AB64A-98F4-EAB1-11B8-4F4EE8AE6D4D}] C:\Documents and Settings\Marcin\Dane aplikacji\Hoyrn\ahbix.exe (KMPlayer)
[2013-07-27 08:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Hoyrn
[2013-08-03 06:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Leaw

:Reg
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-21-1417001333-789336058-725345543-1006\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

**Posty:** 11 · przez **releks** 14 Paź 2013, 20:20

OK wykonałem,

przy czym nie uruchamiałem ponownie deffogera przed skanowaniem. Czy będę musial go jeszcze użyć, czy mozna go wywalić ? Nie trzeba ponownie włączyć tego co on wyłącza?

Zamieszczam logi:

OTL.Txt: (72.71 KiB) Ściągnięto 69 razy

Extras.Txt: (33.73 KiB) Ściągnięto 68 razy

10142013_193550.txt: (4.96 KiB) Ściągnięto 70 razy

**Posty:** 4765 · przez **ordynat** 14 Paź 2013, 20:44

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL)
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.

Nie trzeba ponownie włączyć tego co on wyłącza?

Do normalnego działania Systemu to nie jest potrzebne.

.

**Posty:** 11 · przez **releks** 14 Paź 2013, 21:13

Wszystko to wykonałem.

Pierwsze wrażenie jest takie, ze działa wszystko sprawniej.
Dzięki.

Niestety, gdy wyłączam adblocka, reklamy pokazują się znów.
Oto zrzut ekranu:

Moze to jakis wirus? (Kolega grał w budowanie jakis zamków - nie pamietam jak sie ta gra nazywa. - moze ona infekuje?)

Używam Essentiala, ale on nic nie wykrywa.

**Posty:** 4765 · przez **ordynat** 14 Paź 2013, 21:37

To na pewno nie wirus.
Strona YOUTUBE utrzymuje się z takich reklam, to normalne.
Inna sprawa, że to nie musi wyskakiwać. To kwestia ustawień.
Ale to już nie moja "działka".
.

Kto jest na forum