przez m-daria 14 Gru 2009, 20:03
przez m-daria 15 Gru 2009, 07:39
#
OTL logfile created on: 2009-12-14 19:27:47 - Run 5
#
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Documents and Settings\Microsoft XP\Pulpit
#
Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
#
Internet Explorer (Version = 6.0.2900.5512)
#
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
#
#
1023,48 Mb Total Physical Memory | 457,37 Mb Available Physical Memory | 44,69% Memory free
#
2,40 Gb Paging File | 1,83 Gb Available in Paging File | 76,21% Paging File free
#
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
#
#
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
#
Drive C: | 136,71 Gb Total Space | 30,87 Gb Free Space | 22,58% Space Free | Partition Type: NTFS
#
Drive D: | 49,59 Gb Total Space | 5,03 Gb Free Space | 10,14% Space Free | Partition Type: NTFS
#
Drive E: | 575,11 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
#
F: Drive not present or media not loaded
#
G: Drive not present or media not loaded
#
H: Drive not present or media not loaded
#
I: Drive not present or media not loaded
#
#
Computer Name: MICROSOFT
#
Current User Name: Microsoft XP
#
Logged in as Administrator.
#
#
Current Boot Mode: Normal
#
Scan Mode: Current user
#
Company Name Whitelist: Off
#
Skip Microsoft Files: Off
#
File Age = 30 Days
#
Output = Standard
#
#
[color=#E56717]========== Processes (SafeList) ==========[/color]
#
#
PRC - [2009-12-14 19:27:30 | 00,538,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Microsoft XP\Pulpit\OTL.exe
#
PRC - [2009-11-07 14:35:59 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
#
PRC - [2009-08-17 17:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
#
PRC - [2009-08-17 17:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
#
PRC - [2009-08-17 17:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
#
PRC - [2009-08-17 16:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
#
PRC - [2009-07-25 04:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
#
PRC - [2009-04-03 17:11:48 | 00,408,424 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
#
PRC - [2008-04-14 18:21:16 | 00,977,408 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
#
PRC - [2007-10-10 06:29:14 | 01,250,816 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\winamp.exe
#
PRC - [2007-07-09 08:39:12 | 02,119,104 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
#
PRC - [2007-07-02 16:10:58 | 23,237,416 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe
#
PRC - [2007-07-02 16:10:58 | 01,928,136 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe
#
PRC - [2007-03-18 23:05:02 | 00,630,784 | ---- | M] () -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
#
PRC - [2006-10-22 12:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
#
PRC - [2005-09-30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
#
PRC - [2002-01-29 12:33:14 | 00,077,824 | ---- | M] () -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
#
PRC - [2001-10-25 01:02:00 | 00,090,112 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
#
#
#
[color=#E56717]========== Modules (SafeList) ==========[/color]
#
#
MOD - [2009-12-14 19:27:30 | 00,538,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Microsoft XP\Pulpit\OTL.exe
#
MOD - [2007-03-18 23:04:22 | 00,069,632 | ---- | M] () -- C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
#
MOD - [2006-12-21 13:30:44 | 00,102,400 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\ggwhook.dll
#
#
#
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
#
#
SRV - File not found [Auto | Stopped] -- -- (StyleXPService)
#
SRV - [2009-08-17 17:07:17 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
#
SRV - [2009-08-17 17:07:01 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
#
SRV - [2009-08-17 17:04:21 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
#
SRV - [2009-08-17 16:58:55 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
#
SRV - [2009-07-25 04:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
#
SRV - [2008-11-04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
#
SRV - [2008-10-25 10:44:08 | 00,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
#
SRV - [2006-10-26 12:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
#
SRV - [2006-10-22 12:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
#
SRV - [2005-09-30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
#
SRV - [2003-05-16 17:59:35 | 00,266,240 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\hpdj -- (hpdj)
#
SRV - [2002-01-29 12:33:14 | 00,077,824 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)
#
SRV - [2001-10-25 01:02:00 | 00,090,112 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)
#
#
#
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
#
#
DRV - [2009-08-17 17:06:43 | 00,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
#
DRV - [2009-08-17 17:05:52 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
#
DRV - [2009-08-17 17:05:37 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
#
DRV - [2009-08-17 17:04:40 | 00,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
#
DRV - [2009-08-17 17:04:29 | 00,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
#
DRV - [2009-08-17 17:03:21 | 00,026,944 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
#
DRV - [2009-08-14 20:54:07 | 00,227,344 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
#
DRV - [2008-04-13 19:45:36 | 00,026,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser)
#
DRV - [2008-04-13 17:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
#
DRV - [2008-03-13 17:02:46 | 00,026,640 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klfltdev.sys -- (KLFLTDEV)
#
DRV - [2008-01-29 16:29:38 | 00,032,784 | ---- | M] (Kaspersky Lab) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg)
#
DRV - [2007-11-13 11:25:55 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
#
DRV - [2007-03-20 22:28:42 | 00,047,360 | ---- | M] (VSO Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin)
#
DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
#
DRV - [2006-11-03 23:45:48 | 00,178,913 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\V0260Vid.sys -- (V0260VID)
#
DRV - [2006-10-22 12:22:00 | 03,994,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
#
DRV - [2006-09-18 08:59:00 | 00,250,240 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
#
DRV - [2006-07-24 09:15:04 | 04,353,024 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
#
DRV - [2006-06-14 06:56:00 | 00,012,288 | R--- | M] (ASUSTeK Computer Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\EIO.sys -- (EIO)
#
DRV - [2006-03-02 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
#
DRV - [2004-08-22 16:31:48 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt)
#
DRV - [2004-08-22 16:31:10 | 00,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus)
#
#
#
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
#
#
#
[color=#E56717]========== Internet Explorer ==========[/color]
#
#
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
#
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
#
#
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
#
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
#
#
[color=#E56717]========== FireFox ==========[/color]
#
#
FF - prefs.js..browser.startup.homepage: "http://www.onet.pl"
#
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
#
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.4
#
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
#
#
#
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-09 22:37:49 | 00,000,000 | ---D | M]
#
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-11-07 14:36:06 | 00,000,000 | ---D | M]
#
#
[2008-09-17 22:34:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\Mozilla\Extensions
#
[2009-12-14 14:45:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\Mozilla\Firefox\Profiles\rrdercqs.default\extensions
#
[2009-10-30 09:22:47 | 00,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\Mozilla\Firefox\Profiles\rrdercqs.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
#
[2009-11-25 10:22:15 | 00,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\Mozilla\Firefox\Profiles\rrdercqs.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
#
[2009-12-14 14:45:57 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
#
[2008-01-23 07:20:30 | 00,491,520 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
#
[2006-12-04 23:11:32 | 00,049,152 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
#
[2007-12-11 09:07:00 | 00,307,200 | ---- | M] (ESKA) -- C:\Program Files\Mozilla Firefox\plugins\npOggX.dll
#
[2009-08-24 20:19:13 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
#
[2009-08-24 20:19:13 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
#
[2009-08-24 20:19:13 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
#
[2009-08-24 20:19:13 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
#
[2009-08-24 20:19:13 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
#
[2009-08-24 20:19:13 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml
#
#
O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
#
O1 - Hosts: 127.0.0.1 localhost
#
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Microsoft XP\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.)
#
O4 - HKCU..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.)
#
O4 - HKCU..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.)
#
O4 - HKCU..\Run: [PowerBar] File not found
#
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
#
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
#
O4 - Startup: C:\Documents and Settings\Microsoft XP\Menu Start\Programy\Autostart\RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe ()
#
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
#
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
#
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
#
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
#
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
#
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
#
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
#
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
#
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
#
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
#
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
#
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
#
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
#
O15 - HKCU\..Trusted Domains: gadu-gadu.pl ([www] https in Zaufane witryny)
#
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] https in Zaufane witryny)
#
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
#
O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} http://www.eska.pl/streamplayers/OggX.ocx (OggX Control)
#
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1172769361156 (WUWebControl Class)
#
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
#
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
#
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
#
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
#
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
#
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab (Creative Software AutoUpdate Support Package)
#
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.62 192.168.0.1
#
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
#
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
#
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
#
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
#
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
#
O20 - HKLM Winlogon: UserInit - (\\.\globalroot\systemroot\system32\userinit.exe) - \\.\globalroot\systemroot\system32\userinit.exe ()
#
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
#
O28 - HKLM ShellExecuteHooks: {88485281-8b4b-4f8d-9ede-82e29a064277} - C:\Program Files\MarkAny\ContentSafer\MACSMANAGER.dll (MarkAny Cooperation.)
#
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
#
O32 - HKLM CDRom: AutoRun - 1
#
O32 - AutoRun File - [2007-03-01 17:47:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
#
O32 - AutoRun File - [2006-03-02 13:00:00 | 00,000,112 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
#
O33 - MountPoints2\{f5929d29-c84d-11db-be0d-806d6172696f}\Shell - "" = AutoRun
#
O33 - MountPoints2\{f5929d29-c84d-11db-be0d-806d6172696f}\Shell\AutoRun\command - "" = E:\SETUP.EXE -- [2006-03-02 13:00:00 | 02,584,576 | R--- | M] (Microsoft Corporation)
#
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
#
O34 - HKLM BootExecute: (aswBoot.exe /M:35c3a4ec) - C:\WINDOWS\System32\aswBoot.exe (ALWIL Software)
#
O35 - comfile [open] -- "%1" %*
#
O35 - exefile [open] -- "%1" %*
#
#
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
#
#
[2009-12-14 19:27:28 | 00,538,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Microsoft XP\Pulpit\OTL.exe
#
[2009-12-14 18:44:38 | 00,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu
#
[2009-12-14 18:40:40 | 00,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10
#
[2009-12-14 18:36:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\Gadu-Gadu 10
#
[2009-12-14 17:51:55 | 00,000,000 | ---D | C] -- C:\Program Files\mks_vir_2007
#
[2009-12-12 19:43:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\Janis Joplin
#
[2009-12-12 19:40:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\FINANSE'
#
[2009-12-12 19:39:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\39,5
#
[2009-12-05 14:17:40 | 00,487,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp70.dll
#
[2009-12-05 14:17:39 | 00,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc70.dll
#
[2009-12-05 14:17:39 | 00,000,000 | ---D | C] -- C:\Program Files\AML Products
#
[2009-12-03 14:46:14 | 00,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages
#
[2009-12-03 14:22:11 | 00,000,000 | ---D | C] -- C:\videooutput
#
[2009-12-03 14:22:07 | 00,139,264 | ---- | C] (http://www.xvid.org) -- C:\WINDOWS\System32\xvid.ax
#
[2009-12-03 14:22:06 | 00,000,000 | ---D | C] -- C:\Program Files\Smallvideosoft
#
[2009-12-03 14:17:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\PREZENTACJA
#
[2009-12-01 18:37:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\Chirurdzy.S06E10.www.exsite.pl
#
[2009-11-29 00:17:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\H0607
#
[2009-11-26 22:44:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Microsoft XP\Pulpit\dla Koziełka
#
[2009-08-14 15:11:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft
#
[2007-11-04 14:48:51 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
#
[2007-11-04 14:48:51 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
#
[2007-04-01 20:42:02 | 06,422,611 | ---- | C] (FrostWire Group) -- C:\Program Files\frostwire-4.13.1.6.windows.exe
#
[2007-03-20 22:28:42 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\pcouffin.sys
#
[2007-03-01 17:50:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft
#
[2007-03-01 17:47:44 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft
#
[2007-03-01 17:47:44 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft
#
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
#
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
#
#
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
#
#
[2009-12-14 19:27:30 | 00,538,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Microsoft XP\Pulpit\OTL.exe
#
[2009-12-14 18:44:44 | 00,000,659 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Gadu-Gadu.lnk
#
[2009-12-14 18:35:00 | 22,600,376 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\gg10.exe
#
[2009-12-14 18:31:01 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
#
[2009-12-14 18:30:30 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
#
[2009-12-14 18:30:21 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
#
[2009-12-14 18:29:31 | 00,000,032 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
#
[2009-12-14 18:29:31 | 00,000,032 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
#
[2009-12-14 18:29:31 | 00,000,032 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
#
[2009-12-14 18:29:31 | 00,000,032 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
#
[2009-12-14 18:29:20 | 12,058,624 | -H-- | M] () -- C:\Documents and Settings\Microsoft XP\NTUSER.DAT
#
[2009-12-14 18:29:20 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\Microsoft XP\ntuser.ini
#
[2009-12-14 14:20:11 | 00,088,566 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
#
[2009-12-13 23:10:46 | 00,129,024 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
#
[2009-12-13 12:52:00 | 03,185,152 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Prezentacja1.pps
#
[2009-12-12 18:12:00 | 00,670,720 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\grafik grudzien..doc
#
[2009-12-12 10:58:15 | 00,007,416 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Desperate_Housewives_S06E10_[HDTV XviD-2HD][Torrenty.org](3).torrent
#
[2009-12-10 07:14:04 | 01,287,616 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\skanuj0001.jpg
#
[2009-12-10 03:03:22 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
#
[2009-12-08 11:44:32 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\ramka.docx
#
[2009-12-08 11:41:06 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Zarz. 4.12.doc
#
[2009-12-05 14:25:53 | 00,076,496 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
#
[2009-12-05 14:25:32 | 00,302,032 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
#
[2009-12-05 14:17:40 | 00,000,787 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\AML Free Registry Cleaner.lnk
#
[2009-12-03 18:55:56 | 00,000,992 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
#
[2009-12-03 16:17:53 | 01,203,404 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\video.flv
#
[2009-12-03 14:22:07 | 00,000,885 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Freez FLV to AVI MPEG WMV Converter.lnk
#
[2009-12-01 14:48:29 | 00,166,799 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\The Shield Complete Series (seasons 1 7) Widescreen DVDRip-()Demonoid com() 566216 3456.torrent
#
[2009-11-30 13:57:55 | 00,014,861 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Allo_Allo_-_Sezon_1_[DVDRip XviD-SIBV]_[Lektor_PL][Torrenty.org].torrent
#
[2009-11-30 10:25:06 | 00,392,192 | ---- | M] () -- C:\Documents and Settings\Microsoft XP\Pulpit\wodorowe samochody.doc
#
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
#
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
#
#
[color=#E56717]========== Files Created - No Company Name ==========[/color]
#
#
[2009-12-14 18:44:43 | 00,000,659 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Gadu-Gadu.lnk
#
[2009-12-14 18:34:34 | 22,600,376 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\gg10.exe
#
[2009-12-13 12:52:00 | 03,185,152 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Prezentacja1.pps
#
[2009-12-12 18:12:00 | 00,670,720 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\grafik grudzien..doc
#
[2009-12-12 10:58:14 | 00,007,416 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Desperate_Housewives_S06E10_[HDTV XviD-2HD][Torrenty.org](3).torrent
#
[2009-12-10 07:14:00 | 01,287,616 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\skanuj0001.jpg
#
[2009-12-08 11:44:32 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\ramka.docx
#
[2009-12-08 11:41:06 | 00,026,624 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Zarz. 4.12.doc
#
[2009-12-05 14:17:40 | 00,000,787 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\AML Free Registry Cleaner.lnk
#
[2009-12-03 18:55:56 | 00,000,992 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
#
[2009-12-03 16:17:53 | 01,203,404 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\video.flv
#
[2009-12-03 14:22:07 | 00,000,885 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Freez FLV to AVI MPEG WMV Converter.lnk
#
[2009-12-03 14:22:06 | 08,676,883 | ---- | C] () -- C:\WINDOWS\System32\NCMedia2.dll
#
[2009-12-01 14:48:29 | 00,166,799 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\The Shield Complete Series (seasons 1 7) Widescreen DVDRip-()Demonoid com() 566216 3456.torrent
#
[2009-11-30 13:57:55 | 00,014,861 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\Allo_Allo_-_Sezon_1_[DVDRip XviD-SIBV]_[Lektor_PL][Torrenty.org].torrent
#
[2009-11-30 10:21:00 | 00,392,192 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Pulpit\wodorowe samochody.doc
#
[2009-11-06 21:58:34 | 00,000,137 | ---- | C] () -- C:\WINDOWS\disney.ini
#
[2009-11-06 21:58:30 | 00,000,184 | ---- | C] () -- C:\WINDOWS\disneysy.ini
#
[2009-08-24 13:36:33 | 00,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
#
[2009-08-24 13:25:54 | 00,290,919 | ---- | C] () -- C:\WINDOWS\System32\pythoncom21.dll
#
[2009-08-24 13:25:54 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes21.dll
#
[2009-08-24 13:22:46 | 00,000,072 | R--- | C] () -- C:\WINDOWS\System32\epDPE.ini
#
[2009-08-24 13:22:45 | 00,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
#
[2009-08-24 13:21:10 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\EEBAPI.dll
#
[2009-08-24 13:21:10 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\EEBDSCVR.dll
#
[2009-08-24 13:21:10 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\EBAPI.dll
#
[2009-08-15 01:35:08 | 00,017,506 | ---- | C] () -- C:\Documents and Settings\LocalService\Dane aplikacji\fuvegovab.dl
#
[2009-08-15 01:35:08 | 00,010,531 | ---- | C] () -- C:\Documents and Settings\LocalService\Dane aplikacji\xozum.vbs
#
[2009-05-12 19:52:38 | 00,000,135 | ---- | C] () -- C:\WINDOWS\pdf2word.INI
#
[2008-06-29 15:14:25 | 00,000,065 | ---- | C] () -- C:\WINDOWS\FISHUI.INI
#
[2008-06-28 15:49:17 | 00,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
#
[2008-06-28 15:49:17 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
#
[2008-06-28 15:49:14 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
#
[2008-06-28 15:49:14 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\Ogg.dll
#
[2008-05-18 15:29:17 | 00,000,640 | ---- | C] () -- C:\WINDOWS\ODBC.INI
#
[2008-04-23 11:54:00 | 00,000,348 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
#
[2008-04-01 16:39:10 | 00,000,120 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
#
[2007-12-01 10:01:38 | 00,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
#
[2007-08-22 15:50:06 | 00,000,018 | ---- | C] () -- C:\WINDOWS\gfact.ini
#
[2007-08-22 15:49:47 | 00,000,056 | ---- | C] () -- C:\WINDOWS\Kulki.ini
#
[2007-07-19 23:50:51 | 00,000,362 | ---- | C] () -- C:\WINDOWS\naglos.INI
#
[2007-04-15 16:17:57 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\ctrldll.dll
#
[2007-03-31 14:08:15 | 00,000,486 | ---- | C] () -- C:\WINDOWS\SStylerPro.ini
#
[2007-03-24 13:38:06 | 00,001,350 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\QTSBandwidthCache
#
[2007-03-20 22:29:17 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
#
[2007-03-20 22:28:48 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\pcouffin.log
#
[2007-03-20 22:28:42 | 00,087,608 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\ezpinst.exe
#
[2007-03-20 22:28:42 | 00,007,824 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\pcouffin.cat
#
[2007-03-20 22:28:42 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Dane aplikacji\pcouffin.inf
#
[2007-03-03 13:40:28 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
#
[2007-03-03 13:16:28 | 00,129,024 | ---- | C] () -- C:\Documents and Settings\Microsoft XP\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
#
[2007-03-03 12:37:07 | 00,010,019 | ---- | C] () -- C:\WINDOWS\hpdj3600.ini
#
[2007-03-02 15:38:10 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
#
[2007-03-02 15:38:10 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
#
[2007-03-02 15:38:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
#
[2007-03-02 15:38:08 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
#
[2007-03-02 15:38:08 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
#
[2007-03-01 17:58:37 | 00,143,360 | R--- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
#
[2006-10-22 12:22:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
#
[2006-10-22 12:22:00 | 01,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
#
[2006-10-22 12:22:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
#
[2006-10-22 12:22:00 | 00,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
#
[2006-10-22 12:22:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
#
[2006-10-22 12:22:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
#
[2006-10-22 12:22:00 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
#
[2004-08-22 17:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
#
#
[color=#E56717]========== Alternate Data Streams ==========[/color]
#
#
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:9AB338B9
#
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:E25BED53
#
< End of report >
przez NieWiem 15 Gru 2009, 10:30
przez m-daria 15 Gru 2009, 19:02
przez m-daria 16 Gru 2009, 02:36
#
Malwarebytes' Anti-Malware 1.42
#
Wersja bazy definicji: 3365
#
Windows 5.1.2600 Dodatek Service Pack 3
#
Internet Explorer 6.0.2900.5512
#
#
2009-12-15 17:59:10
#
mbam-log-2009-12-15 (17-59-05).txt
#
#
Typ skanowania: Pełne skanowanie (C:\|D:\|)
#
Przeskanowane obiekty: 209774
#
Upłynęło: 1 hour(s), 20 minute(s), 38 second(s)
#
#
Zainfekowane procesy w pamięci: 0
#
Zainfekowane moduły pamięci: 0
#
Zainfekowane klucze rejestru: 0
#
Zainfekowane wartości rejestru: 0
#
Zainfekowane pliki rejestru: 0
#
Zainfekowane foldery: 0
#
Zainfekowane pliki: 1
#
#
Zainfekowane procesy w pamięci:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane moduły pamięci:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane klucze rejestru:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane wartości rejestru:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane pliki rejestru:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane foldery:
#
(Nie wykryto groźnych plików)
#
#
Zainfekowane pliki:
#
C:\System Volume Information\_restore{E9839BC8-FC85-4059-879C-0C6CFD3A4D7D}\RP97\A0015615.rbf (Trojan.Agent) -> No action taken.
przez NieWiem 16 Gru 2009, 12:18
przez m-daria 16 Gru 2009, 13:53
OOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/12/16 13:00
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name:
Image Path:
Address: 0xF73FE000 Size: 98304 File Visible: No Signed: -
Status: -
Name:
Image Path:
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF1D4D000 Size: 49152 File Visible: No Signed: -
Status: -
SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed1936b8
#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed193574
#: 045 Function Name: NtCreatePagingFile
Status: Hooked by "d347bus.sys" at address 0xf7476a20
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed193a52
#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed19314c
#: 071 Function Name: NtEnumerateKey
Status: Hooked by "d347bus.sys" at address 0xf74772a8
#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "d347bus.sys" at address 0xf7482910
#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed19364e
#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed19308c
#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed1930f0
#: 160 Function Name: NtQueryKey
Status: Hooked by "d347bus.sys" at address 0xf74772c8
#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed19376e
#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed19372e
#: 241 Function Name: NtSetSystemPowerState
Status: Hooked by "d347bus.sys" at address 0xf74820b0
#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xed1938ae
==EOF==przez NieWiem 16 Gru 2009, 14:12
przez m-daria 17 Gru 2009, 01:52
przez wojtas 17 Gru 2009, 18:26
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 15 gości