Coraz bardziej spowolniona praca komputera

**Posty:** 3 · przez **Aga1887** 06 Sie 2010, 10:06

Domyslam sie ze problem dosc typowy, jednak licze na indywidualne podejscie do sprawy

Wszystko smigalo jak nalezy, ale od jakiegos czasu co raz bardziej scinaja mi sie programy, wszystko wolniej sie wlacza i niekiedy zawiesza.. W sumie innych charakterystycznych objawow nie jestem w stanie wymienic poza szeroko pojeta spowolniona praca komputera.
Bardzo prosze o przeanalizowanie logow podanych nizej i w ramach mozliwosci wskazowki ku rozwiazaniu problemu krok po kroku

Log z GMERa

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-08-06 10:00:26 Windows 6.1.7600 Running: gmer.exe; Driver: C:\Users\Andrzej\AppData\Local\Temp\pxldrpow.sys ---- System - GMER 1.0.15 ---- INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A29AF8 INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A29104 INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A293F4 INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A11FB4 INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A291DC INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A29958 INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A296F8 INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A29F2C INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82A2A1A8 ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82A89579 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82AADF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text peauth.sys 9808AC9D 28 Bytes [1E, 02, 6A, CA, D4, BD, DF, ...] .text peauth.sys 9808ACC1 28 Bytes [1E, 02, 6A, CA, D4, BD, DF, ...] PAGE peauth.sys 9809102C 102 Bytes [41, DF, 15, 73, 70, BD, 86, ...] PAGE spsys.sys!?SPRevision@@3PADA + 4F90 9944A000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, ...] PAGE spsys.sys!?SPRevision@@3PADA + 50B3 9944A123 629 Bytes [55, 44, 99, FE, 05, 34, 55, ...] PAGE spsys.sys!?SPRevision@@3PADA + 5329 9944A399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, ...] PAGE spsys.sys!?SPRevision@@3PADA + 538F 9944A3FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, ...] PAGE spsys.sys!?SPRevision@@3PADA + 543B 9944A4AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, ...] PAGE ... ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [745A250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [745A2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74585624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [745856E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [74598573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74594D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [745950CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [745951A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [745966D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [745982CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74598819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7459907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7459E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1772] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74594C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6bd516c1 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6bd516c1@001ca4663057 0x26 0x29 0x23 0xC6 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6bd516c1@001fcc2f9ddd 0xB0 0x01 0xD0 0x6B ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6bd516c1@001d287a2cb2 0xF0 0x90 0x38 0x95 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6bd516c1 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6bd516c1@001ca4663057 0x26 0x29 0x23 0xC6 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6bd516c1@001fcc2f9ddd 0xB0 0x01 0xD0 0x6B ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6bd516c1@001d287a2cb2 0xF0 0x90 0x38 0x95 ... ---- EOF - GMER 1.0.15 ----

Oraz logi z OTL

Kod: Zaznacz wszystko: OTL logfile created on: 8/6/2010 9:54:26 AM - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Andrzej\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 83.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 48.83 Gb Total Space | 11.03 Gb Free Space | 22.60% Space Free | Partition Type: NTFS Drive D: | 62.96 Gb Total Space | 21.52 Gb Free Space | 34.18% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: AGA Current User Name: Andrzej Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010/08/06 09:52:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.com PRC - [2010/08/06 09:34:16 | 000,293,376 | ---- | M] () -- C:\Users\Andrzej\Desktop\gmer.exe PRC - [2009/09/12 14:26:02 | 000,092,672 | ---- | M] () -- C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvs32.exe PRC - [2009/08/31 18:07:34 | 011,391,592 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe PRC - [2009/08/31 16:56:26 | 000,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2009/08/28 13:13:02 | 000,832,808 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009/07/14 03:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sppsvc.exe PRC - [2009/07/14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Windows Defender\MpCmdRun.exe PRC - [2009/07/14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2001/08/24 20:00:00 | 000,036,352 | --S- | M] (Microsoft Corporation) -- C:\Windows\svchost.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010/08/06 09:52:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.com MOD - [2009/07/14 03:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll MOD - [2009/07/14 03:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll MOD - [2009/07/14 03:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll MOD - [2009/07/14 03:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll MOD - [2009/07/14 03:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll MOD - [2009/07/14 03:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll MOD - [2009/07/14 03:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll MOD - [2009/07/14 03:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll MOD - [2009/07/14 03:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx MOD - [2009/07/14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009/07/14 03:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc) SRV - [2009/07/14 03:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc) SRV - [2009/07/14 03:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power) SRV - [2009/07/14 03:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes) SRV - [2009/07/14 03:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify) SRV - [2009/07/14 03:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper) SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009/07/14 03:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc) SRV - [2009/07/14 03:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc) SRV - [2009/07/14 03:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider) SRV - [2009/07/14 03:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg) SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009/07/14 03:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener) SRV - [2009/07/14 03:15:31 | 000,396,288 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS) SRV - [2009/07/14 03:15:31 | 000,396,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2009/07/14 03:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009/07/14 03:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp) SRV - [2009/07/14 03:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc) SRV - [2009/07/14 03:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC) SRV - [2009/07/14 03:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) Instalator formantów ActiveX (AxInstSV) SRV - [2009/07/14 03:14:53 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2009/07/14 03:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc) SRV - [2009/07/14 03:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\sppsvc.exe -- (sppsvc) SRV - [2009/04/02 12:47:04 | 000,234,888 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe -- (ASKUpgrade) SRV - [2001/08/24 20:00:00 | 000,036,352 | --S- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\svchost.exe -- (PowerManager) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\XDva294.sys -- (XDva294) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2009/09/23 10:41:58 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2009/07/14 03:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide) DRV - [2009/07/14 03:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci) DRV - [2009/07/14 03:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx) DRV - [2009/07/14 03:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs) DRV - [2009/07/14 03:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320) DRV - [2009/07/14 03:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas) DRV - [2009/07/14 03:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata) DRV - [2009/07/14 03:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc) DRV - [2009/07/14 03:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata) DRV - [2009/07/14 03:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide) DRV - [2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor) DRV - [2009/07/14 03:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid) DRV - [2009/07/14 03:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960) DRV - [2009/07/14 03:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS) DRV - [2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV) DRV - [2009/07/14 03:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR) DRV - [2009/07/14 03:20:36 | 000,133,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg) DRV - [2009/07/14 03:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI) DRV - [2009/07/14 03:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC) DRV - [2009/07/14 03:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2) DRV - [2009/07/14 03:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp) DRV - [2009/07/14 03:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas) DRV - [2009/07/14 03:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy) DRV - [2009/07/14 03:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor) DRV - [2009/07/14 03:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx) DRV - [2009/07/14 03:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD) DRV - [2009/07/14 03:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends) DRV - [2009/07/14 03:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid) DRV - [2009/07/14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus) DRV - [2009/07/14 03:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp) DRV - [2009/07/14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt) DRV - [2009/07/14 03:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot) DRV - [2009/07/14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc) DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount) DRV - [2009/07/14 03:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide) DRV - [2009/07/14 03:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300) DRV - [2009/07/14 03:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost) DRV - [2009/07/14 03:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx) DRV - [2009/07/14 03:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4) DRV - [2009/07/14 03:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw) DRV - [2009/07/14 03:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2) DRV - [2009/07/14 03:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor) DRV - [2009/07/14 03:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG) DRV - [2009/07/14 02:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2009/07/14 02:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus) DRV - [2009/07/14 02:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP) DRV - [2009/07/14 01:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2) DRV - [2009/07/14 01:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf) DRV - [2009/07/14 01:53:36 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\loop.sys -- (msloop) DRV - [2009/07/14 01:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap) DRV - [2009/07/14 01:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus) DRV - [2009/07/14 01:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\1394ohci.sys -- (1394ohci) DRV - [2009/07/14 01:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass) DRV - [2009/07/14 01:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf) DRV - [2009/07/14 01:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig) DRV - [2009/07/14 01:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus) DRV - [2009/07/14 01:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID) DRV - [2009/07/14 01:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter) DRV - [2009/07/14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap) DRV - [2009/07/14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID) DRV - [2009/07/14 01:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache) DRV - [2009/07/14 01:19:21 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HidBatt.sys -- (HidBatt) DRV - [2009/07/14 01:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi) DRV - [2009/07/14 01:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM) DRV - [2009/07/14 00:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2009/07/14 00:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm) DRV - [2009/07/14 00:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer) DRV - [2009/07/14 00:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm) DRV - [2009/07/14 00:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo) DRV - [2009/07/14 00:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp) DRV - [2009/07/14 00:13:45 | 001,068,032 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2009/07/14 00:02:53 | 000,311,296 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7) DRV - [2009/07/14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R) DRV - [2009/07/14 00:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x) DRV - [2009/07/14 00:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv) DRV - [2009/07/14 00:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv) DRV - [2009/06/16 18:28:22 | 004,756,992 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx) DRV - [2007/04/03 13:57:48 | 000,108,680 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s116mdm.sys -- (s116mdm) DRV - [2007/04/03 13:57:48 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s116mdfl.sys -- (s116mdfl) DRV - [2007/04/03 13:57:42 | 000,083,336 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1929981632-972166767-2900681583-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1929981632-972166767-2900681583-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http= [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/29 10:06:27 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/29 10:06:27 | 000,000,000 | ---D | M] [2009/09/13 15:44:30 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\mozilla\Extensions [2010/08/04 15:36:26 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\mozilla\Firefox\Profiles\iv0n659h.default\extensions [2009/09/13 21:29:20 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Andrzej\AppData\Roaming\mozilla\Firefox\Profiles\iv0n659h.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2009/09/28 16:15:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Andrzej\AppData\Roaming\mozilla\Firefox\Profiles\iv0n659h.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2010/08/05 22:44:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/06/17 03:30:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010/06/17 03:29:48 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010/07/29 10:06:23 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010/07/29 10:06:23 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010/07/29 10:06:23 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010/07/29 10:06:23 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010/07/29 10:06:23 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010/07/29 10:06:23 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKU\S-1-5-21-1929981632-972166767-2900681583-1000..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvs32.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O13 - gopher Prefix: missing O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.150 10.0.0.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010/08/06 09:52:53 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.com [2010/08/06 09:36:49 | 000,916,976 | ---- | C] (Duplex Secure Ltd.) -- C:\Users\Andrzej\Desktop\SPTDinst-v162-x86.exe [2010/08/06 09:33:41 | 000,605,184 | ---- | C] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.exe [2010/08/06 09:23:47 | 000,000,000 | ---D | C] -- C:\Users\Andrzej\AppData\Roaming\Malwarebytes [2010/08/06 09:23:36 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/08/06 09:23:35 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/08/06 09:23:35 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/08/06 09:23:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010/08/06 09:20:39 | 006,189,704 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Andrzej\Desktop\mbam-setup-1.46_[www.programosy.pl].exe [2010/08/05 22:49:24 | 000,000,000 | ---D | C] -- C:\Program Files\SkanerOnline [2010/07/27 16:06:18 | 000,000,000 | ---D | C] -- C:\Users\Andrzej\Desktop\Downloads [2010/07/27 16:06:16 | 000,000,000 | ---D | C] -- C:\Users\Andrzej\AppData\Roaming\GetRightToGo [2010/07/27 16:06:11 | 000,397,912 | ---- | C] (Digital River, Inc.) -- C:\Users\Andrzej\Desktop\Download StudioPlusTE10.6.0.3835 now.exe [2010/07/23 12:27:33 | 272,993,000 | ---- | C] (Microsoft Corporation) -- C:\Users\Andrzej\Desktop\WindowsXP-KB835935-SP2-PLK.exe [2010/07/20 20:52:00 | 000,000,000 | ---D | C] -- C:\Users\Andrzej\Desktop\AvalonKlient [2010/07/20 20:51:46 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010/08/06 09:55:23 | 001,835,008 | -HS- | M] () -- C:\Users\Andrzej\ntuser.dat [2010/08/06 09:52:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.com [2010/08/06 09:41:30 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010/08/06 09:41:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010/08/06 09:41:22 | 2408,144,896 | -HS- | M] () -- C:\hiberfil.sys [2010/08/06 09:40:41 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010/08/06 09:40:41 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010/08/06 09:40:36 | 011,681,093 | -H-- | M] () -- C:\Users\Andrzej\AppData\Local\IconCache.db [2010/08/06 09:36:51 | 000,916,976 | ---- | M] (Duplex Secure Ltd.) -- C:\Users\Andrzej\Desktop\SPTDinst-v162-x86.exe [2010/08/06 09:34:16 | 000,293,376 | ---- | M] () -- C:\Users\Andrzej\Desktop\gmer.exe [2010/08/06 09:33:41 | 000,605,184 | ---- | M] (OldTimer Tools) -- C:\Users\Andrzej\Desktop\OTL.exe [2010/08/06 09:20:55 | 006,189,704 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Andrzej\Desktop\mbam-setup-1.46_[www.programosy.pl].exe [2010/07/31 22:02:02 | 000,320,699 | ---- | M] () -- C:\Users\Andrzej\Desktop\DSC00281.JPG [2010/07/30 22:31:51 | 001,638,561 | ---- | M] () -- C:\Users\Andrzej\Desktop\he.jpg [2010/07/27 16:06:11 | 000,397,912 | ---- | M] (Digital River, Inc.) -- C:\Users\Andrzej\Desktop\Download StudioPlusTE10.6.0.3835 now.exe [2010/07/23 12:50:09 | 272,993,000 | ---- | M] (Microsoft Corporation) -- C:\Users\Andrzej\Desktop\WindowsXP-KB835935-SP2-PLK.exe [2010/07/23 01:29:23 | 002,708,862 | ---- | M] () -- C:\Users\Andrzej\Desktop\IMG_0038.JPG [2010/07/22 13:56:22 | 000,010,660 | ---- | M] () -- C:\Users\Andrzej\Documents\Task1.tsk [2010/07/20 20:50:07 | 001,117,409 | ---- | M] () -- C:\Users\Andrzej\Desktop\7z915.exe [2010/07/20 20:50:05 | 018,322,386 | ---- | M] () -- C:\Users\Andrzej\Desktop\avalonklient_www.przeklej.pl.7z [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010/08/06 09:34:16 | 000,293,376 | ---- | C] () -- C:\Users\Andrzej\Desktop\gmer.exe [2010/07/31 22:01:55 | 000,320,699 | ---- | C] () -- C:\Users\Andrzej\Desktop\DSC00281.JPG [2010/07/30 22:31:50 | 001,638,561 | ---- | C] () -- C:\Users\Andrzej\Desktop\he.jpg [2010/07/23 01:26:38 | 002,708,862 | ---- | C] () -- C:\Users\Andrzej\Desktop\IMG_0038.JPG [2010/07/22 13:56:22 | 000,010,660 | ---- | C] () -- C:\Users\Andrzej\Documents\Task1.tsk [2010/07/20 20:50:07 | 001,117,409 | ---- | C] () -- C:\Users\Andrzej\Desktop\7z915.exe [2010/07/20 20:49:16 | 018,322,386 | ---- | C] () -- C:\Users\Andrzej\Desktop\avalonklient_www.przeklej.pl.7z [2010/05/28 02:04:46 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll [2009/09/30 19:44:00 | 000,000,412 | ---- | C] () -- C:\Windows\ODBC.INI [2009/09/12 14:26:02 | 000,035,328 | ---- | C] () -- C:\Windows\ina32.dll [2009/09/11 18:19:44 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll [2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2003/04/08 11:40:22 | 000,005,679 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI [color=#E56717]========== LOP Check ==========[/color] [2010/02/21 15:06:38 | 000,000,000 | -HSD | M] -- C:\Users\Andrzej\AppData\Roaming\.# [2010/06/29 18:48:30 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\BESTplayer [2010/06/09 15:13:48 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\Dev-Cpp [2009/09/17 10:15:14 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\DMCache [2010/07/28 00:50:23 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\GetRightToGo [2010/05/04 06:24:32 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\ipla [2010/04/03 18:33:30 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\Nowe Gadu-Gadu [2009/09/28 20:25:18 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\OpenFM [2009/09/25 20:08:41 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\Opera [2010/01/25 15:33:25 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\Shira [2010/04/08 12:26:01 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\TeamViewer [2010/02/14 19:18:01 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\Tibia [2009/09/28 17:48:15 | 000,000,000 | ---D | M] -- C:\Users\Andrzej\AppData\Roaming\uTorrent [2010/07/19 14:37:43 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:4EE74317 < End of report >

Kod: Zaznacz wszystko: OTL Extras logfile created on: 8/6/2010 9:54:26 AM - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Andrzej\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 83.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 48.83 Gb Total Space | 11.03 Gb Free Space | 22.60% Space Free | Partition Type: NTFS Drive D: | 62.96 Gb Total Space | 21.52 Gb Free Space | 34.18% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: AGA Current User Name: Andrzej Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{2085F05D-24C5-4E27-B7B4-A51DE890FFC9}" = Opera 10.00 "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6 "{AC76BA86-7AD7-1045-7B44-A91000000001}" = Adobe Reader 9.1 - Polish "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "7-Zip" = 7-Zip 9.15 beta "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Ask Toolbar_is1" = Ask Toolbar "Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2) "Happyland Adventures - Xmas Edition_is1" = Happyland Adventures - Xmas Edition v1.3 "HDMI" = Intel(R) Graphics Media Accelerator Driver "HijackThis" = HijackThis 2.0.2 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "MKV Minimum Set (LD-Anime) - MatroskaSplitter & VSFilter_is1" = Matroska Pack - Lazy Man's MKV 0.9.9 "Mozilla Firefox (3.6.7)" = Mozilla Firefox (3.6.7) "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "Picasa 3" = Picasa 3 "SkanerOnline" = mks_vir - online scanner "Tasker_is1" = Tasker version 3.13 "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "Tibia Auto" = NSIS Example2 "Tibia_is1" = Tibia "TVWiz" = Intel(R) TV Wizard "uTorrent" = µTorrent "WinRAR archiver" = Archiwizator WinRAR "Xfire" = Xfire (remove only) [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1929981632-972166767-2900681583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 7/13/2010 6:30:12 AM | Computer Name = Aga | Source = Application Error | ID = 1000 Description = Nazwa aplikacji powodującej błąd: javaw.exe, wersja: 6.0.200.2, sygnatura czasowa: 0x3b866bf0 Nazwa modułu powodującego błąd: unknown, wersja: 0.0.0.0, sygnatura czasowa: 0x00000000 Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0xffffffff Identyfikator procesu powodującego błąd: 0x13a8 Godzina uruchomienia aplikacji powodującej błąd: 0x01cb22765f3f1e35 Ścieżka aplikacji powodującej błąd: C:\Program Files\Java\jre6\bin\javaw.exe Ścieżka modułu powodującego błąd: unknown Identyfikator raportu: 9dad14d4-8e69-11df-a4bb-001a6bd516c1 Error - 7/18/2010 2:04:37 PM | Computer Name = Aga | Source = Application Error | ID = 1000 Description = Nazwa aplikacji powodującej błąd: firefox.exe, wersja: 1.9.2.3743, sygnatura czasowa: 0x3b866bf0 Nazwa modułu powodującego błąd: ntdll.dll, wersja: 6.1.7600.16385, sygnatura czasowa: 0x4a5bdadb Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00055b44 Identyfikator procesu powodującego błąd: 0xc60 Godzina uruchomienia aplikacji powodującej błąd: 0x01cb26a3aeecdd71 Ścieżka aplikacji powodującej błąd: C:\Program Files\Mozilla Firefox\firefox.exe Ścieżka modułu powodującego błąd: C:\Windows\SYSTEM32\ntdll.dll Identyfikator raportu: ecdc04fd-9296-11df-a698-001a6bd516c1 Error - 7/20/2010 2:05:33 PM | Computer Name = Aga | Source = Application Error | ID = 1000 Description = Nazwa aplikacji powodującej błąd: javaw.exe, wersja: 6.0.200.2, sygnatura czasowa: 0x3b866bf0 Nazwa modułu powodującego błąd: unknown, wersja: 0.0.0.0, sygnatura czasowa: 0x00000000 Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0xffffffff Identyfikator procesu powodującego błąd: 0xec8 Godzina uruchomienia aplikacji powodującej błąd: 0x01cb283624b435db Ścieżka aplikacji powodującej błąd: C:\Program Files\Java\jre6\bin\javaw.exe Ścieżka modułu powodującego błąd: unknown Identyfikator raportu: 6340dec1-9429-11df-aa6d-001a6bd516c1 Error - 7/27/2010 6:30:10 AM | Computer Name = Aga | Source = Application Error | ID = 1000 Description = Nazwa aplikacji powodującej błąd: javaw.exe, wersja: 6.0.200.2, sygnatura czasowa: 0x3b866bf0 Nazwa modułu powodującego błąd: unknown, wersja: 0.0.0.0, sygnatura czasowa: 0x00000000 Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0xffffffff Identyfikator procesu powodującego błąd: 0x780 Godzina uruchomienia aplikacji powodującej błąd: 0x01cb2d76afc7645d Ścieżka aplikacji powodującej błąd: C:\Program Files\Java\jre6\bin\javaw.exe Ścieżka modułu powodującego błąd: unknown Identyfikator raportu: ee85139e-9969-11df-a95a-001a6bd516c1 Error - 7/27/2010 10:15:46 AM | Computer Name = Aga | Source = Microsoft-Windows-CAPI2 | ID = 4107 Description = Nie można wyodrębnić listy głównej innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. . Error - 7/30/2010 6:01:45 AM | Computer Name = Aga | Source = Application Hang | ID = 1002 Description = Program gg.exe w wersji 8.0.0.9453 zatrzymał interakcję z systemem Windows i został zamknięty. Aby zobaczyć, czy jest dostępnych więcej informacji dotyczących tego problemu, sprawdź historię problemu w panelu sterowania Centrum akcji. Identyfikator procesu: 990 Godzina rozpoczęcia: 01cb2fbb0bd2344a Godzina zakończenia: 13 Ścieżka aplikacji: C:\Program Files\Nowe Gadu-Gadu\gg.exe Identyfikator raportu: 5e65677b-9bc1-11df-a803-001a6bd516c1 Error - 7/31/2010 7:04:57 AM | Computer Name = Aga | Source = Microsoft-Windows-CAPI2 | ID = 4107 Description = Nie można wyodrębnić listy głównej innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. . Error - 7/31/2010 4:03:06 PM | Computer Name = Aga | Source = Microsoft-Windows-CAPI2 | ID = 4107 Description = Nie można wyodrębnić listy głównej innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. . Error - 8/3/2010 6:30:11 AM | Computer Name = Aga | Source = Application Error | ID = 1000 Description = Nazwa aplikacji powodującej błąd: javaw.exe, wersja: 6.0.200.2, sygnatura czasowa: 0x3b866bf0 Nazwa modułu powodującego błąd: unknown, wersja: 0.0.0.0, sygnatura czasowa: 0x00000000 Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0xffffffff Identyfikator procesu powodującego błąd: 0xed4 Godzina uruchomienia aplikacji powodującej błąd: 0x01cb32f6d9bcede9 Ścieżka aplikacji powodującej błąd: C:\Program Files\Java\jre6\bin\javaw.exe Ścieżka modułu powodującego błąd: unknown Identyfikator raportu: 17c26f81-9eea-11df-a526-001a6bd516c1 Error - 8/6/2010 3:37:10 AM | Computer Name = Aga | Source = VSS | ID = 8194 Description = [ System Events ] Error - 8/5/2010 4:30:14 PM | Computer Name = Aga | Source = Service Control Manager | ID = 7031 Description = Usługa Net.Tcp Port Sharing Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 120000 milisekund zostanie podjęta następująca czynność korekcyjna: Restart the service. Error - 8/5/2010 4:31:09 PM | Computer Name = Aga | Source = Service Control Manager | ID = 7031 Description = Usługa Windows Media Player Network Sharing Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 30000 milisekund zostanie podjęta następująca czynność korekcyjna: Restart the service. Error - 8/5/2010 4:31:24 PM | Computer Name = Aga | Source = Service Control Manager | ID = 7031 Description = Usługa Software Protection niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 120000 milisekund zostanie podjęta następująca czynność korekcyjna: Restart the service. Error - 8/5/2010 4:33:15 PM | Computer Name = Aga | Source = Service Control Manager | ID = 7031 Description = Usługa Windows Search niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 30000 milisekund zostanie podjęta następująca czynność korekcyjna: Restart the service. Error - 8/5/2010 4:37:36 PM | Computer Name = Aga | Source = APPHOSTSVC | ID = 9010 Description = Error - 8/5/2010 4:52:15 PM | Computer Name = Aga | Source = APPHOSTSVC | ID = 9010 Description = Error - 8/6/2010 2:48:45 AM | Computer Name = Aga | Source = APPHOSTSVC | ID = 9010 Description = Error - 8/6/2010 3:38:36 AM | Computer Name = Aga | Source = APPHOSTSVC | ID = 9010 Description = Error - 8/6/2010 3:40:42 AM | Computer Name = Aga | Source = Service Control Manager | ID = 7023 Description = Usługa Windows Defender zakończyła działanie; wystąpił następujący błąd: %%-2147024882 Error - 8/6/2010 3:41:32 AM | Computer Name = Aga | Source = APPHOSTSVC | ID = 9010 Description = < End of report >

**Posty:** 2183 · przez **NieWiem** 06 Sie 2010, 13:30

Cześć.

Zamknij wszystko nad czym aktualnie pracujesz, także wyłącz swój program antywirusowy, zaporę, programy antyspyware. To ważne. Jak to zrobić, opisane tutaj.

Pamiętaj także o wyinstalowaniu wirtualnych napędów i usunięciu ich sterownika: klik

Pobierz ComboFixa od sUBs'a:
stąd lub stąd

ZANIM UŻYJESZ - Przeczytaj dokładnie jego instrukcję:
http://www.bleepingcomputer.com/combofix/pl/instrukcja-uzycia-combofix

Zalecam instalowanie Konsoli Odzyskiwania (XP, 2000), lub zaopatrzenie się w płytę WinRE (Vista, Se7en). Mimo wszystko ComboFix nie jest doskonały.

Przeklej na forum wyniki pracy narzędzia. Będą automatycznie otwarte w notatniku, znajdziesz je także w pliku C:\ComboFix.txt

**Posty:** 3 · przez **Aga1887** 06 Sie 2010, 14:01

Wyniki pracy ComboFixa:

Kod: Zaznacz wszystko: ComboFix 10-08-05.06 - Andrzej 2010-08-06 13:45:43.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1250.48.1033.18.3062.2285 [GMT 2:00] Uruchomiony z: c:\users\Andrzej\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR c:\program files\myglobalsearch\bar\Cache\002AC0F2 c:\program files\myglobalsearch\bar\Cache\002AC538 c:\program files\myglobalsearch\bar\Cache\002AC73B.bin c:\program files\myglobalsearch\bar\Cache\002AC900.bin c:\program files\myglobalsearch\bar\Cache\002ACA77.bin c:\program files\myglobalsearch\bar\History\search c:\program files\myglobalsearch\bar\Settings\prevcfg.htm c:\users\Andrzej\AppData\Roaming\.# c:\users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvs32.exe c:\windows\ina32.dll c:\windows\svchost.exe c:\windows\system\svchost.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_PowerManager ((((((((((((((((((((((((( Pliki utworzone od 2010-07-06 do 2010-08-06 ))))))))))))))))))))))))))))))) . 2010-08-06 11:50 . 2010-08-06 11:52 -------- d-----w- c:\users\Andrzej\AppData\Local\temp 2010-08-06 11:50 . 2010-08-06 11:50 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-08-06 07:23 . 2010-08-06 07:23 -------- d-----w- c:\users\Andrzej\AppData\Roaming\Malwarebytes 2010-08-06 07:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-06 07:23 . 2010-08-06 07:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-06 07:23 . 2010-08-06 07:23 -------- d-----w- c:\programdata\Malwarebytes 2010-08-06 07:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-05 20:49 . 2010-08-05 21:14 -------- d-----w- c:\program files\SkanerOnline 2010-07-27 14:06 . 2010-07-27 22:50 -------- d-----w- c:\users\Andrzej\AppData\Roaming\GetRightToGo 2010-07-20 18:51 . 2010-07-20 18:51 -------- d-----w- c:\program files\7-Zip . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-05 20:44 . 2009-09-12 14:45 -------- d-----w- c:\programdata\Skype 2010-08-05 20:43 . 2010-01-07 20:50 -------- d-----w- c:\program files\Left4Dead 2010-08-05 20:42 . 2009-10-18 16:50 -------- d-----w- c:\program files\HyCam2 2010-07-10 07:12 . 2010-06-18 13:30 -------- d-----w- c:\users\Andrzej\AppData\Roaming\Xfire 2010-07-05 17:07 . 2009-09-11 15:47 752770 ----a-w- c:\windows\system32\perfh015.dat 2010-07-05 17:07 . 2009-09-11 15:47 158130 ----a-w- c:\windows\system32\perfc015.dat 2010-07-03 21:16 . 2010-06-18 13:30 -------- d-----w- c:\programdata\Xfire 2010-06-29 16:48 . 2009-11-14 14:42 -------- d-----w- c:\users\Andrzej\AppData\Roaming\BESTplayer 2010-06-18 13:30 . 2010-06-18 13:30 -------- d-----w- c:\program files\Xfire 2010-06-17 01:30 . 2010-06-17 01:30 -------- d-----w- c:\program files\Common Files\Java 2010-06-17 01:29 . 2010-06-17 01:14 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-06-17 01:29 . 2010-06-17 01:29 -------- d-----w- c:\program files\Java 2010-06-09 13:13 . 2010-02-24 19:22 -------- d-----w- c:\users\Andrzej\AppData\Roaming\Dev-Cpp 2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr 2010-05-28 00:04 . 2010-05-28 00:04 41872 ----a-w- c:\windows\system32\xfcodec.dll 2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-08-31 11391592] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-16 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-16 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-16 150552] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-02-18 09:43 284392 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe R3 XDva294;XDva294;c:\windows\system32\XDva294.sys [x] R4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-04-02 234888] R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [x] S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyServer = http= IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Andrzej\AppData\Roaming\Mozilla\Firefox\Profiles\iv0n659h.default\ FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\users\Andrzej\AppData\Roaming\Nowe Gadu-Gadu\_userdata\npgg.1.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-IPLA! - c:\program files\ipla\ipla.exe MSConfigStartUp-Konnekt - c:\program files\Konnekt\konnekt.exe MSConfigStartUp-SightSpeed - c:\program files\SightSpeed\SightSpeed.exe . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe c:\windows\system32\taskhost.exe c:\windows\system32\WUDFHost.exe c:\windows\System32\rundll32.exe c:\windows\system32\sppsvc.exe c:\windows\system32\conhost.exe c:\windows\system32\igfxsrvc.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Czas ukończenia: 2010-08-06 13:56:39 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-08-06 11:56 Przed: 12 963 004 416 bajtów wolnych Po: 13 759 676 416 bajtów wolnych - - End Of File - - 7AF3D92D549925F0C388FC2B94C5DF45

**Posty:** 2183 · przez **NieWiem** 06 Sie 2010, 14:58

No niestety nie mam dobrych wiadomości. Na Twoim komputerze zagościła infekcja w plikach wykonywalnych Hidrag. Jest to polimorficzny wirus, którego usunąć bardzo ciężko.

Prostszym rozwiązaniem byłby format, walka może nie być skuteczna. Niemniej spróbować chyba warto.

Pobierz Dr Web Cure It
mirror

Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij Scan żeby odpalić szybkie skanowanie, w wyskakującym okienku wciśnij OK.
Jeśli coś zostanie znalezione, kliknij Yes żeby wyleczyć/usunąć.
Po szybkim skanowaniu wybierz opcję Complete Scan.
Po prawej stronie kliknij zieloną strzałkę.
Jeśli zostaniesz poproszony w trakcie skanowania, kliknij Yes to all (automatyczne leczenie i/lub usuwanie).
Ten skan może trwać bardzo długo - zalecam, żeby odpalić go na noc, zostawiając komputer włączonym!
Po ukończeniu skanowania, wybierz Menu File => Save Report list.
Plik zapisz na pulpicie. Będzie nazywał się DrWeb.cvs
Zrestartuj komputer - to bardzo ważne, ponieważ Dr Web niektóre pliki będzie mógł wyleczyć/usunąć dopiero po restarcie!
Za pomocą notatnika otwórz plik DrWeb.csv i wklej jego zawartość na forum w znacznikach [code] na forum, albo na stronie http://www.wklej.org, a w poście daj tylko linka.

**Posty:** 3 · przez **Aga1887** 07 Sie 2010, 01:04

Przypuszczam ze jedynym wyjsciem zostaje format, ale wrzuce jeszcze log z dr web cure it

Kod: Zaznacz wszystko: Proces w pamięci: C:\Windows\svchost.exe:2392;;Win32.HLLP.Jeefo.32356;Zniszczony.; igxpun.exe;C:\Windows\system32;Win32.HLLP.Jeefo.36352;Wyleczony.; javaw.exe;C:\Windows\system32;Win32.HLLP.Jeefo.36352;Wyleczony.; javaws.exe;C:\Windows\system32;Win32.HLLP.Jeefo.36352;Wyleczony.; TVWizudlg.exe;C:\Windows\system32;Win32.HLLP.Jeefo.36352;Wyleczony.; fsquirt.exe;C:\Windows\system32\DriverStore\FileRepository\bth.inf_x86_neutral_e9873718d5894498;Win32.HLLP.Jeefo.36352;Wyleczony.; hkcmd.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; igfxcfg.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; igfxext.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; igfxpers.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; igfxsrvc.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; igfxtray.exe;C:\Windows\system32\DriverStore\FileRepository\igdlh.inf_x86_neutral_356b676dc697d8eb;Win32.HLLP.Jeefo.36352;Wyleczony.; NPSWF32_FlashUtil.exe;C:\Windows\system32\Macromed\Flash;Win32.HLLP.Jeefo.36352;Wyleczony.; firefox.exe;c:\program files\mozilla firefox;Win32.HLLP.Jeefo.36352;Wyleczony.; svchost.exe;c:\windows;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; DellInfo.exe;C:\dell\drivers\R127811\Apps;Win32.HLLP.Jeefo.36352;Wyleczony.; iProInst.exe;C:\dell\drivers\R127811\Apps;Win32.HLLP.Jeefo.36352;Wyleczony.; iconvrtr.exe;C:\dell\drivers\R127811\Apps\iProData;Win32.HLLP.Jeefo.36352;Wyleczony.; DPInst.exe;C:\dell\drivers\R127811\Drivers;Win32.HLLP.Jeefo.36352;Wyleczony.; iProDifX.exe;C:\dell\drivers\R127811\Drivers;Win32.HLLP.Jeefo.36352;Wyleczony.; devcpp.exe;C:\Dev-Cpp;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; Packman.exe;C:\Dev-Cpp;Win32.HLLP.Jeefo.36352;Wyleczony.; GoogleUpdateSetup.exe;C:\Documents and Settings\Andrzej\AppData\Local\Application Data\Apps\2.0\BH9PDA78.996\0BXHR5OE.85P\clic...exe_9a8dfcd080ccb114;Win32.HLLP.Jeefo.36352;Wyleczony.; f_000786\hasteMuDupe.exe;C:\Documents and Settings\Andrzej\AppData\Local\Application Data\Google\Chrome\User Data\Default\Cache\f_000786;Trojan.Shark.809;; f_000786;C:\Documents and Settings\Andrzej\AppData\Local\Application Data\Google\Chrome\User Data\Default\Cache;Archiwum zawierające zainfekowane obiekty;Przeniesiony.; 7z915.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; ComboFix.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; devcpp-4.9.9.2_setup.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; Download StudioPlusTE10.6.0.3835 now.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; gmer.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; happy_install.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; happy_installxmas.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; mbam-setup-1.46_[www.programosy.pl].exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; OTL.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; SPTDinst-v162-x86.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; vlc-1.1.0-win32.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.0.11159-to-3.3.2.11403-enGB-patch.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; xfire_installer_42784.exe;C:\Documents and Settings\Andrzej\Desktop;Win32.HLLP.Jeefo.36352;Wyleczony.; Avalon.exe;C:\Documents and Settings\Andrzej\Desktop\AvalonKlient;Win32.HLLP.Jeefo.36352;Wyleczony.; Hello.exe;C:\Documents and Settings\Andrzej\Desktop\C;Trojan.KillFiles.2676;Niewyleczalny.Przeniesiony.; cs16full_v7.exe;C:\Documents and Settings\Andrzej\Desktop\CS;Win32.HLLP.Jeefo.36352;Wyleczony.; cs16patch_full_V23.exe;C:\Documents and Settings\Andrzej\Desktop\CS;Win32.HLLP.Jeefo.36352;Wyleczony.; cs16patch_full_v23x.exe;C:\Documents and Settings\Andrzej\Desktop\CS;Win32.HLLP.Jeefo.36352;Wyleczony.; StudioPlusTE10.6.0.3835.exe;C:\Documents and Settings\Andrzej\Desktop\Downloads;Win32.HLLP.Jeefo.36352;Wyleczony.; AdbeRdr910_pl_PL.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; cs16full_v7.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; HJTInstall.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; iplasetup.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; pity2009ngsetup.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; putty.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; tibia852.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; tibia854.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; tibiasoft_com_tibia841.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; ts2_client_rc2_2032.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; TXCSetup_1StableRC1.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; ventrilo-2.1.4-Windows-i386.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; ventrilo-3.0.5-Windows-i386.exe;C:\Documents and Settings\Andrzej\Desktop\instalki itp;Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003;Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia_8.50_tibia.pl.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\Agnieszka;Win32.HLLP.Jeefo.36352;Wyleczony.; UOSU.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\Agnieszka\Photo\na plytke\uosu;Win32.HLLP.Jeefo.36352;Wyleczony.; tibia840.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\Agnieszka\z pc\Nowy folder (4);Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\owc10;Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\owc11;Win32.HLLP.Jeefo.36352;Wyleczony.; dw20.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\files\pfiles\common\msshared\dw;Win32.HLLP.Jeefo.36352;Wyleczony.; msde2ks3.exe;C:\Documents and Settings\Andrzej\Desktop\Microsoft_office_2003\Microsoft office 2003\msde2000;Win32.HLLP.Jeefo.36352;Wyleczony.; Fell.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Lemuria.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia41.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia85.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; tibiasoft_com_TibiaAutoSetup_1_20_1.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia_8.50_tibia.pl.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; Twilight.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland;Win32.HLLP.Jeefo.36352;Wyleczony.; loader.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland\ElfBot albania;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland\ElfBot albania;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Documents and Settings\Andrzej\Desktop\Nimland\TibiaBot_NG\TibiaBot NG;Win32.HLLP.Jeefo.36352;Wyleczony.; Shira9.exe;C:\Documents and Settings\Andrzej\Desktop\Shira_Klient;Win32.HLLP.Jeefo.36352;Wyleczony.; UOSU.exe;C:\Documents and Settings\Andrzej\Desktop\UOSU;Win32.HLLP.Jeefo.36352;Wyleczony.; devcpp.exe;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; f_000786\hasteMuDupe.exe;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine\f_000786;Trojan.Shark.809;; f_000786;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine;Archiwum zawierające zainfekowane obiekty;Przeniesiony.; Hello.exe;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine;Trojan.KillFiles.2676;Niewyleczalny.Przeniesiony.; OTL.exe;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; svchost.exe;C:\Documents and Settings\Andrzej\DoctorWeb\Quarantine;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; nowegg.exe;C:\Documents and Settings\Andrzej\Downloads;Win32.HLLP.Jeefo.36352;Wyleczony.; 7zFM.exe;C:\Program Files\7-Zip;Win32.HLLP.Jeefo.36352;Wyleczony.; 7zG.exe;C:\Program Files\7-Zip;Win32.HLLP.Jeefo.36352;Wyleczony.; A3DUtility.exe;C:\Program Files\Adobe\Reader 9.0\Reader;Win32.HLLP.Jeefo.36352;Wyleczony.; AcroBroker.exe;C:\Program Files\Adobe\Reader 9.0\Reader;Win32.HLLP.Jeefo.36352;Wyleczony.; AcroRd32.exe;C:\Program Files\Adobe\Reader 9.0\Reader;Win32.HLLP.Jeefo.36352;Wyleczony.; AdobeCollabSync.exe;C:\Program Files\Adobe\Reader 9.0\Reader;Win32.HLLP.Jeefo.36352;Wyleczony.; Setup.exe;C:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1045-7B44-A91000000001};Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Program Files\AskBarDis;Win32.HLLP.Jeefo.36352;Wyleczony.; Adobe_Updater.exe;C:\Program Files\Common Files\Adobe\Updater6;Win32.HLLP.Jeefo.36352;Wyleczony.; jaureg.exe;C:\Program Files\Common Files\Java\Java Update;Win32.HLLP.Jeefo.36352;Wyleczony.; jucheck.exe;C:\Program Files\Common Files\Java\Java Update;Win32.HLLP.Jeefo.36352;Wyleczony.; jusched.exe;C:\Program Files\Common Files\Java\Java Update;Win32.HLLP.Jeefo.36352;Wyleczony.; DW20.EXE;C:\Program Files\Common Files\microsoft shared\DW;Win32.HLLP.Jeefo.36352;Wyleczony.; MSPVIEW.EXE;C:\Program Files\Common Files\microsoft shared\MODI\11.0;Win32.HLLP.Jeefo.36352;Wyleczony.; OINFOP11.EXE;C:\Program Files\Common Files\microsoft shared\MSInfo;Win32.HLLP.Jeefo.36352;Wyleczony.; CNFNOT32.EXE;C:\Program Files\Common Files\System\MSMAPI\1045;Win32.HLLP.Jeefo.36352;Wyleczony.; hlds.exe;C:\Program Files\CS;Win32.HLLP.Jeefo.36352;Wyleczony.; hltv.exe;C:\Program Files\CS;Win32.HLLP.Jeefo.36352;Wyleczony.; moviethumb.exe;C:\Program Files\Google\Picasa3;Win32.HLLP.Jeefo.36352;Wyleczony.; Picasa3.exe;C:\Program Files\Google\Picasa3;Win32.HLLP.Jeefo.36352;Wyleczony.; PicasaUpdater.exe;C:\Program Files\Google\Picasa3;Win32.HLLP.Jeefo.36352;Wyleczony.; Uninstall.exe;C:\Program Files\Google\Picasa3;Win32.HLLP.Jeefo.36352;Wyleczony.; PicasaCD.exe;C:\Program Files\Google\Picasa3\cdautorun;Win32.HLLP.Jeefo.36352;Wyleczony.; PicasaRestore.exe;C:\Program Files\Google\Picasa3\cdautorun;Win32.HLLP.Jeefo.36352;Wyleczony.; HyCam2.exe;C:\Program Files\HyCam2;Win32.HLLP.Jeefo.36352;Wyleczony.; setup.exe;C:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9};Win32.HLLP.Jeefo.36352;Wyleczony.; TVWizard.exe;C:\Program Files\Intel\TVWiz10f;Win32.HLLP.Jeefo.36352;Wyleczony.; TvWizard2ft.exe;C:\Program Files\Intel\TVWiz2ft;Win32.HLLP.Jeefo.36352;Wyleczony.; javaw.exe;C:\Program Files\Java\jre6\bin;Win32.HLLP.Jeefo.36352;Wyleczony.; javaws.exe;C:\Program Files\Java\jre6\bin;Win32.HLLP.Jeefo.36352;Wyleczony.; mbam.exe;C:\Program Files\Malwarebytes' Anti-Malware;Win32.HLLP.Jeefo.36352;Wyleczony.; mbamgui.exe;C:\Program Files\Malwarebytes' Anti-Malware;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Program Files\Malwarebytes' Anti-Malware;Win32.HLLP.Jeefo.36352;Wyleczony.; FreeCell.exe;C:\Program Files\Microsoft Games\FreeCell;Win32.HLLP.Jeefo.36352;Wyleczony.; Hearts.exe;C:\Program Files\Microsoft Games\Hearts;Win32.HLLP.Jeefo.36352;Wyleczony.; Mahjong.exe;C:\Program Files\Microsoft Games\Mahjong;Win32.HLLP.Jeefo.36352;Wyleczony.; MineSweeper.exe;C:\Program Files\Microsoft Games\Minesweeper;Win32.HLLP.Jeefo.36352;Wyleczony.; PurblePlace.exe;C:\Program Files\Microsoft Games\Purble Place;Win32.HLLP.Jeefo.36352;Wyleczony.; Solitaire.exe;C:\Program Files\Microsoft Games\Solitaire;Win32.HLLP.Jeefo.36352;Wyleczony.; SpiderSolitaire.exe;C:\Program Files\Microsoft Games\SpiderSolitaire;Win32.HLLP.Jeefo.36352;Wyleczony.; GRAPH.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; INFOPATH.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; MSACCESS.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; MSTORDB.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; MSTORE.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; OIS.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; OUTLOOK.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; POWERPNT.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; PPTVIEW.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; PROFLWIZ.EXE;C:\Program Files\Microsoft Office\OFFICE11;Win32.HLLP.Jeefo.36352;Wyleczony.; crashreporter.exe;C:\Program Files\Mozilla Firefox;Win32.HLLP.Jeefo.36352;Wyleczony.; updater.exe;C:\Program Files\Mozilla Firefox;Win32.HLLP.Jeefo.36352;Wyleczony.; helper.exe;C:\Program Files\Mozilla Firefox\uninstall;Win32.HLLP.Jeefo.36352;Wyleczony.; open-fm.exe;C:\Program Files\Nowe Gadu-Gadu;Win32.HLLP.Jeefo.36352;Wyleczony.; Uninstall.exe;C:\Program Files\Nowe Gadu-Gadu;Win32.HLLP.Jeefo.36352;Wyleczony.; Tasker.exe;C:\Program Files\Tasker;Win32.HLLP.Jeefo.36352;Wyleczony.; TeamSpeak.exe;C:\Program Files\Teamspeak2_RC2;Win32.HLLP.Jeefo.36352;Wyleczony.; Patch.exe;C:\Program Files\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia.exe;C:\Program Files\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Program Files\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; tibiaauto.exe;C:\Program Files\Tibia Auto;Win32.HLLP.Jeefo.36352;Wyleczony.; HijackThis.exe;C:\Program Files\Trend Micro\HijackThis;Win32.HLLP.Jeefo.36352;Wyleczony.; uTorrent.exe;C:\Program Files\uTorrent;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; Ventrilo.exe;C:\Program Files\Ventrilo;Win32.HLLP.Jeefo.36352;Wyleczony.; Uninstall.exe;C:\Program Files\WinRAR;Win32.HLLP.Jeefo.36352;Wyleczony.; WinRAR.exe;C:\Program Files\WinRAR;Win32.HLLP.Jeefo.36352;Wyleczony.; xfencoder.exe;C:\Program Files\Xfire;Win32.HLLP.Jeefo.36352;Wyleczony.; Xfire.exe;C:\Program Files\Xfire;Win32.HLLP.Jeefo.36352;Wyleczony.; ina32.dll.vir;C:\Qoobox\Quarantine\C\Windows;Trojan.Siggen.11347;Niewyleczalny.Przeniesiony.; svchost.exe.vir;C:\Qoobox\Quarantine\C\Windows;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; svchost.exe.vir;C:\Qoobox\Quarantine\C\Windows\system;Win32.HLLP.Jeefo.36352;Wyleczony.; svchost.exe.vir;C:\Qoobox\Quarantine\C\Windows\system;Trojan.PWS.Tibia.297;Usunięty.; Patch.exe;C:\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia.exe;C:\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Tibia;Win32.HLLP.Jeefo.36352;Wyleczony.; Patch.exe;C:\Tibia8.41;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia41.exe;C:\Tibia8.41;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Tibia8.41;Win32.HLLP.Jeefo.36352;Wyleczony.; Patch.exe;C:\Tibia8.5;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia.exe;C:\Tibia8.5;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Tibia8.5;Win32.HLLP.Jeefo.36352;Wyleczony.; Patch.exe;C:\Tibia8.54;Win32.HLLP.Jeefo.36352;Wyleczony.; Tibia.exe;C:\Tibia8.54;Win32.HLLP.Jeefo.36352;Wyleczony.; unins000.exe;C:\Tibia8.54;Win32.HLLP.Jeefo.36352;Wyleczony.; Shira9.exe;C:\Tibia8.54\Shira_Klient;Win32.HLLP.Jeefo.36352;Wyleczony.; multithread.exe;C:\Windows;Win32.HLLP.Jeefo.36352;Wyleczony.; multithread.exe;C:\Windows;Trojan.PWS.Tibia.297;Usunięty.; services.exe;C:\Windows\ERDNT\cache;Win32.HLLP.Jeefo.36352;Wyleczony.; winlogon.exe;C:\Windows\ERDNT\cache;Win32.HLLP.Jeefo.36352;Wyleczony.; ERDNT.EXE;C:\Windows\ERDNT\Hiv-backup;Win32.HLLP.Jeefo.36352;Wyleczony.; ERDNT.EXE;C:\Windows\ERDNT\subs;Win32.HLLP.Jeefo.36352;Wyleczony.; DW20.EXE;D:\MSOCache\All Users\90000415-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\DW;Win32.HLLP.Jeefo.36352;Wyleczony.; BackgroundDownloader.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; BNUpdate.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; Launcher.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; Repair.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; Wow.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; WowError.exe;D:\WoW 3.3.2;Win32.HLLP.Jeefo.36352;Wyleczony.; ultimateleveling_guide_portal.exe;D:\WoW 3.3.2\Interface\AddOns;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.0.1-to-3.0.2-enGB-Win-Update-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.0.9767-to-3.1.1.9806-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.0.9767-to-3.1.1.9806-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.1.9806-to-3.1.1.9835-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.1.9806-to-3.1.1.9835-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.1.9835-to-3.1.2.9901-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.1.9835-to-3.1.2.9901-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.2.9901-to-3.1.3.9947-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.1.2.9901-to-3.1.3.9947-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.2.0-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; WoW-3.2.0.10192-to-3.3.0.10958-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.0.10958-to-3.3.0.11159-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.0.11159-to-3.3.2.11403-enGB-patch.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.2.11403-to-3.3.3.11685-enGB-downloader.exe;D:\WoW 3.3.2\Nowy folder;Win32.HLLP.Jeefo.36352;Wyleczony.; Blizzard Updater.exe;D:\WoW 3.3.2\Patches\WoW-3.0.9-to-3.1.0-enGB-Win-patch;Win32.HLLP.Jeefo.36352;Wyleczony.; Updater.exe;D:\WoW 3.3.2\Updates\WoW-3.0.1-to-3.0.2-Update;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.2.0-enGB-patch.exe;D:\z pendriva\patche;Win32.HLLP.Jeefo.36352;Niewyleczalny.Przeniesiony.; WoW-3.2.0.10192-to-3.3.0.10958-enGB-patch.exe;D:\z pendriva\patche;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.0.10958-to-3.3.0.11159-enGB-patch.exe;D:\z pendriva\patche;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.0.11159-to-3.3.2.11403-enGB-patch.exe;D:\z pendriva\patche;Win32.HLLP.Jeefo.36352;Wyleczony.; WoW-3.3.2.11403-to-3.3.3.11685-enGB-downloader.exe;D:\z pendriva\patche;Win32.HLLP.Jeefo.36352;Wyleczony.; comment.htt\vbscript.1;D:\z pendriva\skany\comment.htt;Trojan.AppActXComp;; comment.htt;D:\z pendriva\skany;Kontener zawiera zainfekowane obiekty;Przeniesiony.; skany.exe;D:\z pendriva\skany;Win32.HLLM.Xgray.3;Niewyleczalny.Przeniesiony.; 2010-04 (kwi).exe;D:\z pendriva\skany\2010-04 (kwi);Win32.HLLM.Xgray.3;Niewyleczalny.Przeniesiony.; comment.htt\vbscript.1;D:\z pendriva\skany\2010-04 (kwi)\comment.htt;Trojan.AppActXComp;; comment.htt;D:\z pendriva\skany\2010-04 (kwi);Kontener zawiera zainfekowane obiekty;Przeniesiony.;

**Posty:** 18165 · przez **wojtas** 07 Sie 2010, 18:42

najszybciej by było zrobić format, jeśli chcesz walczyć to skanuj do tego czasu aż Web nic nie będzie znajdował i daj nowy log