Czasowo zawieszający się komputer i internet

**Posty:** 653 · przez **holi12** 24 Mar 2010, 14:39

j.w. Co jakiś czas następuje totalny zamuł internetu a czasem kompa też

OTL

Kod: Zaznacz wszystko: OTL logfile created on: 2010-03-24 12:36:27 - Run 2 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dawid\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 364,00 Mb Available Physical Memory | 47,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37,26 Gb Total Space | 4,68 Gb Free Space | 12,56% Space Free | Partition Type: NTFS Drive D: | 38,34 Gb Total Space | 23,84 Gb Free Space | 62,18% Space Free | Partition Type: NTFS Drive E: | 37,26 Gb Total Space | 3,85 Gb Free Space | 10,32% Space Free | Partition Type: NTFS Drive F: | 38,34 Gb Total Space | 22,86 Gb Free Space | 59,62% Space Free | Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM-9662BB46C9A Current User Name: Dawid Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-03-24 12:34:08 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe PRC - [2010-03-18 01:43:38 | 000,835,952 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2009-07-01 17:38:40 | 001,481,056 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\winamp.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-05-28 17:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-03-24 12:34:08 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe MOD - [2006-05-03 21:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (Nero BackItUp Scheduler 4.0) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2009-03-04 11:25:12 | 000,621,056 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2007-05-28 17:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Running] -- -- (cpuxp) DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2009-06-03 20:26:29 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-05-27 20:04:19 | 000,009,216 | ---- | M] (SNEG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\FStarForce.sys -- (FStarForce) DRV - [2009-03-19 13:48:18 | 000,136,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2009-03-19 13:48:12 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2009-02-09 07:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2009-02-09 07:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2009-02-09 07:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2009-02-09 07:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008-08-26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008-04-14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008-04-13 21:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2007-12-17 17:14:06 | 000,012,400 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007-06-28 17:43:00 | 006,807,328 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006-07-24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen) DRV - [2005-07-28 08:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock) DRV - [2005-05-17 16:45:08 | 000,092,800 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus) DRV - [2005-04-06 02:22:30 | 000,012,928 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-04-06 02:22:28 | 000,033,536 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2004-12-08 18:16:30 | 000,038,468 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt) DRV - [2004-11-17 18:05:38 | 002,297,664 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2004-03-10 14:31:18 | 000,003,328 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AsInsHelp32.sys -- (ASInsHelp) DRV - [2003-03-10 23:12:06 | 000,059,632 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbser.sys -- (qcusbser) DRV - [2003-03-10 23:12:06 | 000,059,632 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbmdm.sys -- (qcusbmdm) Qualcomm Proprietary USB Driver (PID 3197) DRV - [2001-08-17 21:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Sterownik Creative SoundFont Manager (WDM) DRV - [2001-08-17 21:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Sterownik Creative Interface Manager (WDM) DRV - [2001-08-17 21:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM) DRV - [2001-08-17 21:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "google.pl" FF - prefs.js..extensions.enabledItems: {89506680-e3f4-484c-a2c0-ed711d481eda}:0.9.5.1 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.2.1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009-10-18 19:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Extensions [2009-10-18 19:52:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions [2009-10-18 19:51:29 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda} [2009-10-18 19:43:13 | 000,000,000 | ---D | M] (FoxTab) -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2009-10-18 20:01:34 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions O1 HOSTS File: ([2010-03-21 00:18:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found. O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKCU..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O4 - Startup: C:\Documents and Settings\All Users\My applications\Tibia Client.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.12.7 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp O24 - Desktop BackupWallPaper: F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003-01-01 00:25:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-03-24 12:34:08 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe [2010-03-21 00:03:38 | 000,000,000 | ---D | C] -- C:\Qoobox [2010-03-20 23:51:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Moje dokumenty\My Garmin [2010-03-20 23:51:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Dane aplikacji\GARMIN [2010-03-20 23:51:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\GARMIN [2010-03-20 23:49:59 | 000,000,000 | ---D | C] -- C:\FAM_1787 [2010-03-20 23:48:24 | 000,000,000 | ---D | C] -- C:\Garmin [2010-03-20 23:14:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Pulpit\4762K9Q3 [2010-03-20 23:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Pulpit\Garmin_5.00.60 [2010-03-08 21:53:57 | 000,000,000 | ---D | C] -- C:\Program Files\DC++ [2010-03-07 17:52:53 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll [2010-03-07 17:52:50 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll [2010-03-07 17:52:49 | 000,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys [2010-03-05 12:59:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\LightScribe [2010-03-05 12:58:23 | 000,000,000 | ---D | C] -- C:\Program Files\Nero [2010-03-05 12:48:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Dawid\Recent [2010-03-03 19:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Moje dokumenty\Nowy folders [2010-02-22 21:51:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\My applications [2010-02-22 20:59:43 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF [2010-02-22 20:59:43 | 000,000,000 | ---D | C] -- C:\Program Files\Deluxe Ski Jump [2010-02-21 13:40:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-05-21 18:21:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET [2003-01-01 00:35:11 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2003-01-01 00:30:51 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2003-01-01 00:30:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-03-24 12:37:15 | 000,781,909 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\RSIT.exe [2010-03-24 12:36:21 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\dk9vtzi8.exe [2010-03-24 12:34:37 | 000,361,369 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\dds.com [2010-03-24 12:34:08 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe [2010-03-24 10:24:47 | 008,405,015 | ---- | M] () -- C:\WINDOWS\TempFile [2010-03-24 10:24:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-03-24 10:24:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-03-24 10:24:24 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys [2010-03-23 16:09:22 | 003,670,016 | ---- | M] () -- C:\Documents and Settings\Dawid\ntuser.dat [2010-03-22 11:58:54 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2010-03-21 03:36:19 | 004,299,530 | -H-- | M] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-03-21 00:18:34 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010-03-21 00:18:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010-03-21 00:15:46 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Dawid\ntuser.ini [2010-03-21 00:01:42 | 003,895,855 | R--- | M] () -- C:\Documents and Settings\Dawid\Moje dokumenty\ComboFix.exe [2010-03-16 22:03:29 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-03-16 10:55:21 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\Winamp.lnk [2010-03-12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe [2010-03-11 18:36:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-03-07 16:02:22 | 000,059,392 | ---- | M] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-02-22 21:51:59 | 000,095,787 | ---- | M] () -- C:\Documents and Settings\All Users\My applications\Tibia Client.exe [2010-02-22 20:59:44 | 000,002,855 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\Deluxe Ski Jump.pif [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-03-24 12:37:14 | 000,781,909 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\RSIT.exe [2010-03-24 12:36:21 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\dk9vtzi8.exe [2010-03-24 12:34:37 | 000,361,369 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\dds.com [2010-03-21 00:01:29 | 003,895,855 | R--- | C] () -- C:\Documents and Settings\Dawid\Moje dokumenty\ComboFix.exe [2010-03-16 10:55:21 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\Winamp.lnk [2010-02-22 21:51:59 | 000,095,787 | ---- | C] () -- C:\Documents and Settings\All Users\My applications\Tibia Client.exe [2010-02-22 20:59:44 | 000,002,855 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\Deluxe Ski Jump.pif [2010-01-31 14:51:13 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2010-01-01 16:34:21 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-11-19 23:19:45 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\dacaeabbdfbafe6_d.dll [2009-11-14 23:03:04 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys [2009-11-14 23:03:04 | 000,003,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys [2009-11-13 20:30:59 | 000,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-07-16 17:34:59 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini [2009-07-15 16:25:17 | 000,021,248 | ---- | C] () -- C:\WINDOWS\System32\solidlocalmon.dll [2009-07-15 16:25:17 | 000,013,568 | ---- | C] () -- C:\WINDOWS\System32\solidlocalui.dll [2009-05-23 00:09:48 | 000,000,952 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys [2009-05-04 12:31:50 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009-04-24 23:54:56 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-04-24 12:38:57 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini [2009-04-18 20:28:25 | 000,000,020 | ---- | C] () -- C:\WINDOWS\naglos.INI [2009-04-11 13:00:32 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-11 13:00:30 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-11 13:00:29 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-11 13:00:27 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-11 13:00:27 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-10 08:42:27 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini [2009-04-10 08:42:20 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2009-04-05 16:04:59 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\LauncherAccess.dt [2009-04-05 16:04:06 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2009-03-29 20:22:49 | 000,059,392 | ---- | C] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-03-29 20:09:14 | 000,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-03-29 19:59:08 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\AsIO.dll [2009-03-29 19:59:08 | 000,012,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2009-03-29 19:56:17 | 000,003,821 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-03-29 19:56:15 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007-06-28 17:43:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007-06-28 17:43:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2007-06-28 17:43:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2007-06-28 17:43:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2007-06-28 17:43:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:242231A9 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:0B9D8E22 < End of report >

**Posty:** 1916 · przez **lamar** 24 Mar 2010, 14:43

Zastosuj się do zasad wstawiania logów / brak loga extras.txt oraz Gmera

**Posty:** 653 · przez **holi12** 28 Mar 2010, 20:32

czy ktoś jest w stanie pomoc? inne logi niestety nie da rady zrobić

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 60, http://www.silentrunners.org/ Operating System: Windows XP SP3 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}\(Default) = "IEPluginBHO" -> {HKLM...CLSID} = "IEPluginBHO Class" \InProcServer32\(Default) = "C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll" ["GG Network S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ Groove Explorer Icon Overlay 1 (GFS Unread Stub)\(Default) = "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] Groove Explorer Icon Overlay 2 (GFS Stub)\(Default) = "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\(Default) = "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] Groove Explorer Icon Overlay 3 (GFS Folder)\(Default) = "{16F3DD56-1AF5-4347-846D-7C10C4192619}" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] Groove Explorer Icon Overlay 4 (GFS Unread Mark)\(Default) = "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\ <<!>> ms-help\CLSID = "{314111c7-a502-11d2-bbca-00c04f8ec294}" -> {HKLM...CLSID} = "HxProtocol Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll" [MS] <<!>> skype4com\CLSID = "{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}" -> {HKLM...CLSID} = "IEProtocolHandler Class" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL" ["Skype Technologies"] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ 00nView\(Default) = "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] NvCplDesktopContext\(Default) = "{A70C977A-BF00-412C-90B7-034C51DA2439}" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["mpc-hc@Sourceforge"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["mpc-hc@Sourceforge"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] NeroAutoPlay9VideoCapture\ "Provider" = "Nero Vision" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Program Files\Nero\Nero 9\Nero Vision\NeroVision.exe" /New:VideoCapture" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] Picasa2ImportPicturesOnArrival\ "Provider" = "Picasa3" "InvokeProgID" = "picasa2.autoplay" "InvokeVerb" = "import" HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command\(Default) = "C:\Program Files\Google\Picasa3\Picasa3.exe "%1"" ["Google Inc."] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor iP1900 series\Driver = "CNMLM9M.DLL" ["CANON INC."] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- (launch time: 2010-03-28 20:32:01) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 51 seconds, including 9 seconds for message boxes)

**Posty:** 12734 · przez **Mikou@j** 28 Mar 2010, 20:34

Z logiem extras nie powinieneś mieć problemów jak zaznaczyłeś Extra Registry -> Use safelist.

Loga z gmera nie możesz utworzyć, bo nie przeczytałeś tematu i nadal masz

Kod: Zaznacz wszystko: DRV - [2009-06-03 20:26:29 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

Przeczytaj to programy-emulujace-napedy-wazne-vt117886.html

**Posty:** 653 · przez **holi12** 28 Mar 2010, 21:38

log gmera zawsze tak długo idzie?:) Winde bym szybciej postawil

**Posty:** 18165 · przez **wojtas** 28 Mar 2010, 23:48

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
O4 - Startup: C:\Documents and Settings\All Users\My applications\Tibia Client.exe ()

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdź reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + log z Gmera

**Posty:** 653 · przez **holi12** 29 Mar 2010, 12:45

z tym juz sobie dawno poradziłem.

Dodano 30.03.2010 08:37:14:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-03-30 09:28:03 - Run 1 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dawid\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 442,00 Mb Available Physical Memory | 58,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 68,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37,26 Gb Total Space | 7,86 Gb Free Space | 21,08% Space Free | Partition Type: NTFS Drive D: | 38,34 Gb Total Space | 23,84 Gb Free Space | 62,18% Space Free | Partition Type: NTFS Drive E: | 37,26 Gb Total Space | 3,85 Gb Free Space | 10,32% Space Free | Partition Type: NTFS Drive F: | 38,34 Gb Total Space | 22,86 Gb Free Space | 59,63% Space Free | Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM-9662BB46C9A Current User Name: Dawid Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera 10\opera.exe (Opera Software) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. https [open] -- "C:\Program Files\Opera 10\opera.exe" (Opera Software) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\DC++\DCPlusPlus.exe" = C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++ -- () "C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny -- (Gadu-Gadu S.A.) "C:\Program Files\Opera 10\opera.exe" = C:\Program Files\Opera 10\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK "{05ADEEC8-BD58-43D9-A9E3-1F53B0DA117A}" = Opera 10.51 "{108FAA6F-DEEE-48EA-B3A9-1C5EB2605A6B}" = PL "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1900_series" = Canon iP1900 series Printer Driver "{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86 "{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09 "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav "{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3 "{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A7AA93B6-6909-4073-B4EC-45CCDEFD4665}" = NHL® 08 "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{AC76BA86-7AD7-1045-7B44-A91000000001}" = Adobe Reader 9.1.3 - Polish "{B7CB0BF3-791E-44D3-9F04-786E36D51C9D}" = PC Connectivity Solution "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver "{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA "{CA529363-D0F2-41EA-B44B-D7515A254645}" = Multimedia Card Reader "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{D755C7A3-C03E-4460-8C00-AC6E55505FB5}" = LightScribe 1.4.74.1 "{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player "ALLPlayer_is1" = ALLPlayer V4.X "avast!" = avast! Antivirus "CanonMyPrinter" = Canon Utilities My Printer "CCleaner" = CCleaner "DC++" = DC++ 0.750 "Deluxe Ski Jump_is1" = Deluxe Ski Jump 2.1 "Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX "ENTERPRISE" = Microsoft Office Enterprise 2007 "Gadu-Gadu" = Gadu-Gadu 7.7 "Gadu-Gadu 10" = Gadu-Gadu 10 "InstallShield_{CA529363-D0F2-41EA-B44B-D7515A254645}" = Multimedia Card Reader "KLiteCodecPack_is1" = K-Lite Codec Pack 4.7.5 (Full) "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "MPPL 09" = MPPL 09 "NVIDIA Drivers" = NVIDIA Drivers "Picasa 3" = Picasa 3 "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = Archiwizator WinRAR "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2009-12-05 10:51:28 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\DOCUMENTS AND SETTINGS\DAWID\USTAWIENIA LOKALNE\TEMPORARY INTERNET FILES\CONTENT.IE5\V7L3GJQU\CAROUSEL[1].JS failed, 00000005. Error - 2009-12-25 04:56:54 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\DOCUMENTS AND SETTINGS\DAWID\DANE APLIKACJI\GADU-GADU 10\_USERDATA\GGBHO.2.DLL failed, 00000005. Error - 2009-12-26 15:41:01 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\DOCUMENTS AND SETTINGS\DAWID\DANE APLIKACJI\GADU-GADU 10\_USERDATA\GGBHO.2.DLL failed, 00000005. Error - 2009-12-28 13:10:36 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Program Files\InstallShield Installation Information\{3262EE1B-2E09-42E7-A5C9-E56E3C6C6F79}\setup.ilg failed, 00000005. Error - 2009-12-31 20:17:04 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\DOCUMENTS AND SETTINGS\M@TEUSZ\DANE APLIKACJI\NOWE GADU-GADU\_USERDATA\GGBHO.1.DLL failed, 00000005. Error - 2010-01-23 13:29:35 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of J:\DCIM\101MSDCF\DSC01065.JPG failed, 0000A420. Error - 2010-01-23 13:30:09 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of J:\DCIM\101MSDCF\DSC01054.JPG failed, 0000001E. Error - 2010-01-23 13:30:12 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of J:\DCIM\101MSDCF\DSC01054.JPG failed, 0000001E. Error - 2010-01-23 13:30:51 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of J:\DCIM\101MSDCF\DSC01066.JPG failed, 0000001E. Error - 2010-03-02 15:45:10 | Computer Name = DOM-9662BB46C9A | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\DOCUMENTS AND SETTINGS\DAWID\USTAWIENIA LOKALNE\DANE APLIKACJI\ADOBE\UPDATER6\INSTALL\READER9RDR-PL_PL\ADBERDR930_PL_PL.MSI failed, 00000005. [ Application Events ] Error - 2010-03-20 17:12:39 | Computer Name = DOM-9662BB46C9A | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł powodujący błąd shlwapi.dll, wersja 6.0.2900.5512, adres błędu 0x00059297. Error - 2010-03-24 09:33:13 | Computer Name = DOM-9662BB46C9A | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd unlocker.exe, wersja 0.0.0.0, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00c51102. Error - 2010-03-24 09:33:29 | Computer Name = DOM-9662BB46C9A | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd unlocker.exe, wersja 0.0.0.0, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00caf688. Error - 2010-03-28 13:39:05 | Computer Name = DOM-9662BB46C9A | Source = MsiInstaller | ID = 10005 Description = Product: Opera 9.0 -- Internal Error 2753. opera.exe Error - 2010-03-28 13:53:00 | Computer Name = DOM-9662BB46C9A | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd opera.exe, wersja 9.0.8501.0, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x6c676f6f. Error - 2010-03-28 13:53:19 | Computer Name = DOM-9662BB46C9A | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd opera.exe, wersja 9.0.8501.0, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x6c676f6f. [ System Events ] Error - 2010-03-24 09:34:47 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa Java Quick Starter niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-24 09:34:47 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa StarWind AE Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-25 07:05:45 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa Java Quick Starter niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-25 07:05:45 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa LightScribeService Direct Disc Labeling Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-25 07:05:45 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa NVIDIA Display Driver Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-25 07:05:45 | Computer Name = DOM-9662BB46C9A | Source = Service Control Manager | ID = 7034 Description = Usługa StarWind AE Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-03-25 09:35:59 | Computer Name = DOM-9662BB46C9A | Source = Print | ID = 6161 Description = Nie można wydrukować na drukarce Canon iP1900 series dokumentu Wydruk fotografii na całej stronie będącego własnością Dawid. Typ danych: NT EMF 1.008. Rozmiar pliku buforu w bajtach: 5046272. Liczba wydrukowanych bajtów: 4974004. Całkowita liczba stron w dokumencie: 1. Liczba wydrukowanych stron: 0. Komputer kliencki: \\DOM-9662BB46C9A. Kod błędu systemu Win32 zwrócony przez procesor wydruku: 122 (0x7a). Error - 2010-03-26 14:10:34 | Computer Name = DOM-9662BB46C9A | Source = MRxSmb | ID = 8003 Description = Przeglądarka główna odebrała anons serwera z komputera DOM-73151D1F19F. Komputer ten zachowuje się tak, jakby był przeglądarką główną dla domeny w transporcie NetBT_Tcpip_{9E3735A6-688. Przeglądarka główna właśnie jest zatrzymywana albo wymuszany jest wybór. Error - 2010-03-28 10:14:55 | Computer Name = DOM-9662BB46C9A | Source = MRxSmb | ID = 8003 Description = Przeglądarka główna odebrała anons serwera z komputera FDFSFS-PCJX9PHK. Komputer ten zachowuje się tak, jakby był przeglądarką główną dla domeny w transporcie NetBT_Tcpip_{9E3735A6-688. Przeglądarka główna właśnie jest zatrzymywana albo wymuszany jest wybór. Error - 2010-03-28 14:46:19 | Computer Name = DOM-9662BB46C9A | Source = PlugPlayManager | ID = 11 Description = Urządzenie Root\LEGACY_UNLOCKERDRIVER5\0000 zniknęło z systemu bez uprzedniego przygotowania go do usunięcia. < End of report >

Kod: Zaznacz wszystko: OTL logfile created on: 2010-03-30 09:28:03 - Run 1 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dawid\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 442,00 Mb Available Physical Memory | 58,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 68,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37,26 Gb Total Space | 7,86 Gb Free Space | 21,08% Space Free | Partition Type: NTFS Drive D: | 38,34 Gb Total Space | 23,84 Gb Free Space | 62,18% Space Free | Partition Type: NTFS Drive E: | 37,26 Gb Total Space | 3,85 Gb Free Space | 10,32% Space Free | Partition Type: NTFS Drive F: | 38,34 Gb Total Space | 22,86 Gb Free Space | 59,63% Space Free | Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM-9662BB46C9A Current User Name: Dawid Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-03-30 01:09:33 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe PRC - [2010-03-18 01:43:38 | 000,835,952 | ---- | M] (Opera Software) -- C:\Program Files\Opera 10\opera.exe PRC - [2009-11-25 01:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 01:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 01:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-11-25 01:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-11-25 01:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-04-14 23:51:32 | 000,345,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mspaint.exe PRC - [2008-04-14 23:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008-03-20 12:04:46 | 002,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2007-05-28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-03-30 01:09:33 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe MOD - [2006-12-21 14:30:44 | 000,102,400 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\ggwhook.dll MOD - [2006-05-03 22:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (Nero BackItUp Scheduler 4.0) SRV - [2009-11-25 01:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 01:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 01:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 01:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2009-03-04 12:25:12 | 000,621,056 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2007-05-28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 01:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 01:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 01:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 01:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 01:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 01:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2009-05-27 21:04:19 | 000,009,216 | ---- | M] (SNEG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\FStarForce.sys -- (FStarForce) DRV - [2009-03-19 14:48:18 | 000,136,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2009-03-19 14:48:12 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2009-02-09 08:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2009-02-09 08:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2009-02-09 08:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2009-02-09 08:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008-08-26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008-04-14 01:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008-04-13 22:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2007-12-17 18:14:06 | 000,012,400 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007-06-28 18:43:00 | 006,807,328 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006-07-24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen) DRV - [2005-07-28 09:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock) DRV - [2005-05-17 17:45:08 | 000,092,800 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus) DRV - [2005-04-06 03:22:30 | 000,012,928 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-04-06 03:22:28 | 000,033,536 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2004-12-08 19:16:30 | 000,038,468 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt) DRV - [2004-11-17 19:05:38 | 002,297,664 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2004-03-10 15:31:18 | 000,003,328 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AsInsHelp32.sys -- (ASInsHelp) DRV - [2003-03-11 00:12:06 | 000,059,632 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbser.sys -- (qcusbser) DRV - [2003-03-11 00:12:06 | 000,059,632 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbmdm.sys -- (qcusbmdm) Qualcomm Proprietary USB Driver (PID 3197) DRV - [2001-08-17 22:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Sterownik Creative SoundFont Manager (WDM) DRV - [2001-08-17 22:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Sterownik Creative Interface Manager (WDM) DRV - [2001-08-17 22:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM) DRV - [2001-08-17 22:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-823518204-162531612-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKU\S-1-5-21-823518204-162531612-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "google.pl" FF - prefs.js..extensions.enabledItems: {89506680-e3f4-484c-a2c0-ed711d481eda}:0.9.5.1 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.2.1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009-10-18 20:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Extensions [2009-10-18 20:52:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions [2009-10-18 20:51:29 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda} [2009-10-18 20:43:13 | 000,000,000 | ---D | M] (FoxTab) -- C:\Documents and Settings\Dawid\Dane aplikacji\Mozilla\Firefox\Profiles\5lywz6d9.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} O1 HOSTS File: ([2010-03-21 01:18:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-21-823518204-162531612-725345543-1003..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-823518204-162531612-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-823518204-162531612-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-823518204-162531612-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-823518204-162531612-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.12.7 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp O24 - Desktop BackupWallPaper: F:\Moje obrazy\Tapety\grass-hd-wallpapers_7279_1280x800.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003-01-01 01:25:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-03-30 01:09:33 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe [2010-03-28 22:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu [2010-03-28 21:08:27 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010-03-28 20:38:17 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010-03-28 20:38:17 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010-03-28 20:38:17 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010-03-28 20:38:17 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010-03-28 20:33:55 | 000,000,000 | ---D | C] -- C:\Qoobox [2010-03-28 20:26:08 | 000,000,000 | ---D | C] -- C:\Program Files\Opera 10 [2010-03-28 20:25:18 | 012,991,896 | ---- | C] (Opera Software ASA) -- C:\Documents and Settings\Dawid\Moje dokumenty\Opera_1051_int_Setup.exe [2010-03-28 20:23:53 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Dawid\Recent [2010-03-27 16:55:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-03-27 16:54:42 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2010-03-26 23:30:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Dane aplikacji\Skype [2010-03-26 23:29:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2010-03-26 23:29:49 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2010-03-24 15:32:53 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker [2010-03-21 00:51:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Dane aplikacji\GARMIN [2010-03-21 00:51:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\GARMIN [2010-03-21 00:14:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Moje dokumenty\4762K9Q3 [2010-03-21 00:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Moje dokumenty\Garmin_5.00.60 [2010-03-08 22:53:57 | 000,000,000 | ---D | C] -- C:\Program Files\DC++ [2010-03-07 18:52:53 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll [2010-03-07 18:52:50 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll [2010-03-07 18:52:49 | 000,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys [2010-03-05 13:59:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\LightScribe [2010-03-03 20:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dawid\Moje dokumenty\Nowy folders [2010-02-21 14:40:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-05-21 19:21:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET [2003-01-01 01:35:11 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2003-01-01 01:30:51 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2003-01-01 01:30:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-03-30 08:43:44 | 008,405,015 | ---- | M] () -- C:\WINDOWS\TempFile [2010-03-30 08:43:37 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-03-30 08:43:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-03-30 08:43:20 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys [2010-03-30 01:09:33 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dawid\Pulpit\OTL.exe [2010-03-30 01:08:43 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\dds.scr [2010-03-29 14:28:48 | 003,932,160 | ---- | M] () -- C:\Documents and Settings\Dawid\ntuser.dat [2010-03-29 14:28:15 | 001,573,788 | -H-- | M] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-03-28 22:01:05 | 000,000,653 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\Gadu-Gadu.lnk [2010-03-28 21:26:58 | 000,000,018 | ---- | M] () -- C:\Documents and Settings\Dawid\Moje dokumenty\gmer.bat [2010-03-28 21:09:29 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Dawid\ntuser.ini [2010-03-28 20:51:09 | 000,493,976 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-03-28 20:51:09 | 000,435,396 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-03-28 20:51:09 | 000,085,136 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-03-28 20:51:09 | 000,068,292 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-03-28 20:51:08 | 001,096,384 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-03-28 20:46:23 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010-03-28 20:31:53 | 003,905,353 | R--- | M] () -- C:\Documents and Settings\Dawid\Moje dokumenty\ComboFix.exe [2010-03-28 20:31:53 | 000,453,695 | ---- | M] () -- C:\Documents and Settings\Dawid\Moje dokumenty\Silent Runners.vbs [2010-03-28 20:26:17 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2010-03-28 20:25:18 | 012,991,896 | ---- | M] (Opera Software ASA) -- C:\Documents and Settings\Dawid\Moje dokumenty\Opera_1051_int_Setup.exe [2010-03-25 15:32:27 | 000,075,928 | ---- | M] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-03-25 13:17:11 | 000,284,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-03-25 12:32:41 | 000,076,132 | ---- | M] () -- C:\Documents and Settings\Dawid\Moje dokumenty\11074660_640.jpg [2010-03-24 15:59:34 | 000,000,841 | ---- | M] () -- C:\WINDOWS\win.ini [2010-03-24 15:59:34 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010-03-21 01:18:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010-03-16 23:03:29 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-03-16 11:55:21 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\Dawid\Pulpit\Winamp.lnk [2010-03-12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe [2010-03-11 19:36:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-03-07 17:02:22 | 000,059,392 | ---- | M] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-03-30 01:08:43 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\dds.scr [2010-03-28 22:01:05 | 000,000,653 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\Gadu-Gadu.lnk [2010-03-28 21:26:40 | 000,000,018 | ---- | C] () -- C:\Documents and Settings\Dawid\Moje dokumenty\gmer.bat [2010-03-28 20:38:17 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010-03-28 20:38:17 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010-03-28 20:38:17 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010-03-28 20:31:31 | 000,453,695 | ---- | C] () -- C:\Documents and Settings\Dawid\Moje dokumenty\Silent Runners.vbs [2010-03-28 20:30:04 | 003,905,353 | R--- | C] () -- C:\Documents and Settings\Dawid\Moje dokumenty\ComboFix.exe [2010-03-28 20:26:17 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2010-03-25 12:32:40 | 000,076,132 | ---- | C] () -- C:\Documents and Settings\Dawid\Moje dokumenty\11074660_640.jpg [2010-03-16 11:55:21 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\Dawid\Pulpit\Winamp.lnk [2010-01-31 15:51:13 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2010-01-01 17:34:21 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-11-20 00:19:45 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\dacaeabbdfbafe6_d.dll [2009-11-15 00:03:04 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys [2009-11-15 00:03:04 | 000,003,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys [2009-11-13 21:30:59 | 000,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-07-16 18:34:59 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini [2009-07-15 17:25:17 | 000,021,248 | ---- | C] () -- C:\WINDOWS\System32\solidlocalmon.dll [2009-07-15 17:25:17 | 000,013,568 | ---- | C] () -- C:\WINDOWS\System32\solidlocalui.dll [2009-05-23 01:09:48 | 000,000,952 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys [2009-05-04 13:31:50 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009-04-25 00:54:56 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-04-24 13:38:57 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini [2009-04-18 21:28:25 | 000,000,020 | ---- | C] () -- C:\WINDOWS\naglos.INI [2009-04-11 14:00:32 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-11 14:00:30 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-11 14:00:29 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-11 14:00:27 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-11 14:00:27 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-10 09:42:27 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini [2009-04-10 09:42:20 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2009-04-05 17:04:59 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\LauncherAccess.dt [2009-04-05 17:04:06 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2009-03-29 21:22:49 | 000,059,392 | ---- | C] () -- C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-03-29 20:59:08 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\AsIO.dll [2009-03-29 20:59:08 | 000,012,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2009-03-29 20:56:17 | 000,003,821 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-03-29 20:56:15 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007-06-28 18:43:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007-06-28 18:43:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2007-06-28 18:43:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2007-06-28 18:43:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2007-06-28 18:43:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [color=#E56717]========== LOP Check ==========[/color] [2010-02-08 20:41:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ [2009-06-03 21:29:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-05-20 12:24:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2010-03-27 16:55:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-03-21 00:51:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\GARMIN [2009-05-15 20:46:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Hitman Pro [2009-06-03 21:49:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ice-pick Lodge [2009-08-20 17:59:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-12-08 16:13:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2009-12-28 12:45:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2009-08-20 18:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2009-07-15 17:25:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SolidDocuments [2009-04-13 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2009-07-19 00:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Aston [2009-04-12 21:08:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Atari [2010-02-08 21:16:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Canon [2009-06-03 21:30:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\DAEMON Tools Lite [2010-03-08 23:26:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\DC++ [2009-04-19 00:58:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\foobar2000 [2009-04-21 23:57:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\FrostWire [2009-06-26 01:25:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu [2009-12-17 14:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu 10 [2010-03-21 00:51:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\GARMIN [2009-09-29 13:01:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Leadertech [2010-02-11 23:15:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Nokia [2009-12-17 15:04:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\OpenFM [2010-03-28 20:26:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Opera [2009-08-20 18:04:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\PC Suite [2010-01-31 15:45:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Piechnat Soft [2009-07-15 17:27:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\SolidDocuments [2010-01-23 17:35:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dawid\Dane aplikacji\Spik [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:242231A9 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:0B9D8E22 < End of report >

Kod: Zaznacz wszystko: DDS (Ver_10-03-17.01) - NTFSx86 Run by Dawid at 13:11:30,54 on 2010-03-30 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.767.385 [GMT 2:00] AV: avast! antivirus 4.8.1368 [VPS 100329-2] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Opera 10\opera.exe C:\Documents and Settings\Dawid\Pulpit\dds.scr ============== Pseudo HJT Report =============== BHO: IEPluginBHO Class: {f5cc7f02-6f4e-4462-b5b1-394a57fd3e0d} - c:\documents and settings\all users\dane aplikacji\gadu-gadu 10\_userdata\ggbho.2.dll uRun: [Gadu-Gadu] "c:\program files\gadu-gadu\gg.exe" /tray uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-9-4 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-9-4 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-9-4 138680] R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 52\starwind\StarWindServiceAE.exe [2007-5-28 275968] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-9-4 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-9-4 352920] R3 FStarForce;FStarForce;c:\windows\system32\drivers\FStarForce.sys [2009-5-27 9216] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-10-12 136704] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-10-12 8320] S3 qcusbmdm;Qualcomm Proprietary USB Driver (PID 3197);c:\windows\system32\drivers\qcusbmdm.sys [2009-4-30 59632] S3 qcusbser;Qualcomm Diagnostic Port 3197;c:\windows\system32\drivers\qcusbser.sys [2009-4-11 59632] =============== Created Last 30 ================ 2010-03-28 20:00:53 0 d-----w- c:\program files\Gadu-Gadu 2010-03-28 18:38:17 98816 ----a-w- c:\windows\sed.exe 2010-03-28 18:38:17 161792 ----a-w- c:\windows\SWREG.exe 2010-03-28 18:26:08 0 d-----w- c:\program files\Opera 10 2010-03-27 14:55:02 0 d-----w- c:\docume~1\alluse~1\daneap~1\Gadu-Gadu 10 2010-03-27 14:54:42 0 d-----w- c:\program files\Gadu-Gadu 10 2010-03-26 21:29:49 0 d-----r- c:\program files\Skype 2010-03-24 13:32:53 0 d-----w- c:\program files\Unlocker 2010-03-20 22:51:28 0 d-----w- c:\docume~1\dawid\daneap~1\GARMIN 2010-03-20 22:51:28 0 d-----w- c:\docume~1\alluse~1\daneap~1\GARMIN 2010-03-08 20:53:57 0 d-----w- c:\program files\DC++ 2010-03-07 16:52:53 5632 ----a-w- c:\windows\system32\ptpusb.dll 2010-03-07 16:52:50 159232 ----a-w- c:\windows\system32\ptpusd.dll 2010-03-07 16:52:49 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys 2010-03-07 16:52:49 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys ==================== Find3M ==================== 2010-03-28 18:51:09 85136 ----a-w- c:\windows\system32\perfc015.dat 2010-03-28 18:51:09 493976 ----a-w- c:\windows\system32\perfh015.dat 2010-03-12 16:02:38 261632 ----a-w- c:\windows\PEV.exe 2010-01-08 22:42:58 3366912 ----a-w- c:\windows\system32\GPhotos.scr 2009-11-19 22:19:45 23 --sha-w- c:\windows\system32\dacaeabbdfbafe6_d.dll 2009-05-15 18:47:50 23 --sha-w- c:\windows\system32\edacded0_x.dat 2009-12-03 18:17:34 952 --sha-w- c:\windows\system32\KGyGaAvL.sys ============= FINISH: 13:12:01,43 ===============

**Posty:** 18165 · przez **wojtas** 30 Mar 2010, 18:07

Czynności końcowe :

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )

Zaktualizuj zabezpieczenia:
>>> Adobe Reader 9.3
>>> Internet Explorer 8
>>> Java™ 6 Update 18
>>> Avast 5

**Posty:** 653 · przez **holi12** 31 Mar 2010, 16:06

dalej....komenda NETSTAT pokazuje multum połączen a zaden program z neta nie korzysta

Kto jest na forum