Denerwujące cienie pod ikonkami, komputer długo się włącza

**Posty:** 2042 · przez **Wojtaz** 11 Maj 2009, 15:25

Witam.
Mam cienie pod ikonami na pulpicie - nie mogę ich wyłączyć

Same się pojawiły. PC się włącza ok 3 minuty

Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:25, on 2009-05-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\Tlen.pl\tlen.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\UltraVNC\vncviewer.exe D:\Program Files\rapget141\rapget.exe D:\Program Files\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O4 - Startup: Windows Seven Dock.lnk = ? O17 - HKLM\System\CCS\Services\Tcpip\..\{52A11F0F-890C-4730-A989-FEE6EEEBA053}: NameServer = 192.168.1.1,192.168.1.13 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Unknown owner - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 3447 bytes

**Posty:** 18165 · przez **wojtas** 11 Maj 2009, 15:32

daj screena i Pobierz OTListIt2 i daj loga

**Posty:** 2042 · przez **Wojtaz** 11 Maj 2009, 15:41

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-11 15:37:13 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.6 Folder = C:\Documents and Settings\Wojtaz\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511.30 Mb Total Physical Memory | 163.02 Mb Available Physical Memory | 31.88% Memory free 1.22 Gb Paging File | 0.96 Gb Available in Paging File | 78.50% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19.53 Gb Total Space | 6.13 Gb Free Space | 31.39% Space Free | Partition Type: NTFS Drive D: | 166.77 Gb Total Space | 33.22 Gb Free Space | 19.92% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded Drive H: | 673.61 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS I: Drive not present or media not loaded Computer Name: WOJTAZ Current User Name: Wojtaz Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2005-05-20 19:11:06 | 00,925,696 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe PRC - [2008-08-25 12:42:20 | 05,853,160 | ---- | M] (o2.pl Sp. z o.o.) -- D:\Program Files\Tlen.pl\tlen.exe PRC - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [2007-08-17 17:23:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2005-04-02 02:51:48 | 00,217,600 | ---- | M] (Rocket Division Software) -- D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe PRC - [2007-03-03 14:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe PRC - [2004-08-04 00:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008-07-03 06:28:11 | 00,307,712 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe PRC - [2008-06-03 22:29:48 | 00,171,008 | ---- | M] () -- D:\Program Files\rapget141\rapget.exe PRC - [2008-08-30 16:04:10 | 01,270,848 | ---- | M] (UltraVNC) -- D:\Program Files\UltraVNC\vncviewer.exe PRC - [2009-05-11 15:37:02 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2007-10-24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-04-06 17:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service [Disabled | Stopped]) SRV - [2007-03-06 10:35:02 | 00,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service [Disabled | Stopped]) SRV - [2007-10-24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2007-10-09 12:58:12 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2005-04-04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2007-10-11 09:55:10 | 00,864,256 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - File not found -- -- (mnmsrvc [On_Demand | Stopped]) SRV - [2007-10-11 09:55:14 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - File not found -- -- (nmservice [Auto | Stopped]) SRV - [2007-08-17 17:23:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2003-07-28 21:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2002-08-01 10:22:40 | 00,065,536 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12 [On_Demand | Stopped]) SRV - [2008-08-07 12:17:30 | 00,575,488 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [Disabled | Stopped]) SRV - [2005-04-02 02:51:48 | 00,217,600 | ---- | M] (Rocket Division Software) -- D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- (StarWindService [Auto | Running]) SRV - [2007-03-03 14:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2005-10-06 03:21:10 | 00,141,312 | R--- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService [On_Demand | Running]) DRV - [2005-03-05 06:53:00 | 00,127,872 | R--- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\AEAudio.sys -- (AEAudioService [On_Demand | Running]) DRV - [2006-07-02 00:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2006-06-23 17:00:26 | 00,031,488 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\blueletaudio.sys -- (BlueletAudio [On_Demand | Running]) DRV - [2005-08-31 11:34:52 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio [On_Demand | Running]) DRV - [2006-01-19 14:31:34 | 00,010,068 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\btnetdrv.sys -- (BT [On_Demand | Stopped]) DRV - [2006-07-16 17:06:16 | 00,023,040 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\btcusb.sys -- (Btcsrusb [On_Demand | Stopped]) DRV - [2005-07-30 08:21:32 | 00,011,988 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\vbtenum.sys -- (BTHidEnum [On_Demand | Running]) DRV - [2005-05-01 06:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr [Boot | Running]) DRV - [2004-08-22 17:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running]) DRV - [2004-08-22 17:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running]) DRV - [2006-09-19 11:03:28 | 00,116,992 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Stopped]) DRV - [2006-09-28 14:10:52 | 00,011,648 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\system32\DRIVERS\gggen.sys -- (gggen [On_Demand | Stopped]) DRV - [2006-09-28 14:10:52 | 00,011,648 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\system32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped]) DRV - [2004-05-02 10:47:08 | 00,023,040 | R--- | M] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv [On_Demand | Stopped]) DRV - [2009-01-23 11:37:56 | 00,010,546 | ---- | M] (Applied Networking Inc.) -- C:\WINDOWS\system32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped]) DRV - [2004-10-27 15:21:30 | 00,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\HdAudio.sys -- (HdAudAddService [On_Demand | Stopped]) DRV - [2004-10-27 15:21:36 | 00,138,240 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2006-09-15 11:07:54 | 00,064,000 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\e4ldr.sys -- (IKANLOADER2 [Auto | Stopped]) DRV - [2006-04-23 05:34:34 | 00,029,184 | ---- | M] (http://libusb-win32.sourceforge.net) -- C:\WINDOWS\system32\DRIVERS\libusb0.sys -- (libusb0 [On_Demand | Stopped]) DRV - [2004-08-14 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2008-09-15 08:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped]) DRV - [2008-09-15 08:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped]) DRV - [2008-02-01 16:17:12 | 00,138,112 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu [On_Demand | Stopped]) DRV - [2008-02-01 16:17:06 | 00,008,320 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc [On_Demand | Stopped]) DRV - [2007-08-17 17:23:00 | 06,842,208 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2005-08-13 08:31:12 | 00,098,432 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2005-07-30 11:11:02 | 00,034,048 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running]) DRV - [2005-07-30 11:11:04 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2003-08-04 14:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2007-09-17 16:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped]) DRV - [2008-01-08 17:16:10 | 00,023,992 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\DRIVERS\pnarp.sys -- (pnarp [Auto | Running]) DRV - [2004-10-24 08:11:00 | 00,013,952 | ---- | M] (Deon van der Westhuysen) -- C:\WINDOWS\system32\drivers\PPJoyBus.sys -- (PPJoyBus [On_Demand | Stopped]) DRV - [2004-10-24 08:11:00 | 00,028,800 | ---- | M] (Deon van der Westhuysen) -- C:\WINDOWS\system32\drivers\PPortJoy.sys -- (PPortJoystick [On_Demand | Stopped]) DRV - [2008-06-13 19:08:13 | 00,036,928 | ---- | M] (microOLAP Technologies LTD) -- C:\WINDOWS\system32\Drivers\pssdk41.sys -- (PsSdk41 [On_Demand | Stopped]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-01-08 17:16:10 | 00,025,272 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\DRIVERS\purendis.sys -- (purendis [Auto | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-08-17 21:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Running]) DRV - [2007-04-23 15:54:46 | 00,083,208 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115bus.sys -- (s115bus [On_Demand | Stopped]) DRV - [2007-04-23 15:54:48 | 00,015,112 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mdfl.sys -- (s115mdfl [On_Demand | Stopped]) DRV - [2007-04-23 15:54:48 | 00,108,680 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mdm.sys -- (s115mdm [On_Demand | Stopped]) DRV - [2007-04-23 15:54:50 | 00,100,488 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mgmt.sys -- (s115mgmt [On_Demand | Stopped]) DRV - [2007-04-23 15:54:50 | 00,098,568 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115obex.sys -- (s115obex [On_Demand | Stopped]) DRV - [2007-04-24 11:33:34 | 00,083,336 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125bus.sys -- (s125bus [On_Demand | Stopped]) DRV - [2007-04-24 11:33:42 | 00,015,112 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125mdfl.sys -- (s125mdfl [On_Demand | Stopped]) DRV - [2007-04-24 11:33:44 | 00,108,680 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125mdm.sys -- (s125mdm [On_Demand | Stopped]) DRV - [2008-08-06 22:31:22 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running]) DRV - [2005-08-11 23:49:28 | 00,393,088 | R--- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\Senfilt.sys -- (SenFiltService [On_Demand | Running]) DRV - [2008-09-15 08:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped]) DRV - [2004-08-03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser [On_Demand | Stopped]) DRV - [2008-09-15 08:56:34 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped]) DRV - [2005-04-25 10:43:58 | 00,159,616 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\Vax347b.sys -- (Vax347b [Boot | Running]) DRV - [2004-04-30 09:33:00 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\Vax347s.sys -- (Vax347s [Boot | Running]) DRV - [2004-10-19 14:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\VComm.sys -- (VComm [On_Demand | Running]) DRV - [2006-02-28 17:57:22 | 00,084,836 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\VcommMgr.sys -- (VcommMgr [On_Demand | Running]) DRV - [2008-12-10 16:56:26 | 00,017,792 | ---- | M] (Avnex) -- C:\WINDOWS\system32\DRIVERS\vcsvad.sys -- (VCSVADHWSer [On_Demand | Running]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "www.google.pl" FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.83 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03 FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:2.0.2 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.8.3.6 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.95 FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.6.11 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 FF - prefs.js..extensions.enabledItems: {c1dffba0-628e-11d9-9669-0800200c9a66}:3.0.2 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: D:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2008-10-10 15:28:14 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: D:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2008-12-28 18:44:21 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.21\extensions\\Components: D:\PROGRAM FILES\MOZILLA THUNDERBIRD\COMPONENTS [2009-03-25 16:30:58 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.21\extensions\\Plugins: D:\PROGRAM FILES\MOZILLA THUNDERBIRD\PLUGINS [2008-08-26 21:39:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions [2008-08-26 21:39:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-04-13 11:48:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions [2008-11-03 16:28:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2008-10-05 11:03:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2008-10-28 10:15:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2008-08-26 21:49:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66} [2009-04-13 11:48:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1} [2008-08-16 12:19:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0} [2008-07-07 09:52:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\redshift_V2@shift-themes.com O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] nwiz.exe /install () O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKCU..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe (o2.pl Sp. z o.o.) O4 - Startup: C:\Documents and Settings\Wojtaz\Menu Start\Programy\Autostart\Windows Seven Dock.lnk = C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\Rar$EX00.047\Dock.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{52A11F0F-890C-4730-A989-FEE6EEEBA053}\\NameServer = 192.168.1.1,192.168.1.13 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-05-08 20:42:37 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2005-11-04 07:52:23 | 00,729,088 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2005-11-04 07:52:23 | 00,729,088 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2005-10-14 10:02:16 | 00,585,728 | R--- | M] (Electronic Arts Inc.) - H:\AutoRunGUI.dll -- [ CDFS ] O32 - AutoRun File - [2005-11-04 08:22:30 | 00,000,160 | R--- | M] () - H:\autorun.inf -- [ CDFS ] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-05-11 15:36:53 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [2009-05-11 08:58:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\USBREMOTE [2009-05-11 08:57:54 | 01,838,409 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\USBREMOTE.rar [2009-05-10 22:54:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\RemoteJoyLite_019 [2009-05-10 22:53:58 | 00,124,454 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\RemoteJoyLite_019.zip [2009-05-10 21:21:59 | 00,165,022 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\pic1.png [2009-05-10 21:21:36 | 00,076,747 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver_2.jpg [2009-05-10 21:21:01 | 00,026,260 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\icon0.png [2009-05-10 21:20:23 | 00,017,175 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.jpg [2009-05-10 21:18:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\PsGUI300beta [2009-05-10 21:17:15 | 00,625,561 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\PsGUI300beta.rar [2009-05-10 20:59:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder [2009-05-10 20:59:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\UHARC_GUI.2007-01-19 [2009-05-10 20:45:11 | 00,924,248 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\UHARC_GUI.2007-01-19.zip [2009-05-10 20:36:23 | 99,553,745 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.uha [2009-05-09 22:02:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection [2009-05-09 17:55:08 | 00,009,021 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\En-us-fuck.ogg [2009-05-09 11:21:46 | 00,016,968 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Infected.DVDRip.XviD-DEViSE.torrent [2009-05-09 10:57:22 | 13,180,871 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection.rar [2009-05-06 19:09:52 | 00,000,215 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\settings.ini [2009-05-06 19:09:50 | 00,066,314 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\log.xml [2009-05-06 17:44:06 | 00,035,840 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Chloroplast.doc [2009-05-06 16:53:55 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\xer.doc [2009-05-06 15:27:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Xilisoft Corporation [2009-05-05 17:21:02 | 16,430,149 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Xilisoft_HD_Video_Converter_5.1.23.0417__Serial_.rar [2009-05-05 09:25:43 | 00,022,528 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy Dokument programu Microsoft Word.doc [2009-05-04 21:44:21 | 89,565,226 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\1000.Zlych.Uczynkow.S01E01.PL.PDTV.XviD-P_J.xbus.avi [2009-05-04 21:06:40 | 00,001,547 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\neostrada tp.lnk [2009-05-04 21:05:35 | 00,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini [2009-05-04 21:05:35 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini [2009-05-04 21:05:27 | 00,155,648 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\adadix32.dll [2009-05-04 21:05:27 | 00,127,456 | ---- | C] () -- C:\WINDOWS\System32\IPDETECT.EXE [2009-05-04 21:05:26 | 00,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-05-04 21:05:26 | 00,126,489 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\drivers\adiusbaw.sys [2009-05-04 21:05:26 | 00,116,992 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\drivers\e4usbaw.sys [2009-05-04 21:05:26 | 00,024,576 | ---- | C] () -- C:\WINDOWS\enddisk32.exe [2009-05-04 21:05:26 | 00,012,169 | ---- | C] () -- C:\WINDOWS\System32\drivers\adiusbaw.cat [2009-05-04 21:05:26 | 00,010,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\e4usbaw.cat [2009-05-04 21:05:25 | 00,261,964 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep3.bnm [2009-05-04 21:05:25 | 00,261,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep1.bnm [2009-05-04 21:05:25 | 00,261,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld3.bnm [2009-05-04 21:05:25 | 00,261,932 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld0.bnm [2009-05-04 21:05:25 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei1.bnm [2009-05-04 21:05:25 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p0.BNM [2009-05-04 21:05:25 | 00,261,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld2.bnm [2009-05-04 21:05:25 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p3.BNM [2009-05-04 21:05:25 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p1.BNM [2009-05-04 21:05:25 | 00,261,916 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep0.bnm [2009-05-04 21:05:25 | 00,261,916 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei0.bnm [2009-05-04 21:05:25 | 00,261,914 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei2.bnm [2009-05-04 21:05:25 | 00,261,908 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei3.bnm [2009-05-04 21:05:25 | 00,261,900 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p2.BNM [2009-05-04 21:05:25 | 00,261,894 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld1.bnm [2009-05-04 21:05:25 | 00,261,892 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep2.bnm [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I2.BIN [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I1.BIN [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I0.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P2.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P1.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P0.BIN [2009-05-04 21:05:25 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P2.BIN [2009-05-04 21:05:25 | 00,152,036 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D2.BIN [2009-05-04 21:05:25 | 00,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D1.BIN [2009-05-04 21:05:25 | 00,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D0.BIN [2009-05-04 21:05:25 | 00,135,168 | ---- | C] (Analog Devices.) -- C:\WINDOWS\System32\unaddrv.exe [2009-05-04 21:05:25 | 00,081,088 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep4.bnm [2009-05-04 21:05:25 | 00,078,040 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei4.bnm [2009-05-04 21:05:25 | 00,064,000 | ---- | C] (Analog Deivces) -- C:\WINDOWS\System32\drivers\e4ldr.sys [2009-05-04 21:05:25 | 00,055,228 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld4.bnm [2009-05-04 21:05:25 | 00,050,007 | ---- | C] (Analog Deivces) -- C:\WINDOWS\System32\drivers\adildr.sys [2009-05-04 21:05:25 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-05-04 21:05:25 | 00,022,395 | ---- | C] () -- C:\WINDOWS\System32\drivers\fpga.bin [2009-05-04 21:05:25 | 00,022,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p4.BNM [2009-05-04 21:05:25 | 00,008,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\adildr.cat [2009-05-04 21:05:25 | 00,007,924 | ---- | C] () -- C:\WINDOWS\System32\drivers\e4ldr.cat [2009-05-04 21:05:25 | 00,004,981 | ---- | C] (SITECSOFT Co., LTD.) -- C:\WINDOWS\System32\ADADIX2K.DLL [2009-05-04 21:05:24 | 00,261,964 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i1.bnm [2009-05-04 21:05:24 | 00,261,962 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p3.bnm [2009-05-04 21:05:24 | 00,261,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i0.bnm [2009-05-04 21:05:24 | 00,261,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p1.bnm [2009-05-04 21:05:24 | 00,261,930 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p0.bnm [2009-05-04 21:05:24 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p2.bnm [2009-05-04 21:05:24 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i2.bnm [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P1.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P0.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I2.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I1.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I0.BIN [2009-05-04 21:05:24 | 00,053,590 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i4.bnm [2009-05-04 21:05:24 | 00,041,620 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p4.bnm [2009-05-04 21:05:24 | 00,000,033 | ---- | C] () -- C:\WINDOWS\System32\drivers\adidsl.cfg [2009-05-04 21:05:20 | 00,000,000 | ---D | C] -- C:\Program Files\SAGEM [2009-05-04 21:04:20 | 00,000,000 | ---D | C] -- C:\Program Files\neostrada tp [2009-05-03 19:34:35 | 03,197,110 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\YouTube - Police Control.avi [2009-05-03 18:00:10 | 03,299,576 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\CC CorePlayer V1.32-Signed.zip [2009-05-03 17:26:35 | 00,022,016 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Amplituda.doc [2009-05-03 12:56:13 | 61,220,133 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\pol2009.3.rar [2009-04-27 19:29:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Corel User Files [2009-04-27 19:25:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Corel [2009-04-27 19:25:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall [2009-04-25 20:53:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder (3) [2009-04-25 13:07:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\gtk-2.0 [2009-04-25 12:40:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Inkscape [2009-04-24 21:34:45 | 00,586,004 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.rar [2009-04-24 20:59:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\packagingOutput [2009-04-24 20:41:26 | 00,590,740 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.sis [2009-04-24 20:40:35 | 00,000,000 | ---D | C] -- C:\epoc32 [2009-04-24 20:30:46 | 00,000,271 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\.project [2009-04-24 20:04:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\.sketsa [2009-04-24 10:28:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\My Ringtones [2009-04-24 10:24:54 | 00,000,000 | ---D | C] -- C:\Program Files\One-click Ringtone Converter [2009-04-24 10:19:46 | 00,000,200 | ---- | C] () -- C:\WINDOWS\QCPC80UI.dat [2009-04-24 10:17:01 | 00,303,104 | ---- | C] () -- C:\WINDOWS\System32\ammpp.dll [2009-04-24 10:17:01 | 00,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2009-04-24 10:17:01 | 00,144,896 | ---- | C] () -- C:\WINDOWS\System32\lame_dshow.ax [2009-04-24 10:17:01 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\a1.dll [2009-04-24 10:17:01 | 00,003,772 | ---- | C] () -- C:\WINDOWS\System32\AudioFileConvert.tlb [2009-04-24 10:17:00 | 00,303,104 | ---- | C] () -- C:\WINDOWS\System32\qscl.dll [2009-04-24 10:17:00 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\amrdec.dll [2009-04-24 10:17:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\qcpsdk.dll [2009-04-24 10:17:00 | 00,000,000 | ---D | C] -- C:\AnMingringtone [2009-04-24 10:12:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Music Recognition [2009-04-23 20:53:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Mael [2009-04-23 19:17:13 | 00,000,000 | ---D | C] -- C:\Program Files\FIFA Soccer [2009-04-19 20:10:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\BESTplayer [2009-04-16 08:40:28 | 00,421,888 | ---- | C] (Gabest) -- C:\WINDOWS\System32\RealMediaSplitter.ax [2009-04-15 13:00:34 | 00,013,639 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\save.rar [2009-04-11 10:20:27 | 00,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfmonnt.dll [2009-04-11 10:20:26 | 00,000,164 | ---- | C] () -- C:\WINDOWS\System32\psconv.ini [2009-04-07 17:44:32 | 00,000,145 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini [2009-03-22 16:19:18 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-03-22 16:19:18 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-01-02 11:33:46 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\libssl32.dll [2008-12-25 19:20:03 | 00,000,331 | ---- | C] () -- C:\WINDOWS\doom3.ini [2008-11-19 16:41:13 | 00,000,255 | ---- | C] () -- C:\WINDOWS\ddf_edit.INI [2008-09-22 15:02:29 | 00,000,500 | ---- | C] () -- C:\WINDOWS\Fantastic Flame Screensaver.ini [2008-09-04 20:02:23 | 00,001,923 | ---- | C] () -- C:\WINDOWS\kaillera.ini [2008-09-01 17:29:41 | 00,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll [2008-08-17 23:08:31 | 00,000,024 | ---- | C] () -- C:\WINDOWS\LogonStudio.ini [2008-08-17 23:08:19 | 00,187,392 | ---- | C] () -- C:\WINDOWS\System32\JPGUtils.dll [2008-08-14 22:57:27 | 00,162,432 | ---- | C] () -- C:\WINDOWS\System32\drivers\vidstub.sys [2008-08-14 22:55:37 | 00,000,000 | ---- | C] () -- C:\WINDOWS\WB.ini [2008-08-08 14:50:15 | 00,000,291 | ---- | C] () -- C:\WINDOWS\thug2.ini [2008-07-15 14:14:10 | 00,000,191 | ---- | C] () -- C:\WINDOWS\MBMTool.INI [2008-06-28 21:33:50 | 00,021,738 | ---- | C] () -- C:\WINDOWS\hplj1300.ini [2008-06-17 13:56:55 | 00,210,456 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2008-06-17 13:56:55 | 00,206,360 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2008-06-17 13:56:55 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2008-06-17 13:56:55 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2008-06-17 13:56:55 | 00,194,072 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2008-06-17 13:56:55 | 00,026,136 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2008-06-09 19:23:19 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-05-20 13:56:12 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-05-12 15:29:19 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-05-12 15:29:18 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-05-10 21:53:31 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008-05-10 21:52:49 | 00,000,319 | ---- | C] () -- C:\WINDOWS\game.ini [2008-05-10 20:27:01 | 00,014,848 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2008-05-10 20:26:50 | 00,159,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347b.sys [2008-05-10 20:26:50 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347s.sys [2008-05-09 14:35:27 | 00,000,019 | ---- | C] () -- C:\WINDOWS\cie12.ini [2008-05-09 14:27:01 | 00,000,790 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2008-05-09 14:26:40 | 00,004,288 | ---- | C] () -- C:\WINDOWS\WINCMD.INI [2008-05-08 21:17:53 | 00,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys [2008-05-08 21:11:09 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008-05-08 21:11:08 | 00,014,595 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-05-08 21:10:59 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007-08-07 20:22:22 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2007-03-30 00:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2006-04-14 10:14:12 | 00,014,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2006-03-19 13:34:58 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialCE.dll [2006-03-19 13:34:42 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll [2005-07-30 08:21:32 | 00,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2005-06-15 11:20:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-06-15 11:20:00 | 01,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-06-15 11:20:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-06-15 11:20:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2005-06-15 11:20:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-06-15 11:20:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2005-02-05 22:46:00 | 00,004,608 | ---- | C] () -- C:\WINDOWS\fgexec.dll [2004-08-22 18:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-03-18 19:40:32 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-03-18 19:40:24 | 00,667,648 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2003-01-28 01:09:20 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\libexpat.dll [2002-03-17 02:00:00 | 00,007,420 | ---- | C] () -- C:\WINDOWS\UA000088.DLL [2002-03-17 02:00:00 | 00,007,420 | ---- | C] () -- C:\WINDOWS\UA000035.DLL [2001-08-13 20:09:48 | 00,659,520 | ---- | C] () -- C:\WINDOWS\System32\vbid3lib.dll [2001-07-31 09:17:12 | 00,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [2001-07-21 22:16:20 | 00,000,594 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2001-04-20 19:23:28 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\PManager.dll [1998-09-07 01:03:36 | 00,012,208 | ---- | C] () -- C:\WINDOWS\System32\Cdio16.dll [1998-09-07 00:55:42 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\cdio32.dll [color=orange]========== Files - Modified Within 30 Days ==========[/color] [3 C:\WINDOWS\System32\*.tmp files] [7 C:\WINDOWS\*.tmp files] [2009-05-11 15:37:02 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [2009-05-11 15:16:05 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\desktop.ini [2009-05-11 15:16:05 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-11 15:16:04 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-11 08:58:09 | 01,838,409 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\USBREMOTE.rar [2009-05-10 22:54:02 | 00,124,454 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\RemoteJoyLite_019.zip [2009-05-10 22:40:49 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-05-10 22:03:20 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2009-05-10 21:32:50 | 00,026,260 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\icon0.png [2009-05-10 21:22:00 | 00,165,022 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\pic1.png [2009-05-10 21:21:37 | 00,076,747 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver_2.jpg [2009-05-10 21:20:24 | 00,017,175 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.jpg [2009-05-10 21:17:20 | 00,625,561 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\PsGUI300beta.rar [2009-05-10 20:50:38 | 99,553,745 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.uha [2009-05-10 20:45:28 | 00,924,248 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\UHARC_GUI.2007-01-19.zip [2009-05-09 17:55:08 | 00,009,021 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\En-us-fuck.ogg [2009-05-09 12:27:46 | 00,004,288 | ---- | M] () -- C:\WINDOWS\WINCMD.INI [2009-05-09 12:19:56 | 00,000,790 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini [2009-05-09 11:21:47 | 00,016,968 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Infected.DVDRip.XviD-DEViSE.torrent [2009-05-09 11:00:58 | 13,180,871 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection.rar [2009-05-08 16:19:35 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-06 19:10:55 | 00,066,314 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\log.xml [2009-05-06 19:10:55 | 00,000,215 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\settings.ini [2009-05-06 17:44:06 | 00,035,840 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Chloroplast.doc [2009-05-06 16:53:55 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\xer.doc [2009-05-05 17:23:06 | 16,430,149 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Xilisoft_HD_Video_Converter_5.1.23.0417__Serial_.rar [2009-05-05 09:26:56 | 00,022,528 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy Dokument programu Microsoft Word.doc [2009-05-04 21:58:20 | 89,565,226 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\1000.Zlych.Uczynkow.S01E01.PL.PDTV.XviD-P_J.xbus.avi [2009-05-04 21:06:40 | 00,001,547 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\neostrada tp.lnk [2009-05-04 21:06:25 | 00,000,168 | ---- | M] () -- C:\WINDOWS\adidsl.ini [2009-05-04 21:05:35 | 00,000,033 | ---- | M] () -- C:\WINDOWS\System32\drivers\adidsl.cfg [2009-05-04 21:05:35 | 00,000,021 | ---- | M] () -- C:\WINDOWS\Fast800.ini [2009-05-03 19:34:38 | 03,197,110 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\YouTube - Police Control.avi [2009-05-03 18:01:18 | 03,299,576 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\CC CorePlayer V1.32-Signed.zip [2009-05-03 17:26:35 | 00,022,016 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Amplituda.doc [2009-05-03 13:11:21 | 61,220,133 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\pol2009.3.rar [2009-05-02 10:05:05 | 00,023,732 | -H-- | M] () -- C:\treeinfo.wc [2009-04-24 21:34:45 | 00,586,004 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.rar [2009-04-24 21:01:20 | 00,590,740 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.sis [2009-04-24 20:30:47 | 00,000,271 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\.project [2009-04-24 10:26:51 | 00,000,200 | ---- | M] () -- C:\WINDOWS\QCPC80UI.dat [2009-04-24 10:17:13 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2009-04-19 13:29:03 | 00,000,191 | ---- | M] () -- C:\WINDOWS\MBMTool.INI [2009-04-16 08:40:28 | 00,421,888 | ---- | M] (Gabest) -- C:\WINDOWS\System32\RealMediaSplitter.ax [2009-04-15 13:00:34 | 00,013,639 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\save.rar [2009-04-14 11:17:56 | 01,225,108 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-04-14 11:17:56 | 00,541,692 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-04-14 11:17:56 | 00,480,660 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-04-14 11:17:56 | 00,103,646 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-04-14 11:17:56 | 00,082,616 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [color=orange]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 168 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:0CE7F3C9 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF < End of report >

wojtas napisał(a):daj screena

**Posty:** 18165 · przez **wojtas** 11 Maj 2009, 21:39

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - AutoRun File - [2005-11-04 08:22:30 | 00,000,160 | R--- | M] () - H:\autorun.inf -- [ CDFS ]

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 2042 · przez **Wojtaz** 12 Maj 2009, 09:25

Dodatkowo włączyły mi się aktualizacje :1:

Kod: Zaznacz wszystko: ========== OTLISTIT ========== Process explorer.exe killed successfully! File move failed. H:\autorun.inf scheduled to be moved on reboot. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.6 log created on 05122009_091910 Files moved on Reboot... File move failed. H:\autorun.inf scheduled to be moved on reboot. Registry entries deleted on Reboot...

napęd H:\, to napęd wirtualny jest, a w nim zamontowany NFS MW

**Posty:** 18165 · przez **wojtas** 12 Maj 2009, 10:28

a raport z kaspra?

**Posty:** 2042 · przez **Wojtaz** 12 Maj 2009, 22:11

Combofix:

Kod: Zaznacz wszystko: ComboFix 09-05-12.04 - Wojtaz 2009-05-12 22:06.13 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.281 [GMT 2:00] Uruchomiony z: c:\documents and settings\Wojtaz\Pulpit\ComboFix.exe UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system\ACD.CMD c:\windows\system\ACD2.CMD c:\windows\system32\Ijl11.dll c:\windows\system32\kmon.ocx c:\windows\system32\ktkbdhk3.dll c:\windows\system32\pac.exe c:\windows\system32\scrrntr.dll . ---- Poprzednie uruchomienie ------- . C:\autorun.inf C:\copy.exe C:\host.exe c:\windows\autorun.inf c:\windows\svchost.exe c:\windows\system32\temp1.exe c:\windows\system32\temp2.exe c:\windows\xcopy.exe D:\Autorun.inf D:\copy.exe D:\host.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ISODRIVE -------\Service_ISODrive ((((((((((((((((((((((((( Pliki utworzone od 2009-04-12 do 2009-05-12 ))))))))))))))))))))))))))))))) . 2009-05-12 18:19 . 2009-05-12 18:19 -------- d-----w C:\SDFix 2009-05-12 18:15 . 2009-05-12 18:15 -------- d-----w C:\rsit 2009-05-12 15:15 . 2009-05-12 15:15 -------- d-----w c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Reveal 2009-05-12 15:09 . 2009-05-12 15:10 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Reveal 2009-05-12 12:34 . 2009-05-12 12:34 -------- d-----w C:\ERDNT 2009-05-12 12:34 . 2009-05-12 12:34 -------- d-----w c:\windows\ERUNT 2009-05-12 12:34 . 2009-05-12 12:34 -------- d-----w C:\!FixIEDef 2009-05-12 12:33 . 2009-05-12 12:33 -------- d-----w c:\windows\system32\CatRoot_bak 2009-05-12 12:29 . 2009-05-12 12:29 -------- d-----w c:\documents and settings\Wojtaz\DoctorWeb 2009-05-12 07:19 . 2009-05-12 07:19 -------- d-----w C:\_OTListIt 2009-05-04 19:04 . 2009-05-12 19:59 -------- d-----w c:\program files\neostrada tp 2009-04-27 17:25 . 2009-04-27 17:25 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Corel 2009-04-27 17:25 . 2009-04-27 17:25 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Thinstall 2009-04-25 11:07 . 2009-04-27 17:38 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\gtk-2.0 2009-04-25 10:40 . 2009-04-25 10:40 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Inkscape 2009-04-24 18:40 . 2009-04-24 18:40 -------- d-----w C:\epoc32 2009-04-24 18:04 . 2009-04-24 18:04 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\.sketsa 2009-04-24 08:24 . 2009-04-24 08:24 -------- d-----w c:\program files\One-click Ringtone Converter 2009-04-24 08:19 . 2009-04-24 08:26 200 ----a-w c:\windows\QCPC80UI.dat 2009-04-24 08:17 . 2002-09-06 09:36 233472 ----a-w c:\windows\system32\lame_enc.dll 2009-04-24 08:17 . 2006-12-24 05:34 303104 ----a-w c:\windows\system32\ammpp.dll 2009-04-24 08:17 . 2006-12-24 05:36 73728 ----a-w c:\windows\system32\a1.dll 2009-04-24 08:17 . 2007-03-25 18:46 212992 ----a-w c:\windows\system32\amrdec.dll 2009-04-24 08:17 . 2005-04-15 11:22 303104 ----a-w c:\windows\system32\qscl.dll 2009-04-24 08:17 . 2006-12-21 13:47 81920 ----a-w c:\windows\system32\qcpsdk.dll 2009-04-24 08:17 . 2009-04-24 08:17 -------- d-----w C:\AnMingringtone 2009-04-24 08:12 . 2009-04-24 08:12 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Music Recognition 2009-04-23 18:53 . 2009-04-23 18:53 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\Mael 2009-04-23 17:17 . 2009-04-23 17:17 -------- d-----w c:\program files\FIFA Soccer 2009-04-19 18:10 . 2009-04-19 18:11 -------- d-----w c:\documents and settings\Wojtaz\Dane aplikacji\BESTplayer . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-12 19:53 . 2008-05-25 10:39 -------- d-----w c:\program files\Java 2009-05-04 19:05 . 2009-05-04 19:05 33 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-05-04 19:05 . 2008-05-08 19:11 -------- d--h--w c:\program files\InstallShield Installation Information 2009-05-04 19:05 . 2009-05-04 19:05 -------- d-----w c:\program files\SAGEM 2009-04-30 18:41 . 2008-10-28 08:16 -------- d-----w c:\program files\NAPI-PROJEKT 2009-04-14 09:17 . 2001-10-26 14:15 541692 ----a-w c:\windows\system32\perfh015.dat 2009-04-14 09:17 . 2001-10-26 14:15 103646 ----a-w c:\windows\system32\perfc015.dat 2009-04-11 08:20 . 2009-04-11 08:20 -------- d-----w c:\program files\psconvert 2009-04-08 18:16 . 2009-04-08 18:16 196941305 ----a-w C:\NFS_Porsche_Unleashed.zip 2009-04-04 12:53 . 2008-05-11 18:58 90760 ----a-w c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-03-13 20:37 . 2008-10-17 17:43 481864 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Komunikator"="d:\program files\Tlen.pl\tlen.exe" [2008-08-25 5853160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 995328] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-17 81920] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-17 8478720] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2004-10-27 135680] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "<NO NAME>"= 0 "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\windows\system32\logonui.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \[u]0[/u] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\Tlen.pl\\tlen.exe"= "d:\\Program Files\\BearShare\\BearShare.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "d:\\Program Files\\UltraVNC\\vncviewer.exe"= "d:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\system32\\wuauclt.exe"= "c:\\WINDOWS\\system32\\HDAShCut.exe"= "c:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "67:UDP"= 67:UDP:DHCP Discovery Service "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\loinne.sys --> c:\windows\system32\drivers\loinne.sys [?] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [2009-04-08 17792] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2009-05-04 64000] S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2009-05-04 116992] S3 gggen;Generic USB Flash Driver;c:\windows\system32\drivers\gggen.sys [2008-05-08 11648] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;c:\windows\system32\drivers\libusb0.sys [2008-05-14 29184] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-01-27 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-01-27 8320] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] S3 PsSdk41;PsSdk41;c:\windows\system32\drivers\pssdk41.sys [2008-06-13 36928] S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2008-05-10 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2008-05-10 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2008-05-10 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2008-05-10 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2008-05-10 98568] S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\system32\drivers\s125bus.sys [2008-05-26 83336] S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\system32\drivers\s125mdfl.sys [2008-07-05 15112] S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\system32\drivers\s125mdm.sys [2008-07-05 108680] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - BootScreen [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20612832-80f6-11dd-9658-0015f2bb93a0}] \Shell\Auto\command - I:\activexdebugger32.exe f \Shell\AUToplaY\coMMaNd - I:\fpohd.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - I:\activexdebugger32.exe f \Shell\open\Command - I:\activexdebugger32.exe f . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.neostrada.pl uInternet Settings,ProxyOverride = <local> TCP: {52A11F0F-890C-4730-A989-FEE6EEEBA053} = 192.168.1.1,192.168.1.13 FF - ProfilePath - c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\ywdopzl0.default\ FF - prefs.js: browser.startup.homepage - www.google.pl FF - plugin: c:\program files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll FF - plugin: d:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF - plugin: d:\program files\Mozilla Firefox\plugins\npWebLaunch.dll FF - plugin: d:\program files\Opera\program\plugins\npdsplay.dll FF - plugin: d:\program files\Opera\program\plugins\NPSWF32.dll FF - plugin: d:\program files\Opera\program\plugins\npWebLaunch.dll FF - plugin: d:\program files\Opera\program\plugins\npwmsdrm.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin2.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin3.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin4.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin5.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin6.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin7.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-12 22:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-05-12 22:09 ComboFix-quarantined-files.txt 2009-05-12 20:09 Przed: 8,201,605,120 bajtów wolnych Po: 8,272,584,704 bajtów wolnych 207

Hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:10, on 2009-05-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Tlen.pl\tlen.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe D:\Program Files\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O17 - HKLM\System\CCS\Services\Tcpip\..\{52A11F0F-890C-4730-A989-FEE6EEEBA053}: NameServer = 192.168.1.1,192.168.1.13 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Unknown owner - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing) -- End of file - 3217 bytes

tak:
awaryjny nie działa, PC nie włączał się, dopiero nowa patrycja i system na nowej patrycji pomógł... Więc logu z SDFix nie dam

Dodano 12.05.2009 22:13:55:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 22:12:32 on Tuesday, May 12, 2009 Time Zone : Logged On User : Wojtaz Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 AMD Sempron(tm) Processor 2600+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 8.22 GB Total Physical Memory: 511 MB Free Physical Memory : 257 MB Total Page File : 511 MB Free Page File : 1052 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1965 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

edytor rejestru, menadżer zadań nie działa. Coś jak z tego tematu:
log-w-kazdym-folderze-plik-eml-wyskakujacepowiadomienia-vt109106s60.html
wirus się wziął u mnie z pendrive'a

Dodano 12.05.2009 22:14:39:

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Wojtaz at 2009-05-12 22:14:33 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 8 GB (41%) free of 20 GB Total RAM: 511 MB (39% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:14, on 2009-05-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Tlen.pl\tlen.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\bkrya.exe C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\w7031a.exe C:\WINDOWS\explorer.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\lheh.exe C:\Documents and Settings\Wojtaz\Pulpit\RSIT.exe D:\Program Files\Wojtaz.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O17 - HKLM\System\CCS\Services\Tcpip\..\{52A11F0F-890C-4730-A989-FEE6EEEBA053}: NameServer = 192.168.1.1,192.168.1.13 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Unknown owner - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing) -- End of file - 3408 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll [2008-03-25 509328] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 135680] "SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 995328] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-08-17 81920] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-08-17 8478720] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Komunikator"=D:\Program Files\Tlen.pl\tlen.exe [2008-08-25 5853160] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio] D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe [2002-09-03 987187] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] C:\WINDOWS\system32\NvCpl.dll [2007-08-17 8478720] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] D:\Program Files\QuickTime\qttask.exe [2008-01-31 385024] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe [2003-03-31 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2004-06-30 113664] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] D:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-24 29696] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] ""=0 "DisableTaskMgr"=1 "DisableRegistryTools"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDrives"=0 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\Program Files\Tlen.pl\tlen.exe"="D:\Program Files\Tlen.pl\tlen.exe:*:Enabled:ipsec" "D:\Program Files\BearShare\BearShare.exe"="D:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "D:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="D:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) " "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil" "D:\Program Files\UltraVNC\vncviewer.exe"="D:\Program Files\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe" "D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" "C:\WINDOWS\system32\wuauclt.exe"="C:\WINDOWS\system32\wuauclt.exe:*:Enabled:ipsec" "C:\WINDOWS\system32\HDAShCut.exe"="C:\WINDOWS\system32\HDAShCut.exe:*:Enabled:ipsec" "C:\Program Files\Analog Devices\Core\smax4pnp.exe"="C:\Program Files\Analog Devices\Core\smax4pnp.exe:*:Enabled:ipsec" "C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\bkrya.exe"="C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\bkrya.exe:*:Enabled:ipsec" "C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\w7031a.exe"="C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\w7031a.exe:*:Enabled:ipsec" "C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\qnjl.exe"="C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\qnjl.exe:*:Enabled:ipsec" "C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\lheh.exe"="C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\lheh.exe:*:Enabled:ipsec" "C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\winlbnvo.exe"="C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\winlbnvo.exe:*:Enabled:ipsec" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20612832-80f6-11dd-9658-0015f2bb93a0}] shell\Auto\command - I:\activexdebugger32.exe f shell\AUToplaY\command - I:\fpohd.exe shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f shell\explore\command - I:\activexdebugger32.exe f shell\open\command - I:\activexdebugger32.exe f ======List of files/folders created in the last 1 months====== 2009-05-12 22:09:38 ----A---- C:\ComboFix.txt 2009-05-12 22:06:17 ----D---- C:\ComboFix 2009-05-12 20:19:34 ----D---- C:\SDFix 2009-05-12 20:15:07 ----D---- C:\rsit 2009-05-12 17:09:54 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Reveal 2009-05-12 14:34:53 ----D---- C:\ERDNT 2009-05-12 14:34:50 ----D---- C:\WINDOWS\ERUNT 2009-05-12 14:34:39 ----D---- C:\!FixIEDef 2009-05-12 14:33:26 ----D---- C:\WINDOWS\system32\CatRoot_bak 2009-05-12 09:19:10 ----D---- C:\_OTListIt 2009-05-12 09:12:55 ----D---- C:\WINDOWS\system32\SoftwareDistribution 2009-05-04 21:05:35 ----A---- C:\WINDOWS\Fast800.ini 2009-05-04 21:05:35 ----A---- C:\WINDOWS\adidsl.ini 2009-05-04 21:05:27 ----A---- C:\WINDOWS\system32\IPDETECT.EXE 2009-05-04 21:05:27 ----A---- C:\WINDOWS\system32\adadix32.dll 2009-05-04 21:05:26 ----A---- C:\WINDOWS\system32\coclassfast.dll 2009-05-04 21:05:26 ----A---- C:\WINDOWS\enddisk32.exe 2009-05-04 21:05:25 ----A---- C:\WINDOWS\system32\unaddrv.exe 2009-05-04 21:05:25 ----A---- C:\WINDOWS\system32\ADADIX2K.DLL 2009-05-04 21:05:25 ----A---- C:\WINDOWS\system32\ADADIX16.DLL 2009-05-04 21:05:20 ----D---- C:\Program Files\SAGEM 2009-05-04 21:04:20 ----D---- C:\Program Files\neostrada tp 2009-05-04 19:16:31 ----A---- C:\WINDOWS\ModemLog_Nokia N82 USB Modem #3.txt 2009-04-27 19:25:33 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Corel 2009-04-27 19:25:32 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall 2009-04-25 13:07:26 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\gtk-2.0 2009-04-25 12:40:09 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Inkscape 2009-04-24 20:40:35 ----D---- C:\epoc32 2009-04-24 20:04:47 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\.sketsa 2009-04-24 10:24:54 ----D---- C:\Program Files\One-click Ringtone Converter 2009-04-24 10:17:01 ----A---- C:\WINDOWS\system32\lame_enc.dll 2009-04-24 10:17:01 ----A---- C:\WINDOWS\system32\ammpp.dll 2009-04-24 10:17:01 ----A---- C:\WINDOWS\system32\a1.dll 2009-04-24 10:17:00 ----D---- C:\AnMingringtone 2009-04-24 10:17:00 ----A---- C:\WINDOWS\system32\qscl.dll 2009-04-24 10:17:00 ----A---- C:\WINDOWS\system32\qcpsdk.dll 2009-04-24 10:17:00 ----A---- C:\WINDOWS\system32\amrdec.dll 2009-04-24 10:12:24 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Music Recognition 2009-04-23 20:53:26 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Mael 2009-04-23 19:17:13 ----D---- C:\Program Files\FIFA Soccer 2009-04-19 20:10:55 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\BESTplayer 2009-04-17 17:33:19 ----A---- C:\Nowy Dokument tekstowy.txt 2009-04-17 17:32:53 ----A---- C:\www.symbian-freak.com.txt ======List of files/folders modified in the last 1 months====== 2009-05-12 22:12:36 ----D---- C:\WINDOWS\temp 2009-05-12 22:11:49 ----D---- C:\WINDOWS\Prefetch 2009-05-12 22:09:41 ----D---- C:\WINDOWS\system32 2009-05-12 22:09:40 ----D---- C:\WINDOWS 2009-05-12 22:09:08 ----D---- C:\Qoobox 2009-05-12 22:08:10 ----A---- C:\WINDOWS\system.ini 2009-05-12 22:07:36 ----D---- C:\WINDOWS\system32\drivers 2009-05-12 22:07:36 ----D---- C:\WINDOWS\AppPatch 2009-05-12 22:07:35 ----D---- C:\Program Files\Common Files 2009-05-12 22:06:58 ----D---- C:\WINDOWS\system 2009-05-12 22:06:49 ----D---- C:\WINDOWS\system32\CatRoot2 2009-05-12 22:06:32 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-05-12 22:03:57 ----D---- C:\WINDOWS\system32\ias 2009-05-12 22:03:40 ----A---- C:\WINDOWS\ModemLog_Bluetooth LAP Modem.txt 2009-05-12 22:03:40 ----A---- C:\WINDOWS\ModemLog_Bluetooth LAP Modem #2.txt 2009-05-12 22:01:39 ----ASH---- C:\boot.ini 2009-05-12 21:53:08 ----D---- C:\Program Files\Java 2009-05-12 21:31:53 ----SHD---- C:\System Volume Information 2009-05-12 20:20:51 ----A---- C:\WINDOWS\win.ini 2009-05-12 19:49:58 ----A---- C:\WINDOWS\NeroDigital.ini 2009-05-12 17:56:28 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\foobar2000 2009-05-12 17:23:16 ----A---- C:\m.txt 2009-05-12 16:59:32 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Tlen.pl 2009-05-12 16:48:18 ----D---- C:\WINDOWS\system32\CatRoot 2009-05-12 16:47:56 ----HD---- C:\WINDOWS\inf 2009-05-12 16:09:22 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2009-05-12 16:08:00 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2009-05-12 14:34:50 ----D---- C:\WINDOWS\erdnt 2009-05-12 14:33:26 ----D---- C:\WINDOWS\Debug 2009-05-12 14:27:53 ----SHD---- C:\WINDOWS\CSC 2009-05-12 09:23:20 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-05-12 09:13:05 ----D---- C:\WINDOWS\SoftwareDistribution 2009-05-12 09:13:04 ----D---- C:\WINDOWS\Help 2009-05-11 21:00:30 ----A---- C:\WINDOWS\WINCMD.INI 2009-05-11 19:42:03 ----A---- C:\WINDOWS\wcx_ftp.ini 2009-05-10 21:32:54 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe 2009-05-10 21:18:43 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Adobe 2009-05-06 22:23:07 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\uTorrent 2009-05-04 21:05:23 ----HD---- C:\Program Files\InstallShield Installation Information 2009-05-04 21:05:20 ----RD---- C:\Program Files 2009-05-01 15:36:46 ----A---- C:\WINDOWS\VFind.exe 2009-04-30 20:41:55 ----D---- C:\Program Files\NAPI-PROJEKT 2009-04-25 11:08:32 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-04-24 10:25:37 ----SHD---- C:\WINDOWS\Installer 2009-04-24 10:05:10 ----D---- C:\WINDOWS\system32\LogFiles 2009-04-20 12:56:28 ----A---- C:\WINDOWS\Nircmd.exe 2009-04-19 13:29:03 ----A---- C:\WINDOWS\MBMTool.INI 2009-04-14 14:21:10 ----D---- C:\Documents and Settings\Wojtaz\Dane aplikacji\Hamachi 2009-04-14 11:17:56 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;Sterownik procesora AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-02 43520] R1 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-17 12032] R2 pnarp;Pure Networks Device Discovery Driver; C:\WINDOWS\system32\DRIVERS\pnarp.sys [2008-01-08 23992] R2 purendis;Pure Networks Wireless Driver; C:\WINDOWS\system32\DRIVERS\purendis.sys [2008-01-08 25272] R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\loinne.sys [] R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-06 141312] R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-05 127872] R3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2006-06-23 31488] R3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys [2005-08-31 20480] R3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-07-30 11988] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-14 5810] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-08-17 6842208] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-07-30 34048] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-07-30 12928] R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-17 5888] R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Standardowy sterownik koncentratora USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] R3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312] R3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2006-02-28 84836] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM); C:\WINDOWS\system32\DRIVERS\vcsvad.sys [2008-12-10 17792] R4 catchme;catchme; \??\C:\DOCUME~1\Wojtaz\USTAWI~1\Temp\catchme.sys [] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys); C:\WINDOWS\System32\Drivers\e4ldr.sys [2006-09-15 64000] S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2006-01-19 10068] S3 btaudio;Urządzenie dźwiękowe Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [] S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2006-07-16 23040] S3 BTDriver;Sterownik do komunikacji wirtualnej Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [] S3 BTKRNL;Licznik magistrali Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [] S3 BTWDNDIS;Serwer dostępu do sieci LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [] S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 dot4;Sterownik MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2004-08-03 207360] S3 Dot4Print;Sterownik klasy drukowania dla IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928] S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-26 23936] S3 e4usbaw;USB ADSL2 WAN Adapter; C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 116992] S3 gggen;Generic USB Flash Driver; C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 11648] S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2006-09-28 11648] S3 GVCplDrv;GVCplDrv; C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 23040] S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-01-23 10546] S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920] S3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120; C:\WINDOWS\system32\DRIVERS\libusb0.sys [2006-04-23 29184] S3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664] S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016] S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS [] S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS [] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632] S3 PPJoyBus;Parallel Port Joystick Bus device driver; C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 13952] S3 PPortJoystick;Parallel Port Joystick device driver; C:\WINDOWS\system32\drivers\PPortJoy.sys [2004-10-24 28800] S3 PsSdk41;PsSdk41; \??\C:\WINDOWS\system32\Drivers\pssdk41.sys [] S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 83336] S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 15112] S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 108680] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600] S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 ZDCndis5;ZDCndis5 Protocol Driver; \??\C:\WINDOWS\system32\ZDCndis5.SYS [] S3 ZDPSp50;ZDPSp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\ZDPSp50.sys [] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-08-23 40960] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-08-17 155716] R2 StarWindService;StarWind iSCSI Service; D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600] S2 nmservice;Pure Networks Platform Service; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [] S2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2002-08-01 65536] S4 BlueSoleil Hid Service;BlueSoleil Hid Service; D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe [2005-04-06 110592] S4 Capture Device Service;Capture Device Service; C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe [2007-03-06 198168] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880] S4 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-08-07 575488] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 12 Maj 2009, 23:05

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20612832-80f6-11dd-9658-0015f2bb93a0}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

skasuj:

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

te plik/i :

c:\windows\system32\drivers\loinne.sys

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow oraz przeczysc folder:

C:\DOCUME~1\Wojtaz\USTAWI~1\Temp

i daj nowe logi

**Posty:** 2042 · przez **Wojtaz** 13 Maj 2009, 12:56

wojtas napisał(a):w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

skasuj:

edycja rejestru została wyłączona przez administratora sieci

wojtas napisał(a):O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

usunę to i po chwili wraca, nawet jak kliknę fix.reg

wojtas napisał(a):c:\windows\system32\drivers\loinne.sys

nie ma takiego pliku :1:

wojtas napisał(a):C:\DOCUME~1\Wojtaz\USTAWI~1\Temp

czyściłem CCleaner.
Dodatkowo co chwilę jakiś syf mi się robi bo pojawia się klepsydra i znika.....

Dodano 13.05.2009 13:04:42:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 12:58:47 on Wednesday, May 13, 2009 Time Zone : Logged On User : Wojtaz Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 AMD Sempron(tm) Processor 2600+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 7.66 GB Total Physical Memory: 511 MB Free Physical Memory : 256 MB Total Page File : 511 MB Free Page File : 1042 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1961 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-13 13:01:26 - Run 3 OTListIt2 by OldTimer - Version 2.0.15.6 Folder = C:\Documents and Settings\Wojtaz\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511.30 Mb Total Physical Memory | 235.68 Mb Available Physical Memory | 46.09% Memory free 1.22 Gb Paging File | 1.00 Gb Available in Paging File | 82.06% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19.53 Gb Total Space | 7.44 Gb Free Space | 38.09% Space Free | Partition Type: NTFS Drive D: | 146.48 Gb Total Space | 9.89 Gb Free Space | 6.75% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded Drive H: | 673.61 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive I: | 20.28 Gb Total Space | 17.95 Gb Free Space | 88.48% Space Free | Partition Type: NTFS Computer Name: WOJTAZ Current User Name: Wojtaz Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [2007-08-17 17:23:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2005-04-02 02:51:48 | 00,217,600 | ---- | M] (Rocket Division Software) -- D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe PRC - [2005-05-20 19:11:06 | 00,995,328 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe PRC - [2007-04-27 20:10:18 | 01,441,792 | ---- | M] (IVT Corporation) -- D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2009-05-11 15:37:02 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2007-10-24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-04-06 17:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service [Disabled | Stopped]) SRV - [2007-03-06 10:35:02 | 00,271,896 | ---- | M] (InterVideo Inc.) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service [Disabled | Stopped]) SRV - [2007-10-24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2007-10-09 12:58:12 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2005-04-04 00:41:10 | 00,147,456 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2007-10-11 09:55:10 | 00,864,256 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - File not found -- -- (mnmsrvc [On_Demand | Stopped]) SRV - [2007-10-11 09:55:14 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - File not found -- -- (nmservice [Auto | Stopped]) SRV - [2007-08-17 17:23:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2003-07-28 21:28:22 | 00,158,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2002-08-01 10:22:40 | 00,065,536 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12 [On_Demand | Stopped]) SRV - [2008-08-07 12:17:30 | 00,575,488 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [Disabled | Stopped]) SRV - [2005-04-02 02:51:48 | 00,217,600 | ---- | M] (Rocket Division Software) -- D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- (StarWindService [Auto | Running]) SRV - File not found -- -- (UleadBurningHelper [Auto | Stopped]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - File not found -- -- (abp470n5 [On_Demand | Running]) DRV - [2005-10-06 03:21:10 | 00,141,312 | R--- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService [On_Demand | Running]) DRV - [2005-03-05 06:53:00 | 00,127,872 | R--- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\AEAudio.sys -- (AEAudioService [On_Demand | Running]) DRV - [2006-07-02 00:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2006-06-23 17:00:26 | 00,031,488 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\blueletaudio.sys -- (BlueletAudio [On_Demand | Running]) DRV - [2005-08-31 11:34:52 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio [On_Demand | Running]) DRV - [2006-01-19 14:31:34 | 00,010,068 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\btnetdrv.sys -- (BT [On_Demand | Stopped]) DRV - [2006-07-16 17:06:16 | 00,023,040 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\btcusb.sys -- (Btcsrusb [On_Demand | Running]) DRV - [2005-07-30 08:21:32 | 00,011,988 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\vbtenum.sys -- (BTHidEnum [On_Demand | Running]) DRV - [2005-05-01 06:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr [Boot | Running]) DRV - [2004-08-22 17:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running]) DRV - [2004-08-22 17:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running]) DRV - [2006-09-19 11:03:28 | 00,116,992 | ---- | M] (Analog Devices Inc.) -- C:\WINDOWS\system32\DRIVERS\e4usbaw.sys -- (e4usbaw [On_Demand | Stopped]) DRV - [2006-09-28 14:10:52 | 00,011,648 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\system32\DRIVERS\gggen.sys -- (gggen [On_Demand | Stopped]) DRV - [2006-09-28 14:10:52 | 00,011,648 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\system32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped]) DRV - [2004-05-02 10:47:08 | 00,023,040 | R--- | M] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv [On_Demand | Stopped]) DRV - [2009-01-23 11:37:56 | 00,010,546 | ---- | M] (Applied Networking Inc.) -- C:\WINDOWS\system32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped]) DRV - [2004-10-27 15:21:30 | 00,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\HdAudio.sys -- (HdAudAddService [On_Demand | Stopped]) DRV - [2004-10-27 15:21:36 | 00,138,240 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2006-09-15 11:07:54 | 00,064,000 | ---- | M] (Analog Deivces) -- C:\WINDOWS\System32\Drivers\e4ldr.sys -- (IKANLOADER2 [Auto | Stopped]) DRV - [2006-04-23 05:34:34 | 00,029,184 | ---- | M] (http://libusb-win32.sourceforge.net) -- C:\WINDOWS\system32\DRIVERS\libusb0.sys -- (libusb0 [On_Demand | Stopped]) DRV - [2004-08-14 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running]) DRV - [2008-09-15 08:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped]) DRV - [2008-09-15 08:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped]) DRV - [2008-02-01 16:17:12 | 00,138,112 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu [On_Demand | Stopped]) DRV - [2008-02-01 16:17:06 | 00,008,320 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc [On_Demand | Stopped]) DRV - [2007-08-17 17:23:00 | 06,842,208 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2005-08-13 08:31:12 | 00,098,432 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2005-07-30 11:11:02 | 00,034,048 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running]) DRV - [2005-07-30 11:11:04 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2003-08-04 14:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2007-09-17 16:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped]) DRV - [2008-01-08 17:16:10 | 00,023,992 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\DRIVERS\pnarp.sys -- (pnarp [Auto | Running]) DRV - [2004-10-24 08:11:00 | 00,013,952 | ---- | M] (Deon van der Westhuysen) -- C:\WINDOWS\system32\drivers\PPJoyBus.sys -- (PPJoyBus [On_Demand | Stopped]) DRV - [2004-10-24 08:11:00 | 00,028,800 | ---- | M] (Deon van der Westhuysen) -- C:\WINDOWS\system32\drivers\PPortJoy.sys -- (PPortJoystick [On_Demand | Stopped]) DRV - [2008-06-13 19:08:13 | 00,036,928 | ---- | M] (microOLAP Technologies LTD) -- C:\WINDOWS\system32\Drivers\pssdk41.sys -- (PsSdk41 [On_Demand | Stopped]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-01-08 17:16:10 | 00,025,272 | ---- | M] (Pure Networks, Inc.) -- C:\WINDOWS\system32\DRIVERS\purendis.sys -- (purendis [Auto | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-08-17 21:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Running]) DRV - [2007-04-23 15:54:46 | 00,083,208 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115bus.sys -- (s115bus [On_Demand | Stopped]) DRV - [2007-04-23 15:54:48 | 00,015,112 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mdfl.sys -- (s115mdfl [On_Demand | Stopped]) DRV - [2007-04-23 15:54:48 | 00,108,680 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mdm.sys -- (s115mdm [On_Demand | Stopped]) DRV - [2007-04-23 15:54:50 | 00,100,488 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115mgmt.sys -- (s115mgmt [On_Demand | Stopped]) DRV - [2007-04-23 15:54:50 | 00,098,568 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s115obex.sys -- (s115obex [On_Demand | Stopped]) DRV - [2007-04-24 11:33:34 | 00,083,336 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125bus.sys -- (s125bus [On_Demand | Stopped]) DRV - [2007-04-24 11:33:42 | 00,015,112 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125mdfl.sys -- (s125mdfl [On_Demand | Stopped]) DRV - [2007-04-24 11:33:44 | 00,108,680 | R--- | M] (MCCI Corporation) -- C:\WINDOWS\system32\DRIVERS\s125mdm.sys -- (s125mdm [On_Demand | Stopped]) DRV - [2008-08-06 22:31:22 | 00,163,644 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running]) DRV - [2005-08-11 23:49:28 | 00,393,088 | R--- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\Senfilt.sys -- (SenFiltService [On_Demand | Running]) DRV - [2008-09-15 08:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped]) DRV - [2004-08-03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser [On_Demand | Stopped]) DRV - [2008-09-15 08:56:34 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped]) DRV - [2005-04-25 10:43:58 | 00,159,616 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\Vax347b.sys -- (Vax347b [Boot | Running]) DRV - [2004-04-30 09:33:00 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\Vax347s.sys -- (Vax347s [Boot | Running]) DRV - [2004-10-19 14:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\DRIVERS\VComm.sys -- (VComm [On_Demand | Running]) DRV - [2006-02-28 17:57:22 | 00,084,836 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\VcommMgr.sys -- (VcommMgr [On_Demand | Running]) DRV - [2008-12-10 16:56:26 | 00,017,792 | ---- | M] (Avnex) -- C:\WINDOWS\system32\DRIVERS\vcsvad.sys -- (VCSVADHWSer [On_Demand | Running]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "www.google.pl" FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.83 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03 FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:2.0.2 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.8.3.6 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.95 FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.6.11 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 FF - prefs.js..extensions.enabledItems: {c1dffba0-628e-11d9-9669-0800200c9a66}:3.0.2 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: D:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2008-10-10 15:28:14 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: D:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2008-12-28 18:44:21 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.21\extensions\\Components: D:\PROGRAM FILES\MOZILLA THUNDERBIRD\COMPONENTS [2009-03-25 16:30:58 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.21\extensions\\Plugins: D:\PROGRAM FILES\MOZILLA THUNDERBIRD\PLUGINS [2008-08-26 21:39:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions [2008-08-26 21:39:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-04-13 11:48:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions [2008-11-03 16:28:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2008-10-05 11:03:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2008-10-28 10:15:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2008-08-26 21:49:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66} [2009-04-13 11:48:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1} [2008-08-16 12:19:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0} [2008-07-07 09:52:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\ywdopzl0.default\extensions\redshift_V2@shift-themes.com O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKCU..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe (o2.pl Sp. z o.o.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{52A11F0F-890C-4730-A989-FEE6EEEBA053}\\NameServer = 192.168.1.1,192.168.1.13 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-05-08 20:42:37 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2005-11-04 07:52:23 | 00,729,088 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2005-11-04 07:52:23 | 00,729,088 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2005-10-14 10:02:16 | 00,585,728 | R--- | M] (Electronic Arts Inc.) - H:\AutoRunGUI.dll -- [ CDFS ] O32 - AutoRun File - [2005-11-04 08:22:30 | 00,000,160 | R--- | M] () - H:\autorun.inf -- [ CDFS ] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [3 C:\WINDOWS\System32\*.tmp files] [7 C:\WINDOWS\*.tmp files] [2009-05-13 12:53:11 | 00,000,163 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\fix.reg [2009-05-13 12:36:41 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall [2009-05-13 12:36:28 | 00,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2009-05-13 12:36:24 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$ [2009-05-13 12:36:23 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2009-05-13 12:36:05 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2009-05-12 22:09:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\temp [2009-05-12 22:06:17 | 00,000,000 | ---D | C] -- C:\ComboFix [2009-05-12 22:05:31 | 03,091,227 | R--- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe [2009-05-12 20:19:34 | 00,000,000 | ---D | C] -- C:\SDFix [2009-05-12 20:19:07 | 01,598,873 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\SDFix.exe [2009-05-12 20:15:07 | 00,000,000 | ---D | C] -- C:\rsit [2009-05-12 20:14:36 | 00,855,637 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\RSIT.exe [2009-05-12 19:45:12 | 00,051,232 | ---- | C] (gkweb) -- C:\Documents and Settings\Wojtaz\Pulpit\wwdc_[www.programosy.pl].exe [2009-05-12 19:29:18 | 00,000,755 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\FIM Speedway GP2.lnk [2009-05-12 19:26:25 | 00,124,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSWINSCK.OCX [2009-05-12 17:09:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Reveal [2009-05-12 17:07:48 | 04,366,214 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\reveal_1.2_win.exe [2009-05-12 16:27:29 | 00,622,722 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdjecie.jpg.jpg [2009-05-12 16:18:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder [2009-05-12 16:09:02 | 02,900,816 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC_0001.JPG [2009-05-12 14:34:53 | 00,000,000 | ---D | C] -- C:\ERDNT [2009-05-12 14:34:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT [2009-05-12 14:34:39 | 00,000,000 | ---D | C] -- C:\!FixIEDef [2009-05-12 14:33:55 | 01,211,956 | ---- | C] (Malwareteks.com) -- C:\Documents and Settings\Wojtaz\Pulpit\FixIEDef.exe [2009-05-12 14:33:47 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Dokumenty\Moja muzyka [2009-05-12 14:33:26 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak [2009-05-12 09:26:23 | 14,033,744 | ---- | C] (Doctor Web, Ltd.) -- C:\Documents and Settings\Wojtaz\Pulpit\launch.exe [2009-05-12 09:19:10 | 00,000,000 | ---D | C] -- C:\_OTListIt [2009-05-12 09:18:24 | 00,050,688 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Klasyzycm.doc [2009-05-12 09:12:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution [2009-05-11 15:36:53 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [2009-05-10 20:36:23 | 99,553,745 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.uha [2009-05-09 22:02:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection [2009-05-09 10:57:22 | 13,180,871 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection.rar [2009-05-06 17:44:06 | 00,035,840 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Chloroplast.doc [2009-05-06 15:27:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Xilisoft Corporation [2009-05-05 09:25:43 | 00,022,528 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy Dokument programu Microsoft Word.doc [2009-05-04 21:44:21 | 89,565,226 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\1000.Zlych.Uczynkow.S01E01.PL.PDTV.XviD-P_J.xbus.avi [2009-05-04 21:05:35 | 00,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini [2009-05-04 21:05:35 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini [2009-05-04 21:05:27 | 00,155,648 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\adadix32.dll [2009-05-04 21:05:27 | 00,127,456 | ---- | C] () -- C:\WINDOWS\System32\IPDETECT.EXE [2009-05-04 21:05:26 | 00,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-05-04 21:05:26 | 00,126,489 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\drivers\adiusbaw.sys [2009-05-04 21:05:26 | 00,116,992 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\drivers\e4usbaw.sys [2009-05-04 21:05:26 | 00,024,576 | ---- | C] () -- C:\WINDOWS\enddisk32.exe [2009-05-04 21:05:26 | 00,012,169 | ---- | C] () -- C:\WINDOWS\System32\drivers\adiusbaw.cat [2009-05-04 21:05:26 | 00,010,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\e4usbaw.cat [2009-05-04 21:05:25 | 00,261,964 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep3.bnm [2009-05-04 21:05:25 | 00,261,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep1.bnm [2009-05-04 21:05:25 | 00,261,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld3.bnm [2009-05-04 21:05:25 | 00,261,932 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld0.bnm [2009-05-04 21:05:25 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei1.bnm [2009-05-04 21:05:25 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p0.BNM [2009-05-04 21:05:25 | 00,261,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld2.bnm [2009-05-04 21:05:25 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p3.BNM [2009-05-04 21:05:25 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p1.BNM [2009-05-04 21:05:25 | 00,261,916 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep0.bnm [2009-05-04 21:05:25 | 00,261,916 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei0.bnm [2009-05-04 21:05:25 | 00,261,914 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei2.bnm [2009-05-04 21:05:25 | 00,261,908 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei3.bnm [2009-05-04 21:05:25 | 00,261,900 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p2.BNM [2009-05-04 21:05:25 | 00,261,894 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld1.bnm [2009-05-04 21:05:25 | 00,261,892 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep2.bnm [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I2.BIN [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I1.BIN [2009-05-04 21:05:25 | 00,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I0.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P2.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P1.BIN [2009-05-04 21:05:25 | 00,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P0.BIN [2009-05-04 21:05:25 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P2.BIN [2009-05-04 21:05:25 | 00,152,036 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D2.BIN [2009-05-04 21:05:25 | 00,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D1.BIN [2009-05-04 21:05:25 | 00,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D0.BIN [2009-05-04 21:05:25 | 00,135,168 | ---- | C] (Analog Devices.) -- C:\WINDOWS\System32\unaddrv.exe [2009-05-04 21:05:25 | 00,081,088 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldep4.bnm [2009-05-04 21:05:25 | 00,078,040 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbldei4.bnm [2009-05-04 21:05:25 | 00,064,000 | ---- | C] (Analog Deivces) -- C:\WINDOWS\System32\drivers\e4ldr.sys [2009-05-04 21:05:25 | 00,055,228 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld4.bnm [2009-05-04 21:05:25 | 00,050,007 | ---- | C] (Analog Deivces) -- C:\WINDOWS\System32\drivers\adildr.sys [2009-05-04 21:05:25 | 00,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-05-04 21:05:25 | 00,022,395 | ---- | C] () -- C:\WINDOWS\System32\drivers\fpga.bin [2009-05-04 21:05:25 | 00,022,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTBLD3p4.BNM [2009-05-04 21:05:25 | 00,008,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\adildr.cat [2009-05-04 21:05:25 | 00,007,924 | ---- | C] () -- C:\WINDOWS\System32\drivers\e4ldr.cat [2009-05-04 21:05:25 | 00,004,981 | ---- | C] (SITECSOFT Co., LTD.) -- C:\WINDOWS\System32\ADADIX2K.DLL [2009-05-04 21:05:24 | 00,261,964 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i1.bnm [2009-05-04 21:05:24 | 00,261,962 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p3.bnm [2009-05-04 21:05:24 | 00,261,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i0.bnm [2009-05-04 21:05:24 | 00,261,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p1.bnm [2009-05-04 21:05:24 | 00,261,930 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p0.bnm [2009-05-04 21:05:24 | 00,261,926 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p2.bnm [2009-05-04 21:05:24 | 00,261,918 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i2.bnm [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P1.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P0.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I2.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I1.BIN [2009-05-04 21:05:24 | 00,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I0.BIN [2009-05-04 21:05:24 | 00,053,590 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9i4.bnm [2009-05-04 21:05:24 | 00,041,620 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtbld9p4.bnm [2009-05-04 21:05:24 | 00,000,033 | ---- | C] () -- C:\WINDOWS\System32\drivers\adidsl.cfg [2009-05-04 21:05:20 | 00,000,000 | ---D | C] -- C:\Program Files\SAGEM [2009-05-04 21:04:20 | 00,000,000 | ---D | C] -- C:\Program Files\neostrada tp [2009-05-03 19:34:35 | 03,197,110 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\YouTube - Police Control.avi [2009-05-03 17:26:35 | 00,022,016 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Amplituda.doc [2009-05-03 12:56:13 | 61,220,133 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\pol2009.3.rar [2009-04-27 19:29:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Corel User Files [2009-04-27 19:25:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Corel [2009-04-27 19:25:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall [2009-04-25 20:53:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder (3) [2009-04-25 13:07:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\gtk-2.0 [2009-04-25 12:40:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Inkscape [2009-04-24 21:34:45 | 00,586,004 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.rar [2009-04-24 20:59:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\packagingOutput [2009-04-24 20:41:26 | 00,590,740 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.sis [2009-04-24 20:40:35 | 00,000,000 | ---D | C] -- C:\epoc32 [2009-04-24 20:30:46 | 00,000,271 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\.project [2009-04-24 20:04:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\.sketsa [2009-04-24 10:28:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\My Ringtones [2009-04-24 10:24:54 | 00,000,000 | ---D | C] -- C:\Program Files\One-click Ringtone Converter [2009-04-24 10:19:46 | 00,000,200 | ---- | C] () -- C:\WINDOWS\QCPC80UI.dat [2009-04-24 10:17:01 | 00,303,104 | ---- | C] () -- C:\WINDOWS\System32\ammpp.dll [2009-04-24 10:17:01 | 00,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2009-04-24 10:17:01 | 00,144,896 | ---- | C] () -- C:\WINDOWS\System32\lame_dshow.ax [2009-04-24 10:17:01 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\a1.dll [2009-04-24 10:17:01 | 00,003,772 | ---- | C] () -- C:\WINDOWS\System32\AudioFileConvert.tlb [2009-04-24 10:17:00 | 00,303,104 | ---- | C] () -- C:\WINDOWS\System32\qscl.dll [2009-04-24 10:17:00 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\amrdec.dll [2009-04-24 10:17:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\qcpsdk.dll [2009-04-24 10:17:00 | 00,000,000 | ---D | C] -- C:\AnMingringtone [2009-04-24 10:12:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Music Recognition [2009-04-23 20:53:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Mael [2009-04-23 19:17:13 | 00,000,000 | ---D | C] -- C:\Program Files\FIFA Soccer [2009-04-19 20:10:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\BESTplayer [2009-04-16 08:40:28 | 00,421,888 | ---- | C] (Gabest) -- C:\WINDOWS\System32\RealMediaSplitter.ax [2009-04-15 13:00:34 | 00,013,639 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\save.rar [2009-04-11 10:20:27 | 00,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfmonnt.dll [2009-04-11 10:20:26 | 00,000,164 | ---- | C] () -- C:\WINDOWS\System32\psconv.ini [2009-04-07 17:44:32 | 00,000,145 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini [2009-03-22 16:19:18 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-03-22 16:19:18 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-01-02 11:33:46 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\libssl32.dll [2008-12-25 19:20:03 | 00,000,331 | ---- | C] () -- C:\WINDOWS\doom3.ini [2008-11-19 16:41:13 | 00,000,255 | ---- | C] () -- C:\WINDOWS\ddf_edit.INI [2008-09-22 15:02:29 | 00,000,500 | ---- | C] () -- C:\WINDOWS\Fantastic Flame Screensaver.ini [2008-09-04 20:02:23 | 00,001,923 | ---- | C] () -- C:\WINDOWS\kaillera.ini [2008-09-01 17:29:41 | 00,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll [2008-08-17 23:08:31 | 00,000,024 | ---- | C] () -- C:\WINDOWS\LogonStudio.ini [2008-08-17 23:08:19 | 00,187,392 | ---- | C] () -- C:\WINDOWS\System32\JPGUtils.dll [2008-08-14 22:57:27 | 00,162,432 | ---- | C] () -- C:\WINDOWS\System32\drivers\vidstub.sys [2008-08-14 22:55:37 | 00,000,000 | ---- | C] () -- C:\WINDOWS\WB.ini [2008-08-08 14:50:15 | 00,000,291 | ---- | C] () -- C:\WINDOWS\thug2.ini [2008-07-15 14:14:10 | 00,000,191 | ---- | C] () -- C:\WINDOWS\MBMTool.INI [2008-06-28 21:33:50 | 00,021,738 | ---- | C] () -- C:\WINDOWS\hplj1300.ini [2008-06-17 13:56:55 | 00,210,456 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2008-06-17 13:56:55 | 00,206,360 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2008-06-17 13:56:55 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2008-06-17 13:56:55 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2008-06-17 13:56:55 | 00,194,072 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2008-06-17 13:56:55 | 00,026,136 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2008-06-09 19:23:19 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-05-20 13:56:12 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-05-12 15:29:19 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-05-12 15:29:18 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-05-10 21:53:31 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008-05-10 21:52:49 | 00,000,319 | ---- | C] () -- C:\WINDOWS\game.ini [2008-05-10 20:27:01 | 00,014,848 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2008-05-10 20:26:50 | 00,159,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347b.sys [2008-05-10 20:26:50 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347s.sys [2008-05-09 14:35:27 | 00,000,019 | ---- | C] () -- C:\WINDOWS\cie12.ini [2008-05-09 14:27:01 | 00,000,790 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2008-05-09 14:26:40 | 00,004,271 | ---- | C] () -- C:\WINDOWS\WINCMD.INI [2008-05-08 21:17:53 | 00,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys [2008-05-08 21:11:09 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008-05-08 21:11:08 | 00,014,595 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-05-08 21:10:59 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007-08-07 20:22:22 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2007-03-30 00:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2006-04-14 10:14:12 | 00,014,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2006-03-19 13:34:58 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialCE.dll [2006-03-19 13:34:42 | 00,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll [2005-07-30 08:21:32 | 00,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2005-06-15 11:20:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-06-15 11:20:00 | 01,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-06-15 11:20:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-06-15 11:20:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2005-06-15 11:20:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-06-15 11:20:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2005-02-05 22:46:00 | 00,004,608 | ---- | C] () -- C:\WINDOWS\fgexec.dll [2004-08-22 18:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-03-18 19:40:32 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-03-18 19:40:24 | 00,667,648 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2003-01-28 01:09:20 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\libexpat.dll [2002-03-17 02:00:00 | 00,007,420 | ---- | C] () -- C:\WINDOWS\UA000088.DLL [2002-03-17 02:00:00 | 00,007,420 | ---- | C] () -- C:\WINDOWS\UA000035.DLL [2001-08-13 20:09:48 | 00,659,520 | ---- | C] () -- C:\WINDOWS\System32\vbid3lib.dll [2001-07-31 09:17:12 | 00,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [2001-07-21 22:16:20 | 00,000,594 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,265 | ---- | C] () -- C:\WINDOWS\system.ini [2001-04-20 19:23:28 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\PManager.dll [1998-09-07 01:03:36 | 00,012,208 | ---- | C] () -- C:\WINDOWS\System32\Cdio16.dll [1998-09-07 00:55:42 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\cdio32.dll [color=orange]========== Files - Modified Within 30 Days ==========[/color] [3 C:\WINDOWS\System32\*.tmp files] [7 C:\WINDOWS\*.tmp files] [2009-05-13 13:00:17 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-05-13 12:53:15 | 00,000,163 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\fix.reg [2009-05-13 12:36:57 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009-05-13 12:34:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-13 12:34:35 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\desktop.ini [2009-05-13 12:34:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-12 22:08:10 | 00,000,265 | ---- | M] () -- C:\WINDOWS\system.ini [2009-05-12 22:05:54 | 03,091,227 | R--- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe [2009-05-12 22:01:39 | 00,000,322 | -HS- | M] () -- C:\boot.ini [2009-05-12 20:20:51 | 00,000,594 | ---- | M] () -- C:\WINDOWS\win.ini [2009-05-12 20:19:20 | 01,598,873 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\SDFix.exe [2009-05-12 20:14:42 | 00,855,637 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\RSIT.exe [2009-05-12 19:45:12 | 00,051,232 | ---- | M] (gkweb) -- C:\Documents and Settings\Wojtaz\Pulpit\wwdc_[www.programosy.pl].exe [2009-05-12 19:29:18 | 00,000,755 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\FIM Speedway GP2.lnk [2009-05-12 17:14:42 | 00,622,722 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdjecie.jpg.jpg [2009-05-12 17:09:15 | 04,366,214 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\reveal_1.2_win.exe [2009-05-12 16:09:06 | 02,900,816 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC_0001.JPG [2009-05-12 14:34:35 | 01,211,956 | ---- | M] (Malwareteks.com) -- C:\Documents and Settings\Wojtaz\Pulpit\FixIEDef.exe [2009-05-12 09:28:30 | 14,033,744 | ---- | M] (Doctor Web, Ltd.) -- C:\Documents and Settings\Wojtaz\Pulpit\launch.exe [2009-05-12 09:18:24 | 00,050,688 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Klasyzycm.doc [2009-05-11 21:42:11 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2009-05-11 21:00:30 | 00,004,271 | ---- | M] () -- C:\WINDOWS\WINCMD.INI [2009-05-11 19:42:03 | 00,000,790 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini [2009-05-11 15:37:02 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTListIt2.exe [2009-05-10 20:50:38 | 99,553,745 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\driver2.uha [2009-05-09 11:00:58 | 13,180,871 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Cars.wallpapers_collection.rar [2009-05-08 16:19:35 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-06 17:44:06 | 00,035,840 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Chloroplast.doc [2009-05-05 09:26:56 | 00,022,528 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy Dokument programu Microsoft Word.doc [2009-05-04 21:58:20 | 89,565,226 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\1000.Zlych.Uczynkow.S01E01.PL.PDTV.XviD-P_J.xbus.avi [2009-05-04 21:06:25 | 00,000,168 | ---- | M] () -- C:\WINDOWS\adidsl.ini [2009-05-04 21:05:35 | 00,000,033 | ---- | M] () -- C:\WINDOWS\System32\drivers\adidsl.cfg [2009-05-04 21:05:35 | 00,000,021 | ---- | M] () -- C:\WINDOWS\Fast800.ini [2009-05-03 19:34:38 | 03,197,110 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\YouTube - Police Control.avi [2009-05-03 17:26:35 | 00,022,016 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Amplituda.doc [2009-05-03 13:11:21 | 61,220,133 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\pol2009.3.rar [2009-05-02 10:05:05 | 00,023,732 | -H-- | M] () -- C:\treeinfo.wc [2009-05-01 15:36:46 | 00,117,248 | ---- | M] () -- C:\WINDOWS\VFind.exe [2009-04-24 21:34:45 | 00,586,004 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.rar [2009-04-24 21:01:20 | 00,590,740 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Cartman.sis [2009-04-24 20:30:47 | 00,000,271 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\.project [2009-04-24 10:26:51 | 00,000,200 | ---- | M] () -- C:\WINDOWS\QCPC80UI.dat [2009-04-24 10:17:13 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2009-04-20 12:56:28 | 00,031,232 | ---- | M] (NirSoft) -- C:\WINDOWS\Nircmd.exe [2009-04-19 13:29:03 | 00,000,191 | ---- | M] () -- C:\WINDOWS\MBMTool.INI [2009-04-16 08:40:28 | 00,421,888 | ---- | M] (Gabest) -- C:\WINDOWS\System32\RealMediaSplitter.ax [2009-04-15 13:00:34 | 00,013,639 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\save.rar [2009-04-14 11:17:56 | 01,225,108 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-04-14 11:17:56 | 00,541,692 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-04-14 11:17:56 | 00,480,660 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-04-14 11:17:56 | 00,103,646 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-04-14 11:17:56 | 00,082,616 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [color=orange]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 168 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:0CE7F3C9 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF < End of report >

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:02, on 2009-05-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Tlen.pl\tlen.exe D:\Program Files\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O17 - HKLM\System\CCS\Services\Tcpip\..\{52A11F0F-890C-4730-A989-FEE6EEEBA053}: NameServer = 192.168.1.1,192.168.1.13 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Unknown owner - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing) -- End of file - 3362 bytes

**Posty:** 18165 · przez **wojtas** 13 Maj 2009, 13:52

przeskanuj kompa :

http://www.programosy.pl/program,malwarebytes-anti-malware.html

poczytaj i zastosuj:

http://www.searchengines.pl/Naprawianie-szkod-systemowych-t79791.html

Kto jest na forum