Heur.w32...

[Anadrina]

Witam, mam ogromny problem... Wczoraj jakimś cudem załapałam tego diabelnego wirusa, najpierw wyłączył zaporę, a potem poleciało po całej reszcie... Menedżer zadań się nie włącza, nie działają antywirusy (mam dwa skanerki, SpyWare Doctora i SpyBota), w ogóle nie reagują, skanery online też się nie wczytują...
I teraz pytanie, po pierwsze, czy można te pliki usuwać bez strachu, że uszkodzi się system? Mniejsza o programy, abym nie musiała przeinstalowywać Windowsa, bo nie mam w tej chwili możliwości ;/. Pomocy, błagam, bo nie chcę stracić systemu ;/

Kod: Zaznacz wszystko

Log z Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:02, on 2009-09-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Documents and Settings\dom\Menu Start\Programy\Autostart\lsass.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\Program Files\neostrada tp\Watch.exe
C:\DOCUME~1\dom\USTAWI~1\Temp\wingbfi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {F4F10C1D-87C7-404A-B4B3-000000000000} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: lsass.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203262205945
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AEA5FE5-686D-426A-9ED0-E6E1B6E00BD4}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Program Files\Spyware Doctor\sdhelp.exe

--
End of file - 7014 bytes

[Okocza]

I teraz pytanie, po pierwsze, czy można te pliki usuwać bez strachu, że uszkodzi się system?

zawsze jest możliwość uszkodzenia systemu.

Daj log z RSIT

[Anadrina]

Kod: Zaznacz wszystko

Log z log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by dom at 2009-09-06 21:59:43
Microsoft Windows XP Home Edition Dodatek Service Pack 2
System drive C: has 1 GB (5%) free of 27 GB
Total RAM: 502 MB (11% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:00:15, on 2009-09-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\dom\USTAWI~1\Temp\uuhh.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\WINMINE.EXE
C:\Documents and Settings\dom\Pulpit\FILMY\RSIT.com
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\dom.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {F4F10C1D-87C7-404A-B4B3-000000000000} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203262205945
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AEA5FE5-686D-426A-9ED0-E6E1B6E00BD4}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Program Files\Spyware Doctor\sdhelp.exe

--
End of file - 6992 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-1682526488-725345543-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-1682526488-725345543-1004UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-26 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-26 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{37B85A29-692B-4205-9CAD-2626E4993404}
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-26 148888]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-06-08 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-06-08 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-06-08 114688]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 139776]
"AzMixerSel"=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2005-06-11 135168]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-08-09 14743552]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 139264]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 222768]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"WOOWATCH"=C:\PROGRA~1\NEOSTR~1\Watch.exe [2004-08-23 20480]
"WOOTASKBARICON"=C:\PROGRA~1\NEOSTR~1\GestMaj.exe [2004-10-14 114688]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]
"Google Update"=C:\Documents and Settings\dom\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-07-08 206832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-06-08 131072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\Program Files\DAP\DAP.exe"="C:\Program Files\DAP\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)"
"D:\Program Files\eMule\emule.exe"="D:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"D:\Program Files\Metin2_PL\metin2.bin"="D:\Program Files\Metin2_PL\metin2.bin:*:Enabled:metin2"
"D:\Program Files\Ubisoft\Heroes of Might and Magic III - Zlota Edycja\VCMI_server.exe"="D:\Program Files\Ubisoft\Heroes of Might and Magic III - Zlota Edycja\VCMI_server.exe:*:Enabled:VCMI_server"
"D:\Program Files\eMule2\emule.exe"="D:\Program Files\eMule2\emule.exe:*:Enabled:eMule"
"D:\Zdjecia\Różne 2\YurOTS1\ots\OT.exe"="D:\Zdjecia\Różne 2\YurOTS1\ots\OT.exe:*:Enabled:OT"
"D:\Zdjecia\Tibia-pliki\ots7.81\ots\Xing7.81.exe"="D:\Zdjecia\Tibia-pliki\ots7.81\ots\Xing7.81.exe:*:Enabled:version 7.81"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"D:\Program Files\Warcraft III\War3.exe"="D:\Program Files\Warcraft III\War3.exe:*:Enabled:Warcraft III"
"D:\Program Files\Warcraft III\Warcraft III.exe"="D:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Documents and Settings\dom\Pulpit\FILMY\Mu Online Image Converter\Mu Online Image Converter\MUimgGUI.exe"="C:\Documents and Settings\dom\Pulpit\FILMY\Mu Online Image Converter\Mu Online Image Converter\MUimgGUI.exe:*:Enabled:ipsec"
"C:\WINDOWS\RTHDCPL.EXE"="C:\WINDOWS\RTHDCPL.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winhhas.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winhhas.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\kwrm.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\kwrm.exe:*:Enabled:ipsec"
"C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\bwcagq.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\bwcagq.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\HDAShCut.exe"="C:\WINDOWS\system32\HDAShCut.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\wingbfi.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\wingbfi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\vpao.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\vpao.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winahohf.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winahohf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\xrync.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\xrync.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winxtapnq.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winxtapnq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winmqaun.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winmqaun.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\wineswfyv.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\wineswfyv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winglfak.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winglfak.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\windigtlq.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\windigtlq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\windardmp.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\windardmp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\uuhh.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\uuhh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winildso.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winildso.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winkxnew.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winkxnew.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winrilg.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winrilg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winieprjw.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winieprjw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\winsotoe.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\winsotoe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\wthf.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\wthf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dom\USTAWI~1\Temp\ncpryo.exe"="C:\DOCUME~1\dom\USTAWI~1\Temp\ncpryo.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c3c6192-65ad-11de-919d-00c09fc7acee}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c3c6193-65ad-11de-919d-00c09fc7acee}]
shell\AutoRun\command - G:\AutoRun.exe


======List of files/folders created in the last 1 months======

2009-09-06 21:59:43 ----D---- C:\rsit
2009-09-06 18:00:42 ----A---- C:\WINDOWS\system32\setup_XP.ini
2009-09-06 15:17:06 ----D---- C:\Program Files\Trend Micro
2009-09-06 15:02:14 ----A---- C:\WINDOWS\zip.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\SWSC.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\SWREG.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\sed.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\PEV.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\NIRCMD.exe
2009-09-06 15:02:14 ----A---- C:\WINDOWS\grep.exe
2009-09-06 15:02:13 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-09-06 14:59:08 ----SD---- C:\ComboFix
2009-09-06 14:58:13 ----A---- C:\WINDOWS\system32\CF29846.exe
2009-09-06 14:49:00 ----A---- C:\WINDOWS\system32\CF10716.exe
2009-09-06 00:29:31 ----D---- C:\Program Files\Panda Security
2009-08-27 14:07:19 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-22 16:29:51 ----D---- C:\Documents and Settings\dom\Dane aplikacji\BESTplayer
2009-08-17 17:25:56 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-08-17 13:13:13 ----D---- C:\Documents and Settings\dom\Dane aplikacji\InstallShield
2009-08-16 11:16:43 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-16 11:16:23 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
2009-08-15 11:50:46 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-15 11:50:37 ----D---- C:\Program Files\MSBuild
2009-08-15 11:50:34 ----D---- C:\WINDOWS\system32\en-US
2009-08-15 11:50:22 ----D---- C:\Program Files\Reference Assemblies
2009-08-15 11:49:52 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-15 11:49:51 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-15 11:49:51 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-15 11:49:50 ----D---- C:\e2b1fb7b221bb5ae59b7af
2009-08-15 11:49:28 ----D---- C:\WINDOWS\SxsCaPendDel
2009-08-15 11:46:06 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2009-08-15 11:45:56 ----D---- C:\Program Files\MSXML 6.0
2009-08-15 01:06:50 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-08-15 01:06:43 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-08-15 01:06:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-08-15 01:06:29 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-08-15 01:06:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-08-15 01:06:13 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-08-15 01:06:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-08-15 01:05:58 ----D---- C:\WINDOWS\ServicePackFiles
2009-08-15 01:05:55 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2009-08-15 01:05:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$

======List of files/folders modified in the last 1 months======

2009-09-06 18:00:42 ----SHD---- C:\WINDOWS\system32
2009-09-06 17:46:28 ----D---- C:\Program Files\Mozilla Firefox
2009-09-06 17:46:21 ----D---- C:\WINDOWS\Temp
2009-09-06 17:45:20 ----D---- C:\Program Files\neostrada tp
2009-09-06 17:44:38 ----D---- C:\WINDOWS\system32\Lang
2009-09-06 17:44:12 ----AD---- C:\WINDOWS\system32\drivers
2009-09-06 16:38:43 ----A---- C:\WINDOWS\NeroDigital.ini
2009-09-06 15:17:06 ----RD---- C:\Program Files
2009-09-06 15:02:14 ----D---- C:\WINDOWS
2009-09-06 14:48:33 ----D---- C:\WINDOWS\Prefetch
2009-09-06 02:29:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-06 00:31:07 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-06 00:11:22 ----D---- C:\Program Files\gamefreedom.pl
2009-09-06 00:04:27 ----A---- C:\WINDOWS\system.ini
2009-09-03 09:24:17 ----D---- C:\WINDOWS\Microsoft.NET
2009-09-02 22:56:34 ----D---- C:\WINDOWS\system32\Adobe
2009-09-02 00:19:37 ----SHD---- C:\WINDOWS\Installer
2009-08-31 16:24:21 ----HD---- C:\WINDOWS\inf
2009-08-20 22:14:32 ----D---- C:\Program Files\SpeedFan
2009-08-18 15:54:52 ----D---- C:\Program Files\WinRAR
2009-08-17 17:26:07 ----A---- C:\WINDOWS\imsins.BAK
2009-08-17 17:26:01 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-08-17 13:14:40 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-16 11:19:16 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-16 11:16:42 ----HD---- C:\WINDOWS\$hf_mig$
2009-08-15 15:58:41 ----RSD---- C:\WINDOWS\assembly
2009-08-15 11:56:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-15 11:55:13 ----D---- C:\WINDOWS\WinSxS
2009-08-15 11:50:31 ----RSD---- C:\WINDOWS\Fonts
2009-08-15 11:50:04 ----D---- C:\WINDOWS\system32\spool
2009-08-15 01:06:08 ----D---- C:\Program Files\Outlook Express

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ikhfile;File Security Kernel Anti-Spyware Driver; C:\WINDOWS\system32\drivers\ikhfile.sys [2006-07-10 30592]
R1 ikhlayer;Kernel Anti-Spyware Driver; C:\WINDOWS\system32\drivers\ikhlayer.sys [2006-08-24 51072]
R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 40320]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\fmgpig.sys []
R3 CmBatt;Sterownik baterii Microsoft o metodzie kontroli ACPI; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2006-03-02 9600]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-06-08 1050140]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-08-09 3855360]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 684265]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-02-11 79488]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 mchInjDrv;mchInjDrv; \??\C:\WINDOWS\TEMP\mc22.tmp []
S4 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-08-23 40960]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-26 152984]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S2 SDhelper;PC Tools Spyware Doctor; D:\Program Files\Spyware Doctor\sdhelp.exe [2006-07-14 895160]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-05-16 341552]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


Z info.txt się już tu nie mieści... Jak będzie konieczne to wkleję.

[Okocza]

Anadrina, z tego co widzę, uruchamiałaś combofixa, nie dawno, masz z niego log? jeśli nie, uruchom go ponownie i daj log.