Jak usunąć wyszukiwarkę "fast browser search"?

**Posty:** 9 · przez **Teo_dor** 19 Gru 2009, 20:46

mam podobny problem możecie mi pomóc?
log z otl

Kod: Zaznacz wszystko: [color=#000040][2009-12-01 12:06:52 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-11-30 22:17:44 | 01,052,994 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-19 18:41:36 | 00,006,195 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\Sortowanie.pas [2009-12-19 14:01:03 | 00,055,517 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-16 21:17:48 | 00,732,590 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:27 | 00,063,840 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:02:11 | 00,673,333 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-13 18:38:10 | 00,037,376 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-13 17:32:56 | 03,095,470 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | C] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 22:58:02 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 18:38:28 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-11-30 22:17:44 | 01,052,994 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [2009-11-26 20:01:40 | 00,027,648 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-11-13 08:32:03 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-02 20:53:00 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-08-27 18:08:36 | 00,000,033 | ---- | C] () -- C:\WINDOWS\BiMonitor.ini [2009-08-27 18:08:32 | 00,028,787 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009-08-27 11:35:46 | 00,022,723 | R--- | C] () -- C:\WINDOWS\System32\xrxw1l3.dll [2009-08-27 11:32:53 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2009-08-27 11:32:53 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2009-08-27 11:32:53 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2009-08-27 11:32:53 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2009-08-27 11:32:53 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2009-08-27 11:18:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-08-04 18:36:55 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-08-04 18:36:52 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-08-04 18:36:51 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-08-04 18:36:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-08-04 18:36:48 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-08-04 18:36:47 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-08-04 17:18:20 | 00,018,944 | ---- | C] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006-03-06 10:41:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll [2004-09-16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS [2004-08-22 16:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003-04-08 10:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-05-10 15:30:08 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPEG32.DLL [2001-09-28 12:44:58 | 00,257,536 | ---- | C] () -- C:\WINDOWS\System32\BiImg.dll [2001-07-22 03:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys[/color]

**Posty:** 14516 · przez **ToServeAndProtect** 20 Gru 2009, 12:11

twój problem twój temat, nie podczepiaj się do nikogo

**Posty:** 18165 · przez **wojtas** 20 Gru 2009, 12:23

Daj loga z OTL

**Posty:** 9 · przez **Teo_dor** 20 Gru 2009, 15:44

Kod: Zaznacz wszystko: log OTL logfile created on: 2009-12-20 14:39:34 - Run 2 OTL by OldTimer - Version 3.1.18.0 Folder = C:\Documents and Settings\Teo\Pulpit Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2600.0000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,30 Mb Total Physical Memory | 271,00 Mb Available Physical Memory | 53,00% Memory free 1,22 Gb Paging File | 1,04 Gb Available in Paging File | 84,86% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,34 Gb Total Space | 6,10 Gb Free Space | 20,11% Space Free | Partition Type: NTFS Drive D: | 48,83 Gb Total Space | 45,04 Gb Free Space | 92,24% Space Free | Partition Type: NTFS Drive E: | 48,83 Gb Total Space | 48,51 Gb Free Space | 99,36% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 2,44 Gb Total Space | 1,97 Gb Free Space | 80,70% Space Free | Partition Type: NTFS Drive H: | 10,27 Gb Total Space | 0,65 Gb Free Space | 6,35% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Drive J: | 690,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: TD Current User Name: Teo Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-19 19:33:21 | 00,564,736 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe PRC - [2009-12-19 15:07:38 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-08-15 17:21:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009-02-11 16:28:48 | 05,308,416 | ---- | M] (mpc-hc@Sourceforge) -- C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe PRC - [2007-10-17 14:02:50 | 01,114,112 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\RALINK\Common\RaUI.exe PRC - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2005-09-28 16:09:38 | 00,036,864 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe PRC - [2001-10-26 18:29:52 | 01,002,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-19 19:33:21 | 00,564,736 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe MOD - [2001-08-18 07:37:18 | 00,921,088 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2003-07-28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2001-10-26 18:29:36 | 00,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-13 08:32:04 | 00,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-08-03 16:44:54 | 00,021,419 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x) DRV - [2007-10-01 11:06:40 | 00,451,968 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2006-11-08 13:45:26 | 00,240,384 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2500usb.sys -- (RT2500USB) DRV - [2004-08-22 15:31:48 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt) DRV - [2004-08-22 15:31:10 | 00,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus) DRV - [2003-07-29 08:57:20 | 00,040,448 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Dgivecp.Sys -- (DgiVecp) DRV - [2001-10-26 16:49:50 | 00,281,856 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001-08-17 22:03:16 | 00,024,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2001-08-17 20:19:34 | 00,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) DRV - [2001-08-17 20:12:42 | 00,023,070 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2001-07-22 03:41:32 | 00,027,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search" FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search" FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=" FF - prefs.js..browser.search.order.1: "Fast Browser Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.pajacyk.pl/" FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.11.2 FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-19 15:07:46 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-12-19 15:07:46 | 00,000,000 | ---D | M] [2009-08-03 17:38:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Extensions [2009-12-20 13:54:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions [2009-10-18 16:51:27 | 00,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2009-12-13 12:55:25 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB} [2009-12-19 17:59:31 | 00,005,413 | ---- | M] () -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml [2009-12-15 19:33:40 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-15 20:00:25 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-15 20:00:25 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-15 20:00:25 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-15 20:00:25 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-15 20:00:25 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-15 20:00:25 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (Make The Web Better, LLC) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll (MTWB) O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No CLSID value found. O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - HKCU..\Run: [P2kAutostart] File not found O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm () O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm () O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-08-03 16:20:19 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-01-31 20:06:35 | 00,000,000 | ---- | M] () - G:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-19 19:33:17 | 00,564,736 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-16 20:30:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DOSBox [2009-12-16 20:29:42 | 00,000,000 | ---D | C] -- C:\Program Files\DOSBox-0.73 [2009-12-16 20:10:40 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2009-12-16 20:08:17 | 03,326,576 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:23 | 00,000,000 | ---D | C] -- C:\Liero [2009-12-16 19:38:42 | 01,460,010 | ---- | C] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\Malwarebytes [2009-12-15 19:43:12 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009-12-15 19:43:09 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2009-12-15 19:42:17 | 02,373,096 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-12 11:16:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\OLI [2009-12-12 11:16:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\cosie [2009-12-12 11:04:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\KAMIS [2009-12-10 00:51:45 | 00,000,000 | ---D | C] -- C:\Program Files\SGPSA [2009-12-08 06:41:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\MAMI [2009-12-05 22:17:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\vlc [2009-12-05 22:15:34 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009-11-25 16:16:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\builddesk [2009-10-04 11:42:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-10-04 11:42:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-20 14:35:02 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-20 13:54:12 | 00,028,160 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:50:46 | 00,002,539 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Word.lnk [2009-12-20 13:29:10 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-20 11:08:04 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-20 11:08:01 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-20 11:08:00 | 53,620,3264 | -HS- | M] () -- C:\hiberfil.sys [2009-12-20 00:13:45 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Teo\NTUSER.DAT [2009-12-20 00:13:45 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Teo\ntuser.ini [2009-12-20 00:13:38 | 02,107,966 | -H-- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-12-19 22:18:45 | 00,018,944 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-19 20:50:18 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 19:33:21 | 00,564,736 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-19 14:01:03 | 00,055,517 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-18 19:57:44 | 00,002,557 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Exel.lnk [2009-12-16 23:06:50 | 00,147,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\trygonometria.doc [2009-12-16 22:29:40 | 00,043,096 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-16 21:17:48 | 00,732,590 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:24:57 | 00,192,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-12-16 20:14:33 | 00,063,840 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:09:40 | 03,326,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:16 | 00,673,333 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-16 19:39:03 | 01,460,010 | ---- | M] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-15 19:42:57 | 02,373,096 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-13 17:33:45 | 03,095,470 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | M] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 23:01:07 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 21:11:37 | 00,028,672 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:23:45 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-12-01 12:06:52 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-11-30 22:17:44 | 01,052,994 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-20 13:51:43 | 00,028,160 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:29:10 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 20:50:20 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 18:41:36 | 00,006,195 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\Sortowanie.pas [2009-12-19 14:01:03 | 00,055,517 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-16 21:17:48 | 00,732,590 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:27 | 00,063,840 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:02:11 | 00,673,333 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-13 18:38:10 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-13 17:32:56 | 03,095,470 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | C] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 22:58:02 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 18:38:28 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-11-30 22:17:44 | 01,052,994 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [2009-11-26 20:01:40 | 00,027,648 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-11-13 08:32:03 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-02 20:53:00 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-08-27 18:08:36 | 00,000,033 | ---- | C] () -- C:\WINDOWS\BiMonitor.ini [2009-08-27 18:08:32 | 00,028,787 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009-08-27 11:35:46 | 00,022,723 | R--- | C] () -- C:\WINDOWS\System32\xrxw1l3.dll [2009-08-27 11:32:53 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2009-08-27 11:32:53 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2009-08-27 11:32:53 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2009-08-27 11:32:53 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2009-08-27 11:32:53 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2009-08-27 11:18:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-08-04 18:36:55 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-08-04 18:36:52 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-08-04 18:36:51 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-08-04 18:36:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-08-04 18:36:48 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-08-04 18:36:47 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-08-04 17:18:20 | 00,018,944 | ---- | C] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006-03-06 10:41:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll [2004-09-16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS [2004-08-22 16:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003-04-08 10:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-05-10 15:30:08 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPEG32.DLL [2001-09-28 12:44:58 | 00,257,536 | ---- | C] () -- C:\WINDOWS\System32\BiImg.dll [2001-07-22 03:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

**Posty:** 2183 · przez **NieWiem** 20 Gru 2009, 15:48

Popraw i weź loga w tagi [code], jak za pierwszym razem.

**Posty:** 18165 · przez **wojtas** 20 Gru 2009, 16:21

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.11.2
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q="
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (Make The Web Better, LLC)
O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll (MTWB)
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No CLSID value found.
O4 - HKCU..\Run: [P2kAutostart] File not found
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ]

:Files
aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml
C:\Program Files\SGPSA

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdz reset kompa .

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu

**Posty:** 9 · przez **Teo_dor** 20 Gru 2009, 17:36

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.30 Wersja bazy definicji: 1306 Windows 5.1.2600 2009-12-20 16:30:41 mbam-log-2009-12-20 (16-30-41).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|G:\|H:\|) Przeskanowane obiekty: 68816 Upłynęło: 32 minute(s), 17 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 0 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: (Nie wykryto groźnych plików)

to było z malware

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-20 16:33:38 - Run 1 OTL by OldTimer - Version 3.1.19.0 Folder = C:\Documents and Settings\Teo\Pulpit Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2600.0000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 240,00 Mb Available Physical Memory | 47,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,34 Gb Total Space | 6,23 Gb Free Space | 20,54% Space Free | Partition Type: NTFS Drive D: | 48,83 Gb Total Space | 45,04 Gb Free Space | 92,24% Space Free | Partition Type: NTFS Drive E: | 48,83 Gb Total Space | 48,51 Gb Free Space | 99,36% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 2,44 Gb Total Space | 1,97 Gb Free Space | 80,70% Space Free | Partition Type: NTFS Drive H: | 10,27 Gb Total Space | 0,65 Gb Free Space | 6,35% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Drive J: | 690,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: TD Current User Name: Teo Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe PRC - [2009-12-19 15:07:38 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-08-15 17:21:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2007-10-17 14:02:50 | 01,114,112 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\RALINK\Common\RaUI.exe PRC - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2005-09-28 16:09:38 | 00,036,864 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe PRC - [2001-10-26 18:29:52 | 01,002,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe MOD - [2001-08-18 07:37:18 | 00,921,088 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2003-07-28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2001-10-26 18:29:36 | 00,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-13 08:32:04 | 00,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-08-03 16:44:54 | 00,021,419 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x) DRV - [2007-10-01 11:06:40 | 00,451,968 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2006-11-08 13:45:26 | 00,240,384 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2500usb.sys -- (RT2500USB) DRV - [2004-08-22 15:31:48 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt) DRV - [2004-08-22 15:31:10 | 00,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus) DRV - [2003-07-29 08:57:20 | 00,040,448 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Dgivecp.Sys -- (DgiVecp) DRV - [2001-10-26 16:49:50 | 00,281,856 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001-08-17 22:03:16 | 00,024,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2001-08-17 20:19:34 | 00,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) DRV - [2001-08-17 20:12:42 | 00,023,070 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2001-07-22 03:41:32 | 00,027,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search" FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search" FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=" FF - prefs.js..browser.search.order.1: "Fast Browser Search" FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.tattoodle.com?tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}" FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-19 15:07:46 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-12-19 15:07:46 | 00,000,000 | ---D | M] [2009-08-03 17:38:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Extensions [2009-12-20 13:54:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions [2009-10-18 16:51:27 | 00,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2009-12-13 12:55:25 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB} [2009-12-19 17:59:31 | 00,005,413 | ---- | M] () -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml [2009-12-15 19:33:40 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-15 20:00:25 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-15 20:00:25 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-15 20:00:25 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-15 20:00:25 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-15 20:00:25 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-15 20:00:25 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-08-03 16:20:19 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-01-31 20:06:35 | 00,000,000 | ---- | M] () - G:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\Shell - "" = AutoRun O33 - MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\Shell\AutoRun\command - "" = J:\Setup.Now.exe -- [2002-04-23 13:10:10 | 00,102,400 | R--- | M] (Sold Out Software Ltd.) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-20 16:32:42 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:54:40 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss [2009-12-16 20:30:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DOSBox [2009-12-16 20:29:42 | 00,000,000 | ---D | C] -- C:\Program Files\DOSBox-0.73 [2009-12-16 20:10:40 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2009-12-16 20:08:17 | 03,326,576 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:23 | 00,000,000 | ---D | C] -- C:\Liero [2009-12-16 19:38:42 | 01,460,010 | ---- | C] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\Malwarebytes [2009-12-15 19:43:12 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009-12-15 19:43:09 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2009-12-15 19:42:17 | 02,373,096 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-12 11:16:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\OLI [2009-12-12 11:16:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\cosie [2009-12-12 11:04:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\KAMIS [2009-12-08 06:41:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\MAMI [2009-12-05 22:17:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\vlc [2009-12-05 22:15:34 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009-11-25 16:16:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\builddesk [2009-10-04 11:42:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-10-04 11:42:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-20 16:33:33 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Teo\NTUSER.DAT [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:56:44 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-20 15:56:41 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-20 15:56:40 | 53,620,3264 | -HS- | M] () -- C:\hiberfil.sys [2009-12-20 15:55:57 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Teo\ntuser.ini [2009-12-20 15:55:53 | 04,272,288 | -H-- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-12-20 15:55:34 | 00,000,600 | ---- | M] () -- C:\WINDOWS\win.ini [2009-12-20 15:55:34 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-12-20 15:55:34 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-12-20 15:52:51 | 00,192,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-12-20 14:35:02 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-20 13:54:12 | 00,028,160 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:50:46 | 00,002,539 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Word.lnk [2009-12-20 13:29:10 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 22:18:45 | 00,018,944 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-19 20:50:18 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 14:01:03 | 00,055,517 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-18 19:57:44 | 00,002,557 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Exel.lnk [2009-12-16 23:06:50 | 00,147,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\trygonometria.doc [2009-12-16 22:29:40 | 00,043,096 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-16 21:17:48 | 00,732,590 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:33 | 00,063,840 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:09:40 | 03,326,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:16 | 00,673,333 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-16 19:39:03 | 01,460,010 | ---- | M] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-15 19:42:57 | 02,373,096 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-13 17:33:45 | 03,095,470 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | M] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 23:01:07 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 21:11:37 | 00,028,672 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:23:45 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-12-01 12:06:52 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-11-30 22:17:44 | 01,052,994 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-20 13:51:43 | 00,028,160 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:29:10 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 20:50:20 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 18:41:36 | 00,006,195 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\Sortowanie.pas [2009-12-19 14:01:03 | 00,055,517 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-16 21:17:48 | 00,732,590 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:27 | 00,063,840 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:02:11 | 00,673,333 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-13 18:38:10 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-13 17:32:56 | 03,095,470 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | C] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 22:58:02 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 18:38:28 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-11-30 22:17:44 | 01,052,994 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [2009-11-26 20:01:40 | 00,027,648 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-11-13 08:32:03 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-02 20:53:00 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-08-27 18:08:36 | 00,000,033 | ---- | C] () -- C:\WINDOWS\BiMonitor.ini [2009-08-27 18:08:32 | 00,028,787 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009-08-27 11:35:46 | 00,022,723 | R--- | C] () -- C:\WINDOWS\System32\xrxw1l3.dll [2009-08-27 11:32:53 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2009-08-27 11:32:53 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2009-08-27 11:32:53 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2009-08-27 11:32:53 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2009-08-27 11:32:53 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2009-08-27 11:18:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-08-04 18:36:55 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-08-04 18:36:52 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-08-04 18:36:51 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-08-04 18:36:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-08-04 18:36:48 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-08-04 18:36:47 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-08-04 17:18:20 | 00,018,944 | ---- | C] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006-03-06 10:41:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll [2004-09-16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS [2004-08-22 16:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003-04-08 10:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-05-10 15:30:08 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPEG32.DLL [2001-09-28 12:44:58 | 00,257,536 | ---- | C] () -- C:\WINDOWS\System32\BiImg.dll [2001-07-22 03:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

to z otl

**Posty:** 18165 · przez **wojtas** 20 Gru 2009, 18:02

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.startup.homepage: "http://www.tattoodle.com?tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}"
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q="
O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\Shell - "" = AutoRun
O33 - MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\Shell\AutoRun\command - "" =

:Files
C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml
C:\Program Files\Fast Browser Search

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 9 · przez **Teo_dor** 20 Gru 2009, 18:41

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Prefs.js: "Fast Browser Search" removed from browser.search.defaultenginename Prefs.js: "Fast Browser Search" removed from browser.search.defaultthis.engineName Prefs.js: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=" removed from browser.search.defaulturl Prefs.js: "Fast Browser Search" removed from browser.search.order.1 Prefs.js: "Fast Browser Search" removed from browser.search.selectedEngine Prefs.js: "http://www.tattoodle.com?tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}" removed from browser.startup.homepage Prefs.js: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q=" removed from keyword.URL File move failed. J:\Autorun.inf scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dc2d1365-d026-11de-8c71-0011506b8016}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2d1365-d026-11de-8c71-0011506b8016}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dc2d1365-d026-11de-8c71-0011506b8016}\ not found. ========== FILES ========== C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml moved successfully. File\Folder C:\Program Files\Fast Browser Search not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Teo ->Temp folder emptied: 399 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 43698448 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 42,00 mb OTL by OldTimer - Version 3.1.19.0 log created on 12202009_173636 Files\Folders moved on Reboot... File\Folder J:\Autorun.inf not found! Registry entries deleted on Reboot...

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-20 17:38:40 - Run 2 OTL by OldTimer - Version 3.1.19.0 Folder = C:\Documents and Settings\Teo\Pulpit Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2600.0000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 308,00 Mb Available Physical Memory | 60,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,34 Gb Total Space | 6,25 Gb Free Space | 20,59% Space Free | Partition Type: NTFS Drive D: | 48,83 Gb Total Space | 45,04 Gb Free Space | 92,24% Space Free | Partition Type: NTFS Drive E: | 48,83 Gb Total Space | 48,51 Gb Free Space | 99,36% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 2,44 Gb Total Space | 1,97 Gb Free Space | 80,70% Space Free | Partition Type: NTFS Drive H: | 10,27 Gb Total Space | 0,65 Gb Free Space | 6,35% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Drive J: | 690,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: TD Current User Name: Teo Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe PRC - [2009-12-19 15:07:38 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-08-15 17:21:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2007-10-17 14:02:50 | 01,114,112 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\RALINK\Common\RaUI.exe PRC - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2005-09-28 16:09:38 | 00,036,864 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe PRC - [2001-10-26 18:29:52 | 01,002,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe MOD - [2001-08-18 07:37:18 | 00,921,088 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2003-07-28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2001-10-26 18:29:36 | 00,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-13 08:32:04 | 00,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-08-03 16:44:54 | 00,021,419 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x) DRV - [2007-10-01 11:06:40 | 00,451,968 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2006-11-08 13:45:26 | 00,240,384 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2500usb.sys -- (RT2500USB) DRV - [2004-08-22 15:31:48 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt) DRV - [2004-08-22 15:31:10 | 00,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus) DRV - [2003-07-29 08:57:20 | 00,040,448 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Dgivecp.Sys -- (DgiVecp) DRV - [2001-10-26 16:49:50 | 00,281,856 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001-08-17 22:03:16 | 00,024,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2001-08-17 20:19:34 | 00,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) DRV - [2001-08-17 20:12:42 | 00,023,070 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2001-07-22 03:41:32 | 00,027,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-19 15:07:46 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-12-19 15:07:46 | 00,000,000 | ---D | M] [2009-08-03 17:38:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Extensions [2009-12-20 13:54:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions [2009-10-18 16:51:27 | 00,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2009-12-13 12:55:25 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB} [2009-12-20 17:38:09 | 00,005,413 | ---- | M] () -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml [2009-12-15 19:33:40 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-15 20:00:25 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-15 20:00:25 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-15 20:00:25 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-15 20:00:25 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-15 20:00:25 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-15 20:00:25 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-08-03 16:20:19 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-01-31 20:06:35 | 00,000,000 | ---- | M] () - G:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-20 17:36:36 | 00,000,000 | ---D | C] -- C:\_OTL [2009-12-20 16:32:42 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:54:40 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss [2009-12-16 20:30:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DOSBox [2009-12-16 20:29:42 | 00,000,000 | ---D | C] -- C:\Program Files\DOSBox-0.73 [2009-12-16 20:10:40 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2009-12-16 20:08:17 | 03,326,576 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:23 | 00,000,000 | ---D | C] -- C:\Liero [2009-12-16 19:38:42 | 01,460,010 | ---- | C] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\Malwarebytes [2009-12-15 19:43:12 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009-12-15 19:43:09 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2009-12-15 19:42:17 | 02,373,096 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-12 11:16:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\OLI [2009-12-12 11:16:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\cosie [2009-12-12 11:04:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\KAMIS [2009-12-08 06:41:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\MAMI [2009-12-05 22:17:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\vlc [2009-12-05 22:15:34 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009-11-25 16:16:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\builddesk [2009-10-04 11:42:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-10-04 11:42:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-20 17:37:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-20 17:37:33 | 53,620,3264 | -HS- | M] () -- C:\hiberfil.sys [2009-12-20 17:37:33 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-20 17:36:46 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Teo\NTUSER.DAT [2009-12-20 17:36:46 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Teo\ntuser.ini [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:55:53 | 04,272,288 | -H-- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-12-20 15:55:34 | 00,000,600 | ---- | M] () -- C:\WINDOWS\win.ini [2009-12-20 15:55:34 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-12-20 15:55:34 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-12-20 15:52:51 | 00,192,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-12-20 14:35:02 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-20 13:54:12 | 00,028,160 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:50:46 | 00,002,539 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Word.lnk [2009-12-20 13:29:10 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 22:18:45 | 00,018,944 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-19 20:50:18 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 14:01:03 | 00,055,517 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-18 19:57:44 | 00,002,557 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Exel.lnk [2009-12-16 23:06:50 | 00,147,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\trygonometria.doc [2009-12-16 22:29:40 | 00,043,096 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-16 21:17:48 | 00,732,590 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:33 | 00,063,840 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:09:40 | 03,326,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:16 | 00,673,333 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-16 19:39:03 | 01,460,010 | ---- | M] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-15 19:42:57 | 02,373,096 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-13 17:33:45 | 03,095,470 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | M] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 23:01:07 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 21:11:37 | 00,028,672 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:23:45 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-12-01 12:06:52 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-11-30 22:17:44 | 01,052,994 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-20 13:51:43 | 00,028,160 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:29:10 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 20:50:20 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 18:41:36 | 00,006,195 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\Sortowanie.pas [2009-12-19 14:01:03 | 00,055,517 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-16 21:17:48 | 00,732,590 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:27 | 00,063,840 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:02:11 | 00,673,333 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-13 18:38:10 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-13 17:32:56 | 03,095,470 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | C] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 22:58:02 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 18:38:28 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-11-30 22:17:44 | 01,052,994 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [2009-11-26 20:01:40 | 00,027,648 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-11-13 08:32:03 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-02 20:53:00 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-08-27 18:08:36 | 00,000,033 | ---- | C] () -- C:\WINDOWS\BiMonitor.ini [2009-08-27 18:08:32 | 00,028,787 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009-08-27 11:35:46 | 00,022,723 | R--- | C] () -- C:\WINDOWS\System32\xrxw1l3.dll [2009-08-27 11:32:53 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2009-08-27 11:32:53 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2009-08-27 11:32:53 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2009-08-27 11:32:53 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2009-08-27 11:32:53 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2009-08-27 11:18:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-08-04 18:36:55 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-08-04 18:36:52 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-08-04 18:36:51 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-08-04 18:36:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-08-04 18:36:48 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-08-04 18:36:47 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-08-04 17:18:20 | 00,018,944 | ---- | C] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006-03-06 10:41:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll [2004-09-16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS [2004-08-22 16:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003-04-08 10:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-05-10 15:30:08 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPEG32.DLL [2001-09-28 12:44:58 | 00,257,536 | ---- | C] () -- C:\WINDOWS\System32\BiImg.dll [2001-07-22 03:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

**Posty:** 2183 · przez **NieWiem** 20 Gru 2009, 18:47

Jeszcze takie coś:

:Files
C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\searchplugins\fast-browser-search.xml
:Commands
[start explorer]

Run Fix i raport do wglądu.

Powinno być już ok.

**Posty:** 9 · przez **Teo_dor** 20 Gru 2009, 18:53

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-20 17:50:56 - Run 3 OTL by OldTimer - Version 3.1.19.0 Folder = C:\Documents and Settings\Teo\Pulpit Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2600.0000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 266,00 Mb Available Physical Memory | 52,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 85,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,34 Gb Total Space | 6,24 Gb Free Space | 20,55% Space Free | Partition Type: NTFS Drive D: | 48,83 Gb Total Space | 45,04 Gb Free Space | 92,24% Space Free | Partition Type: NTFS Drive E: | 48,83 Gb Total Space | 48,51 Gb Free Space | 99,36% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 2,44 Gb Total Space | 1,97 Gb Free Space | 80,70% Space Free | Partition Type: NTFS Drive H: | 10,27 Gb Total Space | 0,65 Gb Free Space | 6,35% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Drive J: | 690,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: TD Current User Name: Teo Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe PRC - [2009-12-19 15:07:38 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-08-15 17:21:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2007-10-17 14:02:50 | 01,114,112 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files\RALINK\Common\RaUI.exe PRC - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2005-09-28 16:09:38 | 00,036,864 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe PRC - [2001-10-26 18:29:52 | 01,002,496 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe MOD - [2001-08-18 07:37:18 | 00,921,088 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-08-15 17:21:36 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-05-28 17:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2003-07-28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2001-10-26 18:29:36 | 00,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-13 08:32:04 | 00,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-08-03 16:44:54 | 00,021,419 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x) DRV - [2007-10-01 11:06:40 | 00,451,968 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2006-11-08 13:45:26 | 00,240,384 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2500usb.sys -- (RT2500USB) DRV - [2004-08-22 15:31:48 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt) DRV - [2004-08-22 15:31:10 | 00,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus) DRV - [2003-07-29 08:57:20 | 00,040,448 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Dgivecp.Sys -- (DgiVecp) DRV - [2001-10-26 16:49:50 | 00,281,856 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001-08-17 22:03:16 | 00,024,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2001-08-17 20:19:34 | 00,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) DRV - [2001-08-17 20:12:42 | 00,023,070 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2001-07-22 03:41:32 | 00,027,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search" FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search" FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=" FF - prefs.js..browser.search.order.1: "Fast Browser Search" FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-20 17:43:53 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-12-19 15:07:46 | 00,000,000 | ---D | M] [2009-08-03 17:38:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Extensions [2009-12-20 13:54:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions [2009-10-18 16:51:27 | 00,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2009-12-13 12:55:25 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB} [2009-12-15 19:33:40 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-15 20:00:25 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-15 20:00:25 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-15 20:00:25 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-15 20:00:25 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-15 20:00:25 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-15 20:00:25 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-08-03 16:20:19 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-01-31 20:06:35 | 00,000,000 | ---- | M] () - G:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2002-04-23 09:42:25 | 00,000,050 | R--- | M] () - J:\Autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-20 17:36:36 | 00,000,000 | ---D | C] -- C:\_OTL [2009-12-20 16:32:42 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:54:40 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss [2009-12-16 20:30:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DOSBox [2009-12-16 20:29:42 | 00,000,000 | ---D | C] -- C:\Program Files\DOSBox-0.73 [2009-12-16 20:10:40 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2009-12-16 20:08:17 | 03,326,576 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:23 | 00,000,000 | ---D | C] -- C:\Liero [2009-12-16 19:38:42 | 01,460,010 | ---- | C] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\Malwarebytes [2009-12-15 19:43:12 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009-12-15 19:43:09 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009-12-15 19:43:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2009-12-15 19:42:17 | 02,373,096 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-12 11:16:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\OLI [2009-12-12 11:16:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\cosie [2009-12-12 11:04:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\KAMIS [2009-12-08 06:41:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\MAMI [2009-12-05 22:17:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Dane aplikacji\vlc [2009-12-05 22:15:34 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009-11-25 16:16:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Teo\Pulpit\builddesk [2009-10-04 11:42:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-10-04 11:42:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-03 16:38:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-20 17:37:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-20 17:37:33 | 53,620,3264 | -HS- | M] () -- C:\hiberfil.sys [2009-12-20 17:37:33 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-20 17:36:46 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Teo\NTUSER.DAT [2009-12-20 17:36:46 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Teo\ntuser.ini [2009-12-20 16:33:24 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Teo\Pulpit\OTL.exe [2009-12-20 15:55:53 | 04,272,288 | -H-- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-12-20 15:55:34 | 00,000,600 | ---- | M] () -- C:\WINDOWS\win.ini [2009-12-20 15:55:34 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-12-20 15:55:34 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-12-20 15:52:51 | 00,192,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-12-20 14:35:02 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-20 13:54:12 | 00,028,160 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:50:46 | 00,002,539 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Word.lnk [2009-12-20 13:29:10 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 22:18:45 | 00,018,944 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-19 20:50:18 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 14:01:03 | 00,055,517 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-18 19:57:44 | 00,002,557 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Exel.lnk [2009-12-16 23:06:50 | 00,147,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\trygonometria.doc [2009-12-16 22:29:40 | 00,043,096 | ---- | M] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-16 21:17:48 | 00,732,590 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:33 | 00,063,840 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:09:40 | 03,326,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Teo\Pulpit\ccsetup_2.26.1050(dobreprogramy.pl).exe [2009-12-16 20:02:16 | 00,673,333 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-16 19:39:03 | 01,460,010 | ---- | M] (DOSBox Team) -- C:\Documents and Settings\Teo\Pulpit\DOSBox0.73-win32-installer.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-15 19:42:57 | 02,373,096 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Teo\Pulpit\mbam-setup.exe [2009-12-13 17:33:45 | 03,095,470 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | M] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 23:01:07 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 21:11:37 | 00,028,672 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:23:45 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-12-01 12:06:52 | 00,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-11-30 22:17:44 | 01,052,994 | ---- | M] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | M] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [3 C:\Documents and Settings\Teo\Moje dokumenty\*.tmp files -> C:\Documents and Settings\Teo\Moje dokumenty\*.tmp -> ] [2 C:\Documents and Settings\Teo\Pulpit\*.tmp files -> C:\Documents and Settings\Teo\Pulpit\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-20 13:51:43 | 00,028,160 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\mr.toumbourine.doc [2009-12-20 13:29:10 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\x.doc [2009-12-19 20:50:20 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\ergpeieqpjoijre.doc [2009-12-19 18:41:36 | 00,006,195 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\Sortowanie.pas [2009-12-19 14:01:03 | 00,055,517 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\syncro.jpg [2009-12-16 21:17:48 | 00,732,590 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\rozwiązania.pdf [2009-12-16 20:29:44 | 00,001,561 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DOSBox 0.73.lnk [2009-12-16 20:14:27 | 00,063,840 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\cc_20091216_201424.reg [2009-12-16 20:02:11 | 00,673,333 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\tc_LieroProFinal.exe [2009-12-15 19:43:12 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2009-12-13 18:38:10 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Ubezpieczenie.doc [2009-12-13 17:32:56 | 03,095,470 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\Chemia fizyczna - laboratorium.pdf [2009-12-09 15:59:55 | 00,005,951 | ---- | C] () -- C:\Documents and Settings\Teo\.recently-used.xbel [2009-12-07 22:58:02 | 00,019,968 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\ad.doc [2009-12-07 18:38:28 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Solidarność.doc [2009-12-06 15:17:14 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\~$ezpieczenie.doc [2009-12-05 22:16:18 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VLC media player.lnk [2009-11-30 22:17:44 | 01,052,994 | ---- | C] () -- C:\Documents and Settings\Teo\Pulpit\adad.xcf [2009-11-27 00:40:49 | 00,069,632 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Pole elektryczne.doc [2009-11-26 20:01:40 | 00,027,648 | ---- | C] () -- C:\Documents and Settings\Teo\Moje dokumenty\Ubezpieczenie.doc [2009-11-13 08:32:03 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-02 20:53:00 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-08-27 18:08:36 | 00,000,033 | ---- | C] () -- C:\WINDOWS\BiMonitor.ini [2009-08-27 18:08:32 | 00,028,787 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009-08-27 11:35:46 | 00,022,723 | R--- | C] () -- C:\WINDOWS\System32\xrxw1l3.dll [2009-08-27 11:32:53 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2009-08-27 11:32:53 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2009-08-27 11:32:53 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2009-08-27 11:32:53 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2009-08-27 11:32:53 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2009-08-27 11:18:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-08-04 18:36:55 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-08-04 18:36:52 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-08-04 18:36:51 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-08-04 18:36:50 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-08-04 18:36:48 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-08-04 18:36:47 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-08-04 17:18:20 | 00,018,944 | ---- | C] () -- C:\Documents and Settings\Teo\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006-03-06 10:41:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll [2004-09-16 13:26:40 | 00,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS [2004-08-22 16:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003-04-08 10:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-05-10 15:30:08 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPEG32.DLL [2001-09-28 12:44:58 | 00,257,536 | ---- | C] () -- C:\WINDOWS\System32\BiImg.dll [2001-07-22 03:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

nadal jest niestety wyszukiwarka i przy nowej karcie pustej pojawia się odnośnik do stronki fbs z "nowa kartka jest otwarta"

**Posty:** 2183 · przez **NieWiem** 20 Gru 2009, 20:30

Zastosujemy cięższy kaliber w takim razie

Wykonaj w podanej przeze mnie kolejności:

Przeczytaj uważnie instrukcję programu ComboFix, po czym wyłącz swój program antywirusowy, firewall i inne programy, które mogą zakłócać nawet pobieranie ComboFixa twierdząc, że jest wirusem. Nie jest! Spokojnie go ściągnij i zapisz na pulpicie.
Pobierz z któregoś poniższego linku:
- LINK #1
- LINK #2
Pozamykaj wszystkie otwarte okna, komunikatory, programy. ComboFixowi nie powinno sie przeszkadzać.
Uruchom program z dwukliku (VISTA: prawoklik i 'uruchom jako administrator').
Pozwól mu spokojnie działać, nie klikaj ani nie stukaj w klawiaturę - to może spwodować zawieszenie się komputera.
Zalecane jest też instalowanie konsoli odzyskiwania, jeśli ComboFix o nią poprosi. Dzięki niej można odrolować zmiany w przypadku pomyłki narzędzia.
Jeśli będzie potrzeba - zgódź się na restart.
Kiedy program skończy, wytworzy loga (będzie on także w pliku C:\ComboFix.txt), którego wklej w odpowiedzi, pamiętając o tagach [code] lub na http://www.wklej.org.

Pobierz program DDS:
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Wyskoczy DOSowe okienko informujące, że w tle odbywa się nieingerencyjne skanowanie. Gdy zostanie zakończone, zostanie pokazane okno z komunikatem.
Wygenerowane przez program logi DDS.txt oraz Attach.txt proszę załączyć w poście w tagach [code] lub wkleić na stronie http://www.wklej.org.

**Posty:** 9 · przez **Teo_dor** 20 Gru 2009, 23:28

Kod: Zaznacz wszystko: ComboFix 09-12-19.03 - Teo 2009-12-20 22:18:41.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.0.1250.48.1045.18.511.380 [GMT 1:00] Uruchomiony z: c:\documents and settings\Teo\Pulpit\cosie\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\ieuinit.inf c:\windows\system32\qmgr.dll . . . jest zainfekowany!! . ((((((((((((((((((((((((( Pliki utworzone od 2009-11-20 do 2009-12-20 ))))))))))))))))))))))))))))))) . 2009-12-20 16:36 . 2009-12-20 16:36 -------- d-----w- C:\_OTL 2009-12-16 19:30 . 2009-12-16 19:30 -------- d-----w- c:\documents and settings\Teo\Ustawienia lokalne\Dane aplikacji\DOSBox 2009-12-16 19:29 . 2009-12-16 20:01 -------- d-----w- c:\program files\DOSBox-0.73 2009-12-16 19:10 . 2009-12-16 19:10 -------- d-----w- c:\program files\CCleaner 2009-12-16 19:02 . 2009-12-16 19:02 -------- d-----w- C:\Liero 2009-12-15 18:43 . 2009-12-15 18:43 -------- d-----w- c:\documents and settings\Teo\Dane aplikacji\Malwarebytes 2009-12-15 18:43 . 2008-10-22 15:28 15504 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-12-15 18:43 . 2008-10-22 15:28 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-15 18:43 . 2009-12-15 18:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-12-15 18:43 . 2009-12-15 18:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2009-12-05 21:17 . 2009-12-20 21:07 -------- d-----w- c:\documents and settings\Teo\Dane aplikacji\vlc 2009-12-05 21:15 . 2009-12-05 21:15 -------- d-----w- c:\program files\VideoLAN . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-20 21:25 . 2001-10-26 16:15 74230 ----a-w- c:\windows\system32\perfc015.dat 2009-12-20 21:25 . 2001-10-26 16:15 448004 ----a-w- c:\windows\system32\perfh015.dat 2009-12-20 20:27 . 2009-09-01 08:30 43096 ----a-w- c:\documents and settings\Teo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-12-20 16:58 . 2009-08-22 22:27 -------- d-----w- c:\program files\Maluch sim 2009-12-20 16:58 . 2009-08-27 18:58 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint 2009-12-19 17:26 . 2009-08-04 20:40 -------- d-----w- c:\program files\ALLPlayer 2009-12-09 14:59 . 2009-09-03 19:22 -------- d-----w- c:\documents and settings\Teo\Dane aplikacji\gtk-2.0 2009-11-22 19:58 . 2009-11-12 14:05 -------- d-----w- c:\documents and settings\Teo\Dane aplikacji\uTorrent 2009-11-13 07:36 . 2009-08-03 15:44 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-13 07:33 . 2009-11-13 07:33 -------- d-----w- c:\program files\Alcohol Soft 2009-11-13 07:32 . 2009-11-13 07:32 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-11-12 14:06 . 2009-11-12 14:06 -------- d-----w- c:\program files\uTorrent 2009-11-06 21:06 . 2009-11-06 20:13 -------- d-----w- c:\documents and settings\Teo\Dane aplikacji\U3 2009-10-26 12:02 . 2009-10-26 11:46 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2009-10-26 10:38 . 2009-08-08 15:38 -------- d-----w- c:\program files\Common Files\InstallShield 2009-10-26 10:38 . 2009-10-26 10:28 -------- d-----w- c:\program files\Motorola 2009-10-26 10:28 . 2009-10-26 10:28 -------- d-----w- c:\program files\WIBU-SYSTEMS . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-15 149280] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-09-28 36864] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-09-28 40960] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2001-10-26 13312] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-8-3 1114112] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2003-10-14 08:22 155648 ----a-r- c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2009-10-04 155136] R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2009-10-04 5248] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-11-13 721904] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - ALG *NewlyCreated* - IPNAT . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Teo\Dane aplikacji\Mozilla\Firefox\Profiles\drwkdok9.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q= FF - prefs.js: browser.search.selectedEngine - Fast Browser Search FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q= . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-20 22:24 Windows 5.1.2600 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x81C8BF00]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf8588fd7 \Driver\ACPI -> ACPI.sys @ 0xf84c972e \Driver\atapi -> 0x81c8bf00 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x8054af41 ParseProcedure -> ntoskrnl.exe @ 0x80574176 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x8054af41 ParseProcedure -> ntoskrnl.exe @ 0x80574176 NDIS: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC #2 -> SendCompleteHandler -> NDIS.sys @ 0xf8394d40 PacketIndicateHandler -> NDIS.sys @ 0xf83a1140 SendHandler -> NDIS.sys @ 0xf8394bf0 Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(768) c:\windows\system32\ODBC32.dll - - - - - - - > 'lsass.exe'(824) c:\windows\system32\mswsock.dll c:\windows\System32\wshtcpip.dll c:\windows\System32\dssenh.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Java\jre6\bin\jqs.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe . ************************************************************************** . Czas ukończenia: 2009-12-20 22:27:37 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-12-20 21:27 Przed: 6 629 658 624 bajtów wolnych Po: 6 600 085 504 bajtów wolnych WinXP_PL_PRO_BF.EXE [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect - - End Of File - - 35BE725BE5105C0CEC7008537824D19B

narazie z combofixa

Dodano Dzisiaj, 22:31:

Kod: Zaznacz wszystko: DDS (Ver_09-12-01.01) - NTFSx86 Run by Teo at 22:30:58,13 on 2009-12-20 Internet Explorer: 6.0.2600.0000 BrowserJavaVersion: 1.6.0_15 Microsoft Windows XP Professional 5.1.2600.0.1250.48.1045.18.511.270 [GMT 1:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Teo\Pulpit\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.tattoodle.com?tid={3CD0C0C6-45AD-4342-80BB-F28500438752} BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll EB: Pasek multimediów: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe" mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\menust~1\programy\autost~1\ralink~1.lnk - c:\program files\ralink\common\RaUI.exe IE: E&ksport do programu Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\teo\daneap~1\mozilla\firefox\profiles\drwkdok9.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q= FF - prefs.js: browser.search.selectedEngine - Fast Browser Search FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={439DBE88-C5AD-175C-3B86-80D42EA5DBB1}&q= ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2009-10-4 155136] R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2009-10-4 5248] R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968] =============== Created Last 30 ================ 2009-12-20 21:13:42 0 d-sha-r- C:\cmdcons 2009-12-20 21:10:58 98816 ----a-w- c:\windows\sed.exe 2009-12-20 21:10:58 77312 ----a-w- c:\windows\MBR.exe 2009-12-20 21:10:58 261632 ----a-w- c:\windows\PEV.exe 2009-12-20 21:10:58 161792 ----a-w- c:\windows\SWREG.exe 2009-12-20 16:36:36 0 d-----w- C:\_OTL 2009-12-20 14:54:40 0 d-----w- c:\windows\pss 2009-12-16 19:29:42 0 d-----w- c:\program files\DOSBox-0.73 2009-12-16 19:10:40 0 d-----w- c:\program files\CCleaner 2009-12-16 19:02:23 0 d-----w- C:\Liero 2009-12-15 18:43:14 0 d-----w- c:\docume~1\teo\daneap~1\Malwarebytes 2009-12-15 18:43:12 15504 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-12-15 18:43:09 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-15 18:43:08 0 d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-12-15 18:43:08 0 d-----w- c:\docume~1\alluse~1\daneap~1\Malwarebytes 2009-12-09 14:59:55 5951 ----a-w- c:\documents and settings\teo\.recently-used.xbel 2009-12-05 21:15:34 0 d-----w- c:\program files\VideoLAN ==================== Find3M ==================== 2009-12-20 21:27:21 74230 ----a-w- c:\windows\system32\perfc015.dat 2009-12-20 21:27:21 448004 ----a-w- c:\windows\system32\perfh015.dat 2009-11-13 07:32:04 721904 ----a-w- c:\windows\system32\drivers\sptd.sys ============= FINISH: 22:31:13,20 ===============

Z DDS

I ATTTACHE

Kod: Zaznacz wszystko: F: is CDROM () G: is FIXED (NTFS) - 2 GiB total, 1,972 GiB free. H: is FIXED (NTFS) - 10 GiB total, 0,724 GiB free. I: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318} Description: Mysz Microsoft PS/2 Device ID: ACPI\PNP0F03\4&15F50029&0 Manufacturer: Microsoft Name: Mysz Microsoft PS/2 PNP Device ID: ACPI\PNP0F03\4&15F50029&0 Service: i8042prt ==== System Restore Points =================== RP118: 2009-12-20 16:21:03 - Punkt kontrolny systemu RP119: 2009-12-20 17:58:36 - Removed ABBYY FineReader 6.0 Sprint Plus RP120: 2009-12-20 17:59:15 - Removed MP3 Player Utilities 4.18 ==== Installed Programs ====================== Adobe Flash Player 10 Plugin Adobe Reader 9.1 - Polish Adobe Shockwave Player 11.5 Archiwizator WinRAR µTorrent Audacity 1.2.6 CCleaner Colin McRae Rally 2 DAEMON Tools GIMP 2.7.0 Java(TM) 6 Update 15 K-Lite Codec Pack 4.6.2 (Full) Malwarebytes' Anti-Malware Microsoft .NET Framework 2.0 Microsoft Office Professional Edition 2003 Motorola Handset USB Driver Mozilla Firefox (3.5.6) NAPIPROJEKT 1.0.6.2 Obsługa sterownika Xerox WorkCentre PE220 Series Ralink Wireless LAN ScanSoft PaperPort 10 VLC media player 1.0.3 WebFldrs XP Windows Installer 3.1 (KB893803) ==== End Of File ===========================

**Posty:** 2183 · przez **NieWiem** 21 Gru 2009, 08:58

Najpierw musimy znaleźć plik do podstawienia, dopiero potem możemy usuwać cokolwiek.

Pobierz aplikację SystemLook i zapisz ją na pulpicie.
Kliknij dwukrotnie na ikonę, aby uruchomić program.
Gdy pojawi sie okno, wlej w nim:
:Filefind
qmgr*.*
Kliknij Look i poczekaj cierpliwie aż program wykona swoja prace.
Kiedy skanowanie sie skończy, pojawią sie okno notatnika, zatytułowane SystemLook. Będzie on zapisany w tym samym miejscu, co aplikacja SystemLook.
Skopiuj (Edycja -> Zaznacz wszystko, Edycja -> Kopiuj) zawartość tego pliku i wklej na http://www.wklej.org lub w poście w tagach [code].

**Posty:** 9 · przez **Teo_dor** 21 Gru 2009, 13:32

Kod: Zaznacz wszystko: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 12:32 on 21/12/2009 by Teo (Administrator - Elevation successful) ========== Filefind ========== Searching for "qmgr*.*" C:\Qoobox\Quarantine\C\WINDOWS\system32\qmgr.dll.vir --a--- 179200 bytes [15:17 03/08/2009] [17:29 26/10/2001] CD35DF4A829D44E04B2BC698CC9F216D C:\WINDOWS\ERDNT\cache\qmgr.dll --a--- 179200 bytes [21:26 20/12/2009] [17:29 26/10/2001] CD35DF4A829D44E04B2BC698CC9F216D C:\WINDOWS\inf\qmgr.inf --a--- 6468 bytes [17:25 26/10/2001] [17:25 26/10/2001] 8AA8E67C909081BCAEEAE4B2BF7042B2 C:\WINDOWS\inf\qmgr.PNF --a--- 8300 bytes [16:00 03/08/2009] [16:00 03/08/2009] A1932D1EEBA10B1755DCF75E500F5CB7 C:\WINDOWS\system32\dllcache\qmgrprxy.dll --a--c 17408 bytes [15:17 03/08/2009] [17:29 26/10/2001] 5304B1786A890DD5C88B43415FDCD4E6 C:\WINDOWS\system32\qmgr.dll ------ 179200 bytes [15:17 03/08/2009] [17:29 26/10/2001] CD35DF4A829D44E04B2BC698CC9F216D C:\WINDOWS\system32\qmgrprxy.dll --a--- 17408 bytes [15:17 03/08/2009] [17:29 26/10/2001] 5304B1786A890DD5C88B43415FDCD4E6 -=End Of File=-

**Posty:** 2183 · przez **NieWiem** 21 Gru 2009, 13:37

Masz płytę instalacyjną swojego Windowsa??

**Posty:** 9 · przez **Teo_dor** 21 Gru 2009, 19:34

mam chyba gdzies;)

**Posty:** 18165 · przez **wojtas** 21 Gru 2009, 21:17

1. Pobierz świeży plik http://www.sendspace.com/file/q5dnrr. Wypakuj je i bezpośrednio na dysku C;

FCopy::
c:\qmgr.dll | c:\windows\system32\qmgr.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Rozpocznie się usuwanie i powstanie log daj go.

poszukaj gdzieś na dysku folderu lub pliku cos związanego z Fast Browser

**Posty:** 9 · przez **Teo_dor** 27 Gru 2009, 01:18

przeinstalowałem firefoxa i wszystko biega

jednakze dziek iwielkie za pomoc

Kto jest na forum