Kłopot z antywirusem i defraglerem

[mirekg1963]

Witam z nowym problemem. Muszę się nazwać problemowy Mir! Proszę o sprawdzenie czy coś jest nie tak, kiedy chciałem ściągnąć darmową wersję DrWeb strony mi zamykają się i mam kłopot jeszcze z defraglerem

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:15:26, on 2009-05-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\admin\USTAWI~1\Temp\bbde.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://cached.gamedesire.com/g_bin/pl/snooker_2_0_0_35.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: (no name) - http://photos.nasza-klasa.pl/4757722/7/other/std/aea5e073d2.jpeg

--
End of file - 3957 bytes


[wojtas]

Pobierz OTListIt2 i daj z niego loga

[mirekg1963]

Już wysyłam!

Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-05-16 13:40:00 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = C:\Documents and Settings\admin\Pulpit
Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

447,48 Mb Total Physical Memory | 171,00 Mb Available Physical Memory | 38,21% Memory free
1,03 Gb Paging File | 0,83 Gb Available in Paging File | 80,03% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 61,56 Gb Free Space | 82,60% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: XPN23
Current User Name: admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2006-03-02 14:00:00 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2007-01-30 12:54:36 | 16,116,224 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
PRC - [2008-11-09 11:20:48 | 00,086,016 | ---- | M] (alch) -- C:\Program Files\ClamWin\bin\ClamTray.exe
PRC - [2009-04-14 18:08:10 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2004-08-04 01:55:54 | 01,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2009-04-16 13:36:36 | 24,264,488 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe
PRC - [2009-04-14 18:08:10 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2006-10-31 08:35:00 | 00,155,715 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2009-02-06 18:39:29 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2006-03-02 14:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\internet explorer\iexplore.exe
PRC - [2009-05-16 13:39:52 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\admin\Pulpit\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2006-03-02 14:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-04-14 18:08:10 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2009-04-27 15:32:42 | 00,953,168 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [On_Demand | Stopped])
SRV - [2006-10-31 08:35:00 | 00,155,715 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2008-11-11 10:38:06 | 00,620,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2006-06-19 00:51:32 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running])
DRV - [2006-05-18 09:48:50 | 00,047,249 | ---- | M] (FTDI Ltd.) -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS [On_Demand | Stopped])
DRV - [2006-05-18 09:49:02 | 00,061,067 | ---- | M] (FTDI Ltd.) -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K [On_Demand | Stopped])
DRV - [2009-02-05 18:11:54 | 00,014,656 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv [On_Demand | Stopped])
DRV - [2005-01-07 18:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2007-01-30 12:57:50 | 04,474,368 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
DRV - [2009-03-05 18:09:03 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd [Boot | Running])
DRV - [2006-10-31 08:35:00 | 03,964,256 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2006-10-18 17:31:38 | 00,105,472 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running])
DRV - [2006-11-27 17:33:50 | 00,058,368 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
DRV - [2006-11-27 17:33:54 | 00,019,968 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running])
DRV - [2008-08-26 10:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2006-03-02 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2006-03-02 14:00:00 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2005-08-10 14:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running])
DRV - [2005-05-16 15:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running])
DRV - [2005-11-03 16:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=orange]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "www.google.pl"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-04-14 18:08:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-04-29 13:05:56 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-05-16 11:39:53 | 00,000,000 | ---D | M]

[2009-02-12 14:00:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\admin\Dane aplikacji\mozilla\Extensions
[2009-02-12 14:00:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\admin\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-03-05 18:07:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\admin\Dane aplikacji\mozilla\Firefox\Profiles\4urjx59f.default\extensions
[2009-05-16 11:39:39 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-04-29 13:05:56 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-05-07 21:04:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009-04-14 18:08:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009-04-29 13:05:50 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-04-29 13:05:50 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2006-06-03 18:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon (alch)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (Skype Technologies S.A.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} http://cached.gamedesire.com/g_bin/pl/snooker_2_0_0_35.cab (GameDesire Snooker)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://photos.nasza-klasa.pl/4757722/7/other/std/aea5e073d2.jpeg
O24 - Desktop Components:1 (Moja bieżąca strona główna) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-02-05 17:59:39 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{048575ac-2d8d-11de-aa85-001a4d80e902}\Shell\AutoRun\command - "" = D:\uxkl0apt.bat -- File not found
O33 - MountPoints2\{048575ac-2d8d-11de-aa85-001a4d80e902}\Shell\open\Command - "" = D:\uxkl0apt.bat -- File not found
O33 - MountPoints2\{12d1544c-2294-11de-aa56-001a4d80e902}\Shell\Auto\command - "" = D:\tel.xls.exe -- File not found
O33 - MountPoints2\{1776baec-f78a-11dd-a980-001a4d80e902}\Shell\AutoRun\command - "" = D:\eaywxx.cmd -- File not found
O33 - MountPoints2\{1776baec-f78a-11dd-a980-001a4d80e902}\Shell\open\Command - "" = D:\eaywxx.cmd -- File not found
O33 - MountPoints2\{1b537506-fcdf-11dd-a993-001a4d80e902}\Shell\AutoRun\command - "" = D:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537506-fcdf-11dd-a993-001a4d80e902}\Shell\open\Command - "" = D:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537507-fcdf-11dd-a993-001a4d80e902}\Shell\AutoRun\command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537507-fcdf-11dd-a993-001a4d80e902}\Shell\open\Command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{1bea054a-41f2-11de-aaeb-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{1e308112-1529-11de-aa12-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{1e308112-1529-11de-aa12-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{1fa8a8d6-fda4-11dd-a99b-001a4d80e902}\Shell\AutoRun\command - "" = D:\cb.exe -- File not found
O33 - MountPoints2\{1fa8a8d6-fda4-11dd-a99b-001a4d80e902}\Shell\open\Command - "" = D:\cb.exe -- File not found
O33 - MountPoints2\{2088543a-192f-11de-aa24-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{2088543a-192f-11de-aa24-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{2b7ad5a0-0e4b-11de-a9ef-001a4d80e902}\Shell\AutoRun\command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{2b7ad5a0-0e4b-11de-a9ef-001a4d80e902}\Shell\open\Command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{2f100f16-036d-11de-a9bb-001a4d80e902}\Shell\AutoRun\command - "" = D:\qxty9be.cmd -- File not found
O33 - MountPoints2\{2f100f16-036d-11de-a9bb-001a4d80e902}\Shell\open\Command - "" = D:\qxty9be.cmd -- File not found
O33 - MountPoints2\{32b40bbc-36ef-11de-aab3-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbc-36ef-11de-aab3-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbd-36ef-11de-aab3-001a4d80e902}\Shell\AutoRun\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbd-36ef-11de-aab3-001a4d80e902}\Shell\open\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{3c6b2d6e-1252-11de-aa00-001a4d80e902}\Shell\AutoRun\command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d6e-1252-11de-aa00-001a4d80e902}\Shell\open\Command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d72-1252-11de-aa00-001a4d80e902}\Shell\AutoRun\command - "" = E:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d72-1252-11de-aa00-001a4d80e902}\Shell\open\Command - "" = E:\luk1ylq.com -- File not found
O33 - MountPoints2\{49693757-0ca1-11de-a9e0-001a4d80e902}\Shell\AutoRun\command - "" = D:\i.com -- File not found
O33 - MountPoints2\{49693757-0ca1-11de-a9e0-001a4d80e902}\Shell\open\Command - "" = D:\i.com -- File not found
O33 - MountPoints2\{580052b0-000b-11de-a9ab-001a4d80e902}\Shell\AutoRun\command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{580052b0-000b-11de-a9ab-001a4d80e902}\Shell\open\Command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{5d9194c8-0718-11de-a9ca-001a4d80e902}\Shell\AutoRun\command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{5d9194c8-0718-11de-a9ca-001a4d80e902}\Shell\open\Command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{60004fbe-0e3a-11de-a9ed-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{60004fbe-0e3a-11de-a9ed-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{60004fbf-0e3a-11de-a9ed-001a4d80e902}\Shell\AutoRun\command - "" = E:\i.com -- File not found
O33 - MountPoints2\{60004fbf-0e3a-11de-a9ed-001a4d80e902}\Shell\open\Command - "" = E:\i.com -- File not found
O33 - MountPoints2\{63465b8e-3a43-11de-aac3-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{63465b8e-3a43-11de-aac3-001a4d80e902}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{63779968-057a-11de-a9c7-001a4d80e902}\Shell\AutoRun\command - "" = D:\gi2ky.exe -- File not found
O33 - MountPoints2\{63779968-057a-11de-a9c7-001a4d80e902}\Shell\open\Command - "" = D:\gi2ky.exe -- File not found
O33 - MountPoints2\{637f36bb-2a6a-11de-aa7b-001a4d80e902}\Shell\AutoRun\command - "" = D:\ej10fkdo.bat -- File not found
O33 - MountPoints2\{637f36bb-2a6a-11de-aa7b-001a4d80e902}\Shell\open\Command - "" = D:\ej10fkdo.bat -- File not found
O33 - MountPoints2\{63937c64-0417-11de-a9bf-001a4d80e902}\Shell\AutoRun\command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{63937c64-0417-11de-a9bf-001a4d80e902}\Shell\open\Command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{64d83388-f3a2-11dd-a964-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{64d83388-f3a2-11dd-a964-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{64d83389-f3a2-11dd-a964-001a4d80e902}\Shell\AutoRun\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{64d83389-f3a2-11dd-a964-001a4d80e902}\Shell\open\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{691792ce-fc25-11dd-a98f-001a4d80e902}\Shell\AutoRun\command - "" = D:\jm3cx96.bat -- File not found
O33 - MountPoints2\{691792ce-fc25-11dd-a98f-001a4d80e902}\Shell\open\Command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{70ded5fe-3f8f-11de-aad9-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{7611235d-1ac6-11de-aa2e-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{7611235d-1ac6-11de-aa2e-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{84ca99e0-03f3-11de-a9bc-001a4d80e902}\Shell\AutoRun\command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{84ca99e0-03f3-11de-a9bc-001a4d80e902}\Shell\open\Command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\AutoRun\command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\explore\Command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\open\Command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b6612b-f8fc-11dd-a987-001a4d80e902}\Shell\AutoRun\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{b4b6612b-f8fc-11dd-a987-001a4d80e902}\Shell\open\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{bbb71c35-f3aa-11dd-a966-001a4d80e902}\Shell\AutoRun\command - "" = D:\a2h2.com -- File not found
O33 - MountPoints2\{bbb71c35-f3aa-11dd-a966-001a4d80e902}\Shell\open\Command - "" = D:\a2h2.com -- File not found
O33 - MountPoints2\{beb5b583-f3a3-11dd-b514-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{beb5b583-f3a3-11dd-b514-806d6172696f}\Shell\AutoRun\command - "" = D:\Run.exe -- File not found
O33 - MountPoints2\{c92b8563-f3a4-11dd-a965-001a4d80e902}\Shell\AutoRun\command - "" = D:\pook.com -- File not found
O33 - MountPoints2\{c92b8563-f3a4-11dd-a965-001a4d80e902}\Shell\open\Command - "" = D:\pook.com -- File not found
O33 - MountPoints2\{e5f70f8a-2f6a-11de-aa93-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{e5f70f8a-2f6a-11de-aa93-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{e5f70f8b-2f6a-11de-aa93-001a4d80e902}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorunme.exe -- File not found
O33 - MountPoints2\{e5f70f8b-2f6a-11de-aa93-001a4d80e902}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorunme.exe -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\AutoRun\command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\explore\Command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\open\Command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{eb0b10ae-fe94-11dd-a9a4-001a4d80e902}\Shell\AutoRun\command - "" = E:\0bcobed.exe -- File not found
O33 - MountPoints2\{eb0b10ae-fe94-11dd-a9a4-001a4d80e902}\Shell\open\Command - "" = E:\0bcobed.exe -- File not found
O33 - MountPoints2\{eb0b10af-fe94-11dd-a9a4-001a4d80e902}\Shell\AutoRun\command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{eb0b10af-fe94-11dd-a9a4-001a4d80e902}\Shell\open\Command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{f0dd1342-387d-11de-aab4-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{f0dd1342-387d-11de-aab4-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\AutoRun\command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\explore\Command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\open\Command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f8fc35b6-3f0f-11de-aad7-001a4d80e902}\Shell\AutoRun\command - "" = D:\dbrxubcw.com -- File not found
O33 - MountPoints2\{f8fc35b6-3f0f-11de-aad7-001a4d80e902}\Shell\open\Command - "" = D:\dbrxubcw.com -- File not found
O33 - MountPoints2\{fb26d210-1ae2-11de-aa2f-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{fb26d210-1ae2-11de-aa2f-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{fd0ddd92-397a-11de-aabd-001a4d80e902}\Shell\AutoRun\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found
O33 - MountPoints2\{fd0ddd92-397a-11de-aabd-001a4d80e902}\Shell\open\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-05-16 13:39:52 | 00,000,000 | ---D | M]
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-05-16 13:39:50 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\admin\Pulpit\OTListIt2.exe
[2009-05-16 13:15:19 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\admin\Pulpit\HijackThis.lnk
[2009-05-16 13:15:19 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009-05-16 13:15:11 | 00,881,976 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\admin\Pulpit\HJTInstall.exe
[2009-05-16 12:54:21 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DiskTrix
[2009-05-16 11:38:25 | 00,392,632 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\admin\Pulpit\wmpfirefoxplugin.exe
[2009-05-16 10:25:55 | 00,000,000 | ---D | C] -- C:\Program Files\Techland
[2009-05-15 15:24:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\admin\Pulpit\Odkurzacz
[2009-05-15 10:22:26 | 00,000,638 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk
[2009-05-15 10:19:11 | 20,398,051 | ---- | C] (CipSoft GmbH                                                ) -- C:\Documents and Settings\admin\Pulpit\tibia842.exe
[2009-05-14 13:10:36 | 00,000,000 | ---D | C] -- C:\Program Files\SkanerOnline
[2009-05-07 21:06:00 | 00,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-05-07 21:06:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\admin\Dane aplikacji\skypePM
[2009-05-07 21:04:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\admin\Dane aplikacji\Skype
[2009-05-07 21:04:14 | 00,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk
[2009-05-07 21:04:12 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2009-05-07 21:04:08 | 00,000,000 | R--D | C] -- C:\Program Files\Skype
[2009-05-07 21:04:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype
[2009-05-07 21:02:21 | 01,976,104 | ---- | C] (Skype Technologies S.A.) -- C:\Documents and Settings\admin\Pulpit\SkypeSetup.exe
[2009-04-27 17:14:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\admin\Moje dokumenty\Odebrane pliki
[2009-04-27 16:53:34 | 00,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-04-27 16:53:34 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-04-27 16:53:34 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax
[2009-04-27 16:53:34 | 00,000,000 | ---D | C] -- C:\Program Files\Xvid
[2009-04-27 16:53:32 | 00,000,000 | ---D | C] -- C:\Program Files\FDRLab
[2009-04-24 21:12:25 | 00,000,040 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\UC.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\RAR.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\PKZIP.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\PKUNZIP.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\NOCLOSE.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\LHA.PIF
[2009-04-24 21:09:48 | 00,000,545 | ---- | C] () -- C:\WINDOWS\ARJ.PIF
[2009-04-24 21:09:48 | 00,000,534 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009-04-24 21:09:48 | 00,000,000 | ---D | C] -- C:\totalcmd
[2009-04-08 10:59:43 | 00,000,133 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2009-02-17 15:33:54 | 00,179,712 | -H-- | C] () -- C:\WINDOWS\System32\smtp.dll
[2009-02-05 21:36:32 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006-10-31 08:35:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006-10-31 08:35:00 | 01,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006-10-31 08:35:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006-10-31 08:35:00 | 00,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006-10-31 08:35:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006-10-31 08:35:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006-10-31 08:35:00 | 00,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006-03-02 14:00:00 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2006-03-02 14:00:00 | 00,000,557 | ---- | C] () -- C:\WINDOWS\win.ini
[2006-03-02 14:00:00 | 00,000,262 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[2009-05-16 13:39:52 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\admin\Pulpit\OTListIt2.exe
[2009-05-16 13:36:03 | 00,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-05-16 13:35:56 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\admin\Ustawienia lokalne\desktop.ini
[2009-05-16 13:35:56 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-05-16 13:35:53 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-05-16 13:15:19 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\admin\Pulpit\HijackThis.lnk
[2009-05-16 13:15:13 | 00,881,976 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\admin\Pulpit\HJTInstall.exe
[2009-05-16 12:54:21 | 00,000,262 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-05-16 11:38:25 | 00,392,632 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\admin\Pulpit\wmpfirefoxplugin.exe
[2009-05-15 10:22:26 | 00,000,638 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Tibia.lnk
[2009-05-15 10:22:07 | 20,398,051 | ---- | M] (CipSoft GmbH                                                ) -- C:\Documents and Settings\admin\Pulpit\tibia842.exe
[2009-05-11 10:55:43 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-07 21:06:00 | 00,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-05-07 21:04:14 | 00,001,880 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk
[2009-05-07 21:02:29 | 01,976,104 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\admin\Pulpit\SkypeSetup.exe
[2009-05-04 10:13:03 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009-04-28 14:09:45 | 00,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2009-04-27 15:37:50 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2009-04-24 21:48:50 | 00,000,534 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-04-24 21:12:25 | 00,000,040 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-04-23 16:53:10 | 00,448,348 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-04-23 16:53:10 | 00,392,432 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-04-23 16:53:10 | 00,074,450 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-04-23 16:53:10 | 00,058,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-04-23 16:53:09 | 00,984,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
< End of report >


[wojtas]

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - Reg Error: Key error. File not found
O33 - MountPoints2\{048575ac-2d8d-11de-aa85-001a4d80e902}\Shell\AutoRun\command - "" = D:\uxkl0apt.bat -- File not found
O33 - MountPoints2\{048575ac-2d8d-11de-aa85-001a4d80e902}\Shell\open\Command - "" = D:\uxkl0apt.bat -- File not found
O33 - MountPoints2\{12d1544c-2294-11de-aa56-001a4d80e902}\Shell\Auto\command - "" = D:\tel.xls.exe -- File not found
O33 - MountPoints2\{1776baec-f78a-11dd-a980-001a4d80e902}\Shell\AutoRun\command - "" = D:\eaywxx.cmd -- File not found
O33 - MountPoints2\{1776baec-f78a-11dd-a980-001a4d80e902}\Shell\open\Command - "" = D:\eaywxx.cmd -- File not found
O33 - MountPoints2\{1b537506-fcdf-11dd-a993-001a4d80e902}\Shell\AutoRun\command - "" = D:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537506-fcdf-11dd-a993-001a4d80e902}\Shell\open\Command - "" = D:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537507-fcdf-11dd-a993-001a4d80e902}\Shell\AutoRun\command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{1b537507-fcdf-11dd-a993-001a4d80e902}\Shell\open\Command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{1bea054a-41f2-11de-aaeb-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{1e308112-1529-11de-aa12-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{1e308112-1529-11de-aa12-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{1fa8a8d6-fda4-11dd-a99b-001a4d80e902}\Shell\AutoRun\command - "" = D:\cb.exe -- File not found
O33 - MountPoints2\{1fa8a8d6-fda4-11dd-a99b-001a4d80e902}\Shell\open\Command - "" = D:\cb.exe -- File not found
O33 - MountPoints2\{2088543a-192f-11de-aa24-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{2088543a-192f-11de-aa24-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{2b7ad5a0-0e4b-11de-a9ef-001a4d80e902}\Shell\AutoRun\command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{2b7ad5a0-0e4b-11de-a9ef-001a4d80e902}\Shell\open\Command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{2f100f16-036d-11de-a9bb-001a4d80e902}\Shell\AutoRun\command - "" = D:\qxty9be.cmd -- File not found
O33 - MountPoints2\{2f100f16-036d-11de-a9bb-001a4d80e902}\Shell\open\Command - "" = D:\qxty9be.cmd -- File not found
O33 - MountPoints2\{32b40bbc-36ef-11de-aab3-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbc-36ef-11de-aab3-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbd-36ef-11de-aab3-001a4d80e902}\Shell\AutoRun\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{32b40bbd-36ef-11de-aab3-001a4d80e902}\Shell\open\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{3c6b2d6e-1252-11de-aa00-001a4d80e902}\Shell\AutoRun\command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d6e-1252-11de-aa00-001a4d80e902}\Shell\open\Command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d72-1252-11de-aa00-001a4d80e902}\Shell\AutoRun\command - "" = E:\luk1ylq.com -- File not found
O33 - MountPoints2\{3c6b2d72-1252-11de-aa00-001a4d80e902}\Shell\open\Command - "" = E:\luk1ylq.com -- File not found
O33 - MountPoints2\{49693757-0ca1-11de-a9e0-001a4d80e902}\Shell\AutoRun\command - "" = D:\i.com -- File not found
O33 - MountPoints2\{49693757-0ca1-11de-a9e0-001a4d80e902}\Shell\open\Command - "" = D:\i.com -- File not found
O33 - MountPoints2\{580052b0-000b-11de-a9ab-001a4d80e902}\Shell\AutoRun\command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{580052b0-000b-11de-a9ab-001a4d80e902}\Shell\open\Command - "" = D:\2fiy.bat -- File not found
O33 - MountPoints2\{5d9194c8-0718-11de-a9ca-001a4d80e902}\Shell\AutoRun\command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{5d9194c8-0718-11de-a9ca-001a4d80e902}\Shell\open\Command - "" = D:\luk1ylq.com -- File not found
O33 - MountPoints2\{60004fbe-0e3a-11de-a9ed-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{60004fbe-0e3a-11de-a9ed-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{60004fbf-0e3a-11de-a9ed-001a4d80e902}\Shell\AutoRun\command - "" = E:\i.com -- File not found
O33 - MountPoints2\{60004fbf-0e3a-11de-a9ed-001a4d80e902}\Shell\open\Command - "" = E:\i.com -- File not found
O33 - MountPoints2\{63465b8e-3a43-11de-aac3-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{63465b8e-3a43-11de-aac3-001a4d80e902}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{63779968-057a-11de-a9c7-001a4d80e902}\Shell\AutoRun\command - "" = D:\gi2ky.exe -- File not found
O33 - MountPoints2\{63779968-057a-11de-a9c7-001a4d80e902}\Shell\open\Command - "" = D:\gi2ky.exe -- File not found
O33 - MountPoints2\{637f36bb-2a6a-11de-aa7b-001a4d80e902}\Shell\AutoRun\command - "" = D:\ej10fkdo.bat -- File not found
O33 - MountPoints2\{637f36bb-2a6a-11de-aa7b-001a4d80e902}\Shell\open\Command - "" = D:\ej10fkdo.bat -- File not found
O33 - MountPoints2\{63937c64-0417-11de-a9bf-001a4d80e902}\Shell\AutoRun\command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{63937c64-0417-11de-a9bf-001a4d80e902}\Shell\open\Command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{64d83388-f3a2-11dd-a964-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{64d83388-f3a2-11dd-a964-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{64d83389-f3a2-11dd-a964-001a4d80e902}\Shell\AutoRun\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{64d83389-f3a2-11dd-a964-001a4d80e902}\Shell\open\command - "" = E:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{691792ce-fc25-11dd-a98f-001a4d80e902}\Shell\AutoRun\command - "" = D:\jm3cx96.bat -- File not found
O33 - MountPoints2\{691792ce-fc25-11dd-a98f-001a4d80e902}\Shell\open\Command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{70ded5fe-3f8f-11de-aad9-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{7611235d-1ac6-11de-aa2e-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{7611235d-1ac6-11de-aa2e-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{84ca99e0-03f3-11de-a9bc-001a4d80e902}\Shell\AutoRun\command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{84ca99e0-03f3-11de-a9bc-001a4d80e902}\Shell\open\Command - "" = D:\wx8o0bt1.com -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\AutoRun\command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\explore\Command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b66128-f8fc-11dd-a987-001a4d80e902}\Shell\open\Command - "" = D:\2.cmd -- File not found
O33 - MountPoints2\{b4b6612b-f8fc-11dd-a987-001a4d80e902}\Shell\AutoRun\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{b4b6612b-f8fc-11dd-a987-001a4d80e902}\Shell\open\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{bbb71c35-f3aa-11dd-a966-001a4d80e902}\Shell\AutoRun\command - "" = D:\a2h2.com -- File not found
O33 - MountPoints2\{bbb71c35-f3aa-11dd-a966-001a4d80e902}\Shell\open\Command - "" = D:\a2h2.com -- File not found
O33 - MountPoints2\{beb5b583-f3a3-11dd-b514-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{beb5b583-f3a3-11dd-b514-806d6172696f}\Shell\AutoRun\command - "" = D:\Run.exe -- File not found
O33 - MountPoints2\{c92b8563-f3a4-11dd-a965-001a4d80e902}\Shell\AutoRun\command - "" = D:\pook.com -- File not found
O33 - MountPoints2\{c92b8563-f3a4-11dd-a965-001a4d80e902}\Shell\open\Command - "" = D:\pook.com -- File not found
O33 - MountPoints2\{e5f70f8a-2f6a-11de-aa93-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{e5f70f8a-2f6a-11de-aa93-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{e5f70f8b-2f6a-11de-aa93-001a4d80e902}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorunme.exe -- File not found
O33 - MountPoints2\{e5f70f8b-2f6a-11de-aa93-001a4d80e902}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorunme.exe -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\AutoRun\command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\explore\Command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{e85fa764-2380-11de-aa5e-001a4d80e902}\Shell\open\Command - "" = D:\rdsfk.com -- File not found
O33 - MountPoints2\{eb0b10ae-fe94-11dd-a9a4-001a4d80e902}\Shell\AutoRun\command - "" = E:\0bcobed.exe -- File not found
O33 - MountPoints2\{eb0b10ae-fe94-11dd-a9a4-001a4d80e902}\Shell\open\Command - "" = E:\0bcobed.exe -- File not found
O33 - MountPoints2\{eb0b10af-fe94-11dd-a9a4-001a4d80e902}\Shell\AutoRun\command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{eb0b10af-fe94-11dd-a9a4-001a4d80e902}\Shell\open\Command - "" = E:\cv22.cmd -- File not found
O33 - MountPoints2\{f0dd1342-387d-11de-aab4-001a4d80e902}\Shell - "" = AutoRun
O33 - MountPoints2\{f0dd1342-387d-11de-aab4-001a4d80e902}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\AutoRun\command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\explore\Command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f0dd1343-387d-11de-aab4-001a4d80e902}\Shell\open\Command - "" = E:\fkljwg.exe -- File not found
O33 - MountPoints2\{f8fc35b6-3f0f-11de-aad7-001a4d80e902}\Shell\AutoRun\command - "" = D:\dbrxubcw.com -- File not found
O33 - MountPoints2\{f8fc35b6-3f0f-11de-aad7-001a4d80e902}\Shell\open\Command - "" = D:\dbrxubcw.com -- File not found
O33 - MountPoints2\{fb26d210-1ae2-11de-aa2f-001a4d80e902}\Shell\AutoRun\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{fb26d210-1ae2-11de-aa2f-001a4d80e902}\Shell\open\command - "" = D:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe -- File not found
O33 - MountPoints2\{fd0ddd92-397a-11de-aabd-001a4d80e902}\Shell\AutoRun\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found
O33 - MountPoints2\{fd0ddd92-397a-11de-aabd-001a4d80e902}\Shell\open\command - "" = D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTListIt2 z opcją Run Scan. Pokazujesz nowy log OTListIt.txt (czyszczenie i skan )

oraz


1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

[mirekg1963]

Daaje raport z kasperka

Kod: Zaznacz wszystko

--------------------------------------------------------------------------------
RAPORT KASPERSKY ONLINE SCANNER 7.0
poniedziałek, 18 maj 2009
System operacyjny: Microsoft Windows XP Home Edition Dodatek Service Pack 2 (build 2600)
Wersja Kaspersky Online Scanner: 7.0.26.12
Data ostatniej aktualizacji bazy danych: Monday, May 18, 2009 17:57:29
Liczba wpisów: 2191346
--------------------------------------------------------------------------------

Ustawienia skanowania:
   Typ bazy danych użytej do skanowania: rozszerzona
   Skanuj archiwa: tak
   Skanuj pocztowe bazy danych: tak

Obszar skanowania - Mój komputer:
   A:\
   C:\

Statystyki skanowania:
   Przeskanowanych plików: 23134
   Nazwa zagrożenia: 3
   Zainfekowanych obiektów: 98
   Podejrzanych obiektów: 0
   Czas skanowania: 00:34:11


Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń
C:\Documents and Settings\admin\Dane aplikacji\U3\temp\cleanup.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\admin\Dane aplikacji\U3\temp\Launchpad Removal.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\admin\Pulpit\install_flash_player.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\admin\Pulpit\nowegg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AAWService.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AAWTray.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AAWWSC.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-Aware.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\lsdelete.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\threatwork.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\icxpa.cmd   Zainfekowany: Trojan-GameThief.Win32.Magania.bcah   1
C:\instaaal\Ad-AwareAE_[www.programosy.pl].exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\Firefox Setup 3.0.10.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\OpenOffice.org 3.0 (pl) Installation Files\instmsia.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\OpenOffice.org 3.0 (pl) Installation Files\instmsiw.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\OpenOffice.org 3.0 (pl) Installation Files\setup.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\UltimateDefrag Freeware Edition 1.72\UltimateDefragFREEPublicDomainEditionSetup.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\instaaal\WindowsXP-KB894391-x86-PLK.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\ClamWin\bin\clamscan.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\ClamWin\bin\sigtool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver2.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\patchjre.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\zipper.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}\setup.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\java-rmi.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\java.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\javaw.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\javaws.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\jureg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\keytool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\kinit.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\klist.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\ktab.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\orbd.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\pack200.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\policytool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\rmid.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\rmiregistry.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\servertool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\tnameserv.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Java\jre1.6.0_05\bin\unpack200.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\AAWWSC.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe.aawbak   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareCommand.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\drivers\32\AAWDriverTool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\lsdelete.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\threatwork.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Lavasoft\Ad-Aware\Toolbox\AutoStart Manager\AutoStart Manager.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Metin2_PL\config.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Metin2_PL\errorlog.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Metin2_PL\metin2.bin   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Metin2_PL\metin2.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Metin2_PL\PatchUpdater.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Mozilla Firefox\crashreporter.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Mozilla Firefox\uninstall\helper.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Mozilla Firefox\updater.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Nowe Gadu-Gadu\CrashReporter.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Nowe Gadu-Gadu\gg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Nowe Gadu-Gadu\Uninstall.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\gengal.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\msfontextract.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\nsplugin.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\python-core-2.3.4\lib\distutils\command\wininst.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\senddoc.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\setofficelang.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\stclient_wrapper.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\Basis\program\testtool.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\program\crashrep.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\program\python.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\program\quickstart.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\program\unoinfo.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\program\unopkg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\URE\bin\regcomp.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\URE\bin\regmerge.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\URE\bin\regview.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\OpenOffice.org 3\URE\bin\uno.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Realtek\InstallShield\Alcmtr.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Realtek\InstallShield\ChCfg.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Realtek\InstallShield\RtlUpd.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Realtek\InstallShield\SoundMan.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Valve\hl.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Valve\hlds.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\Program Files\Valve\hltv.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\w.com   Zainfekowany: Trojan-GameThief.Win32.Magania.bbul   1
C:\WINDOWS\Alcmtr.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\WINDOWS\system32\nwiz.exe   Zainfekowany: Virus.Win32.Sality.aa   1
C:\WINDOWS\system32\SkanerOnlineUninstall.exe   Zainfekowany: Virus.Win32.Sality.aa   1

Wybrany obszar został przeskanowany.


[wojtas]

zastosuj :

kaspersky-virus-removal-tool-i-system-repair-engineer-vt100058.html
kaspersky virus removal tool oraz

daj loga z dss

http://www.searchengines.pl/ComboFix-vs-DDS-OTListIt2-t86306.html

[mirekg1963]

kasper virus removaal nieotwiera sie ale mam z dss-a !!!

Kod: Zaznacz wszystko

DDS (Ver_09-05-14.01) - NTFSx86 
Run by admin at 17:07:29,10 on 2009-05-19
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.447.192 [GMT 2:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
C:\DOCUME~1\admin\USTAWI~1\Temp\winemhq.exe
C:\DOCUME~1\admin\USTAWI~1\Temp\winjfmagm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\admin\Pulpit\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.pl/
mDefault_Page_URL = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [ClamWin] "c:\program files\clamwin\bin\ClamTray.exe" --logon
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admin\daneap~1\mozilla\firefox\profiles\bjm19one.default\
FF - prefs.js: browser.startup.homepage - www.google.pl

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-7 64160]
R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\lmrnm.sys --> c:\windows\system32\drivers\lmrnm.sys [?]
S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-8-17 18688]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1026896]

=============== Created Last 30 ================

2009-05-19 17:07   <DIR>   --d-h---   c:\windows\PIF
2009-05-18 19:53   <DIR>   --d-----   c:\windows\ERUNT
2009-05-18 19:53   <DIR>   --d-----   C:\!FixIEDef
2009-05-18 18:34   <DIR>   --d-----   c:\documents and settings\admin\DoctorWeb
2009-05-18 17:51   <DIR>   --d-----   c:\program files\common files\DiskTrix
2009-05-18 17:47   <DIR>   --d-----   c:\windows\pss
2009-05-15 18:36   <DIR>   --d-----   c:\program files\Nowe Gadu-Gadu
2009-05-15 17:24   106,336   ---shr--   C:\icxpa.cmd
2009-05-14 20:08   <DIR>   --d-----   c:\program files\Trend Micro
2009-05-14 19:40   <DIR>   --d-----   c:\program files\SkanerOnline
2009-05-14 19:38   15,688   a-------   c:\windows\system32\lsdelete.exe
2009-05-13 10:29   <DIR>   --d-----   c:\program files\Techland
2009-05-13 10:21   <DIR>   --d-----   c:\program files\WinAce
2009-05-12 15:19   107,633   ---shr--   C:\w.com
2009-05-11 18:05   31,616   ac------   c:\windows\system32\dllcache\usbccgp.sys
2009-05-11 18:05   31,616   a-------   c:\windows\system32\drivers\usbccgp.sys
2009-05-08 12:23   57   a-------   c:\windows\wininit.ini
2009-05-07 18:27   221,184   a-------   c:\windows\system32\wmpns.dll
2009-05-07 17:29   <DIR>   --d-----   c:\docume~1\admin\daneap~1\OpenFM
2009-05-07 17:28   <DIR>   --d-----   c:\docume~1\admin\daneap~1\Nowe Gadu-Gadu
2009-05-07 17:27   <DIR>   --d-----   c:\program files\Odkurzacz
2009-05-07 17:20   <DIR>   --d-----   C:\instaaal
2009-05-07 17:19   <DIR>   --d-----   c:\docume~1\admin\daneap~1\OpenOffice.org
2009-05-07 17:18   <DIR>   --d-----   c:\program files\OpenOffice.org 3
2009-05-07 17:01   <DIR>   --d-----   c:\program files\Valve
2009-05-07 16:58   <DIR>   --d-----   c:\program files\Metin2_PL
2009-05-07 16:38   3,072   a-------   c:\windows\system32\drivers\audstub.sys
2009-05-07 16:37   58,624   a-------   c:\windows\system32\drivers\redbook.sys
2009-05-07 16:37   77,312   a-------   c:\windows\system32\usbui.dll
2009-05-07 16:36   <DIR>   --d-----   c:\program files\common files\ODBC
2009-05-07 16:36   <DIR>   --d-----   c:\program files\common files\SpeechEngines
2009-05-07 16:35   127,008   a-------   c:\windows\system\MSVIDEO.DLL
2009-05-07 16:35   <DIR>   --d-h---   c:\documents and settings\all users\Szablony
2009-05-07 16:35   <DIR>   --d--r--   c:\documents and settings\all users\Menu Start
2009-05-07 16:35   <DIR>   --d--r--   c:\documents and settings\all users\Dokumenty
2009-05-07 16:35   <DIR>   --d-----   c:\documents and settings\all users\Ulubione
2009-05-07 16:35   <DIR>   --d-----   c:\documents and settings\all users\Pulpit
2009-05-07 16:35   <DIR>   --d-hr--   c:\documents and settings\all users\Dane aplikacji
2009-05-07 16:34   261   a-------   c:\windows\system32\$winnt$.inf
2009-05-07 16:27   <DIR>   -cd-h---   c:\docume~1\alluse~1\daneap~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-05-07 16:27   <DIR>   --d-----   c:\program files\Lavasoft
2009-05-07 16:24   <DIR>   --d-----   c:\docume~1\admin\daneap~1\.clamwin
2009-05-07 16:24   <DIR>   --d-----   c:\program files\ClamWin
2009-05-07 16:24   <DIR>   --d-----   c:\documents and settings\all users\.clamwin
2009-05-07 14:54   <DIR>   --d-----   c:\program files\Realtek
2009-05-07 14:49   <DIR>   --d-hr--   c:\documents and settings\admin\Dane aplikacji
2009-05-07 14:49   <DIR>   --d--r--   c:\documents and settings\admin\Moje dokumenty
2009-05-07 14:49   <DIR>   --d--r--   c:\documents and settings\admin\Menu Start
2009-05-07 14:49   <DIR>   --d-h---   c:\documents and settings\admin\Ustawienia lokalne
2009-05-07 14:49   <DIR>   --d-h---   c:\documents and settings\admin\Szablony
2009-05-07 14:49   <DIR>   --d--r--   c:\documents and settings\admin\Ulubione
2009-05-07 14:49   <DIR>   --d-----   c:\documents and settings\admin\Pulpit
2009-05-07 14:44   <DIR>   --dsh---   c:\documents and settings\all users\DRM
2009-05-07 14:44   <DIR>   --d-h---   c:\program files\WindowsUpdate
2009-05-07 14:44   <DIR>   --d-----   c:\program files\Usługi online
2009-05-07 14:43   <DIR>   --d-----   c:\program files\common files\MSSoap
2009-05-07 14:42   <DIR>   --d-----   c:\program files\Messenger
2009-05-07 14:42   <DIR>   --d-----   c:\program files\MSN Gaming Zone
2009-05-07 14:42   <DIR>   --d-----   c:\program files\Windows NT

==================== Find3M  ====================

2009-05-07 16:29   64,160   a-------   c:\windows\system32\drivers\Lbd.sys
2009-05-07 14:56   14,656   a-------   c:\windows\gdrv.sys
2009-05-07 14:55   355,486   a-------   c:\windows\system32\perfh015.dat
2009-05-07 14:55   49,492   a-------   c:\windows\system32\perfc015.dat
2009-05-07 14:54   315,392   a-------   c:\windows\HideWin.exe
2009-05-07 14:45   76,487   a-------   c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-07 14:43   21,856   a-------   c:\windows\system32\emptyregdb.dat

============= FINISH: 17:07:42,79 ===============


i jeszcze z Attach

Kod: Zaznacz wszystko

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 2009-05-07 14:47:42
System Uptime: 2009-05-19 13:08:37 (4 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. |  | M61SME-S2
Processor: AMD Sempron(tm) Processor 3000+ | Socket M2 | 1607/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 75 GiB total, 69,051 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP12: 2009-05-18 18:00:49 - Punkt kontrolny systemu
RP13: 2009-05-18 19:53:36 - Created By FixIEDef

==== Installed Programs ======================

Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Aktualizacja dla systemu Windows XP (KB894391)
Aktualizacja dla systemu Windows XP (KB911164)
ClamWin Free Antivirus 0.95.1
Counter-Strike 1.6
High Definition Audio Driver Package - KB888111
Java(TM) 6 Update 5
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.10)
Nowe Gadu-Gadu
NVIDIA Drivers
Odkurzacz 11.3
OpenOffice.org 3.0
Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)
Realtek High Definition Audio Driver
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP

==== Event Viewer Messages From Past Week ========

2009-05-18 16:58:19, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\shell32.dll. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 6.0.2900.2180.
2009-05-16 10:08:48, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 18:33:10, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 17:23:47, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 17:23:03, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 12:33:15, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 10:37:48, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 10:31:16, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 10:27:35, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.
2009-05-15 10:21:48, informacje: Windows File Protection [64002]  - Podjęto próbę zamiany chronionego pliku systemowego cdaudio.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.0.

==== End Of File ===========================


[wojtas]

jak tam skan webem ? daj raport oraz log z http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[mirekg1963]

DrWeb

Kod: Zaznacz wszystko

aawservice.exe;c:\program files\lavasoft\ad-aware;Win32.Sector.5;Wyleczony.;
ad-awareadmin.exe;c:\program files\lavasoft\ad-aware;Win32.Sector.5;Wyleczony.;
nmdfgds0.dll;c:\windows\system32;Prawdopodobnie Trojan.Packed.191;Niewyleczalny.Usunięty.;
olhrwef.exe;c:\windows\system32;Prawdopodobnie Trojan.Packed.191;Niewyleczalny.Usunięty.;
xh319r9b.bat;c:\;Prawdopodobnie Trojan.Packed.191;Niewyleczalny.Usunięty.;


combofix

Kod: Zaznacz wszystko

ComboFix 09-05-19.08 - admin 2009-05-20 17:02.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.447.235 [GMT 2:00]
Uruchomiony z: c:\documents and settings\admin\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\icxpa.cmd
C:\lc.exe
C:\ukvr.bat
C:\w.com
c:\windows\IE4 Error Log.txt
c:\windows\system32\nmdfgds1.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASC3360PR
-------\Service_asc3360pr


(((((((((((((((((((((((((   Pliki utworzone od 2009-04-20 do 2009-05-20  )))))))))))))))))))))))))))))))
.

2009-05-20 10:47 . 2009-05-20 10:47   --------   d-----w   c:\documents and settings\All Users\Dane aplikacji\NOS
2009-05-20 10:47 . 2009-05-20 10:47   --------   d-----w   c:\program files\NOS
2009-05-19 15:07 . 2009-05-19 15:07   --------   d--h--w   c:\windows\PIF
2009-05-18 17:53 . 2009-05-18 17:53   --------   d-----w   c:\windows\ERUNT
2009-05-18 16:34 . 2009-05-18 16:34   --------   d-----w   c:\documents and settings\admin\DoctorWeb
2009-05-18 15:52 . 2009-05-18 15:52   16504   ----a-w   c:\documents and settings\admin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-18 15:51 . 2009-05-18 15:51   --------   d-----w   c:\program files\Common Files\DiskTrix
2009-05-15 16:36 . 2009-05-15 16:36   --------   d-----w   c:\program files\Nowe Gadu-Gadu
2009-05-14 18:08 . 2009-05-14 18:08   --------   d-----w   c:\program files\Trend Micro
2009-05-14 17:40 . 2009-05-15 08:22   --------   d-----w   c:\program files\SkanerOnline
2009-05-14 17:38 . 2009-05-14 17:36   15688   ----a-w   c:\windows\system32\lsdelete.exe
2009-05-14 15:16 . 2009-05-14 15:16   --------   d-----w   c:\documents and settings\LocalService\Pulpit
2009-05-13 08:29 . 2009-05-13 08:29   --------   d-----w   c:\program files\Techland
2009-05-13 08:21 . 2009-05-13 11:30   --------   d-----w   c:\program files\WinAce
2009-05-11 16:05 . 2004-08-03 21:08   31616   -c--a-w   c:\windows\system32\dllcache\usbccgp.sys
2009-05-11 16:05 . 2004-08-03 21:08   31616   ----a-w   c:\windows\system32\drivers\usbccgp.sys
2009-05-11 14:48 . 2009-05-11 14:48   --------   d-----w   c:\documents and settings\admin\Ustawienia lokalne\Dane aplikacji\Identities
2009-05-07 16:35 . 2009-05-07 16:35   0   ----a-w   c:\windows\nsreg.dat
2009-05-07 16:35 . 2009-05-07 16:35   --------   d-----w   c:\documents and settings\admin\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-05-07 16:27 . 2006-03-02 12:00   221184   ----a-w   c:\windows\system32\wmpns.dll
2009-05-07 15:29 . 2009-05-07 15:29   --------   d-----w   c:\documents and settings\admin\Dane aplikacji\OpenFM
2009-05-07 15:28 . 2009-05-19 17:21   --------   d-----w   c:\documents and settings\admin\Dane aplikacji\Nowe Gadu-Gadu
2009-05-07 15:27 . 2009-05-07 15:46   --------   d-----w   c:\program files\Odkurzacz
2009-05-07 15:20 . 2009-05-18 15:51   --------   d-----w   C:\instaaal
2009-05-07 15:19 . 2009-05-07 15:19   --------   d-----w   c:\documents and settings\admin\Dane aplikacji\OpenOffice.org
2009-05-07 15:18 . 2009-05-07 15:18   --------   d-----w   c:\program files\OpenOffice.org 3
2009-05-07 15:01 . 2009-05-07 15:02   --------   d-----w   c:\program files\Valve

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 15:15 . 2009-05-07 14:58   --------   d-----w   c:\program files\Metin2_PL
2009-05-13 08:29 . 2009-05-07 12:54   --------   d--h--w   c:\program files\InstallShield Installation Information
2009-05-13 08:27 . 2009-05-07 12:52   --------   d-----w   c:\program files\Common Files\InstallShield
2009-05-07 14:29 . 2009-05-07 14:29   64160   ----a-w   c:\windows\system32\drivers\Lbd.sys
2009-05-07 14:27 . 2009-05-07 14:27   --------   d-----w   c:\program files\Lavasoft
2009-05-07 14:24 . 2009-05-07 14:24   --------   d-----w   c:\program files\ClamWin
2009-05-07 14:23 . 2009-05-07 14:23   --------   d-----w   c:\program files\Java
2009-05-07 14:22 . 2009-05-07 14:22   --------   d-----w   c:\program files\Common Files\Java
2009-05-07 12:56 . 2009-05-07 12:50   14656   ----a-w   c:\windows\gdrv.sys
2009-05-07 12:55 . 2006-03-02 12:00   49492   ----a-w   c:\windows\system32\perfc015.dat
2009-05-07 12:55 . 2006-03-02 12:00   355486   ----a-w   c:\windows\system32\perfh015.dat
2009-05-07 12:54 . 2009-05-07 12:54   --------   d-----w   c:\program files\Realtek
2009-05-07 12:54 . 2009-05-07 12:54   315392   ----a-w   c:\windows\HideWin.exe
2009-05-07 12:53 . 2009-05-07 12:53   --------   d-----w   c:\program files\DIFX
2009-05-07 12:46 . 2009-05-07 12:46   --------   d-----w   c:\program files\microsoft frontpage
2009-05-07 12:44 . 2009-05-07 12:44   --------   d-----w   c:\program files\Usługi online
2009-05-07 12:43 . 2009-05-07 12:43   21856   ----a-w   c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-01-30 16116224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^admin^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\admin\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Metin2_PL\\metin2.bin"=
"c:\\Program Files\\OpenOffice.org 3\\program\\quickstart.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\OpenOffice.org 3\\program\\soffice.bin"=
"c:\\WINDOWS\\system32\\wpabaln.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe"=
"c:\\Program Files\\OpenOffice.org 3\\program\\soffice.exe"=
"c:\\WINDOWS\\notepad.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Metin2_PL\\metin2.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-05-07 64160]
S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-08-17 18688]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-05-20 33176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 953168]
.
Zawartość folderu 'Zaplanowane zadania'

2009-05-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 14:30]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-ClamWin - c:\program files\ClamWin\bin\ClamTray.exe


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
mStart Page = hxxp://www.yahoo.com
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
FF - ProfilePath - c:\documents and settings\admin\Dane aplikacji\Mozilla\Firefox\Profiles\bjm19one.default\
FF - prefs.js: browser.startup.homepage - www.google.pl
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 17:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\rundll32.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-05-20 17:05 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-05-20 15:05

Przed: 73 254 686 720 bajtów wolnych
Po: 73 304 563 712 bajtów wolnych

WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

153


[wojtas]

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

Malwarebytes Anti-Malware.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

[mirekg1963]

Przepraszam Cię bardzo ale to już przerabialiśmy i mam wrażenie że kręcę się w kółko. No co, działać się na nim działa ale coś nie jest tak. Zobaczę , wezmę na przeczekanie a później raczej format. W innym poście odesłałeś mnie na forum gdzie pisali o gotowych płytach ratunkowych tzw! Tylko że ja poszukuję czegoś takiego ale na pena bo nie mam kieszonki Tego typu problem (mam na myśli tą infekcje) zaczyna mi się pojawiać coraz częściej na innych kompach i nie ma na niego sposobu Dzieki za to co dotychczas !

[wojtas]

musisz taka plytke zrobic na NIE zainfekowanym kompie i wtedy odpalac u siebie na zarazonych bo inaczej lipa

[mirekg1963]

A masz jakiś pomysł na pendriva , czy istnieje taka szansa zrobienia takiej płytki, czy to po prostu kwestia tylko nagrania na inny nośnik? No i czy wtedy trzeba coś w biosie zmieniać żeby startowało to z usb?

[wojtas]

nie wiem czy jest taka mozliwosc ale sadze ze jest... jesli mozna tak w biosie ustawic.. sprobuj