Kolor czcionek plikow systemowych, zarazanie swojego ftp'a

[lolekzehej]

Witam,

Postanowilem wkleic tutaj loga z otl'a gdyz ostatnio cos chwycilem dziwnego, jakies chore .exe pousuwałem które sie zamontowały ale czcionki mi kolor zmieniły w plikach systemowych to raz a dwa szlaja sie za mna jakis syf bo nawet podczas wrzucania na ftp stronek www cos tam sie montuje, lekko mi stabilnosc rowniez spadla. bardzo prosze o sprawdzenie loga

Kod: Zaznacz wszystko

OTL logfile created on: 2009-08-04 19:15:14 - Run 1
OTL by OldTimer - Version 3.0.10.4     Folder = C:\Documents and Settings\Kania\Pulpit
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

767,48 Mb Total Physical Memory | 362,13 Mb Available Physical Memory | 47,18% Memory free
1,83 Gb Paging File | 1,41 Gb Available in Paging File | 76,79% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 10,00 Gb Total Space | 1,62 Gb Free Space | 16,16% Space Free | Partition Type: NTFS
Drive D: | 139,04 Gb Total Space | 111,91 Gb Free Space | 80,49% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KANIA
Current User Name: Kania
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2006-05-03 18:43:46 | 00,413,696 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2006-05-03 18:43:46 | 00,413,696 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008-02-08 18:36:14 | 00,227,856 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
PRC - [2008-02-08 18:36:14 | 00,227,856 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
PRC - [2009-03-31 09:39:36 | 00,233,472 | ---- | M] (Teruten) -- C:\WINDOWS\System32\FsUsbExService.Exe
PRC - [2008-09-01 18:11:07 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2008-08-04 01:04:00 | 01,345,376 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\winamp.exe
PRC - [2007-06-21 07:01:00 | 01,076,168 | ---- | M] (C. Ghisler & Co.) -- C:\Program Files\totalcmd\TOTALCMD.EXE
PRC - [2009-07-24 00:39:29 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-08-04 19:12:58 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kania\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2008-09-01 17:43:13 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped])
SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2006-05-03 18:43:46 | 00,413,696 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2006-05-03 11:57:00 | 00,520,192 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008-02-08 18:36:14 | 00,227,856 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe -- (AVP [Auto | Running])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009-03-31 09:39:36 | 00,233,472 | ---- | M] (Teruten) -- C:\WINDOWS\System32\FsUsbExService.Exe -- (FsUsbExService [Auto | Running])
SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2008-09-01 18:03:46 | 00,069,632 | ---- | M] (Macromedia) -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service [On_Demand | Stopped])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2008-11-11 10:38:06 | 00,620,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2002-07-17 09:53:02 | 00,016,877 | ---- | M] (Adaptec) -- C:\WINDOWS\System32\drivers\aspi32.BAK -- (ASPI32 [Auto | Running])
DRV - [2006-05-03 18:50:42 | 01,540,608 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2001-08-17 22:19:34 | 00,040,704 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\es1371mp.sys -- (es1371 [On_Demand | Stopped])
DRV - [2004-08-04 01:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running])
DRV - [2008-09-02 00:36:07 | 00,112,144 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running])
DRV - [2007-12-28 19:51:04 | 00,195,344 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys -- (klif [System | Running])
DRV - [2007-12-13 13:28:40 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Running])
DRV - [2001-10-24 15:49:16 | 00,006,752 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\PfModNT.sys -- (PfModNT [Auto | Running])
DRV - [2001-08-18 01:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2006-02-27 06:46:20 | 00,081,408 | ---- | M] (Realtek Semiconductor Corporation                           ) -- C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys -- (RTL8023xp [On_Demand | Running])
DRV - [2004-08-04 00:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Stopped])
DRV - [2001-10-26 02:00:00 | 00,492,672 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\sbpci.sys -- (sbpci [On_Demand | Running])
DRV - [2004-07-17 11:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2009-03-20 10:01:26 | 00,090,112 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\ss_bbus.sys -- (ss_bbus [On_Demand | Stopped])
DRV - [2009-03-20 10:01:26 | 00,014,976 | ---- | M] (MCCI Corporation) -- C:\WINDOWS\System32\DRIVERS\ss_bmdfl.sys -- (ss_bmdfl [On_Demand | Stopped])
DRV - [2009-03-20 10:01:26 | 00,121,856 | ---- | M] (MCCI Corporation) -- C:\WINDOWS\System32\DRIVERS\ss_bmdm.sys -- (ss_bmdm [On_Demand | Stopped])
DRV - [2003-07-02 04:42:00 | 00,027,904 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1 [Boot | Running])
DRV - [2009-03-31 09:39:36 | 00,036,608 | ---- | M] () -- C:\WINDOWS\System32\FsUsbExDisk.SYS -- (FsUsbExDisk [On_Demand | Running])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1645522239-602609370-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1645522239-602609370-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-1645522239-602609370-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1645522239-602609370-682003330-1003\S-1-5-21-1645522239-602609370-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.openintab: true
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1
FF - prefs.js..extensions.enabledItems: {c36177c0-224a-11da-8cd6-0800200c9a99}:3.0.4
FF - prefs.js..extensions.enabledItems: {31513E58-F253-47ad-86DB-D5F21E905429}:0.0.1.2006102615+
FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:2.1.4
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.1
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.12

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-07-24 00:39:34 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-07-24 00:39:34 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009-06-23 21:54:54 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2008-09-01 17:50:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Extensions
[2008-09-01 17:50:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-08-04 00:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions
[2009-06-27 16:38:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{31513E58-F253-47ad-86DB-D5F21E905429}
[2009-06-27 16:38:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a99}
[2009-07-14 16:34:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-08-02 23:19:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2009-06-13 23:05:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34}
[2009-06-27 16:38:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2009-06-27 13:47:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mozilla\Firefox\Profiles\2lvaatd3.default\extensions\filtersetg@updater
[2009-08-04 00:26:24 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-07-24 00:39:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008-09-02 00:03:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
[2009-07-24 00:39:29 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-07-24 00:39:29 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2007-04-10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll
[2009-07-24 00:39:30 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2003-07-15 06:56:52 | 00,013,888 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
[2009-01-28 20:46:54 | 00,307,200 | ---- | M] (ESKA) -- C:\Program Files\mozilla firefox\plugins\npOggX.dll
[2006-10-22 23:24:32 | 00,091,768 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2006-10-07 06:18:48 | 00,144,984 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2006-09-12 22:57:38 | 00,131,072 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2006-09-12 22:57:38 | 00,131,072 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2006-09-12 22:57:38 | 00,131,072 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2006-09-12 22:57:40 | 00,131,072 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2006-09-12 22:57:40 | 00,131,072 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2006-10-07 06:01:00 | 00,081,920 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprpjplug.dll
[2009-07-24 00:39:30 | 00,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (318441 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1   www.007guard.com
O1 - Hosts: 127.0.0.1   007guard.com
O1 - Hosts: 127.0.0.1   008i.com
O1 - Hosts: 127.0.0.1   www.008k.com
O1 - Hosts: 127.0.0.1   008k.com
O1 - Hosts: 127.0.0.1   www.00hq.com
O1 - Hosts: 127.0.0.1   00hq.com
O1 - Hosts: 127.0.0.1   010402.com
O1 - Hosts: 127.0.0.1   www.032439.com
O1 - Hosts: 127.0.0.1   032439.com
O1 - Hosts: 127.0.0.1   www.0scan.com
O1 - Hosts: 127.0.0.1   0scan.com
O1 - Hosts: 127.0.0.1   1000gratisproben.com
O1 - Hosts: 127.0.0.1   www.1000gratisproben.com
O1 - Hosts: 127.0.0.1   1001namen.com
O1 - Hosts: 127.0.0.1   www.1001namen.com
O1 - Hosts: 127.0.0.1   100888290cs.com
O1 - Hosts: 127.0.0.1   www.100888290cs.com
O1 - Hosts: 127.0.0.1   www.100sexlinks.com
O1 - Hosts: 127.0.0.1   100sexlinks.com
O1 - Hosts: 127.0.0.1   10sek.com
O1 - Hosts: 127.0.0.1   www.10sek.com
O1 - Hosts: 127.0.0.1   www.1-2005-search.com
O1 - Hosts: 127.0.0.1   1-2005-search.com
O1 - Hosts: 10922 more lines...
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe (Kaspersky Lab)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1645522239-602609370-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm ()
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 58 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1645522239-602609370-682003330-1003\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 85.14.85.14 89.25.184.132
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\System32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-09-01 16:09:05 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

File not found -- C:\Documents and Settings\Kania\Pulpit\Sander van Doorn vs Robbie Williams-Close My Eyes (Original Mix)
File not found -- C:\Documents and Settings\Kania\Pulpit\Joop - The Future
File not found -- C:\Documents and Settings\Kania\Pulpit\Jay-Z - 99 Problems
File not found -- C:\Documents and Settings\Kania\Pulpit\Interstate & Sander Van Doorn - Remember Sun Goes Down ( First State Mashup)
[2009-08-04 19:12:49 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kania\Pulpit\OTL.exe
[2009-08-02 22:37:44 | 00,328,921 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\01.jpg
[2009-08-02 22:34:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\!fotografia
[2009-08-02 22:33:12 | 00,000,000 | ---D | C] -- C:\qwicnementownia
[2009-08-02 22:20:18 | 00,000,112 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\planeta_katowice.pls
[2009-07-30 21:26:40 | 00,595,859 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\wydech.jpg
[2009-07-30 21:25:50 | 02,177,259 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\IMG_0953.JPG
[2009-07-29 22:54:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\Nowy folder (2)
[2009-07-29 21:30:37 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009-07-29 21:30:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
[2009-07-27 22:58:51 | 01,973,054 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\artemida nowe.psd
[2009-07-26 23:54:52 | 02,852,351 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5741.JPG
[2009-07-26 23:51:58 | 00,159,190 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\Ol.jpg
[2009-07-26 23:44:23 | 00,167,794 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\2.jpg
[2009-07-26 23:44:13 | 00,159,190 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\1.jpg
[2009-07-26 23:34:38 | 02,446,052 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5733.JPG
[2009-07-26 23:32:57 | 02,792,687 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5731.JPG
[2009-07-26 23:31:25 | 02,771,382 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5719.JPG
[2009-07-26 23:28:54 | 02,268,912 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5696.JPG
[2009-07-26 23:24:03 | 00,339,697 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\10,.jpg
[2009-07-26 23:22:25 | 02,586,026 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5727.JPG
[2009-07-26 23:19:18 | 01,865,410 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5692.JPG
[2009-07-25 22:28:31 | 00,103,170 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\marta_0126b-15.jpg
[2009-07-24 00:10:06 | 00,106,344 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\getAttachment.jpg
[2009-07-22 20:24:28 | 02,696,275 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5552.JPG
[2009-07-22 20:20:31 | 02,596,799 | ---- | C] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5516.JPG
[2009-07-19 13:12:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\Nowy folder
[2009-07-12 00:00:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\lol
[2009-07-09 16:34:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\art
[2009-07-09 16:31:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kania\Pulpit\lapointes_road
[2009-06-03 19:20:05 | 00,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009-06-03 19:20:05 | 00,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2008-12-19 23:23:52 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008-12-19 23:23:52 | 00,383,238 | ---- | C] () -- C:\WINDOWS\System32\libmp3lame-0.dll
[2008-11-01 15:09:05 | 00,000,113 | ---- | C] () -- C:\WINDOWS\Inetreg.ini
[2008-10-23 09:14:52 | 00,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2008-09-07 11:20:48 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008-09-02 00:31:39 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-09-01 23:34:43 | 00,000,557 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008-09-01 23:32:05 | 00,005,701 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008-09-01 18:18:06 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007-10-25 17:26:10 | 00,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004-07-17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2001-07-22 02:16:20 | 00,000,477 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 02:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
File not found -- C:\Documents and Settings\Kania\Pulpit\Sander van Doorn vs Robbie Williams-Close My Eyes (Original Mix)
File not found -- C:\Documents and Settings\Kania\Pulpit\Joop - The Future
File not found -- C:\Documents and Settings\Kania\Pulpit\Jay-Z - 99 Problems
File not found -- C:\Documents and Settings\Kania\Pulpit\Interstate & Sander Van Doorn - Remember Sun Goes Down ( First State Mashup)
[2009-08-04 19:12:58 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kania\Pulpit\OTL.exe
[2009-08-04 19:10:09 | 27,863,840 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009-08-04 18:43:16 | 01,093,920 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2009-08-04 16:44:06 | 00,005,701 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-08-04 16:43:00 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-08-04 16:42:58 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-08-04 16:42:55 | 80,483,5328 | -HS- | M] () -- C:\hiberfil.sys
[2009-08-04 01:04:33 | 00,399,092 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009-08-04 01:04:33 | 00,106,736 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2009-08-03 18:53:44 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009-08-03 18:37:18 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-08-02 22:39:31 | 00,015,310 | -H-- | M] () -- C:\treeinfo.wc
[2009-08-02 22:37:45 | 00,328,921 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\01.jpg
[2009-08-02 22:20:20 | 00,000,112 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\planeta_katowice.pls
[2009-07-30 21:27:18 | 00,000,557 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-07-30 21:26:42 | 00,595,859 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\wydech.jpg
[2009-07-30 21:25:52 | 02,177,259 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\IMG_0953.JPG
[2009-07-29 21:21:13 | 00,000,477 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-07-29 21:21:13 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-07-29 21:21:13 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-07-27 23:02:04 | 01,973,054 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\artemida nowe.psd
[2009-07-26 23:52:00 | 00,159,190 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\Ol.jpg
[2009-07-26 23:44:25 | 00,167,794 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\2.jpg
[2009-07-26 23:44:14 | 00,159,190 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\1.jpg
[2009-07-26 23:24:06 | 00,339,697 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\10,.jpg
[2009-07-26 20:02:00 | 02,852,351 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5741.JPG
[2009-07-26 20:01:24 | 02,446,052 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5733.JPG
[2009-07-26 20:01:08 | 02,792,687 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5731.JPG
[2009-07-26 20:00:00 | 02,771,382 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5719.JPG
[2009-07-26 18:09:18 | 02,586,026 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5727.JPG
[2009-07-26 17:11:22 | 02,268,912 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5696.JPG
[2009-07-26 17:07:10 | 01,865,410 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5692.JPG
[2009-07-25 22:28:32 | 00,103,170 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\marta_0126b-15.jpg
[2009-07-24 00:10:06 | 00,106,344 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\getAttachment.jpg
[2009-07-22 17:18:58 | 02,696,275 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5552.JPG
[2009-07-22 17:06:16 | 02,596,799 | ---- | M] () -- C:\Documents and Settings\Kania\Pulpit\DSC_5516.JPG
[2009-07-12 13:31:30 | 00,034,896 | ---- | M] () -- C:\Documents and Settings\Kania\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
[2009-07-10 16:25:18 | 00,170,688 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-07-06 18:23:01 | 00,016,896 | ---- | M] () -- C:\Documents and Settings\Kania\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[color=#E56717]========== LOP Check ==========[/color]

[2009-07-29 21:30:37 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji
[2009-02-25 20:29:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
[2009-01-19 00:28:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations
[2009-01-19 00:31:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
[2008-09-01 17:54:56 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Dane aplikacji
[2009-07-29 21:17:58 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Kania\Dane aplikacji
[2008-09-01 18:17:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Ahead
[2008-09-01 17:33:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\ATI
[2008-09-02 00:04:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Azureus
[2009-02-25 20:30:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\CyberLink
[2009-03-21 15:37:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Docx2Rtf
[2008-09-01 18:11:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Gadu-Gadu
[2008-09-02 00:06:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Leadertech
[2009-03-22 23:43:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\mojosoft
[2008-12-19 23:07:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Moyea
[2008-09-01 18:21:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\NetMedia Providers
[2009-03-01 23:02:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Nokia
[2009-02-12 12:28:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Nowe Gadu-Gadu
[2009-03-21 15:37:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\NwDocx
[2008-09-18 15:41:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Opera
[2009-01-19 00:32:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\PC Suite
[2008-09-01 18:21:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Publish Providers
[2009-06-03 19:19:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Samsung
[2008-11-02 12:52:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Sony
[2008-09-02 00:31:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\Thunderbird
[2008-12-09 01:01:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\VSO
[2008-11-04 14:28:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kania\Dane aplikacji\WebStripper
[2008-09-01 16:12:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji
[2008-09-01 16:12:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji
[2001-07-22 02:17:50 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009-08-04 16:43:00 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

[color=#E56717]========== Purity Check ==========[/color]


< End of report >


[Okocza]

lolekzehej, daj jeszcze log z RSIT

[lolekzehej]

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Kania at 2009-08-04 20:21:33
Microsoft Windows XP Professional Dodatek Service Pack 2
System drive C: has 2 GB (16%) free of 10 GB
Total RAM: 767 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:23:36, on 2009-08-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kania\Pulpit\RSIT.exe
C:\Program Files\trend micro\Kania.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 3533 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0\bin\ssv.dll [2008-09-02 501384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2008-02-08 227856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-02-08 219664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Disabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Disabled:KTF MUSIC VoD Server"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Disabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2009-08-04 20:21:47 ----D---- C:\Program Files\trend micro
2009-08-04 20:21:33 ----D---- C:\rsit
2009-08-02 22:33:12 ----D---- C:\qwicnementownia
2009-07-29 21:30:37 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-29 21:30:37 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy

======List of files/folders modified in the last 1 months======

2009-08-04 20:22:49 ----A---- C:\WINDOWS\wincmd.ini
2009-08-04 20:22:49 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-08-04 20:21:47 ----D---- C:\Program Files
2009-08-04 20:13:20 ----D---- C:\Program Files\Mozilla Thunderbird
2009-08-04 20:06:23 ----D---- C:\Program Files\Mozilla Firefox
2009-08-04 19:16:58 ----D---- C:\WINDOWS\Temp
2009-08-04 19:14:39 ----D---- C:\WINDOWS\Prefetch
2009-08-04 18:43:17 ----D---- C:\WINDOWS
2009-08-04 16:43:50 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-04 16:43:49 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2009-08-04 01:04:28 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-03 18:53:44 ----A---- C:\WINDOWS\NeroDigital.ini
2009-08-02 09:38:21 ----SHD---- C:\WINDOWS\CSC
2009-07-29 22:06:20 ----SD---- C:\Documents and Settings\Kania\Dane aplikacji\Microsoft
2009-07-29 21:21:13 ----SH---- C:\boot.ini
2009-07-29 21:21:13 ----A---- C:\WINDOWS\win.ini
2009-07-29 21:21:13 ----A---- C:\WINDOWS\system.ini
2009-07-29 21:21:12 ----D---- C:\WINDOWS\pss
2009-07-29 21:04:49 ----D---- C:\WINDOWS\system32
2009-07-11 23:51:55 ----D---- C:\WINDOWS\Minidump
2009-07-09 16:31:32 ----RSD---- C:\WINDOWS\Fonts
2009-07-08 18:30:21 ----RSHDC---- C:\WINDOWS\system32\dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-04 41472]
R1 klif;Klif; \??\C:\WINDOWS\system32\drivers\klif.sys []
R2 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [1997-12-23 23936]
R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\PfModNT.sys []
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 sbpci;Sound Blaster PCI128 Audio Driver (WDM); C:\WINDOWS\system32\drivers\sbpci.sys [2001-10-26 492672]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); C:\WINDOWS\system32\drivers\es1371mp.sys [2001-08-17 40704]
S3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
S3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys []
S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Sterownik filtru Przywracania systemu; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 AVP;Kaspersky Internet Security 7.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2008-02-08 227856]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-09-01 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 Macromedia Licensing Service;Macromedia Licensing Service; C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [2008-09-01 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]

-----------------EOF-----------------


[Okocza]

lolekzehej, zhakowane-konto-wow-a-logi-po-czyszczeniu-vt111408.html#p844321 wykonaj to co napisane jest w tym poście

[lolekzehej]

Okocza, nie ma potrzeby, takie rzeczy jak przywracanie itd mam wylaczane, to samo tyczy sie między innymi msconfiga itd, tam wsazystko mam poukladane, wszelkie oczyszania mialem porobione\

Pozatym uzywam Ccleaner'a, ktory swietnie sobie radzi z tymi tematami, wiec chyba nie tedy droga...

[Okocza]

lolekzehej, logi są czyste, zmiana koloru czcionek (pewnie na niebieski) to nie wina wirusów. dla pewności, zrób log z Combofixa.

[lolekzehej]

ok, dzieki bardzo za info, pozdraiwam

[Okocza]

lolekzehej, oczywiście zamieść go tutaj..