Komputer rozsyła spam

**Posty:** 7 · przez **Tarzanisko** 22 Maj 2009, 14:01

Z firmy prowadzącej mój mail dostałem informacje że mój komputer rozsyła spam, wobec czego blokują mi możliwość wysyłania maili. Jeden z moich komputerów od jakiegoś czasu znacznie wolniej działa, muli, net słabo działa. Przesyłam z niego logi z ITLisy It'a,
Proszę o rady...

Log:

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-22 13:50:20 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = G:\PROGRAMY Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1013,42 Mb Total Physical Memory | 246,24 Mb Available Physical Memory | 24,30% Memory free 2,39 Gb Paging File | 1,78 Gb Available in Paging File | 74,66% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 107,42 Gb Total Space | 90,83 Gb Free Space | 84,56% Space Free | Partition Type: NTFS Drive D: | 125,45 Gb Total Space | 120,99 Gb Free Space | 96,44% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 271,75 Gb Total Space | 248,51 Gb Free Space | 91,45% Space Free | Partition Type: NTFS H: Drive not present or media not loaded I: Drive not present or media not loaded Drive Z: | 271,75 Gb Total Space | 248,51 Gb Free Space | 91,45% Space Free | Partition Type: NTFS Computer Name: SEKRETARIAT Current User Name: USER Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2009-01-08 14:23:08 | 01,019,464 | ---- | M] (G DATA Software) -- C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe PRC - [2009-01-08 14:23:08 | 00,386,120 | ---- | M] (G DATA Software) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe PRC - [2008-12-18 16:35:48 | 01,230,816 | ---- | M] (G DATA Software AG) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe PRC - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2008-04-14 19:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2004-08-11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe PRC - [2007-09-05 11:13:40 | 00,141,848 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxtray.exe PRC - [2007-09-05 11:13:26 | 00,166,424 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\hkcmd.exe PRC - [2007-09-05 11:13:34 | 00,137,752 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxpers.exe PRC - [2008-02-13 08:31:34 | 16,857,600 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE PRC - [2008-08-04 01:02:20 | 00,036,352 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2009-03-09 05:19:17 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009-01-08 14:23:08 | 00,955,464 | ---- | M] (G DATA Software) -- C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe PRC - [2008-04-14 19:21:30 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe PRC - [2007-06-01 10:21:08 | 00,153,136 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2008-08-01 07:59:37 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009-05-11 12:10:00 | 00,525,640 | R--- | M] (WinZip Computing, S.L.) -- C:\Program Files\WinZip\WZQKPICK.EXE PRC - [2007-09-05 11:13:36 | 00,252,440 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxsrvc.exe PRC - [2006-11-30 16:10:40 | 02,334,720 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 2.1\program\soffice.exe PRC - [2006-11-30 16:11:16 | 02,486,272 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN PRC - [2007-06-01 10:21:30 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe PRC - [2007-06-01 10:21:30 | 01,209,904 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2008-04-14 19:21:28 | 00,060,928 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe PRC - [2009-05-22 13:47:00 | 00,501,248 | ---- | M] (OldTimer Tools) -- G:\PROGRAMY\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2004-07-15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2009-01-08 14:23:08 | 01,019,464 | ---- | M] (G DATA Software) -- C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe -- (avkproxy [Auto | Running]) SRV - [2009-01-08 14:23:08 | 00,386,120 | ---- | M] (G DATA Software) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe -- (avkservice [Auto | Running]) SRV - [2008-12-18 16:35:48 | 01,230,816 | ---- | M] (G DATA Software AG) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe -- (avkwctl [Auto | Running]) SRV - [2009-04-27 09:29:40 | 00,182,768 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped]) SRV - [2008-04-14 19:20:44 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2007-04-13 21:09:56 | 00,792,112 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService [On_Demand | Stopped]) SRV - [2007-06-01 10:21:30 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Running]) SRV - [2007-08-24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2009-04-03 06:00:21 | 00,047,104 | RHS- | M] () -- C:\WINDOWS\system32\aaclientk.exe -- (PolicyAgentDhcp [Auto | Stopped]) SRV - [2004-08-11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2009-05-18 13:51:56 | 00,048,712 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\system32\drivers\MiniIcpt.sys -- (gdmnicpt [On_Demand | Running]) DRV - [2008-06-16 14:19:36 | 00,016,608 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv [On_Demand | Stopped]) DRV - [2009-05-18 13:51:52 | 00,051,016 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys -- (gdtdiinterceptor [Auto | Running]) DRV - [2008-02-22 17:53:00 | 00,016,168 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\drivers\GEARAspiWDM.sys -- (gearaspiwdm [On_Demand | Running]) DRV - [2009-05-18 13:57:52 | 00,068,424 | ---- | M] (G DATA Software) -- C:\WINDOWS\system32\drivers\GRD.sys -- (grd [System | Running]) DRV - [2008-04-13 18:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2009-05-18 13:51:51 | 00,032,328 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\system32\drivers\HookCentre.sys -- (hookcentre [On_Demand | Running]) DRV - [2007-08-24 05:22:56 | 05,776,928 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\igxpmp32.sys -- (ialm [On_Demand | Running]) DRV - [2008-02-14 11:04:06 | 04,676,096 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2007-10-29 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2008-01-03 16:10:16 | 00,105,856 | R--- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys -- (RTLE8023xp [On_Demand | Running]) DRV - [2007-11-13 12:25:55 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ig?hl=pl&source=iglk IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-02-18 07:47:34 | 00,000,000 | ---D | M] O1 HOSTS File: (306104 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10539 more lines... O2 - BHO: (G DATA WebFilter) - {0124123d-61b4-456f-af86-78c53a0790c5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll () O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll () O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (G DATA WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll () O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll () O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe (G DATA Software) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [JobHisInit] C:\Program Files\RMClient\JobHisInit.exe () O4 - HKLM..\Run: [MplSetUp] C:\Program Files\RMClient\MplSetUp.exe (RICOH CO.,LTD.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" () O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (Nero AG) O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.) O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.) O4 - Startup: C:\Documents and Settings\USER\Menu Start\Programy\Autostart\OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-06-16 14:03:22 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-05-22 10:55:12 | 00,000,000 | ---D | M] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [6 C:\WINDOWS\*.tmp files] [2009-05-21 12:04:23 | 00,010,815 | ---- | C] () -- C:\Documents and Settings\USER\Pulpit\a.docx [2009-05-18 13:57:52 | 00,068,424 | ---- | C] (G DATA Software) -- C:\WINDOWS\System32\drivers\GRD.sys [2009-05-18 13:51:56 | 00,048,712 | ---- | C] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\MiniIcpt.sys [2009-05-18 13:51:52 | 00,051,016 | ---- | C] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\GDTdiIcpt.sys [2009-05-18 13:51:52 | 00,001,740 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\G DATA AntiVirus.lnk [2009-05-18 13:51:51 | 00,032,328 | ---- | C] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\HookCentre.sys [2009-05-18 13:51:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\G DATA [2009-05-18 13:51:26 | 00,000,000 | ---D | C] -- C:\Program Files\G DATA [2009-05-18 13:51:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\G DATA [2009-05-18 13:42:16 | 14,093,0128 | ---- | C] () -- C:\Program Files\setup.exe [2009-05-18 06:51:52 | 00,000,000 | ---D | C] -- C:\WINDOWS\CD95F661A5C444F5A6AAECDD91C240B8.TMP [2009-05-18 06:47:28 | 00,001,771 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\WinZip.lnk [2009-05-18 06:47:28 | 00,001,699 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk [2009-05-18 06:47:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\WinZip [2009-05-18 06:47:11 | 00,000,000 | ---D | C] -- C:\Program Files\WinZip [2009-05-18 06:45:42 | 13,714,760 | ---- | C] () -- C:\Program Files\winzip121.exe [2009-05-15 11:19:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2009-05-15 11:18:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft [2009-05-15 07:00:33 | 00,104,640 | ---- | C] () -- C:\WINDOWS\System32\drivers\6380684d.sys [2009-05-06 12:40:02 | 05,881,015 | ---- | C] (alch ) -- C:\Documents and Settings\USER\Pulpit\clamwin-0.87.1-setup.exe [2009-05-06 12:32:36 | 00,000,000 | ---D | C] -- C:\Program Files\SkanerOnline [2009-05-06 11:02:42 | 36,753,920 | ---- | C] () -- C:\ess_trial_nt32_plk.msi [2009-05-04 08:23:14 | 00,008,949 | ---- | C] () -- C:\HR0409A.ES5 [2009-05-04 06:33:52 | 00,000,026 | ---- | C] () -- C:\WINDOWS\Zone.Identifier [2009-04-30 08:17:27 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2009-04-27 10:12:42 | 00,013,028 | ---- | C] () -- C:\HR0409.ES5 [2009-04-27 10:10:53 | 00,054,307 | ---- | C] () -- C:\H0409.ES5 [2009-01-26 09:37:13 | 00,000,260 | ---- | C] () -- C:\WINDOWS\AUDOZ3_0.INI [2008-07-11 13:16:00 | 00,003,039 | ---- | C] () -- C:\WINDOWS\polonica.ini [2008-06-25 07:41:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\RPCS.ini [2008-06-25 07:40:56 | 00,041,250 | ---- | C] () -- C:\WINDOWS\RicDB.ini [2008-06-25 07:40:49 | 00,000,226 | ---- | C] () -- C:\WINDOWS\PMJobCli.ini [2008-06-25 07:40:48 | 00,012,358 | ---- | C] () -- C:\WINDOWS\PMRicMb.ini [2008-06-25 07:40:48 | 00,006,702 | ---- | C] () -- C:\WINDOWS\PMRicPMb.ini [2008-06-25 07:40:48 | 00,005,390 | ---- | C] () -- C:\WINDOWS\PMPrtMb.ini [2008-06-25 07:40:48 | 00,004,303 | ---- | C] () -- C:\WINDOWS\PMRicFMb.ini [2008-06-25 07:40:48 | 00,003,005 | ---- | C] () -- C:\WINDOWS\PMDvPrn.ini [2008-06-25 07:40:48 | 00,002,102 | ---- | C] () -- C:\WINDOWS\PMDvDev.ini [2008-06-25 07:40:48 | 00,002,047 | ---- | C] () -- C:\WINDOWS\PMDIOMb.ini [2008-06-25 07:40:48 | 00,002,036 | ---- | C] () -- C:\WINDOWS\PMHostMb.ini [2008-06-25 07:40:48 | 00,001,885 | ---- | C] () -- C:\WINDOWS\PMPSIOMb.ini [2008-06-25 07:40:48 | 00,001,727 | ---- | C] () -- C:\WINDOWS\PMRicSMb.ini [2008-06-25 07:40:48 | 00,001,706 | ---- | C] () -- C:\WINDOWS\PMRicCMb.ini [2008-06-25 07:40:48 | 00,001,494 | ---- | C] () -- C:\WINDOWS\PMMib2Mb.ini [2008-06-25 07:40:48 | 00,001,143 | ---- | C] () -- C:\WINDOWS\PMDPIMb.ini [2008-06-25 07:40:48 | 00,001,110 | ---- | C] () -- C:\WINDOWS\PMDvFax.ini [2008-06-25 07:40:48 | 00,001,094 | ---- | C] () -- C:\WINDOWS\PMAxsMb.ini [2008-06-25 07:40:48 | 00,000,842 | ---- | C] () -- C:\WINDOWS\PMDvScan.ini [2008-06-25 07:40:48 | 00,000,423 | ---- | C] () -- C:\WINDOWS\PMDvCopy.ini [2008-06-25 07:40:48 | 00,000,332 | ---- | C] () -- C:\WINDOWS\PMSnmpMb.ini [2008-06-25 07:40:44 | 00,376,832 | ---- | C] () -- C:\WINDOWS\System32\rpnv2ui.dll [2008-06-25 07:40:44 | 00,176,128 | ---- | C] () -- C:\WINDOWS\System32\rtcpf.dll [2008-06-25 07:40:44 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\RLPR.dll [2008-06-25 07:40:43 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\PMObservps.dll [2008-06-24 08:41:12 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-06-24 01:08:54 | 00,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2008-06-16 15:05:59 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008-06-16 14:17:35 | 00,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4864.dll [2007-10-29 14:00:00 | 00,000,552 | ---- | C] () -- C:\WINDOWS\win.ini [2007-10-29 14:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [6 C:\WINDOWS\*.tmp files] [2009-05-22 13:53:29 | 00,104,640 | ---- | M] () -- C:\WINDOWS\System32\drivers\6380684d.sys [2009-05-22 06:05:01 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-22 06:04:35 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\USER\Ustawienia lokalne\desktop.ini [2009-05-22 06:04:35 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-22 06:04:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-21 12:09:17 | 00,010,815 | ---- | M] () -- C:\Documents and Settings\USER\Pulpit\a.docx [2009-05-20 07:27:39 | 00,000,026 | ---- | M] () -- C:\WINDOWS\Zone.Identifier [2009-05-19 05:58:39 | 00,000,269 | --S- | M] () -- C:\WINDOWS\System32\2349680048.dat [2009-05-18 13:57:52 | 00,068,424 | ---- | M] (G DATA Software) -- C:\WINDOWS\System32\drivers\GRD.sys [2009-05-18 13:51:56 | 00,048,712 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\MiniIcpt.sys [2009-05-18 13:51:52 | 00,051,016 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\GDTdiIcpt.sys [2009-05-18 13:51:52 | 00,001,740 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\G DATA AntiVirus.lnk [2009-05-18 13:51:51 | 00,032,328 | ---- | M] (G DATA Software AG) -- C:\WINDOWS\System32\drivers\HookCentre.sys [2009-05-18 06:47:28 | 00,001,771 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\WinZip.lnk [2009-05-18 06:47:28 | 00,001,699 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk [2009-05-15 11:48:39 | 00,000,211 | RHS- | M] () -- C:\boot.ini [2009-05-15 11:48:38 | 00,000,552 | ---- | M] () -- C:\WINDOWS\win.ini [2009-05-15 11:48:38 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-05-15 11:21:07 | 00,306,104 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009-05-06 12:40:02 | 05,881,015 | ---- | M] (alch ) -- C:\Documents and Settings\USER\Pulpit\clamwin-0.87.1-setup.exe [2009-05-06 11:02:43 | 36,753,920 | ---- | M] () -- C:\ess_trial_nt32_plk.msi [2009-05-04 08:23:25 | 00,008,949 | ---- | M] () -- C:\HR0409A.ES5 [2009-04-30 08:20:50 | 00,000,077 | -HS- | M] () -- C:\Moje dokumenty\desktop.ini [2009-04-27 10:13:04 | 00,013,028 | ---- | M] () -- C:\HR0409.ES5 [2009-04-27 10:11:21 | 00,054,307 | ---- | M] () -- C:\H0409.ES5 < End of report >

2nd part:

Kod: Zaznacz wszystko: OTListIt Extras logfile created on: 2009-05-22 13:50:21 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = G:\PROGRAMY Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1013,42 Mb Total Physical Memory | 246,24 Mb Available Physical Memory | 24,30% Memory free 2,39 Gb Paging File | 1,78 Gb Available in Paging File | 74,66% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 107,42 Gb Total Space | 90,83 Gb Free Space | 84,56% Space Free | Partition Type: NTFS Drive D: | 125,45 Gb Total Space | 120,99 Gb Free Space | 96,44% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 271,75 Gb Total Space | 248,51 Gb Free Space | 91,45% Space Free | Partition Type: NTFS H: Drive not present or media not loaded I: Drive not present or media not loaded Drive Z: | 271,75 Gb Total Space | 248,51 Gb Free Space | 91,45% Space Free | Partition Type: NTFS Computer Name: SEKRETARIAT Current User Name: USER Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [color=orange]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 1 "FirewallDisableNotify" = 1 "UpdatesDisableNotify" = 1 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 [color=orange]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [2008-04-13 20:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] [2008-04-13 20:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [2008-05-21 04:37:24 | 12,844,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook [2008-03-20 12:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny File not found -- C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb File not found -- C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray File not found -- C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client [color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{14F5121B-E4D9-4236-BB73-364CC5C0CFC8}" = OpenOffice.org 2.1 "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1ea84402-cd4f-4f19-afed-c5c228259873}" = G DATA AntiVirus "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13 "{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{640A96B3-2660-41B7-84F6-1324D7FC9741}" = InsDRUK "{66EBD70F-A42C-475F-AEDF-277378151045}" = Nero 7 Essentials "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0015-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}_PROHYBRIDR_{72776234-19F1-4688-9312-85FAF07143F4}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-001F-0415-0000-0000000FF1CE}_PROHYBRIDR_{2D1F88C2-ADAE-47C4-8648-6EA8F7E6EB2D}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}_PROHYBRIDR_{94A4609B-0414-4427-81F3-0FD282A2D0D3}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{A4047F55-BAA7-4361-87DA-7D3635DA6FC7}_is1" = DD_JSW "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A8BB9906-E618-406A-B161-7383AFF46C39}" = EasyRecovery Professional "{AC76BA86-7AD7-1045-7B44-A81200000003}" = Adobe Reader 8 - Polish "{C098DAEC-29EF-4A59-B18E-0E950169CA3C}" = Western Australian Time Zone Update "{C138D676-4F0F-4FDE-8BE5-26CFD3566DCD}" = SmartDeviceMonitor for Client "{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{cd95f661-a5c4-44f5-a6aa-ecdd91c240b8}" = WinZip 12.1 "{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = Rozszerzenie HighMAT do Kreatora zapisywania dysku CD w systemie Microsoft Windows XP "7-Zip" = 7-Zip 4.57 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "freeCommander_is1" = freeCommander 2006.06b "Gadu-Gadu" = Gadu-Gadu 7.7 "HDMI" = Intel(R) Graphics Media Accelerator Driver "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "InstallShield_{A8BB9906-E618-406A-B161-7383AFF46C39}" = EasyRecovery Professional "IrfanView" = IrfanView (remove only) "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "PDFCreator Toolbar" = PDFCreator Toolbar "PITy 2008_is1" = PITy 2008 dla Windows kompilacja:1.0.2.8 "PROHYBRIDR" = 2007 Microsoft Office system "R-Linux_is1" = R-Linux v1.0 "SkanerOnline" = Skaner on-line mks_vir "Smart Data Recovery_is1" = Smart Data Recovery v4.1 "Szyk Przetargi Formularz ofertowy" = Szyk Przetargi Formularz ofertowy "Winamp" = Winamp "Winamp Toolbar" = Winamp Toolbar for Internet Explorer "Winamp Toolbar for Firefox" = Winamp Toolbar for Firefox "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 [color=orange]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-01-30 01:19:51 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1004 Description = Aplikacja powodująca błąd spoolsv.exe, wersja 5.1.2600.5512, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x01e9e199. Error - 2009-02-04 04:33:54 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd msimn.exe, wersja 6.0.2900.5512, moduł powodujący błąd msoe.dll, wersja 6.0.2900.5512, adres błędu 0x000165e9. Error - 2009-02-04 04:33:58 | Computer Name = SEKRETARIAT | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca msimn.exe, wersja 6.0.2900.5512, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-02-04 04:33:58 | Computer Name = SEKRETARIAT | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca msimn.exe, wersja 6.0.2900.5512, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-02-09 05:35:02 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 7.0.6000.16762, moduł powodujący błąd mshtml.dll, wersja 7.0.6000.16788, adres błędu 0x00171a98. Error - 2009-02-09 05:49:38 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 7.0.6000.16762, moduł powodujący błąd mshtml.dll, wersja 7.0.6000.16788, adres błędu 0x00171a98. Error - 2009-02-10 02:44:34 | Computer Name = SEKRETARIAT | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 7.0.6000.16762, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-02-24 04:55:38 | Computer Name = SEKRETARIAT | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.5512, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-02-27 08:50:51 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 7.0.6000.16791, moduł powodujący błąd flash10a.ocx, wersja 10.0.12.36, adres błędu 0x00094f25. Error - 2009-03-18 08:44:24 | Computer Name = SEKRETARIAT | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 7.0.6000.16791, moduł powodujący błąd pdfcreator_toolbar.dll, wersja 3.0.0.0, adres błędu 0x0004ed76. [ OSession Events ] Error - 2008-06-27 08:24:22 | Computer Name = SEKRETARIAT | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.4518.1014. This session lasted 1926 seconds with 1140 seconds of active time. This session ended with a crash. [ System Events ] Error - 2009-05-15 05:52:58 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi ESET Service z powodu następującego błędu: %%1053 Error - 2009-05-17 23:58:09 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-18 07:49:04 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-18 07:54:24 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-18 23:58:47 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-20 00:00:52 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-20 03:57:18 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-20 23:59:07 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-21 08:02:09 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-05-22 00:05:01 | Computer Name = SEKRETARIAT | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 < End of report >

**Posty:** 18165 · przez **wojtas** 22 Maj 2009, 14:28

1.Uruchom OTListIt2 z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

wejdź na dysk na którym masz windows zainstalowany, tam w katalog WINDOWS -> system 32 -> drivers -> etc
i tam za pomocą notatnika otwórz plik hosts

Jeśli są jakieś wpisy pod

# 102.54.94.97 rhino.acme.com # serwer źródłowy
# 38.25.63.10 x.acme.com # komputer kliencki x
127.0.0.1 localhost

to usun tylko zostaw te pokazane przeze mnie wyzej zapisz edytowany plik

**Posty:** 7 · przez **Tarzanisko** 28 Maj 2009, 13:00

Dr. Web

Kod: Zaznacz wszystko: samdump.dll C:\Documents and Settings\USER\Ustawienia lokalne\Temp\RarSFX0\pwdump2 Tool.Pwdump Niewyleczalny.Usunięty. samdump.dll C:\Documents and Settings\USER\Ustawienia lokalne\Temp\RarSFX1\pwdump2 Tool.Pwdump Niewyleczalny.Usunięty.

KAS

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 czwartek, 28 maj 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 3 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Thursday, May 28, 2009 08:03:36 Liczba wpisów: 2263545 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ E:\ G:\ K:\ L:\ M:\ N:\ Z:\ Statystyki skanowania: Przeskanowanych plików: 115227 Nazwa zagrożenia: 3 Zainfekowanych obiektów: 1 Podejrzanych obiektów: 4 Czas skanowania: 02:30:00 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\outlook\Elementy usunięte.dbx Podejrzany: Email-Worm.Win32.Bagle.mail 1 C:\outlook\Elementy usunięte.dbx Podejrzany: Exploit.HTML.Iframe.FileDownload 1 C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc2.bak Podejrzany: Email-Worm.Win32.Bagle.mail 1 C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc2.bak Podejrzany: Exploit.HTML.Iframe.FileDownload 1 C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc25.exe Zainfekowany: Backdoor.Win32.IRCBot.iir 1 Wybrany obszar został przeskanowany.

**Posty:** 18165 · przez **wojtas** 28 Maj 2009, 13:22

znasz to:

C:\outlook\Elementy usunięte.dbx
C:\outlook\Elementy usunięte.dbx

??

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc2.bak
C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc2.bak
C:\RECYCLER\S-1-5-21-349401807-244745987-3779192951-1003\Dc25.exe

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.