Niechciane otwieranie się stron

**Posty:** 9 · przez **Long Neck** 29 Lis 2009, 21:23

Witam!

Mam pewien problem ,gdy siedze na necie (Mozilli) po jakims czasie odpalaja sie same strony z grami online i innymi badziewiami. Jest jeden podejzany plik z logow ,ale nie wiem czy mam go sfixowac

Kod: Zaznacz wszystko: O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\System32\IoctlSvc.exe

Logi:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:20:32, on 2009-11-29 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe D:\Torrenty\uTorrent.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\IoctlSvc.exe C:\WINDOWS\System32\PnkBstrA.exe C:\WINDOWS\System32\PnkBstrB.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe D:\Nowe Gadu-Gadu\gg.exe D:\Nowe Gadu-Gadu\spellchecker_gg.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [uTorrent] "D:\Torrenty\uTorrent.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\System32\IoctlSvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 4202 bytes

**Posty:** 2183 · przez **NieWiem** 29 Lis 2009, 21:55

To będzie akurat poprawny proces, moim zdaniem. Jak się chcesz upewnić - wrzuć plik na www.virscan.org

Pobierz aplikację OTL i zapisz ją na pulpicie.
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Gdy pojawi sie okno, skonfiguruj go następująco:
- Zaznacz opcje LOP Check i Purity Check
- Zaznacz opcje Scan All Users.
- Upewnij się, że w okienku Extra Registry jest zaznaczone Use Safelist.
Upewnij się, że wszystkie pozostałe okna są zamknięte i pozwól mu pracować bez zakłóceń - nie stukaj w klawiaturę, nie ruszaj myszką.
Kliknij Run Scan i poczekaj cierpliwie aż program wykona swoje.
Kiedy skanowanie sie skończy, pojawią sie 2 okna notatnika, zatytułowane OTL.txt i Extras.txt. Będą one zapisane w tym samym miejscu, co aplikacja OTL.
Skopiuj (Edycja => Zaznacz wszystko, Edycja => Kopiuj) zawartość tych plików i wklej na http://www.wklej.org lub w poście w tagach [code].

**Posty:** 9 · przez **Long Neck** 30 Lis 2009, 00:43

Oto logi:

Extras.TxT

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2009-11-29 23:36:37 - Run 1 OTL by OldTimer - Version 3.1.11.2 Folder = C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack. 1 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2800.1106) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1022,73 Mb Total Physical Memory | 553,29 Mb Available Physical Memory | 54,10% Memory free 2,40 Gb Paging File | 2,02 Gb Available in Paging File | 84,18% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 13,96 Gb Total Space | 0,28 Gb Free Space | 2,01% Space Free | Partition Type: NTFS Drive D: | 23,30 Gb Total Space | 2,16 Gb Free Space | 9,26% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BEZ-7QFSQUD0I7G Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Opera\opera.exe" File not found https [open] -- "C:\Program Files\Opera\opera.exe" File not found piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "D:\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "D:\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "D:\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86 "{2222B364-0854-4265-B32E-A142DB9DC7BB}" = Intel(R) PRO Network Connections 11.2.0.69 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36C9E08A-BE2B-40A0-83C5-576748F7B777}" = TestDrive Client "{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo "{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare 2(TM) 1.6 Patch "{90AF0415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003 "{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare 2(TM) 1.7 Patch "{95120000-00AF-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Polish) "{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution "{AC76BA86-7AD7-1045-7B44-A91000000001}" = Adobe Reader 9.1.3 - Polish "{CA567AD5-33A4-403D-86D1-EE2D38251951}_is1" = VDownloader 0.83 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{D6D5CB84-0E6E-4E69-B300-C690B6911045}" = Nero 8 "{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX "{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Pakiet sterowników systemu Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0) "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop 7.0 CE" = Adobe Photoshop 7.0 CE "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "AMX Mod X Installer" = AMX Mod X Installer 1.8.1 "ATI Display Driver" = ATI Display Driver "DVD Shrink_is1" = DVD Shrink 3.2 "ElfBot NG_is1" = ElfBot NG 4.5.0 "HijackThis" = HijackThis 2.0.2 "InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch "InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch "InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5) "NOD32" = System Antywirusowy NOD32 "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "SGsoft WordPad_is1" = SGsoft WordPad Version 1.0.1 "Tibia_is1" = Tibia "TMIPC" = Tibia MULTI-ip changer "Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "WinRAR archiver" = Archiwizator WinRAR "WorldUnlock Codes Calculator" = WorldUnlock Codes Calculator [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-08-19 19:55:20 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.5.5.2435, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-08-22 17:08:50 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2800.1106, moduł powodujący błąd mshtml.dll, wersja 6.0.2800.1106, adres błędu 0x00097034. Error - 2009-08-26 13:52:20 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2800.1106, moduł powodujący błąd flash10b.ocx, wersja 10.0.22.87, adres błędu 0x00010ba8. Error - 2009-09-01 16:28:33 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca IEXPLORE.EXE, wersja 6.0.2800.1106, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-09-05 05:59:24 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2800.1106, moduł powodujący błąd mshtml.dll, wersja 6.0.2800.1106, adres błędu 0x00097034. Error - 2009-09-07 10:50:09 | Computer Name = BEZ-7QFSQUD0I7G | Source = Perflib | ID = 1015 Description = Upłynął czas oczekiwania na zakończenie wywołania funkcji gromadzenia danych wydajności, „PerfOS”, w bibliotece „C:\WINDOWS\System32\perfos.dll”. Może to być spowodowane problemem z tym rozszerzalnym licznikiem lub też usługa albo system, z którego pobiera on dane, mogły być bardzo zajęte w momencie wywołania tej procedury. Error - 2009-09-09 08:17:39 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca CrashReporter.exe, wersja 0.0.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-09-11 06:18:34 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca IEXPLORE.EXE, wersja 6.0.2800.1106, moduł zawieszenia jscript.dll, wersja 5.6.0.6626, adres zawieszenia 0x00007075. Error - 2009-09-13 10:26:33 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2800.1106, moduł powodujący błąd mshtml.dll, wersja 6.0.2800.1106, adres błędu 0x00097034. Error - 2009-09-15 16:33:10 | Computer Name = BEZ-7QFSQUD0I7G | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca IEXPLORE.EXE, wersja 6.0.2800.1106, moduł zawieszenia ntdll.dll, wersja 5.1.2600.1106, adres zawieszenia 0x00029772. [ System Events ] Error - 2009-11-11 05:22:16 | Computer Name = BEZ-7QFSQUD0I7G | Source = atapi | ID = 262153 Description = Urządzenie \Device\Ide\IdePort1 nie odpowiedziało w ramach ustalonego limitu czasu. Error - 2009-11-18 17:55:05 | Computer Name = BEZ-7QFSQUD0I7G | Source = Dhcp | ID = 1002 Description = Adres IP połączenia 89.230.53.184 dla karty sieciowej o adresie 0011D873343D został zabroniony przez serwer DHCP 0.0.0.0 (Serwer DHCP wysłał komunikat DHCPNACK). < End of report >

OTL.Txt

Kod: Zaznacz wszystko: OTL logfile created on: 2009-11-29 23:36:37 - Run 1 OTL by OldTimer - Version 3.1.11.2 Folder = C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack. 1 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2800.1106) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1022,73 Mb Total Physical Memory | 553,29 Mb Available Physical Memory | 54,10% Memory free 2,40 Gb Paging File | 2,02 Gb Available in Paging File | 84,18% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 13,96 Gb Total Space | 0,28 Gb Free Space | 2,01% Space Free | Partition Type: NTFS Drive D: | 23,30 Gb Total Space | 2,16 Gb Free Space | 9,26% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BEZ-7QFSQUD0I7G Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-11-29 23:34:57 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe PRC - [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe PRC - [2009-11-03 04:41:11 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-01 12:06:26 | 00,288,048 | ---- | M] (BitTorrent, Inc.) -- D:\Torrenty\uTorrent.exe PRC - [2009-07-27 16:42:10 | 10,719,848 | ---- | M] (GG Network S.A.) -- D:\Nowe Gadu-Gadu\gg.exe PRC - [2009-07-27 15:39:44 | 00,077,824 | ---- | M] () -- D:\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2009-06-21 12:08:11 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe PRC - [2009-06-19 16:12:10 | 00,949,376 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32kui.exe PRC - [2009-06-19 16:12:09 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32krn.exe PRC - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-02-18 16:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe PRC - [2002-11-08 14:50:32 | 00,098,304 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMTray.exe PRC - [2002-09-20 17:05:24 | 01,005,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-11-29 23:34:57 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe MOD - [2002-11-06 18:00:38 | 00,040,820 | ---- | M] (SoundMAX) -- C:\WINDOWS\system32\Syncor11.dll MOD - [2002-09-20 17:03:32 | 00,921,600 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found -- -- (ServiceLayer) SRV - [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB) SRV - [2009-06-21 12:08:11 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA) SRV - [2009-06-19 16:12:09 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn) SRV - [2008-02-28 17:07:48 | 00,529,704 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008-02-25 20:05:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) SRV - [2008-02-18 16:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3) SRV - [2006-12-19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service) SRV - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-06-19 16:12:10 | 00,512,096 | ---- | M] (Eset ) -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON) DRV - [2009-06-19 16:12:09 | 00,015,424 | ---- | M] () -- C:\WINDOWS\system32\drivers\nod32drv.sys -- (nod32drv) DRV - [2008-09-24 09:40:22 | 04,122,368 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2008-08-20 18:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2008-02-26 06:51:43 | 02,863,616 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-11-29 09:39:42 | 00,016,896 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2007-09-17 14:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2006-10-24 09:28:48 | 00,170,392 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e1000325.sys -- (E1000) Intel(R) DRV - [2002-12-19 16:48:48 | 00,539,008 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm) DRV - [2002-04-01 12:15:00 | 00,004,816 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio) DRV - [2002-03-25 19:02:14 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\S-1-5-21-1645522239-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.selectedEngine: "Gameztar Toolbar" FF - prefs.js..browser.startup.homepage: "http://www.wp.pl/" FF - prefs.js..extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 FF - prefs.js..extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 FF - prefs.js..extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 FF - HKLM\software\mozilla\Firefox\Extensions\\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files\Web Search Operator\3.1.0.1800\FF [2009-11-27 11:45:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files\Automated Content Enhancer\4.1.0.5050\FF [2009-11-27 11:45:29 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files\Customized Platform Advancer\3.1.0.1540\FF [2009-11-27 11:45:38 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-11-08 16:29:43 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-11-08 16:29:35 | 00,000,000 | ---D | M] [2009-11-08 16:29:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2009-11-08 16:29:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\hd3tdxa4.default\extensions [2009-11-08 16:29:36 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-11-03 02:54:10 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-11-03 02:54:10 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-11-03 02:54:10 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-11-03 02:54:10 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-11-03 02:54:10 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-11-03 02:54:10 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset ) O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.) O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [uTorrent] D:\Torrenty\uTorrent.exe (BitTorrent, Inc.) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\imon.dll (Eset ) O15 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..Trusted Domains: ([]msn in Mój komputer) O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} http://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.228.7.228 217.172.224.92 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-06-18 22:54:53 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-11-28 20:48:44 | 00,000,000 | ---D | C] -- C:\Program Files\NeroInstall.bak [2009-11-28 20:47:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Program Files\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Nero [2009-11-28 18:10:17 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2009-11-27 11:45:58 | 00,000,000 | ---D | C] -- C:\Program Files\Content Management Wizard [2009-11-27 11:45:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today [2009-11-27 11:45:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer [2009-11-27 11:45:37 | 00,000,000 | ---D | C] -- C:\Program Files\Customized Platform Advancer [2009-11-27 11:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer [2009-11-27 11:45:27 | 00,000,000 | ---D | C] -- C:\Program Files\Automated Content Enhancer [2009-11-27 11:45:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator [2009-11-27 11:45:21 | 00,000,000 | ---D | C] -- C:\Program Files\Web Search Operator [2009-11-27 11:44:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar [2009-11-26 20:59:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2009-11-25 16:13:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie [2009-11-24 13:33:49 | 00,000,000 | ---D | C] -- C:\adaptec [2009-11-22 13:34:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL [2009-11-20 21:13:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Ahead [2009-11-20 21:13:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Ahead [2009-11-20 21:13:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Ahead [2009-11-20 20:37:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Allegro [2009-11-20 20:30:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Dokumenty [2009-11-14 14:45:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\CDJ1000MK3 [2009-11-09 00:17:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia [2009-11-08 19:19:13 | 00,000,000 | -HSD | C] -- C:\WINDOWS\System32\28463 [2009-11-08 16:29:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla [2009-11-08 16:29:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla [2009-11-08 16:29:34 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2009-11-06 15:31:05 | 00,000,000 | ---D | C] -- C:\Program Files\AMX Mod X [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-11-29 23:29:36 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2009-11-29 23:29:35 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-11-29 23:29:33 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-11-29 23:06:03 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe [2009-11-29 22:38:37 | 00,138,576 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-11-28 20:48:30 | 00,002,376 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nero StartSmart.lnk [2009-11-28 20:48:30 | 00,002,286 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nero Home.lnk [2009-11-28 20:47:19 | 00,001,024 | ---- | M] () -- C:\Documents and Settings\Administrator\.rnd [2009-11-27 22:48:14 | 00,000,472 | ---- | M] () -- C:\WINDOWS\win.ini [2009-11-27 22:48:14 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-11-27 22:48:14 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-11-27 13:15:36 | 00,000,043 | ---- | M] () -- C:\WINDOWS\System32\imon1.dat [2009-11-24 21:25:22 | 09,020,632 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Now You See It (Benny Benassi Dub Re.mp3 [2009-11-24 21:07:02 | 13,268,114 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Fast Foot - Perfect Paganini (Full Original Mix) 4clubbers.pl - Djohnny.mp3 [2009-11-24 13:28:26 | 00,522,682 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\aspi_471a2.exe [2009-11-23 19:46:26 | 15,313,087 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\23-45 feat 5ivesta Family - Ya Budu (Denis Rublev feat Natasha Baccardi Remix)(By DJ DOMINICO)4clubbers.pl.mp3 [2009-11-23 19:45:35 | 14,709,150 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\07-the_mobb-disco_beat_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:44:48 | 15,118,750 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\02-the_mobb-bass_get_smooth_(club_mix)4clubbers.pl.mp3 [2009-11-22 22:52:58 | 04,616,882 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Storm dance electro.mp3 [2009-11-22 13:52:10 | 12,188,821 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Komodo - I'm Not Missing (South Blast! Electric Remix) www.4clubbers.pl by _Kameleon_.mp3 [2009-11-22 13:34:32 | 00,498,657 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL.zip [2009-11-21 20:12:23 | 11,745,408 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Like Thiz! Pres. Rockstars - As Long As I Believe (TAITO Remix) www.4clubbers.com.pl.mp3 [2009-11-21 20:11:17 | 10,534,730 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Cherry Coke & Dann'D - Whine Up (Voltage Mix) [www.4clubbers.pl] up by Silvo88.mp3 [2009-11-20 22:35:00 | 00,017,385 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ISO1.nri [2009-11-20 22:30:36 | 28,185,2022 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Image.nrg [2009-11-20 22:22:11 | 00,023,539 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\JukeBox1.nrj [2009-11-20 22:20:51 | 24,393,379 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Sobota - Stoprocent 2 (feat_ Kool Savas _ Gural _ Wall-e _ Rytmus _ Bigz prod_ Matheo)_19 [2009-11-20 22:19:16 | 04,038,531 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Moklok Moklok (Gdzie Ten Kac_) (Feat_ Numer Raz).mp3 [2009-11-20 22:18:47 | 04,828,996 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 08_ Tetrahydrokanabilizacja.mp3 [2009-11-20 22:16:15 | 04,472,686 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 15_ Odpowiedzialność.mp3 [2009-11-20 22:14:37 | 04,081,894 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente - T_O_A_S_T_.mp3 [2009-11-20 22:13:15 | 04,836,833 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Watch Out Now EP.mp3 [2009-11-20 22:09:06 | 07,997,649 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Stoprocent Tour - Peja_ Gural_ Kaczor_ Pih_ Borixon___.mp3 [2009-11-20 22:08:53 | 05,150,302 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja SoLUfka - Bragga feat_ Charlie P [Oficjalny Teledysk].mp3 [2009-11-20 22:08:03 | 06,107,951 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja - Szacunek Ludzi Ulicy.mp3 [2009-11-20 22:07:53 | 06,721,829 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Baku Baku to jest skład.mp3 [2009-11-20 22:06:28 | 04,598,074 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Nasze mózgi wypełnione są Marią.mp3 [2009-11-20 22:06:24 | 05,585,502 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Słoń- Ssij go feat_ Gandzior_ Rychu Peja ( Chore melodie ).mp3 [2009-11-20 22:05:03 | 05,716,114 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja _Życie kurewskie_.mp3 [2009-11-20 22:04:20 | 05,197,845 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Abrakadabra.mp3 [2009-11-20 22:02:32 | 04,562,025 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Gruby czarny kot.mp3 [2009-11-20 22:01:07 | 04,625,241 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu peja solufka-Rap jest moja kokaina.mp3 [2009-11-20 22:00:34 | 05,055,739 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Normalnie O Tej Porze.mp3 [2009-11-20 21:59:29 | 02,305,567 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44-Usłysz mój głos.mp3 [2009-11-20 21:55:35 | 05,917,257 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja Feat_Czwórka -Regulamin zabijania.mp3 [2009-11-20 21:55:32 | 00,017,376 | ---- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-11-20 21:51:20 | 03,927,249 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja Solufka-Pozwól mi żyć.mp3 [2009-11-20 20:17:44 | 00,015,487 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Nero_7 10 1 0_[PL]_[Full]_[keygen][Torrenty.org].torrent [2009-11-17 09:44:05 | 00,094,323 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\The_Sims_Castaway_Stories_-_The_Sims _Historie_z_bezludnej_wyspy_[PL]_[DVD]_[RELOADED][Torrenty[1].org].torrent [2009-11-17 09:38:55 | 00,104,960 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\plan.doc [2009-11-14 12:34:46 | 00,198,656 | ---- | M] () -- C:\WINDOWS\elf_key.dll [2009-11-09 19:20:05 | 17,335,881 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Wolfgang Gartner - Flashback (Will Bailey & Mikey Hook Remix) 4clubbers.pl by Orzel.mp3 [2009-11-08 16:29:45 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [2009-11-08 16:29:38 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-11-08 00:26:46 | 05,330,502 | -H-- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-11-06 15:31:18 | 00,000,805 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\AMX Mod X Studio.lnk [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-11-28 20:48:30 | 00,002,376 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nero StartSmart.lnk [2009-11-28 20:48:30 | 00,002,286 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nero Home.lnk [2009-11-28 20:47:18 | 00,001,024 | ---- | C] () -- C:\Documents and Settings\Administrator\.rnd [2009-11-24 21:09:53 | 09,020,632 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Now You See It (Benny Benassi Dub Re.mp3 [2009-11-24 21:05:18 | 13,268,114 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Fast Foot - Perfect Paganini (Full Original Mix) 4clubbers.pl - Djohnny.mp3 [2009-11-24 13:28:24 | 00,522,682 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\aspi_471a2.exe [2009-11-23 19:40:57 | 15,118,750 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\02-the_mobb-bass_get_smooth_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:39:21 | 14,709,150 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\07-the_mobb-disco_beat_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:37:02 | 15,313,087 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\23-45 feat 5ivesta Family - Ya Budu (Denis Rublev feat Natasha Baccardi Remix)(By DJ DOMINICO)4clubbers.pl.mp3 [2009-11-22 22:52:23 | 04,616,882 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Storm dance electro.mp3 [2009-11-22 13:50:23 | 12,188,821 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Komodo - I'm Not Missing (South Blast! Electric Remix) www.4clubbers.pl by _Kameleon_.mp3 [2009-11-22 13:34:32 | 00,498,657 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL.zip [2009-11-21 20:09:25 | 11,745,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Like Thiz! Pres. Rockstars - As Long As I Believe (TAITO Remix) www.4clubbers.com.pl.mp3 [2009-11-21 20:08:31 | 10,534,730 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Cherry Coke & Dann'D - Whine Up (Voltage Mix) [www.4clubbers.pl] up by Silvo88.mp3 [2009-11-20 22:35:00 | 00,017,385 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ISO1.nri [2009-11-20 22:30:04 | 28,185,2022 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Image.nrg [2009-11-20 22:22:11 | 00,023,539 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\JukeBox1.nrj [2009-11-20 22:18:58 | 04,038,531 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Moklok Moklok (Gdzie Ten Kac_) (Feat_ Numer Raz).mp3 [2009-11-20 22:18:26 | 04,828,996 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 08_ Tetrahydrokanabilizacja.mp3 [2009-11-20 22:16:45 | 24,393,379 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Sobota - Stoprocent 2 (feat_ Kool Savas _ Gural _ Wall-e _ Rytmus _ Bigz prod_ Matheo)_19 [2009-11-20 22:15:53 | 04,472,686 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 15_ Odpowiedzialność.mp3 [2009-11-20 22:14:18 | 04,081,894 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente - T_O_A_S_T_.mp3 [2009-11-20 22:12:52 | 04,836,833 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Watch Out Now EP.mp3 [2009-11-20 22:08:24 | 05,150,302 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja SoLUfka - Bragga feat_ Charlie P [Oficjalny Teledysk].mp3 [2009-11-20 22:08:10 | 07,997,649 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Stoprocent Tour - Peja_ Gural_ Kaczor_ Pih_ Borixon___.mp3 [2009-11-20 22:07:24 | 06,107,951 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja - Szacunek Ludzi Ulicy.mp3 [2009-11-20 22:07:19 | 06,721,829 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Baku Baku to jest skład.mp3 [2009-11-20 22:06:06 | 04,598,074 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Nasze mózgi wypełnione są Marią.mp3 [2009-11-20 22:05:54 | 05,585,502 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Słoń- Ssij go feat_ Gandzior_ Rychu Peja ( Chore melodie ).mp3 [2009-11-20 22:04:40 | 05,716,114 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja _Życie kurewskie_.mp3 [2009-11-20 22:03:58 | 05,197,845 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Abrakadabra.mp3 [2009-11-20 22:02:16 | 04,562,025 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Gruby czarny kot.mp3 [2009-11-20 22:00:47 | 04,625,241 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu peja solufka-Rap jest moja kokaina.mp3 [2009-11-20 22:00:17 | 05,055,739 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Normalnie O Tej Porze.mp3 [2009-11-20 21:59:20 | 02,305,567 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44-Usłysz mój głos.mp3 [2009-11-20 21:55:15 | 05,917,257 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja Feat_Czwórka -Regulamin zabijania.mp3 [2009-11-20 21:51:03 | 03,927,249 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja Solufka-Pozwól mi żyć.mp3 [2009-11-20 20:17:44 | 00,015,487 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Nero_7 10 1 0_[PL]_[Full]_[keygen][Torrenty.org].torrent [2009-11-17 09:44:05 | 00,094,323 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\The_Sims_Castaway_Stories_-_The_Sims _Historie_z_bezludnej_wyspy_[PL]_[DVD]_[RELOADED][Torrenty[1].org].torrent [2009-11-17 09:38:55 | 00,104,960 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\plan.doc [2009-11-14 12:34:47 | 00,198,656 | ---- | C] () -- C:\WINDOWS\elf_key.dll [2009-11-09 19:17:49 | 17,335,881 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Wolfgang Gartner - Flashback (Will Bailey & Mikey Hook Remix) 4clubbers.pl by Orzel.mp3 [2009-11-08 16:29:45 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009-11-08 16:29:38 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-11-06 15:31:18 | 00,000,805 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\AMX Mod X Studio.lnk [2009-07-19 12:01:10 | 00,008,704 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-07-01 22:23:31 | 00,160,768 | ---- | C] () -- C:\WINDOWS\System32\io.dll [2009-07-01 13:51:36 | 00,000,008 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\wiaserva.log [2009-06-20 23:31:30 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-06-20 23:30:45 | 00,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-06-20 23:30:44 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\PnkBstrK.sys [2009-06-20 23:30:17 | 00,000,267 | ---- | C] () -- C:\WINDOWS\game.ini [2009-06-19 16:12:30 | 00,015,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\nod32drv.sys [2009-06-19 16:05:03 | 00,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll [2009-06-19 10:56:25 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2002-03-25 19:02:14 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [color=#E56717]========== LOP Check ==========[/color] [2009-07-02 21:36:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Desktopicon [2009-07-13 14:18:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\ICAClient [2009-08-16 18:54:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu [2009-08-20 01:00:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\OpenFM [2009-09-20 12:05:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2009-07-13 14:18:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Runaware [2009-07-19 21:10:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Thinstall [2009-11-09 23:13:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia [2009-11-29 23:30:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent [2009-08-12 08:22:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-08-20 01:00:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 2183 · przez **NieWiem** 30 Lis 2009, 01:12

Widzę, że połowa rzeczy już się "wyczyściła". Zostały tylko jakieś szczątki na kasację.

Uruchom ponownie program OTL
W okienku na dole Custom Scans / Fixes wklej to, co poniżej w ramce:
Kod: Zaznacz wszystko
:Processes Explorer.exe :OTL SRV - File not found -- -- (ServiceLayer) FF - prefs.js..browser.search.selectedEngine: "Gameztar Toolbar" FF - prefs.js..extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 FF - prefs.js..extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 FF - prefs.js..extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 FF - HKLM\software\mozilla\Firefox\Extensions\\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files\Web Search Operator\3.1.0.1800\FF [2009-11-27 11:45:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files\Automated Content Enhancer\4.1.0.5050\FF [2009-11-27 11:45:29 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files\Customized Platform Advancer\3.1.0.1540\FF [2009-11-27 11:45:38 | 00,000,000 | ---D | M] O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found :Files [2009-11-27 11:45:58 | 00,000,000 | ---D | C] -- C:\Program Files\Content Management Wizard [2009-11-27 11:45:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today [2009-11-27 11:45:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer [2009-11-27 11:45:37 | 00,000,000 | ---D | C] -- C:\Program Files\Customized Platform Advancer [2009-11-27 11:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer [2009-11-27 11:45:27 | 00,000,000 | ---D | C] -- C:\Program Files\Automated Content Enhancer [2009-11-27 11:45:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator [2009-11-27 11:45:21 | 00,000,000 | ---D | C] -- C:\Program Files\Web Search Operator [2009-11-27 11:44:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar :Services ServiceLayer :Commands [purity] [emptytemp] [clearrestorepoints] [start explorer] [reboot]
Upewnij się, że wszystkie inne okna, programy, komunikatory są wyłączone.
Kliknij przycisk Run Fix i poczekaj cierpliwie. To może chwilę potrwać!
Na prośbę komputera o restart zgódź się.
Po restarcie program automatycznie wyświetli raport z czyszczenia, który należy zapisać i wkleić w poście w tagach [code], lub na stronie http://www.wklej.org
Wykonaj także nowego loga OTL.txt z OTL z opcji Run Scan i także go dołącz. Plik extras.txt nie będzie potrzebny.

**Posty:** 9 · przez **Long Neck** 30 Lis 2009, 19:48

Ostra lipa ,nadal sie wlaczaja te j**ane gierki...

Logi:

Kod: Zaznacz wszystko: processes killed ========== PROCESSES ========== No active process named Explorer.exe was found! No active process named :OTL was found! No active process named SRV - File not found -- -- was found! No active process named FF - prefs.js..browser.search.selectedEngine: "Gameztar Toolbar" was found! No active process named FF - prefs.js..extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 was found! No active process named FF - prefs.js..extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 was found! No active process named FF - prefs.js..extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 was found! No active process named FF [2009-11-27 11:45:22 | 00,000,000 | ---D | M] was found! No active process named FF [2009-11-27 11:45:29 | 00,000,000 | ---D | M] was found! No active process named FF [2009-11-27 11:45:38 | 00,000,000 | ---D | M] was found! No active process named WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. was found! No active process named WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. was found! No active process named NMBgMonitor.exe File not found was found! No active process named :Files was found! No active process named Content Management Wizard was found! No active process named Internet Today was found! No active process named Customized Platform Advancer was found! No active process named Customized Platform Advancer was found! No active process named Automated Content Enhancer was found! No active process named Automated Content Enhancer was found! No active process named Web Search Operator was found! No active process named Web Search Operator was found! No active process named Gameztar Toolbar was found! No active process named :Services was found! No active process named ServiceLayer was found! No active process named :Commands was found! No active process named [purity] was found! No active process named [emptytemp] was found! No active process named [clearrestorepoints] was found! No active process named [start explorer] was found! No active process named [reboot] was found! OTL by OldTimer - Version 3.1.11.2 log created on 11302009_183929 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Extras.Txt

Kod: Zaznacz wszystko: OTL logfile created on: 2009-11-30 18:44:31 - Run 2 OTL by OldTimer - Version 3.1.11.2 Folder = C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack. 1 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2800.1106) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1022,73 Mb Total Physical Memory | 654,63 Mb Available Physical Memory | 64,01% Memory free 2,40 Gb Paging File | 2,13 Gb Available in Paging File | 88,72% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 13,96 Gb Total Space | 0,25 Gb Free Space | 1,82% Space Free | Partition Type: NTFS Drive D: | 23,30 Gb Total Space | 2,16 Gb Free Space | 9,26% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BEZ-7QFSQUD0I7G Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-11-29 23:34:57 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe PRC - [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe PRC - [2009-11-03 04:41:11 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-01 12:06:26 | 00,288,048 | ---- | M] (BitTorrent, Inc.) -- D:\Torrenty\uTorrent.exe PRC - [2009-06-21 12:08:11 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe PRC - [2009-06-19 16:12:10 | 00,949,376 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32kui.exe PRC - [2009-06-19 16:12:09 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32krn.exe PRC - [2009-02-27 16:10:28 | 00,035,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe PRC - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-02-18 16:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe PRC - [2002-11-08 14:50:32 | 00,098,304 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMTray.exe PRC - [2002-09-20 17:05:24 | 01,005,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-11-29 23:34:57 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe MOD - [2002-11-06 18:00:38 | 00,040,820 | ---- | M] (SoundMAX) -- C:\WINDOWS\system32\Syncor11.dll MOD - [2002-09-20 17:03:32 | 00,921,600 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found -- -- (ServiceLayer) SRV - [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB) SRV - [2009-06-21 12:08:11 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA) SRV - [2009-06-19 16:12:09 | 00,552,064 | ---- | M] (Eset ) -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn) SRV - [2008-02-28 17:07:48 | 00,529,704 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2008-02-26 04:00:02 | 00,520,192 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008-02-25 20:05:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) SRV - [2008-02-18 16:29:12 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3) SRV - [2006-12-19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service) SRV - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-06-19 16:12:10 | 00,512,096 | ---- | M] (Eset ) -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON) DRV - [2009-06-19 16:12:09 | 00,015,424 | ---- | M] () -- C:\WINDOWS\system32\drivers\nod32drv.sys -- (nod32drv) DRV - [2008-09-24 09:40:22 | 04,122,368 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2008-08-20 18:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2008-02-26 06:51:43 | 02,863,616 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-11-29 09:39:42 | 00,016,896 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2007-09-17 14:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2006-10-24 09:28:48 | 00,170,392 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e1000325.sys -- (E1000) Intel(R) DRV - [2002-12-19 16:48:48 | 00,539,008 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm) DRV - [2002-04-01 12:15:00 | 00,004,816 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio) DRV - [2002-03-25 19:02:14 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ IE - HKU\S-1-5-21-1645522239-562591055-1417001333-500\S-1-5-21-1645522239-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.selectedEngine: "Gameztar Toolbar" FF - prefs.js..browser.startup.homepage: "http://www.wp.pl/" FF - prefs.js..extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 FF - prefs.js..extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 FF - prefs.js..extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 FF - HKLM\software\mozilla\Firefox\Extensions\\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files\Web Search Operator\3.1.0.1800\FF [2009-11-27 11:45:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files\Automated Content Enhancer\4.1.0.5050\FF [2009-11-27 11:45:29 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files\Customized Platform Advancer\3.1.0.1540\FF [2009-11-27 11:45:38 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-11-08 16:29:43 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-11-08 16:29:35 | 00,000,000 | ---D | M] [2009-11-08 16:29:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2009-11-08 16:29:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\hd3tdxa4.default\extensions [2009-11-08 16:29:36 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-11-03 02:54:10 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-11-03 02:54:10 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-11-03 02:54:10 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-11-03 02:54:10 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-11-03 02:54:10 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-11-03 02:54:10 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset ) O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.) O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [uTorrent] D:\Torrenty\uTorrent.exe (BitTorrent, Inc.) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\imon.dll (Eset ) O15 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..Trusted Domains: ([]msn in Mój komputer) O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} http://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.228.7.228 217.172.224.92 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-06-18 22:54:53 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-11-30 18:39:29 | 00,000,000 | ---D | C] -- C:\_OTL [2009-11-28 20:48:44 | 00,000,000 | ---D | C] -- C:\Program Files\NeroInstall.bak [2009-11-28 20:47:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Program Files\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero [2009-11-28 20:42:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Nero [2009-11-28 18:10:17 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2009-11-27 11:45:58 | 00,000,000 | ---D | C] -- C:\Program Files\Content Management Wizard [2009-11-27 11:45:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today [2009-11-27 11:45:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer [2009-11-27 11:45:37 | 00,000,000 | ---D | C] -- C:\Program Files\Customized Platform Advancer [2009-11-27 11:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer [2009-11-27 11:45:27 | 00,000,000 | ---D | C] -- C:\Program Files\Automated Content Enhancer [2009-11-27 11:45:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator [2009-11-27 11:45:21 | 00,000,000 | ---D | C] -- C:\Program Files\Web Search Operator [2009-11-27 11:44:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar [2009-11-26 20:59:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2009-11-25 16:13:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie [2009-11-24 13:33:49 | 00,000,000 | ---D | C] -- C:\adaptec [2009-11-22 13:34:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL [2009-11-20 21:13:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Ahead [2009-11-20 21:13:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Ahead [2009-11-20 21:13:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Ahead [2009-11-20 20:37:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit\Allegro [2009-11-20 20:30:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Dokumenty [2009-11-14 14:45:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\CDJ1000MK3 [2009-11-09 00:17:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia [2009-11-08 19:19:13 | 00,000,000 | -HSD | C] -- C:\WINDOWS\System32\28463 [2009-11-08 16:29:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla [2009-11-08 16:29:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla [2009-11-08 16:29:34 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2009-11-06 15:31:05 | 00,000,000 | ---D | C] -- C:\Program Files\AMX Mod X [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-11-30 18:40:42 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-11-30 18:40:40 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-11-30 18:39:40 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2009-11-30 18:39:40 | 00,000,190 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2009-11-29 23:04:11 | 00,215,104 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe [2009-11-29 22:38:37 | 00,138,576 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-11-28 20:48:30 | 00,002,376 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nero StartSmart.lnk [2009-11-28 20:48:30 | 00,002,286 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nero Home.lnk [2009-11-28 20:47:19 | 00,001,024 | ---- | M] () -- C:\Documents and Settings\Administrator\.rnd [2009-11-27 22:48:14 | 00,000,472 | ---- | M] () -- C:\WINDOWS\win.ini [2009-11-27 22:48:14 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-11-27 22:48:14 | 00,000,194 | -HS- | M] () -- C:\boot.ini [2009-11-27 13:15:36 | 00,000,043 | ---- | M] () -- C:\WINDOWS\System32\imon1.dat [2009-11-24 21:25:22 | 09,020,632 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Now You See It (Benny Benassi Dub Re.mp3 [2009-11-24 21:07:02 | 13,268,114 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Fast Foot - Perfect Paganini (Full Original Mix) 4clubbers.pl - Djohnny.mp3 [2009-11-24 13:28:26 | 00,522,682 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\aspi_471a2.exe [2009-11-23 19:46:26 | 15,313,087 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\23-45 feat 5ivesta Family - Ya Budu (Denis Rublev feat Natasha Baccardi Remix)(By DJ DOMINICO)4clubbers.pl.mp3 [2009-11-23 19:45:35 | 14,709,150 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\07-the_mobb-disco_beat_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:44:48 | 15,118,750 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\02-the_mobb-bass_get_smooth_(club_mix)4clubbers.pl.mp3 [2009-11-22 22:52:58 | 04,616,882 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Storm dance electro.mp3 [2009-11-22 13:52:10 | 12,188,821 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Komodo - I'm Not Missing (South Blast! Electric Remix) www.4clubbers.pl by _Kameleon_.mp3 [2009-11-22 13:34:32 | 00,498,657 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL.zip [2009-11-21 20:12:23 | 11,745,408 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Like Thiz! Pres. Rockstars - As Long As I Believe (TAITO Remix) www.4clubbers.com.pl.mp3 [2009-11-21 20:11:17 | 10,534,730 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Cherry Coke & Dann'D - Whine Up (Voltage Mix) [www.4clubbers.pl] up by Silvo88.mp3 [2009-11-20 22:35:00 | 00,017,385 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ISO1.nri [2009-11-20 22:30:36 | 28,185,2022 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Image.nrg [2009-11-20 22:22:11 | 00,023,539 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\JukeBox1.nrj [2009-11-20 22:20:51 | 24,393,379 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Sobota - Stoprocent 2 (feat_ Kool Savas _ Gural _ Wall-e _ Rytmus _ Bigz prod_ Matheo)_19 [2009-11-20 22:19:16 | 04,038,531 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Moklok Moklok (Gdzie Ten Kac_) (Feat_ Numer Raz).mp3 [2009-11-20 22:18:47 | 04,828,996 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 08_ Tetrahydrokanabilizacja.mp3 [2009-11-20 22:16:15 | 04,472,686 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 15_ Odpowiedzialność.mp3 [2009-11-20 22:14:37 | 04,081,894 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente - T_O_A_S_T_.mp3 [2009-11-20 22:13:15 | 04,836,833 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Watch Out Now EP.mp3 [2009-11-20 22:09:06 | 07,997,649 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Stoprocent Tour - Peja_ Gural_ Kaczor_ Pih_ Borixon___.mp3 [2009-11-20 22:08:53 | 05,150,302 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja SoLUfka - Bragga feat_ Charlie P [Oficjalny Teledysk].mp3 [2009-11-20 22:08:03 | 06,107,951 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja - Szacunek Ludzi Ulicy.mp3 [2009-11-20 22:07:53 | 06,721,829 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Baku Baku to jest skład.mp3 [2009-11-20 22:06:28 | 04,598,074 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Nasze mózgi wypełnione są Marią.mp3 [2009-11-20 22:06:24 | 05,585,502 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Słoń- Ssij go feat_ Gandzior_ Rychu Peja ( Chore melodie ).mp3 [2009-11-20 22:05:03 | 05,716,114 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja _Życie kurewskie_.mp3 [2009-11-20 22:04:20 | 05,197,845 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Abrakadabra.mp3 [2009-11-20 22:02:32 | 04,562,025 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Gruby czarny kot.mp3 [2009-11-20 22:01:07 | 04,625,241 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu peja solufka-Rap jest moja kokaina.mp3 [2009-11-20 22:00:34 | 05,055,739 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Normalnie O Tej Porze.mp3 [2009-11-20 21:59:29 | 02,305,567 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44-Usłysz mój głos.mp3 [2009-11-20 21:55:35 | 05,917,257 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja Feat_Czwórka -Regulamin zabijania.mp3 [2009-11-20 21:55:32 | 00,017,376 | ---- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-11-20 21:51:20 | 03,927,249 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja Solufka-Pozwól mi żyć.mp3 [2009-11-20 20:17:44 | 00,015,487 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Nero_7 10 1 0_[PL]_[Full]_[keygen][Torrenty.org].torrent [2009-11-17 09:44:05 | 00,094,323 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\The_Sims_Castaway_Stories_-_The_Sims _Historie_z_bezludnej_wyspy_[PL]_[DVD]_[RELOADED][Torrenty[1].org].torrent [2009-11-17 09:38:55 | 00,104,960 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\plan.doc [2009-11-14 12:34:46 | 00,198,656 | ---- | M] () -- C:\WINDOWS\elf_key.dll [2009-11-09 19:20:05 | 17,335,881 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\Wolfgang Gartner - Flashback (Will Bailey & Mikey Hook Remix) 4clubbers.pl by Orzel.mp3 [2009-11-08 16:29:45 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [2009-11-08 16:29:38 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-11-08 00:26:46 | 05,330,502 | -H-- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-11-06 15:31:18 | 00,000,805 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\AMX Mod X Studio.lnk [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-11-28 20:48:30 | 00,002,376 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nero StartSmart.lnk [2009-11-28 20:48:30 | 00,002,286 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nero Home.lnk [2009-11-28 20:47:18 | 00,001,024 | ---- | C] () -- C:\Documents and Settings\Administrator\.rnd [2009-11-24 21:09:53 | 09,020,632 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Now You See It (Benny Benassi Dub Re.mp3 [2009-11-24 21:05:18 | 13,268,114 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Fast Foot - Perfect Paganini (Full Original Mix) 4clubbers.pl - Djohnny.mp3 [2009-11-24 13:28:24 | 00,522,682 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\aspi_471a2.exe [2009-11-23 19:40:57 | 15,118,750 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\02-the_mobb-bass_get_smooth_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:39:21 | 14,709,150 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\07-the_mobb-disco_beat_(club_mix)4clubbers.pl.mp3 [2009-11-23 19:37:02 | 15,313,087 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\23-45 feat 5ivesta Family - Ya Budu (Denis Rublev feat Natasha Baccardi Remix)(By DJ DOMINICO)4clubbers.pl.mp3 [2009-11-22 22:52:23 | 04,616,882 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Storm dance electro.mp3 [2009-11-22 13:50:23 | 12,188,821 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Komodo - I'm Not Missing (South Blast! Electric Remix) www.4clubbers.pl by _Kameleon_.mp3 [2009-11-22 13:34:32 | 00,498,657 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ultimate_sounds_PL.zip [2009-11-21 20:09:25 | 11,745,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Like Thiz! Pres. Rockstars - As Long As I Believe (TAITO Remix) www.4clubbers.com.pl.mp3 [2009-11-21 20:08:31 | 10,534,730 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Cherry Coke & Dann'D - Whine Up (Voltage Mix) [www.4clubbers.pl] up by Silvo88.mp3 [2009-11-20 22:35:00 | 00,017,385 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\ISO1.nri [2009-11-20 22:30:04 | 28,185,2022 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Image.nrg [2009-11-20 22:22:11 | 00,023,539 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\JukeBox1.nrj [2009-11-20 22:18:58 | 04,038,531 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Moklok Moklok (Gdzie Ten Kac_) (Feat_ Numer Raz).mp3 [2009-11-20 22:18:26 | 04,828,996 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 08_ Tetrahydrokanabilizacja.mp3 [2009-11-20 22:16:45 | 24,393,379 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Sobota - Stoprocent 2 (feat_ Kool Savas _ Gural _ Wall-e _ Rytmus _ Bigz prod_ Matheo)_19 [2009-11-20 22:15:53 | 04,472,686 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\T_O_A_S_T_ Mixtape Proceente _ Dj Abdool - 15_ Odpowiedzialność.mp3 [2009-11-20 22:14:18 | 04,081,894 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente - T_O_A_S_T_.mp3 [2009-11-20 22:12:52 | 04,836,833 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Proceente _ Dj Abdool Watch Out Now EP.mp3 [2009-11-20 22:08:24 | 05,150,302 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja SoLUfka - Bragga feat_ Charlie P [Oficjalny Teledysk].mp3 [2009-11-20 22:08:10 | 07,997,649 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Stoprocent Tour - Peja_ Gural_ Kaczor_ Pih_ Borixon___.mp3 [2009-11-20 22:07:24 | 06,107,951 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja - Szacunek Ludzi Ulicy.mp3 [2009-11-20 22:07:19 | 06,721,829 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Baku Baku to jest skład.mp3 [2009-11-20 22:06:06 | 04,598,074 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Nasze mózgi wypełnione są Marią.mp3 [2009-11-20 22:05:54 | 05,585,502 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Słoń- Ssij go feat_ Gandzior_ Rychu Peja ( Chore melodie ).mp3 [2009-11-20 22:04:40 | 05,716,114 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja _Życie kurewskie_.mp3 [2009-11-20 22:03:58 | 05,197,845 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Abrakadabra.mp3 [2009-11-20 22:02:16 | 04,562,025 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Gruby czarny kot.mp3 [2009-11-20 22:00:47 | 04,625,241 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu peja solufka-Rap jest moja kokaina.mp3 [2009-11-20 22:00:17 | 05,055,739 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44 - Normalnie O Tej Porze.mp3 [2009-11-20 21:59:20 | 02,305,567 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Kaliber 44-Usłysz mój głos.mp3 [2009-11-20 21:55:15 | 05,917,257 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Peja Feat_Czwórka -Regulamin zabijania.mp3 [2009-11-20 21:51:03 | 03,927,249 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Rychu Peja Solufka-Pozwól mi żyć.mp3 [2009-11-20 20:17:44 | 00,015,487 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Nero_7 10 1 0_[PL]_[Full]_[keygen][Torrenty.org].torrent [2009-11-17 09:44:05 | 00,094,323 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\The_Sims_Castaway_Stories_-_The_Sims _Historie_z_bezludnej_wyspy_[PL]_[DVD]_[RELOADED][Torrenty[1].org].torrent [2009-11-17 09:38:55 | 00,104,960 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\plan.doc [2009-11-14 12:34:47 | 00,198,656 | ---- | C] () -- C:\WINDOWS\elf_key.dll [2009-11-09 19:17:49 | 17,335,881 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\Wolfgang Gartner - Flashback (Will Bailey & Mikey Hook Remix) 4clubbers.pl by Orzel.mp3 [2009-11-08 16:29:45 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009-11-08 16:29:38 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2009-11-06 15:31:18 | 00,000,805 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\AMX Mod X Studio.lnk [2009-07-19 12:01:10 | 00,008,704 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-07-01 22:23:31 | 00,160,768 | ---- | C] () -- C:\WINDOWS\System32\io.dll [2009-07-01 13:51:36 | 00,000,008 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\wiaserva.log [2009-06-20 23:31:30 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2009-06-20 23:30:45 | 00,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-06-20 23:30:44 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\PnkBstrK.sys [2009-06-20 23:30:17 | 00,000,267 | ---- | C] () -- C:\WINDOWS\game.ini [2009-06-19 16:12:30 | 00,015,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\nod32drv.sys [2009-06-19 16:05:03 | 00,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll [2009-06-19 10:56:25 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2002-03-25 19:02:14 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [color=#E56717]========== LOP Check ==========[/color] [2009-07-02 21:36:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Desktopicon [2009-07-13 14:18:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\ICAClient [2009-08-16 18:54:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu [2009-08-20 01:00:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\OpenFM [2009-09-20 12:05:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2009-07-13 14:18:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Runaware [2009-07-19 21:10:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Thinstall [2009-11-09 23:13:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia [2009-11-30 18:46:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent [2009-08-12 08:22:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-08-20 01:00:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 2183 · przez **NieWiem** 30 Lis 2009, 19:55

Ciężko jestem zdziwiony, ale widzę, że OTL dał ciała. Damy mu więc jeszcze jedną szansę, inaczej konstruując skrypt.

Uruchom ponownie program OTL
W okienku na dole Custom Scans / Fixes wklej to, co poniżej w ramce:
Kod: Zaznacz wszystko
:OTL PRC - C:\Windows\Explorer.exe SRV - File not found -- -- (ServiceLayer) FF - prefs.js..browser.search.selectedEngine: "Gameztar Toolbar" FF - prefs.js..extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 FF - prefs.js..extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 FF - prefs.js..extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 FF - HKLM\software\mozilla\Firefox\Extensions\\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files\Web Search Operator\3.1.0.1800\FF [2009-11-27 11:45:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files\Automated Content Enhancer\4.1.0.5050\FF [2009-11-27 11:45:29 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files\Customized Platform Advancer\3.1.0.1540\FF [2009-11-27 11:45:38 | 00,000,000 | ---D | M] O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-1645522239-562591055-1417001333-500\..\Toolbar\WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. O4 - HKU\S-1-5-21-1645522239-562591055-1417001333-500..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found :Files [2009-11-27 11:45:58 | 00,000,000 | ---D | C] -- C:\Program Files\Content Management Wizard [2009-11-27 11:45:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today [2009-11-27 11:45:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer [2009-11-27 11:45:37 | 00,000,000 | ---D | C] -- C:\Program Files\Customized Platform Advancer [2009-11-27 11:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer [2009-11-27 11:45:27 | 00,000,000 | ---D | C] -- C:\Program Files\Automated Content Enhancer [2009-11-27 11:45:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator [2009-11-27 11:45:21 | 00,000,000 | ---D | C] -- C:\Program Files\Web Search Operator [2009-11-27 11:44:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar :Services ServiceLayer :Commands [purity] [emptytemp] [clearrestorepoints] [start explorer] [reboot]
Upewnij się, że wszystkie inne okna, programy, komunikatory są wyłączone.
Kliknij przycisk Run Fix i poczekaj cierpliwie. To może chwilę potrwać!
Na prośbę komputera o restart zgódź się.
Po restarcie program automatycznie wyświetli raport z czyszczenia, który należy zapisać i wkleić w poście w tagach [code], lub na stronie http://www.wklej.org
Wykonaj także nowego loga OTL.txt z OTL z opcji Run Scan i także go dołącz. Plik extras.txt nie będzie potrzebny.

A jak to nie da rady, to zastosujemy potężniejsze zabawki, jakich nam nie brakuje :]

**Posty:** 9 · przez **Long Neck** 01 Gru 2009, 19:50

Lekka lipa wyszla ,bo gdy wklejam ten fix i pozniej run fix wszystko znika z pulpitu i zostaje sam OTL.
Po chwili program lapie blok i ''(brak odpowiedźi)'' ,zatrzymujac sie na procesie C:/Program files/Explorer.exe... :S i nic mi nie pozostaje jak zrobic resa kompa..

**Posty:** 18165 · przez **wojtas** 01 Gru 2009, 22:37

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 9 · przez **Long Neck** 03 Gru 2009, 15:34

Oto login z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 09-12-02.07 - Administrator 2009-12-03 14:17.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.1.1250.48.1045.18.1023.548 [GMT 1:00] Uruchomiony z: c:\documents and settings\Administrator\Moje dokumenty\Pobieranie\ComboFix.exe * Rezydentny antywirus jest aktywny . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\ADMINI~1\USTAWI~1\Temp\svchost.exe c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\burnlib.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\dsp_sps.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_aacplus.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_flac.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_flake.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_lame.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_vorbis.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_wav.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\enc_wma.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_crasher.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_dropbox.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_ff.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_hotkeys.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_ml.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\gen_tray.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_cdda.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_dshow.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_flac.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_flv.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_linein.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_midi.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_mod.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_mp3.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_mp4.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_nsv.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_swf.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_vorbis.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_wav.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_wave.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_wm.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\in_wv.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_autotag.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_bookmarks.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_dash.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_disc.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_history.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_impex.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_local.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_nowplaying.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_online.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_orb.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_playlists.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_plg.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_pmp.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_rg.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_transcode.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\ml_wire.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\out_disk.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\out_ds.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\out_wave.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\playlist.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\pmp_activesync.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\pmp_ipod.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\pmp_njb.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\pmp_p4s.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\pmp_usb.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\tagz.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\vis_avs.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\vis_milk2.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\vis_nsfs.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\winamp.lng c:\docume~1\ADMINI~1\USTAWI~1\Temp\WLZ73C1.tmp\winampa.lng c:\documents and settings\Administrator\Dane aplikacji\Desktopicon c:\documents and settings\Administrator\Dane aplikacji\Desktopicon\eBayShortcuts.exe c:\documents and settings\Administrator\Dane aplikacji\wiaserva.log c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\burnlib.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\dsp_sps.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_aacplus.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_flac.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_flake.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_lame.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_vorbis.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_wav.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\enc_wma.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_crasher.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_dropbox.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_ff.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_hotkeys.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_ml.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\gen_tray.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_cdda.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_dshow.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_flac.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_flv.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_linein.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_midi.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_mod.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_mp3.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_mp4.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_nsv.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_swf.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_vorbis.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_wav.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_wave.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_wm.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\in_wv.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_autotag.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_bookmarks.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_dash.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_disc.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_history.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_impex.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_local.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_nowplaying.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_online.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_orb.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_playlists.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_plg.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_pmp.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_rg.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_transcode.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\ml_wire.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\out_disk.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\out_ds.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\out_wave.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\playlist.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\pmp_activesync.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\pmp_ipod.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\pmp_njb.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\pmp_p4s.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\pmp_usb.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\tagz.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\vis_avs.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\vis_milk2.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\vis_nsfs.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\winamp.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temp\WLZ73C1.tmp\winampa.lng c:\documents and settings\Administrator\Ustawienia lokalne\Temporary Internet Files\mvb06759.tmp c:\windows\system32\28463 c:\windows\system32\28463\AKV.exe c:\windows\system32\28463\key.bin c:\windows\system32\28463\KGUT.001 c:\windows\system32\28463\KGUT.002 c:\windows\system32\28463\KGUT.005 c:\windows\system32\28463\KGUT.006 c:\windows\system32\28463\KGUT.007 c:\windows\system32\28463\KGUT.009 c:\windows\system32\28463\KGUT.exe c:\windows\system32\ieuinit.inf c:\windows\system32\qmgr.dll . . . jest zainfekowany!! . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_glaide32 ((((((((((((((((((((((((( Pliki utworzone od 2009-11-03 do 2009-12-03 ))))))))))))))))))))))))))))))) . 2009-11-30 22:01 . 2009-11-30 22:01 -------- d-----w- c:\program files\WinPcap 2009-11-30 22:00 . 2009-11-30 22:03 -------- d-----w- c:\program files\Cain 2009-11-30 17:39 . 2009-11-30 17:39 -------- d-----w- C:\_OTL 2009-11-28 19:48 . 2009-11-28 19:48 -------- d-----w- c:\program files\NeroInstall.bak 2009-11-28 19:47 . 2009-11-28 19:47 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Nero 2009-11-28 19:42 . 2009-11-28 19:46 -------- d-----w- c:\program files\Common Files\Nero 2009-11-28 19:42 . 2009-11-28 19:42 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero 2009-11-28 19:42 . 2009-11-28 19:42 -------- d-----w- c:\program files\Nero 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\program files\Content Management Wizard 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\program files\Customized Platform Advancer 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\program files\Automated Content Enhancer 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\program files\Web Search Operator 2009-11-27 10:44 . 2009-11-27 16:15 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar 2009-11-26 19:59 . 2009-11-28 08:47 -------- d-----w- c:\windows\system32\Adobe 2009-11-24 12:33 . 2009-11-24 12:33 -------- d-----w- C:\adaptec 2009-11-20 20:55 . 2009-11-20 20:55 17376 ----a-w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-11-20 20:13 . 2009-11-20 20:55 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Ahead 2009-11-20 20:13 . 2009-11-20 20:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Ahead 2009-11-20 20:13 . 2009-11-20 20:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Ahead 2009-11-14 11:34 . 2009-11-14 11:34 198656 ----a-w- c:\windows\elf_key.dll 2009-11-08 23:17 . 2009-11-09 22:13 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Tibia 2009-11-08 15:29 . 2009-11-08 15:29 0 ----a-w- c:\windows\nsreg.dat 2009-11-08 15:29 . 2009-11-08 15:29 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla 2009-11-06 14:31 . 2009-11-06 14:31 -------- d-----w- c:\program files\AMX Mod X . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-03 13:29 . 2009-08-01 11:05 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\uTorrent 2009-12-03 13:29 . 2001-10-26 16:15 49492 ----a-w- c:\windows\system32\perfc015.dat 2009-12-03 13:29 . 2001-10-26 16:15 355486 ----a-w- c:\windows\system32\perfh015.dat 2009-12-01 22:27 . 2009-06-20 22:30 215104 ----a-w- c:\windows\system32\PnkBstrB.exe 2009-12-01 21:59 . 2009-06-20 22:30 138576 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2009-11-28 17:12 . 2009-08-01 17:04 -------- d-----w- c:\program files\Common Files\Ahead 2009-10-30 19:49 . 2009-10-30 19:47 -------- d-----w- c:\program files\VirtualDJ 2009-10-29 04:48 . 2009-10-29 04:48 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-10-29 04:48 . 2009-10-29 04:48 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-10-20 18:19 . 2009-10-20 18:19 281104 ----a-w- c:\windows\system32\wpcap.dll 2009-10-20 18:19 . 2009-10-20 18:19 100880 ----a-w- c:\windows\system32\Packet.dll 2009-10-20 18:19 . 2009-10-20 18:19 50704 ----a-w- c:\windows\system32\drivers\npf.sys 2009-10-20 18:19 . 2009-10-20 18:19 53299 ----a-w- c:\windows\system32\pthreadVC.dll 2009-10-04 14:45 . 2009-10-01 19:42 -------- d-----w- c:\program files\Counter Strike 1.6 2009-09-27 21:05 . 2009-09-27 21:05 56 ---ha-w- c:\windows\system32\ezsidmv.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2002-08-20 1511453] "uTorrent"="d:\torrenty\uTorrent.exe" [2009-08-01 288048] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-06-19 949376] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-20 13312] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^rncsys32.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\rncsys32.exe backup=c:\windows\pss\rncsys32.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^smgr34.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\smgr34.exe backup=c:\windows\pss\smgr34.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^Virtual DJ Pro Updater.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\Virtual DJ Pro Updater.exe backup=c:\windows\pss\Virtual DJ Pro Updater.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-06-19 15424] R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704] . . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\PCHealth\HelpCtr\System\panels\blank.htm uStart Page = hxxp://www.wp.pl/ uInternet Connection Wizard,ShellNext = iexplore LSP: c:\windows\System32\imon.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\hd3tdxa4.default\ FF - prefs.js: browser.search.selectedEngine - Gameztar Toolbar FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/ FF - component: c:\program files\Automated Content Enhancer\4.1.0.5050\FF\components\ACEFFAddOn.dll FF - component: c:\program files\Customized Platform Advancer\3.1.0.1540\FF\components\CPAFFAddOn.dll FF - component: c:\program files\Web Search Operator\3.1.0.1800\FF\components\WSOFFAddOn.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe AddRemove-ElfBot NG_is1 - c:\program files\ElfBot NG5\unins000.exe AddRemove-Tibia_is1 - c:\program files\Tibia 8.4\unins000.exe AddRemove-TMIPC - c:\program files\Asprate\Tibia Multi IP Changer\UNinstaller.exe AddRemove-WorldUnlock Codes Calculator - c:\program files\WorldUnlock Codes Calculator\uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-03 14:28 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(676) c:\windows\System32\ODBC32.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(732) c:\windows\System32\imon.dll c:\program files\Eset\pr_imon.dll c:\windows\System32\dssenh.dll - - - - - - - > 'explorer.exe'(5912) c:\windows\System32\msi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\System32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\program files\Eset\nod32krn.exe c:\windows\System32\PnkBstrA.exe c:\windows\System32\PnkBstrB.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\windows\System32\wdfmgr.exe . ************************************************************************** . Czas ukończenia: 2009-12-03 14:30 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-12-03 13:30 Przed: 1 126 592 512 bajtów wolnych Po: 4 031 721 472 bajtów wolnych winxpsp1_pl_pro_bf.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect - - End Of File - - 519F0791AACEC702433AD0F35DEB9839

**Posty:** 18165 · przez **wojtas** 03 Gru 2009, 17:06

pobierz i zapisz na dysku C:

http://www.sendspace.com/file/i42hry

Otworz notatnik i wklej w nim to:

File::
c:\documents and settings\Administrator\Menu Start\Programy\Autostart\rncsys32.exe
c:\documents and settings\Administrator\Menu Start\Programy\Autostart\smgr34.exe
c:\windows\system32\qmgr.dll

Folder::
c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today
c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer
c:\program files\Customized Platform Advancer
c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer
c:\program files\Automated Content Enhancer
c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator
c:\program files\Web Search Operator
c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar

Registry::
[-HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^rncsys32.exe]
[-HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^smgr34.exe]

FCopy::
c:\qmgr.dll | c:\windows\system32\qmgr.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Rozpocznie się usuwanie i powstanie log daj go.

**Posty:** 9 · przez **Long Neck** 03 Gru 2009, 19:58

Wszystko wyszło pomyślnie!

A o to logi z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 09-12-02.07 - Administrator 2009-12-03 18:44.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.1.1250.48.1045.18.1023.681 [GMT 1:00] Uruchomiony z: c:\documents and settings\Administrator\Moje dokumenty\Pobieranie\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Administrator\Moje dokumenty\Pobieranie\CFScript.txt * Rezydentny antywirus jest aktywny FILE :: "c:\documents and settings\Administrator\Menu Start\Programy\Autostart\rncsys32.exe" "c:\documents and settings\Administrator\Menu Start\Programy\Autostart\smgr34.exe" "c:\windows\system32\qmgr.dll" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\config.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\ipdata.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-114529.390.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-114638.875.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-115439.906.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-122526.046.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-170912.078.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-170913.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-170956.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-171558.031.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-171601.875.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-190657.390.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-190808.921.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-191654.812.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-191853.781.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-192534.593.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-192653.218.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-192802.843.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-192906.515.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-220136.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-221715.703.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-221831.640.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-222235.437.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-223236.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-223440.593.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-223600.859.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-223734.765.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-224151.046.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091127-231508.468.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-081948.140.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-093044.062.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-093113.718.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-093700.531.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-114540.640.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-124212.000.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-153921.093.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-164733.250.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-174401.109.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-180140.875.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-184046.578.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-192011.828.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-194512.687.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-204939.156.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-225102.000.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091128-232145.339.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-124023.406.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-130743.781.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-144654.593.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-151638.453.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-152606.687.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-195544.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-203333.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-204721.875.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-210312.625.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091129-233119.453.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-165153.000.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-183520.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-184120.312.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-222138.578.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-222614.593.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-223430.968.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-230526.656.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091130-230753.171.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-134031.515.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-135634.828.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-135644.187.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-144237.718.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-182859.015.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-184514.875.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-194501.250.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-225619.156.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-232758.734.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091201-233110.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091202-154410.328.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091202-220906.390.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091202-235735.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-140439.203.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-141423.515.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-141707.468.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-143211.078.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-150027.484.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-150602.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-152021.703.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-152359.984.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-153550.531.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-183548.625.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\NP_20091203-184157.343.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Automated Content Enhancer\4.1.0.5050\rstatus.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\config.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-114538.781.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-114638.937.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-115439.953.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-122526.109.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-170912.156.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-170913.437.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-170956.515.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-171558.093.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-171601.921.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-190657.531.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-190808.953.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-191654.859.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-191853.828.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-192534.625.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-192653.265.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-192802.906.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-192906.562.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-220136.437.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-221715.750.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-221831.687.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-222235.468.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-223236.406.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-223440.625.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-223600.937.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-223734.859.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-224151.171.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091127-231508.515.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-081948.218.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-093044.093.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-093113.750.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-093700.562.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-114540.671.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-124212.031.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-153921.125.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-164733.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-174401.250.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-180140.937.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-184046.671.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-192012.031.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-194512.828.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-204939.234.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-225102.046.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091128-232145.433.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-124023.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-130743.812.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-144654.687.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-151638.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-152606.734.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-195544.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-203333.453.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-204721.906.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-210312.640.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091129-233119.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-165153.046.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-183520.453.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-184120.562.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-222138.609.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-222614.859.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-223431.015.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-230526.687.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091130-230753.265.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-134031.718.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-135634.859.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-135644.203.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-144237.796.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-182859.109.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-184515.140.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-194501.453.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-225619.234.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-232758.843.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091201-233110.406.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091202-154410.359.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091202-220906.421.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091202-235735.531.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-140439.234.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-141423.625.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-141707.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-143211.093.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-150027.500.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-150602.437.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-152021.734.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-152400.000.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-153550.562.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-183548.718.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\HJHP_20091203-184157.375.log c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\ipdata.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Customized Platform Advancer\3.1.0.1540\rstatus.md c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Gameztar Toolbar c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Internet Today c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Web Search Operator\3.1.0.1800\config.md c:\program files\Automated Content Enhancer c:\program files\Automated Content Enhancer\4.1.0.5050\ACECommon.dll c:\program files\Automated Content Enhancer\4.1.0.5050\ACEIEAddOnSub.dll c:\program files\Automated Content Enhancer\4.1.0.5050\ACEIEAddOnSubL.dll c:\program files\Automated Content Enhancer\4.1.0.5050\acepx.exe c:\program files\Automated Content Enhancer\4.1.0.5050\Data\config.md c:\program files\Automated Content Enhancer\4.1.0.5050\FF\chrome.manifest c:\program files\Automated Content Enhancer\4.1.0.5050\FF\chrome\ACEAddOn.jar c:\program files\Automated Content Enhancer\4.1.0.5050\FF\chrome\content\ACEAddOn.js c:\program files\Automated Content Enhancer\4.1.0.5050\FF\chrome\content\ACEAddOn.xul c:\program files\Automated Content Enhancer\4.1.0.5050\FF\components\ACEFFAddOn.dll c:\program files\Automated Content Enhancer\4.1.0.5050\FF\components\ACEFFAddOn.xpt c:\program files\Automated Content Enhancer\4.1.0.5050\FF\components\ACEFFHelperComponent.js c:\program files\Automated Content Enhancer\4.1.0.5050\FF\install.rdf c:\program files\Automated Content Enhancer\4.1.0.5050\unins000.dat c:\program files\Automated Content Enhancer\4.1.0.5050\unins000.exe c:\program files\Customized Platform Advancer c:\program files\Customized Platform Advancer\3.1.0.1540\CPACommon.dll c:\program files\Customized Platform Advancer\3.1.0.1540\CPAHelper.exe c:\program files\Customized Platform Advancer\3.1.0.1540\CPAIEAddOnSub.dll c:\program files\Customized Platform Advancer\3.1.0.1540\CPAIEAddOnSubL.dll c:\program files\Customized Platform Advancer\3.1.0.1540\cpapx.exe c:\program files\Customized Platform Advancer\3.1.0.1540\Data\config.md c:\program files\Customized Platform Advancer\3.1.0.1540\FF\chrome.manifest c:\program files\Customized Platform Advancer\3.1.0.1540\FF\chrome\content\CPAAddOn.js c:\program files\Customized Platform Advancer\3.1.0.1540\FF\chrome\content\CPAAddOn.xul c:\program files\Customized Platform Advancer\3.1.0.1540\FF\chrome\CPAAddOn.jar c:\program files\Customized Platform Advancer\3.1.0.1540\FF\components\CPAFFAddOn.dll c:\program files\Customized Platform Advancer\3.1.0.1540\FF\components\CPAFFAddOn.xpt c:\program files\Customized Platform Advancer\3.1.0.1540\FF\components\CPAFFHelperComponent.js c:\program files\Customized Platform Advancer\3.1.0.1540\FF\install.rdf c:\program files\Customized Platform Advancer\3.1.0.1540\unins000.dat c:\program files\Customized Platform Advancer\3.1.0.1540\unins000.exe c:\program files\Web Search Operator c:\program files\Web Search Operator\3.1.0.1800\Data\config.md c:\program files\Web Search Operator\3.1.0.1800\FF\chrome.manifest c:\program files\Web Search Operator\3.1.0.1800\FF\chrome\content\WSOAddOn.js c:\program files\Web Search Operator\3.1.0.1800\FF\chrome\content\WSOAddOn.xul c:\program files\Web Search Operator\3.1.0.1800\FF\chrome\WSOAddOn.jar c:\program files\Web Search Operator\3.1.0.1800\FF\components\WSOFFAddOn.dll c:\program files\Web Search Operator\3.1.0.1800\FF\components\WSOFFAddOn.xpt c:\program files\Web Search Operator\3.1.0.1800\FF\components\WSOFFHelperComponent.js c:\program files\Web Search Operator\3.1.0.1800\FF\install.rdf c:\program files\Web Search Operator\3.1.0.1800\unins000.dat c:\program files\Web Search Operator\3.1.0.1800\unins000.exe c:\program files\Web Search Operator\3.1.0.1800\WSOCommon.dll c:\program files\Web Search Operator\3.1.0.1800\wsopx.exe . --------------- FCopy --------------- c:\qmgr.dll --> c:\windows\system32\qmgr.dll . ((((((((((((((((((((((((( Pliki utworzone od 2009-11-03 do 2009-12-03 ))))))))))))))))))))))))))))))) . 2009-12-03 17:38 . 2009-12-03 17:38 409088 ------w- C:\qmgr.dll 2009-11-30 22:01 . 2009-11-30 22:01 -------- d-----w- c:\program files\WinPcap 2009-11-30 22:00 . 2009-11-30 22:03 -------- d-----w- c:\program files\Cain 2009-11-30 17:39 . 2009-11-30 17:39 -------- d-----w- C:\_OTL 2009-11-28 19:48 . 2009-11-28 19:48 -------- d-----w- c:\program files\NeroInstall.bak 2009-11-28 19:47 . 2009-11-28 19:47 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Nero 2009-11-28 19:42 . 2009-11-28 19:46 -------- d-----w- c:\program files\Common Files\Nero 2009-11-28 19:42 . 2009-11-28 19:42 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero 2009-11-28 19:42 . 2009-11-28 19:42 -------- d-----w- c:\program files\Nero 2009-11-27 10:45 . 2009-11-27 10:45 -------- d-----w- c:\program files\Content Management Wizard 2009-11-26 19:59 . 2009-11-28 08:47 -------- d-----w- c:\windows\system32\Adobe 2009-11-24 12:33 . 2009-11-24 12:33 -------- d-----w- C:\adaptec 2009-11-20 20:55 . 2009-11-20 20:55 17376 ----a-w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-11-20 20:13 . 2009-11-20 20:55 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Ahead 2009-11-20 20:13 . 2009-11-20 20:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Ahead 2009-11-20 20:13 . 2009-11-20 20:13 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Ahead 2009-11-14 11:34 . 2009-11-14 11:34 198656 ----a-w- c:\windows\elf_key.dll 2009-11-08 23:17 . 2009-11-09 22:13 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Tibia 2009-11-08 15:29 . 2009-11-08 15:29 0 ----a-w- c:\windows\nsreg.dat 2009-11-08 15:29 . 2009-11-08 15:29 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla 2009-11-06 14:31 . 2009-11-06 14:31 -------- d-----w- c:\program files\AMX Mod X . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-03 17:52 . 2009-08-01 11:05 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\uTorrent 2009-12-03 17:38 . 2009-06-18 21:52 409088 ----a-w- c:\windows\system32\qmgr.dll 2009-12-03 16:06 . 2009-06-20 22:30 215104 ----a-w- c:\windows\system32\PnkBstrB.exe 2009-12-03 15:37 . 2009-06-20 22:30 138576 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2009-12-03 13:29 . 2001-10-26 16:15 49492 ----a-w- c:\windows\system32\perfc015.dat 2009-12-03 13:29 . 2001-10-26 16:15 355486 ----a-w- c:\windows\system32\perfh015.dat 2009-11-28 17:12 . 2009-08-01 17:04 -------- d-----w- c:\program files\Common Files\Ahead 2009-10-30 19:49 . 2009-10-30 19:47 -------- d-----w- c:\program files\VirtualDJ 2009-10-29 04:48 . 2009-10-29 04:48 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-10-29 04:48 . 2009-10-29 04:48 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-10-20 18:19 . 2009-10-20 18:19 281104 ----a-w- c:\windows\system32\wpcap.dll 2009-10-20 18:19 . 2009-10-20 18:19 100880 ----a-w- c:\windows\system32\Packet.dll 2009-10-20 18:19 . 2009-10-20 18:19 50704 ----a-w- c:\windows\system32\drivers\npf.sys 2009-10-20 18:19 . 2009-10-20 18:19 53299 ----a-w- c:\windows\system32\pthreadVC.dll 2009-09-27 21:05 . 2009-09-27 21:05 56 ---ha-w- c:\windows\system32\ezsidmv.dat . ------- Sigcheck ------- [-] 2009-12-03 . 78200FAA6FD9C69394134C238C87FB7F . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll [7] 2002-09-20 . 7778B79E6DE07A92A2E545CA04660196 . 221696 . . [6.2.2600.1106] . . c:\windows\ERDNT\cache\qmgr.dll c:\windows\System32\wscntfy.exe ... - brak elementu !! c:\windows\System32\xmlprov.dll ... - brak elementu !! . ((((((((((((((((((((((((((((( SnapShot@2009-12-03_13.28.03 ))))))))))))))))))))))))))))))))))))))))) . + 2001-08-17 21:30 . 2009-12-03 13:29 39992 c:\windows\system32\perfc009.dat - 2001-08-17 21:30 . 2009-10-25 10:06 39992 c:\windows\system32\perfc009.dat + 2001-08-17 21:30 . 2009-12-03 13:29 311604 c:\windows\system32\perfh009.dat - 2001-08-17 21:30 . 2009-10-25 10:06 311604 c:\windows\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2002-08-20 1511453] "uTorrent"="d:\torrenty\uTorrent.exe" [2009-08-01 288048] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-06-19 949376] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-20 13312] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^rncsys32.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\rncsys32.exe backup=c:\windows\pss\rncsys32.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^smgr34.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\smgr34.exe backup=c:\windows\pss\smgr34.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^Virtual DJ Pro Updater.exe] path=c:\documents and settings\Administrator\Menu Start\Programy\Autostart\Virtual DJ Pro Updater.exe backup=c:\windows\pss\Virtual DJ Pro Updater.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-06-19 15424] R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704] . . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\PCHealth\HelpCtr\System\panels\blank.htm uStart Page = hxxp://www.wp.pl/ uInternet Connection Wizard,ShellNext = iexplore LSP: c:\windows\System32\imon.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\hd3tdxa4.default\ FF - prefs.js: browser.search.selectedEngine - Gameztar Toolbar FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|http://www.wp.pl/ ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-03 18:53 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(672) c:\windows\System32\ODBC32.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(728) c:\windows\System32\imon.dll c:\program files\Eset\pr_imon.dll c:\windows\System32\dssenh.dll . Czas ukończenia: 2009-12-03 18:55 ComboFix-quarantined-files.txt 2009-12-03 17:55 ComboFix2.txt 2009-12-03 13:30 Przed: 3 764 482 048 bajtów wolnych Po: 3 937 128 448 bajtów wolnych - - End Of File - - 9EBF1BE5A73DD2ED8FB47A7BB1712BC3

**Posty:** 18165 · przez **wojtas** 03 Gru 2009, 22:17

pobierz i wypakuj ja C

Otworz notatnik i wklej w nim to:

FCopy::
c:\wscntfy.exe | c:\windows\system32\wscntfy.exe
c:\xmlprov.dll | c:\windows\system32\xmlprov.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu

**Posty:** 9 · przez **Long Neck** 03 Gru 2009, 22:43

co mam pobrac i wypakowac?

ps. juz nie otwieraja sie strony

**Posty:** 18165 · przez **wojtas** 03 Gru 2009, 23:07

sorka

http://www.sendspace.com/file/pcgiok
wykonaj co kazałem

**Posty:** 9 · przez **Long Neck** 04 Gru 2009, 22:24

Wszystko poszło zgodnie z planem

Oto LOG:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.42 Wersja bazy definicji: 3295 Windows 5.1.2600 Dodatek Service Pack. 1 Internet Explorer 6.0.2800.1106 2009-12-04 21:16:26 mbam-log-2009-12-04 (21-16-19).txt Typ skanowania: Pełne skanowanie (C:\|D:\|) Przeskanowane obiekty: 130646 Upłynęło: 15 minute(s), 44 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 26 Zainfekowane wartości rejestru: 3 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 2 Zainfekowane pliki: 15 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: HKEY_CLASSES_ROOT\explorerbar.cmw (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\explorerbar.cmw.1 (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.Agent) -> No action taken. HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{50ad41d2-b1f0-47cc-9ea7-395355eaeebd} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{8ceb185e-81a5-46d3-bc20-c555d605afbd} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a72522ba-9ff3-4c83-abc6-9b476728a396} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{c5762628-ae15-4ca6-96c4-b00dd17f3419} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{d062e03e-65ca-49e4-9b15-31938ba98922} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Explorer\Bars\{b72681c0-a222-4b21-a0e2-53a5a5ca3d411} (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Web Search Operator (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\SOFTWARE\Internet Today (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Automated Content Enhancer (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Customized Platform Advancer (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Web Search Operator (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Automated Content Enhancer (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Customized Platform Advancer (Adware.DoubleD) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> No action taken. Zainfekowane wartości rejestru: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{8141440e-08f0-4339-9959-5c31c6a69f23} (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{e63605fc-d583-4c81-867f-9457bdb3ea1b} (Adware.DoubleD) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{e889f097-b0be-471b-89ad-b86b6f04b506} (Adware.DoubleD) -> No action taken. Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: C:\Program Files\Content Management Wizard\1.1.0.1820 (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard (Adware.Agent) -> No action taken. Zainfekowane pliki: C:\Documents and Settings\Administrator\Moje dokumenty\Downloads\Nero 8.3.2.1 PL\Nero 8.× Keygen.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\Administrator\Ustawienia lokalne\Temporary Internet Files\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\productinfo.dll (Adware.DoubleD) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\28463\AKV.exe.vir (PUP.ArdamaxKeyLogger) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\28463\KGUT.006.vir (PUP.ArdamaxKeyLogger) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\28463\KGUT.007.vir (PUP.ArdamaxKeyLogger) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\28463\KGUT.exe.vir (PUP.ArdamaxKeyLogger) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\cmwpx.exe (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\cmwsh.dll (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\config.mx (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\data.mx (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\exclude.mx (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\MatchingData.zd5 (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\pxtmpdata.mx (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\unins000.dat (Adware.Agent) -> No action taken. C:\Program Files\Content Management Wizard\1.1.0.1820\unins000.exe (Adware.Agent) -> No action taken.

**Posty:** 2183 · przez **NieWiem** 05 Gru 2009, 00:19

Wszystko usunąć.

Miałeś keyloggera. Pozmieniaj hasła, jakich używasz do kont. WSZYSTKIE BEZ WYJĄTKU.

Potem nowe skanowanie MBAM i znowu raport. Chcemy zobaczyć same "0"

**Posty:** 9 · przez **Long Neck** 05 Gru 2009, 12:33

Mialem kg? u.U"

Tylko ze nic w msconfigu nie mialem.. :S
Jeszcze ardmax na dodatek lolz.

Wróce z editem

**Posty:** 3 · przez **nicname** 16 Gru 2009, 18:37

Hej mam ten sam problem co "Long Neck", gdy przeglądam stronki internetowe(używam Mozilli) dodatkowo otwierają mi sie jakieś dodatkowe niechciane. To moje logi z OTL:
OTL.txt
http://www.wklej.org/id/237604/
Extras.txt
http://wklej.org/id/237609/

**Posty:** 18165 · przez **wojtas** 16 Gru 2009, 20:43

nicname, załóż swój temat ,

Kto jest na forum