Niedziałający menadżer zadań

**Posty:** 7 · przez **mariuszg** 11 Lis 2011, 01:10

Witam!
Od jakiegoś czasu klikając Ctrl+Alt+Delete wyświetla mi się komunikat Menadżer zadań został wyłączony przez administratora. Na komputerze jet tylko jedno konto i kompletnie nie wiem co robić.

**Posty:** 8001 · przez **Okocza** 11 Lis 2011, 01:21

obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html

prosiłem o zapoznanie się z tym...

**Posty:** 7 · przez **mariuszg** 11 Lis 2011, 01:35

**Posty:** 8001 · przez **Okocza** 11 Lis 2011, 01:43

Tam nie ma nic napisane o Hijack this... Przeczytaj jeszcze raz ten temat dokładnie a później zastosuj się...

**Posty:** 7 · przez **mariuszg** 11 Lis 2011, 01:46

Racja

zasugerowałem się czymś innym

Dodano Dzisiaj, 01:10:

Kod: Zaznacz wszystko: OTL logfile created on: 2011-11-11 00:59:53 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\SLAWEK\Moje dokumenty\Downloads Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,94 Gb Total Physical Memory | 0,78 Gb Available Physical Memory | 40,34% Memory free 3,79 Gb Paging File | 2,71 Gb Available in Paging File | 71,52% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 42,79 Gb Free Space | 18,37% Space Free | Partition Type: NTFS Computer Name: SLAWEK-073F7D17 | User Name: SLAWEK | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-11-11 00:56:55 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SLAWEK\Moje dokumenty\Downloads\OTL.exe PRC - [2011-11-11 00:47:24 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\i5rgtvmn.exe PRC - [2011-11-11 00:43:50 | 000,563,824 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe PRC - [2011-11-11 00:43:49 | 000,273,528 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2011-11-10 23:36:23 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\winsocd.exe PRC - [2011-11-10 23:31:54 | 000,012,970 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\sdarbx.exe PRC - [2011-10-26 09:10:47 | 001,105,976 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe PRC - [2010-03-28 10:16:06 | 000,866,744 | ---- | M] (iMesh, Inc) -- C:\Program Files\BearShare Applications\MediaBar\DataMngr\DataMngrUI.exe PRC - [2008-05-02 02:44:08 | 000,879,120 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe PRC - [2008-05-02 02:40:56 | 000,076,304 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-12-14 13:28:02 | 000,790,528 | ---- | M] (Edimax Technology Co., Ltd) -- C:\Program Files\EDIMAX\Common\RaUI.exe PRC - [2006-10-27 20:34:00 | 000,143,360 | ---- | M] (VicMan Software) -- C:\Program Files\Photo Toolkit\IvBar\phototoolkitmem.exe PRC - [2005-06-10 17:19:38 | 000,869,888 | ---- | M] (Nero AG) -- C:\Program Files\Ahead\InCD\InCDsrv.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2011-11-11 00:47:24 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\i5rgtvmn.exe MOD - [2011-11-10 23:36:23 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\winsocd.exe MOD - [2011-11-10 23:31:54 | 000,012,970 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\sdarbx.exe MOD - [2011-10-26 09:10:46 | 000,420,920 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\ppgooglenaclpluginchrome.dll MOD - [2011-10-26 09:10:45 | 003,702,840 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\pdf.dll MOD - [2011-10-26 09:09:09 | 000,122,952 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\avutil-51.dll MOD - [2011-10-26 09:09:07 | 000,222,280 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\avformat-53.dll MOD - [2011-10-26 09:09:06 | 001,745,992 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\avcodec-53.dll MOD - [2011-10-26 06:14:43 | 008,587,936 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\15.0.874.106\gcswf32.dll MOD - [2009-02-27 18:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL MOD - [2007-11-28 03:32:00 | 001,163,264 | ---- | M] () -- C:\Program Files\EDIMAX\Common\acAuth.dll MOD - [2006-10-31 07:35:00 | 000,196,608 | ---- | M] () -- C:\WINDOWS\system32\nvapi.dll MOD - [2006-10-27 20:33:50 | 000,417,792 | ---- | M] () -- C:\Program Files\Photo Toolkit\IvBar\ivbar.dll MOD - [2006-10-19 18:19:32 | 000,602,624 | ---- | M] () -- C:\Program Files\Photo Toolkit\IvBar\locs.dll MOD - [2006-08-30 11:11:08 | 000,049,152 | ---- | M] () -- C:\Program Files\Photo Toolkit\IvBar\ivbarhk.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- -- (mks_services) SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2008-05-02 02:42:06 | 000,195,088 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2005-06-10 17:19:38 | 000,869,888 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrv) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Running] -- -- (amsint32) DRV - [2009-06-07 20:18:24 | 000,015,600 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv) DRV - [2009-05-18 08:41:48 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\ec7959a9.sys -- (ec7959a9) DRV - [2009-04-16 14:14:44 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\48552975.sys -- (48552975) DRV - [2008-02-29 03:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2008-02-29 03:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2008-02-29 03:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd) DRV - [2008-01-15 20:50:50 | 000,459,520 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2007-07-18 12:26:04 | 004,547,584 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2006-11-27 16:33:54 | 000,019,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-11-27 16:33:50 | 000,058,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-10-18 16:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-06-18 22:51:32 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005-06-10 17:12:12 | 000,099,584 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\InCDfs.sys -- (InCDfs) DRV - [2005-06-10 17:11:50 | 000,029,696 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDpass.sys -- (InCDPass) DRV - [2005-06-10 15:11:44 | 000,028,160 | ---- | M] (Nero AG) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDrm.sys -- (incdrm) DRV - [2003-12-05 10:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=dpgppc&s={searchTerms}&f=4 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=dpgppc IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Winamp Search" FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" FF - prefs.js..browser.search.order.1: "BearShare Web Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://pl.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official" FF - prefs.js..extensions.enabledItems: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: {CF9581A5-DF6E-4B6F-ACCE-09F163BFEB73}:1.0 FF - prefs.js..extensions.enabledItems: optout@google.com:1.5 FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20100112 FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-11 00:44:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-11-10 23:22:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-11-10 23:22:47 | 000,000,000 | ---D | M] [2009-02-15 19:32:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Extensions [2011-11-10 22:54:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions [2010-10-08 13:09:41 | 000,000,000 | ---D | M] (4shared.com Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} [2010-10-08 13:09:41 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010-10-08 13:09:42 | 000,000,000 | ---D | M] (MyAshampoo Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2011-11-10 22:54:01 | 000,000,000 | ---D | M] (Facemoods) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\ffxtlbr@Facemoods.com [2010-01-31 15:03:21 | 000,000,000 | ---D | M] (NASA Night Launch) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\nasanightlaunch@example.com [2011-10-22 13:16:49 | 000,000,000 | ---D | M] (Advertising Cookie Opt-out) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\optout@google.com [2010-01-24 22:23:26 | 000,002,257 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\askcom.xml [2010-03-28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\BearShareWebSearch.xml [2010-01-20 11:19:10 | 000,000,923 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\conduit.xml [2010-10-08 13:09:53 | 000,001,201 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\winamp-search.xml [2011-11-08 17:25:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2009-02-25 23:05:04 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Program Files\Mozilla Firefox\extensions\{CF9581A5-DF6E-4B6F-ACCE-09F163BFEB73} [2011-11-11 00:44:27 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\DANE APLIKACJI\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT [2011-11-03 22:11:01 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2010-03-28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml [2011-11-03 22:11:01 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2011-11-10 22:54:02 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml [2011-11-03 22:11:01 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2011-11-03 22:11:01 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2011-11-03 22:11:01 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2011-11-03 22:11:01 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\pdf.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Keep My Opt-Outs = C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\hhnjdplhmcnkiecampfdgfjilccfpfoe\1.0.14_0\ CHR - Extension: Default = C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\hkacjpbfdknhflllbcmjibkdeoafencn\1.1_0\ CHR - Extension: Facemoods = C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif\1.4.1_0\ CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\ O1 HOSTS File: ([2006-03-02 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Advertising Cookie Opt-out) - {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} - C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc) O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found. O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com) O3 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\Toolbar\ShellBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\Toolbar\ShellBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found O4 - HKLM..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause File not found O4 - HKLM..\Run: [DataMngr] C:\Program Files\BearShare Applications\MediaBar\DataMngr\DataMngrUI.exe (iMesh, Inc) O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe File not found O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe File not found O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" File not found O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" File not found O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" File not found O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKU\.DEFAULT..\Run: [nDler2] \\?\globalroot\systemroot\system32\nDler2.exe File not found O4 - HKU\S-1-5-18..\Run: [nDler2] \\?\globalroot\systemroot\system32\nDler2.exe File not found O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe File not found O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [I&F Viewer toolbar] C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe (VicMan Software) O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun File not found O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [IVONA Reader] "C:\Program Files\IVONA\IVONA Reader\IVONA Reader.exe.exe" -t -nosplash File not found O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [Twoje TVN24] File not found O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\MS-0902-upd271024.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Wireless Utility.lnk = C:\Program Files\EDIMAX\Common\RaUI.exe (Edimax Technology Co., Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Program Files\4shared Desktop\down_all.htm File not found O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F8B818B7-B6A3-4670-8688-5A5AA728E3D8}: DhcpNameServer = 192.168.0.1 O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\DataMngr\datamngr.dll) -C:\Program Files\BearShare Applications\MediaBar\DataMngr\datamngr.dll (iMesh, Inc) O20 - AppInit_DLLs: (c:\progra~1\ThunMail\testabd.dll) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-15 17:20:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\AuToPlAy\CoMMand - "" = D:\fvokfs.exe O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\AutoRun\command - "" = D:\fvokfs.exe O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\expLore\coMMand - "" = D:\fvokfs.exe O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\open\COmmAND - "" = D:\fvokfs.exe O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\AUToPLAy\cOmMAnd - "" = D:\svtrj.exe O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\AutoRun\command - "" = D:\svtrj.exe O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\explore\COMmaNd - "" = D:\svtrj.exe O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\OPen\CoMmanD - "" = D:\svtrj.exe O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\AutOplAy\COMMAnD - "" = F:\cidlpa.cmd O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\AutoRun\command - "" = F:\cidlpa.cmd O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\explore\Command - "" = F:\cidlpa.cmd O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\opEn\cOMmaNd - "" = F:\cidlpa.cmd O33 - MountPoints2\{ef3c0372-0335-11de-b92b-001fd03e1880}\Shell - "" = AutoRun O33 - MountPoints2\{ef3c0372-0335-11de-b92b-001fd03e1880}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-11-11 00:44:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared [2011-11-11 00:44:20 | 000,198,832 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll [2011-11-11 00:43:51 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll [2011-11-11 00:43:51 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll [2011-11-11 00:43:50 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll [2011-11-11 00:43:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Real [2011-11-11 00:43:17 | 025,963,472 | ---- | C] (RealNetworks, Inc.) -- C:\Documents and Settings\SLAWEK\Pulpit\RealPlayer.exe [2011-11-10 23:22:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\facemoods.com [2011-11-10 23:02:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\hijackthis [2011-11-10 23:01:14 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-11-10 23:01:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Menu Start\Programy\HiJackThis [2011-11-10 22:54:01 | 000,000,000 | ---D | C] -- C:\Program Files\facemoods.com [2011-11-10 22:45:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2011-11-10 20:02:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\Nowy folder (3) [2011-11-10 19:17:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Immunet [2011-11-10 19:17:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Immunet [2011-11-10 19:16:36 | 000,000,000 | ---D | C] -- C:\Program Files\Immunet [2011-11-02 21:03:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\ABC Magazine_Boeing 777-200 [2011-11-02 19:06:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\Nowy folder (2) [2011-10-23 15:34:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\Nowy folder [2011-10-23 14:23:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\fizyka1 [2011-10-15 10:39:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SLAWEK\Pulpit\fizyka [2009-05-20 17:57:28 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\pcouffin.sys [2004-11-24 19:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-11-11 01:00:44 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1202660629-1078145449-682003330-1004.job [2011-11-11 01:00:44 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1202660629-1078145449-682003330-1004.job [2011-11-11 00:47:24 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\i5rgtvmn.exe [2011-11-11 00:44:34 | 000,001,601 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Free Offers.lnk [2011-11-11 00:44:34 | 000,000,929 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\RealPlayer.lnk [2011-11-11 00:44:20 | 000,198,832 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll [2011-11-11 00:43:51 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll [2011-11-11 00:43:51 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll [2011-11-11 00:43:50 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll [2011-11-11 00:42:04 | 025,963,472 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\SLAWEK\Pulpit\RealPlayer.exe [2011-11-10 23:55:58 | 000,000,508 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\fix.reg [2011-11-10 23:54:55 | 000,001,507 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Notatnik.lnk [2011-11-10 23:28:42 | 000,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2011-11-10 23:28:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-11-10 22:46:13 | 000,000,223 | RHS- | M] () -- C:\boot.ini [2011-11-10 20:37:08 | 000,152,576 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-11-10 19:58:00 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-11-10 15:18:15 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-11-09 21:27:14 | 005,370,735 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Killer - Liar.mp3 [2011-11-09 21:03:12 | 000,075,814 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\stroik-na-jodle-na-grob-cmentarz-2-swiece-srebrny-2.jpg [2011-11-09 21:01:21 | 000,251,520 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\stroiki-kompozycje-boze-narodzenie-4-1.jpg [2011-11-09 20:59:03 | 000,144,698 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\2.jpg [2011-11-09 20:58:21 | 000,139,921 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Zdjecie004.jpg [2011-11-09 20:57:33 | 000,020,790 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\zdjecie,b,5440_0,.png [2011-11-07 17:22:26 | 000,541,305 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\skanuj0001.jpg [2011-11-02 21:14:35 | 000,545,176 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Juillet1600x1200.jpg [2011-11-02 21:13:57 | 000,282,910 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Juillet1600x1200 (1).jpg [2011-10-31 12:37:55 | 004,612,086 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\bez tytułu.bmp [2011-10-30 19:37:56 | 000,504,042 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2011-10-30 19:37:56 | 000,444,664 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011-10-30 19:37:56 | 000,090,422 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2011-10-30 19:37:56 | 000,072,288 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011-10-28 17:13:17 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Google Chrome.lnk [2011-10-22 16:33:43 | 000,047,185 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\BIGkolorowanki-justin-bieber7.jpg.jpg [2011-10-22 11:46:35 | 000,229,592 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011-10-21 19:48:15 | 000,684,382 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\Zdjęcie0150.jpg [2011-10-21 19:37:54 | 000,621,719 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_74336_dwa_male_grzybki.jpg [2011-10-21 19:33:15 | 000,681,697 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_57885_dwa_muchomory_jesien (1).jpg [2011-10-21 19:33:00 | 000,681,697 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_57885_dwa_muchomory_jesien.jpg [2011-10-18 18:05:49 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc8db82f25c9aa.job [2011-10-14 23:23:51 | 000,007,887 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Pulpit\fizyka.ods [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-11-11 00:48:46 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\i5rgtvmn.exe [2011-11-11 00:44:34 | 000,001,601 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Free Offers.lnk [2011-11-11 00:44:34 | 000,000,929 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\RealPlayer.lnk [2011-11-10 23:55:58 | 000,000,508 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\fix.reg [2011-11-09 22:41:50 | 005,370,735 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Killer - Liar.mp3 [2011-11-09 21:03:14 | 000,075,814 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\stroik-na-jodle-na-grob-cmentarz-2-swiece-srebrny-2.jpg [2011-11-09 21:01:24 | 000,251,520 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\stroiki-kompozycje-boze-narodzenie-4-1.jpg [2011-11-09 20:59:06 | 000,144,698 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\2.jpg [2011-11-09 20:58:23 | 000,139,921 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Zdjecie004.jpg [2011-11-09 20:57:35 | 000,020,790 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\zdjecie,b,5440_0,.png [2011-11-02 21:14:00 | 000,282,910 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Juillet1600x1200 (1).jpg [2011-11-02 21:13:40 | 000,545,176 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Juillet1600x1200.jpg [2011-11-02 19:16:08 | 001,361,290 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\ĺŃ-104.pdf [2011-10-31 12:37:54 | 004,612,086 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\bez tytułu.bmp [2011-10-22 16:33:42 | 000,047,185 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\BIGkolorowanki-justin-bieber7.jpg.jpg [2011-10-21 19:48:15 | 000,684,382 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Zdjęcie0150.jpg [2011-10-21 19:37:56 | 000,621,719 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_74336_dwa_male_grzybki.jpg [2011-10-21 19:33:16 | 000,681,697 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_57885_dwa_muchomory_jesien (1).jpg [2011-10-21 19:33:00 | 000,681,697 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\tapety_normalne_57885_dwa_muchomory_jesien.jpg [2011-10-18 18:05:49 | 000,001,032 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc8db82f25c9aa.job [2011-10-15 13:02:32 | 000,001,515 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\Paint.lnk [2011-10-14 23:23:51 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Pulpit\fizyka.ods [2011-05-15 21:43:50 | 000,000,530 | ---- | C] () -- C:\WINDOWS\_iserr31.ini [2011-05-15 21:43:50 | 000,000,264 | ---- | C] () -- C:\WINDOWS\_delis32.ini [2011-05-08 15:45:42 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\jesterss.dll [2011-04-09 21:56:01 | 000,038,488 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2010-08-10 01:03:25 | 000,001,536 | ---- | C] () -- C:\WINDOWS\_ISENV31.INI [2010-08-09 23:35:01 | 000,128,464 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2010-05-18 17:23:06 | 000,000,046 | ---- | C] () -- C:\WINDOWS\2pic.ini [2010-05-17 20:00:31 | 000,111,104 | ---- | C] () -- C:\WINDOWS\System32\Uharc.exe [2010-05-17 20:00:31 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\moveex.exe [2010-05-17 20:00:31 | 000,008,636 | ---- | C] () -- C:\WINDOWS\System32\modifype.exe [2010-04-08 15:04:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI [2010-02-21 02:12:04 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI [2010-02-17 23:47:19 | 000,000,056 | ---- | C] () -- C:\WINDOWS\Kulki.ini [2009-12-24 08:53:06 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\setup_ldm.iss [2009-12-22 21:48:47 | 000,409,600 | ---- | C] () -- C:\WINDOWS\LVUNINST.EXE [2009-09-24 21:20:17 | 000,019,540 | ---- | C] () -- C:\WINDOWS\hpqins13.dat [2009-08-06 20:05:31 | 000,155,282 | ---- | C] () -- C:\WINDOWS\hpoins14.dat [2009-08-06 20:05:31 | 000,002,000 | ---- | C] () -- C:\WINDOWS\hpomdl14.dat [2009-08-03 09:19:05 | 000,000,912 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2009-08-02 19:30:49 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2009-08-02 19:30:49 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2009-08-02 19:30:49 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2009-07-26 14:35:08 | 000,018,704 | ---- | C] () -- C:\WINDOWS\System32\mksidsf.sys [2009-07-25 14:23:59 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32\rt73.bin [2009-07-18 20:15:59 | 000,051,823 | ---- | C] () -- C:\WINDOWS\System32\_command.com [2009-07-18 20:15:49 | 000,000,019 | ---- | C] () -- C:\WINDOWS\compedia.ini [2009-06-07 20:16:42 | 000,397,765 | ---- | C] () -- C:\WINDOWS\System32\senekalog.dat [2009-06-07 20:04:01 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2009-05-30 10:09:50 | 000,090,433 | ---- | C] () -- C:\WINDOWS\System32\vic_setup.exe [2009-05-20 17:58:35 | 000,000,055 | ---- | C] () -- C:\WINDOWS\QRPhotoDVDSlideshow.INI [2009-05-20 17:57:28 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\pcouffin.cat [2009-05-20 17:57:28 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\pcouffin.inf [2009-05-17 10:52:10 | 000,090,293 | ---- | C] () -- C:\WINDOWS\System32\vp_setup.exe [2009-04-17 20:57:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\ec7959a9.sys [2009-04-03 18:16:23 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2009-04-03 15:17:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\48552975.sys [2009-02-28 19:52:44 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-02-26 01:49:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\seneka.sys [2009-02-25 23:10:04 | 000,000,043 | ---- | C] () -- C:\WINDOWS\System32\senekaijwswuxb.dat [2009-02-25 23:05:04 | 2231,209,378 | ---- | C] () -- C:\WINDOWS\System32\senekalldltuix.dat [2009-02-25 22:47:34 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-02-25 22:26:05 | 000,122,880 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe [2009-02-25 13:08:07 | 000,001,732 | ---- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin [2009-02-20 22:02:30 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2009-02-17 08:46:20 | 000,152,576 | ---- | C] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-02-15 19:32:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009-02-15 18:07:25 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009-02-15 18:04:37 | 000,229,592 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-02-15 17:22:44 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2009-02-15 17:18:22 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-12-19 15:15:58 | 004,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-12-17 17:41:18 | 000,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-12-17 17:22:58 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-12-17 17:22:48 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-12-17 17:17:34 | 000,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-12-17 16:59:54 | 000,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2006-11-02 16:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2006-10-31 07:35:00 | 001,699,840 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2006-10-31 07:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006-10-31 07:35:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006-10-31 07:35:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2006-10-31 07:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006-10-31 07:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006-10-31 07:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006-10-31 07:35:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2006-10-31 07:35:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2006-10-31 07:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-10-31 07:35:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2006-03-02 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2006-03-02 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006-03-02 13:00:00 | 000,504,042 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2006-03-02 13:00:00 | 000,444,664 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006-03-02 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2006-03-02 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006-03-02 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006-03-02 13:00:00 | 000,090,422 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2006-03-02 13:00:00 | 000,072,288 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006-03-02 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006-03-02 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2006-03-02 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006-03-02 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006-03-02 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2006-03-02 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2006-03-02 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2004-10-03 17:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-06-09 21:38:01 | 000,184,320 | ---- | C] () -- C:\WINDOWS\System32\JPeg32.dll [2003-04-08 11:40:22 | 000,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [color=#E56717]========== LOP Check ==========[/color] [2009-05-19 16:52:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\14280 [2009-05-17 10:38:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\172BF [2009-06-08 16:45:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1A148 [2009-06-08 17:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1B36B [2009-05-16 19:40:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1D30D [2009-05-20 15:59:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1D38A [2009-05-26 18:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\202DE [2011-06-11 22:59:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2276 [2009-05-27 18:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\244E [2009-05-25 15:22:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2A3A [2009-05-16 19:04:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2C1F4 [2009-06-08 17:15:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2EBB [2009-06-07 17:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\30280 [2009-05-21 20:47:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3029F [2009-05-17 19:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\312DE [2009-06-07 20:19:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3236B [2010-02-17 22:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\36FA [2009-05-30 17:46:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3A8C [2009-05-18 16:36:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\83A9 [2009-05-22 17:12:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\9203 [2010-12-02 18:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software [2010-04-07 21:19:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo [2009-02-15 17:56:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Backup [2010-04-29 21:10:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\e-onsoftware [2010-05-15 21:45:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-02-19 21:30:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InterAction studios [2011-05-21 21:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2010-02-12 22:29:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-04-13 16:18:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\RDRM [2009-02-15 18:00:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\sentinel [2010-06-26 17:58:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010-04-07 21:19:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Ashampoo [2009-04-26 18:08:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\autoupdate [2009-08-18 17:49:44 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Chromeflower [2009-08-18 17:49:44 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\CrystalSpace [2010-04-27 21:58:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\e-on software [2011-11-10 23:22:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\facemoods.com [2010-08-10 00:01:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\flightgear.org [2010-01-01 21:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\fltk.org [2010-04-18 15:30:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\FreeFLVConverter [2010-02-12 21:21:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Gadu-Gadu 10 [2009-12-29 19:26:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\GHISLER [2009-02-28 19:54:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\ICAClient [2011-11-10 19:17:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Immunet [2009-02-25 22:30:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\InterTrust [2011-11-10 15:19:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\ipla [2010-02-27 16:24:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\IVONA Player [2009-12-24 08:53:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Leadertech [2009-02-25 13:15:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mikrotik [2010-08-10 00:45:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Notepad++ [2009-04-26 18:08:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Onet [2010-02-12 21:16:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\OpenFM [2009-02-15 21:36:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\OpenOffice.ux.pl [2011-11-10 23:23:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\PriceGong [2010-11-20 12:04:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\RDRM [2009-02-28 19:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Runaware [2009-07-31 16:37:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Thunderbird [2010-12-27 22:54:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\uTorrent [2010-08-10 00:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Vso [2010-01-24 14:10:43 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 01:11:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2011-11-11 00:59:53 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\SLAWEK\Moje dokumenty\Downloads Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,94 Gb Total Physical Memory | 0,78 Gb Available Physical Memory | 40,34% Memory free 3,79 Gb Paging File | 2,71 Gb Available in Paging File | 71,52% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 42,79 Gb Free Space | 18,37% Space Free | Partition Type: NTFS Computer Name: SLAWEK-073F7D17 | User Name: SLAWEK | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 1 "FirewallDisableNotify" = 1 "UpdatesDisableNotify" = 1 "AntiVirusOverride" = 1 "FirewallOverride" = 1 "UacDisableNotify" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] "DisableMonitoring" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] "DisableMonitoring" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 1 "AntiVirusDisableNotify" = 1 "FirewallDisableNotify" = 1 "FirewallOverride" = 1 "UpdatesDisableNotify" = 1 "UacDisableNotify" = 1 [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe:*:Disabled:Gadu-Gadu 10 -- (GG Network S.A.) "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare "C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Disabled:Gadu-Gadu - program glowny "C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google) "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" = C:\Program Files\Alwil Software\Avast5\AvastUI.exe:*:Enabled:avast! Internet Security "D:\fvokfs.exe" = D:\fvokfs.exe:*:Enabled:ipsec "C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE" = C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjavcma.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjavcma.exe:*:Enabled:ipsec "C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe" = C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe:*:Enabled:ipsec -- (Google Inc.) "C:\WINDOWS\system32\nwiz.exe" = C:\WINDOWS\system32\nwiz.exe:*:Enabled:ipsec -- () "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ntou.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ntou.exe:*:Enabled:ipsec "C:\WINDOWS\KHALMNPR.EXE" = C:\WINDOWS\KHALMNPR.EXE:*:Enabled:ipsec -- (Logitech, Inc.) "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jjujbh.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jjujbh.exe:*:Enabled:ipsec "C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe" = C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe:*:Enabled:ipsec -- (Sun Microsystems, Inc.) "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbuooro.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbuooro.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windesv.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windesv.exe:*:Enabled:ipsec "C:\Program Files\EDIMAX\Common\RaUI.exe" = C:\Program Files\EDIMAX\Common\RaUI.exe:*:Enabled:ipsec -- (Edimax Technology Co., Ltd) "C:\Program Files\Logitech\SetPoint\SetPoint.exe" = C:\Program Files\Logitech\SetPoint\SetPoint.exe:*:Enabled:ipsec -- (Logitech, Inc.) "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pnfy.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pnfy.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincvkrrl.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincvkrrl.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hqtct.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hqtct.exe:*:Enabled:ipsec "C:\Program Files\Real\RealPlayer\update\realsched.exe" = C:\Program Files\Real\RealPlayer\update\realsched.exe:*:Enabled:ipsec -- (RealNetworks, Inc.) "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wqqiai.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wqqiai.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cqkn.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cqkn.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ckwyst.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ckwyst.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dnfr.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dnfr.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\awnvg.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\awnvg.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hebo.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hebo.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiipaai.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiipaai.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintauc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintauc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bncpm.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bncpm.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wuuil.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wuuil.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dguylj.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dguylj.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windvfvc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windvfvc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wkjhsy.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wkjhsy.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\fyirh.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\fyirh.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windaqtdk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windaqtdk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlckqib.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlckqib.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\adkq.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\adkq.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\oftuai.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\oftuai.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\eqpya.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\eqpya.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\uqyey.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\uqyey.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xuqo.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xuqo.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\badvc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\badvc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyakx.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyakx.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqlrhgp.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqlrhgp.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxrefs.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxrefs.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winavfu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winavfu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xntvd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xntvd.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winpeit.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winpeit.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\onahdv.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\onahdv.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sajx.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sajx.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winypof.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winypof.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rjuu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rjuu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vqlwa.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vqlwa.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dbjj.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dbjj.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pwaf.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pwaf.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ewbkux.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ewbkux.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cenzura!.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cenzura!.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincirw.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincirw.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\khcp.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\khcp.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingorola.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingorola.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdvgy.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdvgy.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqptla.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqptla.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlkwhjk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlkwhjk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingufyq.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingufyq.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyigc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyigc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintuyeso.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintuyeso.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winmbps.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winmbps.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjdcunk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjdcunk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qxhcbv.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qxhcbv.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\osue.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\osue.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dyyr.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dyyr.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlffpc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlffpc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vjyb.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vjyb.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jxouuh.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jxouuh.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwcnee.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwcnee.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxswrw.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxswrw.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjiyoy.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjiyoy.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\etwhdg.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\etwhdg.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winfwyfid.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winfwyfid.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincjkiv.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincjkiv.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiwrgvq.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiwrgvq.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\aunrwu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\aunrwu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintymal.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintymal.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbhmnfg.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbhmnfg.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\djlpel.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\djlpel.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbcsft.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbcsft.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ouym.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ouym.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rvvlo.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rvvlo.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingqqykk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingqqykk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qtyvk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qtyvk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winitdd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winitdd.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqdvii.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqdvii.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqljidb.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqljidb.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\llqig.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\llqig.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wlnnsd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wlnnsd.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvbnlhf.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvbnlhf.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gyucs.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gyucs.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rpjatg.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rpjatg.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqrume.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqrume.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\soslx.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\soslx.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrwgec.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrwgec.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\njfjkl.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\njfjkl.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdaumv.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdaumv.exe:*:Enabled:ipsec "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" = C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wineebs.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wineebs.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winhoqlu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winhoqlu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxxngcf.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxxngcf.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\silg.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\silg.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsofu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsofu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windelwph.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windelwph.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vonc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vonc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winnnpm.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winnnpm.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsgyc.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsgyc.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lehs.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lehs.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincrww.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincrww.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvkvk.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvkvk.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gvnxm.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gvnxm.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bvit.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bvit.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbnln.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbnln.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bbhif.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bbhif.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hgytln.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hgytln.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vman.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vman.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlhcia.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlhcia.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdujd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdujd.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvhbftf.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvhbftf.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\armdu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\armdu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsdgdky.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsdgdky.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lkcerd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lkcerd.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winseoei.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winseoei.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbtvp.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbtvp.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winunsurx.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winunsurx.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sirw.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sirw.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqbpjgu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqbpjgu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\foyxr.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\foyxr.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jommxu.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jommxu.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvxykse.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvxykse.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winicsbi.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winicsbi.exe:*:Enabled:ipsec "C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:ipsec -- (Microsoft Corporation) "C:\Program Files\Google\Chrome\Application\chrome.exe" = C:\Program Files\Google\Chrome\Application\chrome.exe:*:Enabled:ipsec -- (Google Inc.) "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbfsta.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbfsta.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winidhiwn.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winidhiwn.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\clvl.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\clvl.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sdarbx.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sdarbx.exe:*:Enabled:ipsec -- () "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsocd.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsocd.exe:*:Enabled:ipsec -- () "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwgvqdq.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwgvqdq.exe:*:Enabled:ipsec "C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xfolh.exe" = C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xfolh.exe:*:Enabled:ipsec -- () [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK "{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer "{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp "{15e13d3b-4b57-4f68-9ba4-5d86c0931833}" = Pixia "{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy "{19B72AA9-985A-11D4-9C8A-00D0B75D1498}" = Colin McRae Rally 2 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher "{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1 "{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg "{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1 "{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan "{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5 "{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT "{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing "{4415B0E6-B266-49C3-B501-FFEF76C3D71B}" = Google Advertising Cookie Opt-out "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{4E5AFCDB-0ACA-49FA-9854-0E9E8469F33E}" = OpenOffice.ux.pl 3.0 "{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1 "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime "{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes "{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK "{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90A40415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6 "{A0BCF90F-B4E4-435C-A48D-8FAAE10554F9}" = Pixia "{A6C265BE-E2C1-483e-843D-6B4C1E912AE0}" = F4100 "{A6EE99EA-420C-4FA6-8A7C-FDB60D278855}" = VS10RuntimeWin32 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in "{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1045-7B44-A91000000001}" = Adobe Reader 9.1 - Polish "{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant "{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support "{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6 "{B4509BCE-7BAD-4a8c-B1AE-4D0CE7467C42}" = F4100_doccd "{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min "{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1 "{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution "{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CA50045C-5119-48e7-9BA7-6B317379857A}" = DJ_AIO_Software "{cb2f7edd-9d1f-43c1-90fc-4f52eae172a1}" = Microsoft .NET Framework 1.1 "{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86 "{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component "{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential "{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E548726E-F4E8-459f-BAB8-45551BC071E9}" = DJ_AIO_ProductContext "{E91E8912-769D-42F0-8408-0E329443BABC}" = Edimax Wireless LAN "{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint "{F31E509D-3597-324E-83CF-0C160B2320F0}" = Microsoft .NET Framework 3.5 Language Pack - plk "{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE "{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}" = HP Deskjet All-In-One Software 9.0 "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status "{FFD44E90-AEA4-4D25-AF53-5CE2723E88DA}" = MarketingReg "6A1545AE87FC8D98ACA7539CE7AA69DF2A5C7E1C" = Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) "Adobe Acrobat 5.0" = Adobe Acrobat 5.0 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE "Chicken Invaders: Revenge of the Yolk (Christmas Edition)_is1" = Chicken Invaders: Revenge of the Yolk (Christmas Edition) v3.20 "facemoods" = Facemoods Toolbar "Gadu-Gadu 10" = Gadu-Gadu 10 "Google Chrome" = Google Chrome "HP Imaging Device Functions" = HP Imaging Device Functions 9.0 "HP Photosmart Essential" = HP Photosmart Essential 3.5 "HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0 "InCD!UninstallKey" = InCD "ipla" = ipla 2.3.3 "Kurka Wodna 2 Demo Edycja Świąteczna" = Kurka Wodna 2 Demo Edycja Świąteczna "microsoft .net framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5 "Microsoft .NET Framework 3.5 Language Pack - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 — PLK "Mozilla Firefox (3.6.23)" = Mozilla Firefox (3.6.23) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "My Free Mahjong_is1" = My Free Mahjong "my global search uninstall" = My Global Search Bar "MyAshampoo Toolbar" = MyAshampoo Toolbar "Nero - Burning Rom!UninstallKey" = Nero OEM "NVIDIA Drivers" = NVIDIA Drivers "PhotoToolkit_is1" = Photo Toolkit 1.7 "RealPlayer 12.0" = RealPlayer "SVEN SPANNT" = SVEN SPANNT "Totalcmd" = Total Commander (Remove or Repair) "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "WIC" = Windows Imaging Component "winace archiver" = WinAce Archiver "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "XP Codec Pack" = XP Codec Pack "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2011-11-10 14:16:55 | Computer Name = SLAWEK-073F7D17 | Source = crypt32 | ID = 131083 Description = Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. Error - 2011-11-10 14:16:55 | Computer Name = SLAWEK-073F7D17 | Source = crypt32 | ID = 131083 Description = Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. Error - 2011-11-10 17:34:53 | Computer Name = SLAWEK-073F7D17 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł powodujący błąd , wersja 0.0.0.0, adres błędu 0x00000000. Error - 2011-11-10 17:35:49 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 17:35:51 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 17:35:54 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 18:24:35 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 18:24:37 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 18:29:39 | Computer Name = SLAWEK-073F7D17 | Source = MsiInstaller | ID = 11721 Description = Product: HPPhotosmartEssential -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: KillMon.27372AF7_42C8_4792_AC6F_A9ACB331F2E7, location: C:\Program Files\HP\Digital Imaging\bin\, command: C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe "-off" Error - 2011-11-10 20:00:53 | Computer Name = SLAWEK-073F7D17 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca i5rgtvmn.exe, wersja 1.0.15.15641, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2011-11-10 18:29:48 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:29:48 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:29:48 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:29:48 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%2” podczas próby uruchomienia usługi BITS z argumentami „” w celu uruchomienia serwera: {4991D34B-80A1-4291-83B6-3328366B9097} Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%2” podczas próby uruchomienia usługi BITS z argumentami „” w celu uruchomienia serwera: {4991D34B-80A1-4291-83B6-3328366B9097} Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%2” podczas próby uruchomienia usługi BITS z argumentami „” w celu uruchomienia serwera: {4991D34B-80A1-4291-83B6-3328366B9097} Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 Error - 2011-11-10 18:30:11 | Computer Name = SLAWEK-073F7D17 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa inteligentnego transferu w tle z powodu następującego błędu: %%2 < End of report >

**Posty:** 18165 · przez **wojtas** 12 Lis 2011, 17:12

brak Gmera , proszę uzupełnić w następnym poście

niestety mamy tu do czynienia z Sality o czym świadczy:

DRV - File not found [Kernel | On_Demand | Running] -- -- (amsint32)

odinstaluj w dodaj usuń: MyAshampoo Toolbar, My Global Search Bar, Facemoods Toolbar, Ask Toolbar

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
PRC - [2011-11-10 23:36:23 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\winsocd.exe
PRC - [2011-11-10 23:31:54 | 000,012,970 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Temp\sdarbx.exe
SRV - File not found [Auto | Stopped] -- -- (mks_services)
DRV - File not found [Kernel | On_Demand | Running] -- -- (amsint32)
DRV - [2009-05-18 08:41:48 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\ec7959a9.sys -- (ec7959a9)
DRV - [2009-04-16 14:14:44 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\48552975.sys -- (48552975)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=dpgppc&s={searchTerms}&f=4
IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=dpgppc
IE - HKU\S-1-5-21-1202660629-1078145449-682003330-1004\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
[2010-10-08 13:09:41 | 000,000,000 | ---D | M] (4shared.com Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7}
[2010-10-08 13:09:41 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010-10-08 13:09:42 | 000,000,000 | ---D | M] (MyAshampoo Toolbar) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2011-11-10 22:54:01 | 000,000,000 | ---D | M] (Facemoods) -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\extensions\ffxtlbr@Facemoods.com
[2010-01-24 22:23:26 | 000,002,257 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\askcom.xml
[2010-03-28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\BearShareWebSearch.xml
[2010-01-20 11:19:10 | 000,000,923 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\conduit.xml
[2010-10-08 13:09:53 | 000,001,201 | ---- | M] () -- C:\Documents and Settings\SLAWEK\Dane aplikacji\Mozilla\Firefox\Profiles\xwsjm64u.default\searchplugins\winamp-search.xml
[2010-03-28 10:04:34 | 000,002,476 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2011-11-10 22:54:02 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
CHR - Extension: Facemoods = C:\Documents and Settings\SLAWEK\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif\1.4.1_0\
O3 - HKLM\..\Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause File not found
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe File not found
O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe File not found
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe File not found
O4 - HKLM..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" File not found
O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun File not found
O4 - HKU\.DEFAULT..\Run: [nDler2] \\?\globalroot\systemroot\system32\nDler2.exe File not found
O4 - HKU\S-1-5-18..\Run: [nDler2] \\?\globalroot\systemroot\system32\nDler2.exe File not found
O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe File not found
O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [IVONA Reader] "C:\Program Files\IVONA\IVONA Reader\IVONA Reader.exe.exe" -t -nosplash File not found
O4 - HKU\S-1-5-21-1202660629-1078145449-682003330-1004..\Run: [Twoje TVN24] File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\MS-0902-upd271024.exe ()
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\DataMngr\datamngr.dll) -C:\Program Files\BearShare Applications\MediaBar\DataMngr\datamngr.dll (iMesh, Inc)
O20 - AppInit_DLLs: (c:\progra~1\ThunMail\testabd.dll) - File not found
O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\AuToPlAy\CoMMand - "" = D:\fvokfs.exe
O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\AutoRun\command - "" = D:\fvokfs.exe
O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\expLore\coMMand - "" = D:\fvokfs.exe
O33 - MountPoints2\{256b94d2-0565-11e1-803a-001f1f31c81f}\Shell\open\COmmAND - "" = D:\fvokfs.exe
O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\AUToPLAy\cOmMAnd - "" = D:\svtrj.exe
O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\AutoRun\command - "" = D:\svtrj.exe
O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\explore\COMmaNd - "" = D:\svtrj.exe
O33 - MountPoints2\{803092a5-e777-11e0-800e-001f1f31c81f}\Shell\OPen\CoMmanD - "" = D:\svtrj.exe
O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\AutOplAy\COMMAnD - "" = F:\cidlpa.cmd
O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\AutoRun\command - "" = F:\cidlpa.cmd
O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\explore\Command - "" = F:\cidlpa.cmd
O33 - MountPoints2\{bc4b292b-232e-11e0-bedb-001f1f31c81f}\Shell\opEn\cOMmaNd - "" = F:\cidlpa.cmd
O33 - MountPoints2\{ef3c0372-0335-11de-b92b-001fd03e1880}\Shell - "" = AutoRun
O33 - MountPoints2\{ef3c0372-0335-11de-b92b-001fd03e1880}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe
[2009-05-19 16:52:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\14280
[2009-05-17 10:38:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\172BF
[2009-06-08 16:45:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1A148
[2009-06-08 17:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1B36B
[2009-05-16 19:40:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1D30D
[2009-05-20 15:59:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1D38A
[2009-05-26 18:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\202DE
[2011-06-11 22:59:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2276
[2009-05-27 18:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\244E
[2009-05-25 15:22:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2A3A
[2009-05-16 19:04:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2C1F4
[2009-06-08 17:15:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2EBB
[2009-06-07 17:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\30280
[2009-05-21 20:47:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3029F
[2009-05-17 19:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\312DE
[2009-06-07 20:19:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3236B
[2010-02-17 22:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\36FA
[2009-05-30 17:46:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3A8C
[2009-05-18 16:36:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\83A9
[2009-05-22 17:12:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\9203
[2010-01-24 14:10:43 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\fvokfs.exe"=-winjavcma.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ntou.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbuooro.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windesv.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pnfy.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincvkrrl.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hqtct.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wqqiai.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cqkn.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ckwyst.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dnfr.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\awnvg.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hebo.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiipaai.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintauc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bncpm.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wuuil.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dguylj.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windvfvc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wkjhsy.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\fyirh.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windaqtdk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlckqib.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\adkq.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\oftuai.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\eqpya.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\uqyey.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xuqo.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\badvc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyakx.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqlrhgp.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxrefs.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winavfu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xntvd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winpeit.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\onahdv.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sajx.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winypof.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rjuu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vqlwa.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dbjj.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\pwaf.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ewbkux.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\cenzura!.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincirw.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\khcp.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingorola.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdvgy.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqptla.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlkwhjk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingufyq.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winyigc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintuyeso.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winmbps.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjdcunk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qxhcbv.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\osue.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\dyyr.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlffpc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vjyb.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jxouuh.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwcnee.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxswrw.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winjiyoy.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\etwhdg.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winfwyfid.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincjkiv.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winiwrgvq.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\aunrwu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wintymal.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbhmnfg.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\djlpel.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbcsft.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\ouym.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rvvlo.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wingqqykk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\qtyvk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winitdd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqdvii.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqljidb.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\llqig.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wlnnsd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvbnlhf.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gyucs.exe"=-e
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\rpjatg.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqrume.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\soslx.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrwgec.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\njfjkl.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdaumv.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wineebs.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winhoqlu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winxxngcf.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\silg.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsofu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\windelwph.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vonc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winnnpm.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsgyc.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lehs.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\wincrww.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvkvk.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\gvnxm.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bvit.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbnln.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\bbhif.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\hgytln.exe"=-c
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\vman.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winlhcia.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winrdujd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvhbftf.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\armdu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsdgdky.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lkcerd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winseoei.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winbtvp.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winunsurx.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sirw.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winqbpjgu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\foyxr.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\jommxu.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winvxykse.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winicsbi.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\lbfsta.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winidhiwn.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\clvl.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\sdarbx.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winsocd.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\winwgvqdq.exe"=-
"C:\DOCUME~1\SLAWEK\USTAWI~1\Temp\xfolh.exe"=-

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

pobierz to i skanuj dopóki nie będzie nic znajdował, żadnego pliku zainfekowanego..

potem pobierz [ur;=http://www.fixitpc.pl/picasso/download/malware/sality_regkeys.zip]to[/url] i odpal plik SafeBootWinXP i potwierdz dodanie do rejestru

następnie dajesz nowy log z OTL, Gmera, USBFIX , Ad Remover