Ogólne spowolnienie internetu

**Posty:** 945 · przez **qrminator** 28 Gru 2010, 15:50

witam,
mam problem z szybkością reakcji internetu (sama prędkość jest ok, mimo to strony wolno się wczytują, duże pingi itp.)
Udało mi się wygenerować logi jedynie z otl'a.
Gmer zawiesza system blokując równocześnie menedżer zadań i muszę robić twardy reset.

Kod: Zaznacz wszystko: OTL logfile created on: 2010-12-28 14:08:39 - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Paweł\Desktop Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 114,44 Gb Free Space | 49,14% Space Free | Partition Type: NTFS Drive D: | 221,16 Gb Total Space | 133,73 Gb Free Space | 60,47% Space Free | Partition Type: NTFS Computer Name: PAWEL-PC | User Name: Paweł | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-12-28 14:06:29 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Paweł\Desktop\OTL.exe PRC - [2010-12-11 04:06:15 | 000,912,344 | ---- | M] (Mozilla Corporation) -- D:\Programy\Firefox\firefox.exe PRC - [2010-09-07 17:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe PRC - [2010-09-07 17:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe PRC - [2010-02-06 23:23:56 | 000,088,576 | ---- | M] (Kadu Team) -- D:\Programy\Kadu\kadu.exe PRC - [2009-09-28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2009-07-13 22:18:12 | 000,071,096 | ---- | M] () -- D:\Programy\CDBurnerXP\NMSAccessU.exe PRC - [2009-07-05 02:30:28 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009-04-07 18:04:36 | 000,070,880 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe PRC - [2009-04-07 17:34:26 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe PRC - [2009-04-02 19:49:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe PRC - [2009-03-30 05:06:15 | 000,424,864 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrl.exe PRC - [2009-03-24 12:10:25 | 007,289,376 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe PRC - [2009-03-21 04:37:18 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe PRC - [2009-03-04 18:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2009-02-07 00:13:16 | 001,593,344 | ---- | M] () -- C:\Program Files\ASUS\Wireless Console 3\wcourier.exe PRC - [2008-12-23 01:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe PRC - [2008-12-09 23:01:10 | 000,424,504 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\smartlogon.exe PRC - [2008-12-09 23:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe PRC - [2008-10-01 07:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe PRC - [2008-08-18 19:27:32 | 000,117,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe PRC - [2008-08-14 05:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe PRC - [2008-08-14 04:59:52 | 000,100,920 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe PRC - [2008-08-14 00:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe PRC - [2008-04-01 07:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe PRC - [2008-03-31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2008-01-21 03:33:52 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2007-11-30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe PRC - [2007-08-08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe PRC - [2006-12-24 12:16:42 | 000,131,584 | ---- | M] (Stoic Joker's Network) -- D:\Programy\Tclock\TClock\Clock.exe PRC - [2005-07-15 22:48:33 | 000,479,232 | ---- | M] (Google Inc.) -- D:\Programy\Gmail Notifier\gnotify.exe PRC - [2005-07-06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-12-28 14:06:29 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Paweł\Desktop\OTL.exe MOD - [2010-08-31 16:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll MOD - [2009-03-30 04:48:13 | 000,245,760 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDApix.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe -- (Norton Internet Security) SRV - [2010-09-07 17:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner) SRV - [2010-09-07 17:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner) SRV - [2010-09-07 17:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2010-03-18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009-09-28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2009-07-13 22:18:12 | 000,071,096 | ---- | M] () [Auto | Running] -- D:\Programy\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2009-04-07 18:04:36 | 000,070,880 | ---- | M] (SRS Labs, Inc.) [Auto | Running] -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe -- (SRS_VolSync_Service) SRV - [2008-12-08 16:01:58 | 000,533,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2008-08-14 04:59:52 | 000,100,920 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService) SRV - [2008-03-31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) SRV - [2008-01-21 03:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007-08-08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX) DRV - File not found [File_System | System | Stopped] -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS -- (NAVEX15) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS -- (NAVENG) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2010-09-07 16:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2010-09-07 16:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2010-09-07 16:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2010-09-07 16:47:30 | 000,050,768 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2010-09-07 16:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2010-02-26 14:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2010-02-12 18:33:31 | 000,049,720 | ---- | M] (Data Encryption Systems Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\dk2drv.sys -- (dk2drv) DRV - [2009-11-12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2009-09-18 09:04:20 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-08-05 03:18:24 | 000,551,424 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM) DRV - [2009-07-21 11:39:32 | 000,576,896 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA) DRV - [2009-07-05 02:42:46 | 000,030,264 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm) DRV - [2009-04-15 05:01:49 | 009,561,472 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009-04-01 22:12:48 | 000,233,128 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service) DRV - [2009-03-30 08:33:17 | 000,129,536 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ETD.sys -- (ETD) DRV - [2009-03-24 12:33:27 | 002,346,016 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2009-02-18 04:01:34 | 001,093,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008-12-08 16:01:52 | 000,055,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr) DRV - [2008-11-27 12:16:47 | 000,135,680 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008-11-13 02:02:17 | 000,146,464 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32) DRV - [2008-11-03 08:03:27 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr) DRV - [2008-08-25 11:22:51 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) DRV - [2008-08-11 03:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008-05-02 10:58:28 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2008-05-02 10:58:14 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2008-05-02 10:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008-04-07 07:00:45 | 000,006,656 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CRFILTER.sys -- (CRFILTER) DRV - [2008-01-21 03:32:53 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008-01-21 03:32:53 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008-01-21 03:32:52 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008-01-21 03:32:52 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008-01-21 03:32:52 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008-01-21 03:32:52 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008-01-21 03:32:51 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008-01-21 03:32:51 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008-01-21 03:32:50 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008-01-21 03:32:50 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008-01-21 03:32:50 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008-01-21 03:32:49 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008-01-21 03:32:49 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008-01-21 03:32:49 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008-01-21 03:32:49 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008-01-21 03:32:49 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008-01-21 03:32:48 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008-01-21 03:32:48 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008-01-21 03:32:47 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008-01-21 03:32:47 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008-01-21 03:32:46 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008-01-21 03:32:45 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008-01-21 03:32:21 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008-01-21 03:32:21 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008-01-21 03:32:21 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007-07-24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP) DRV - [2006-12-14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor) DRV - [2006-11-10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc) DRV - [2006-11-02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006-11-02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006-11-02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006-11-02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006-11-02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006-11-02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006-11-02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006-11-02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006-11-02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006-11-02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006-11-02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006-11-02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006-11-02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006-11-02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006-11-02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006-11-02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006-11-02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006-11-02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006-11-02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006-11-02 08:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh) DRV - [1996-04-03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\drivers\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.selectedEngine: "Allegro" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://google.pl" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: noia2_option@kk.noia:3.76 FF - prefs.js..extensions.enabledItems: {eaf8a4ef-d221-45ca-9deb-d0934b45fa34}:1.3.0.3 FF - prefs.js..extensions.enabledItems: ramback@pavlov.net:1.0 FF - prefs.js..extensions.enabledItems: zrzuta.eu@gmail.com:1.0 FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.87 FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.0.3.0 FF - prefs.js..extensions.enabledItems: {9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}:3.76 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: D:\Programy\Firefox\components [2010-12-19 15:05:38 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: D:\Programy\Firefox\plugins [2010-12-11 04:06:16 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0b1\extensions\\Components: D:\Programy\Fx beta\components [2010-07-07 22:06:26 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0b1\extensions\\Plugins: D:\Programy\Fx beta\plugins [2010-09-15 18:43:45 | 000,000,000 | ---D | M] [2009-09-04 12:46:32 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\mozilla\Extensions [2010-12-27 14:23:13 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions [2010-11-08 18:49:03 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2010-09-10 22:41:54 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} [2010-11-27 11:13:00 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2010-02-23 16:08:14 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} [2010-12-24 00:16:48 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009-09-30 08:26:33 | 000,000,000 | ---D | M] (OggX (powered by TIME S.A.)) -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34} [2010-02-23 16:08:14 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\noia2_option@kk.noia [2009-10-26 23:06:29 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\ramback@pavlov.net [2010-03-14 16:01:54 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\qntt7vvo.default\extensions\zrzuta.eu@gmail.com [2009-10-11 10:23:49 | 000,006,222 | ---- | M] () -- C:\Users\Paweł\AppData\Roaming\Mozilla\FireFox\Profiles\qntt7vvo.default\searchplugins\filmwebpl---filmy.xml [2009-09-05 10:20:22 | 000,001,736 | ---- | M] () -- C:\Users\Paweł\AppData\Roaming\Mozilla\FireFox\Profiles\qntt7vvo.default\searchplugins\google-pl.xml [2009-09-06 22:24:42 | 000,001,979 | ---- | M] () -- C:\Users\Paweł\AppData\Roaming\Mozilla\FireFox\Profiles\qntt7vvo.default\searchplugins\wrzuta.xml [2010-05-30 14:13:01 | 000,001,502 | ---- | M] () -- C:\Users\Paweł\AppData\Roaming\Mozilla\FireFox\Profiles\qntt7vvo.default\searchplugins\wykoppl---linki.xml [2009-09-05 10:19:16 | 000,000,970 | ---- | M] () -- C:\Users\Paweł\AppData\Roaming\Mozilla\FireFox\Profiles\qntt7vvo.default\searchplugins\wyszukiwanie-filmw-wideo-w-youtube.xml O1 HOSTS File: ([2006-09-18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Programy\Gmail Notifier\gnotify.exe (Google Inc.) O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe () O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000..\Run: [AASecuUFD] File not found O4 - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000..\Run: [Kadu] D:\Programy\Kadu\kadu.exe (Kadu Team) O4 - Startup: C:\Users\Paweł\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Clock — skrót.lnk = D:\Programy\Tclock\TClock\Clock.exe (Stoic Joker's Network) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra Button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Programy\partypoker\PartyPoker\RunApp.exe () O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Programy\partypoker\PartyPoker\RunApp.exe () O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Paweł\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\Paweł\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{09c58eed-febf-11de-8d1d-0026185fd705}\Shell - "" = AutoRun O33 - MountPoints2\{09c58eed-febf-11de-8d1d-0026185fd705}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found O33 - MountPoints2\{71d41ab4-c0b6-11de-ba17-0026185fd705}\Shell\AutoRun\command - "" = 6p2dxv.bat O33 - MountPoints2\{71d41ab4-c0b6-11de-ba17-0026185fd705}\Shell\open\Command - "" = 6p2dxv.bat O33 - MountPoints2\{e2ee17cb-695f-11df-9be6-0026185fd705}\Shell - "" = AutoRun O33 - MountPoints2\{e2ee17cb-695f-11df-9be6-0026185fd705}\Shell\AutoRun\command - "" = F:\USBNB.exe -- File not found O33 - MountPoints2\{fbda2fe1-a429-11de-9893-0026185fd705}\Shell - "" = AutoRun O33 - MountPoints2\{fbda2fe1-a429-11de-9893-0026185fd705}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-12-28 14:06:23 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Paweł\Desktop\OTL.exe [2010-12-28 12:04:49 | 000,000,000 | ---D | C] -- C:\Users\Paweł\Desktop\sam_naprawiam_renault_kangoo_pl_www.przeklej.pl [2010-12-27 01:23:18 | 000,000,000 | ---D | C] -- C:\Users\Paweł\Desktop\FamGuy_2OIO [2010-12-24 14:25:42 | 000,000,000 | ---D | C] -- C:\Users\Paweł\{f584d4a3-581d-449c-9284-506639394a2a} [2010-12-24 14:21:45 | 000,000,000 | ---D | C] -- C:\Users\Paweł\{952725f5-1dab-49ae-acce-7979148c853f} [2010-12-15 17:54:11 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010-12-15 17:54:07 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010-12-15 17:54:07 | 000,345,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010-12-15 17:54:06 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010-12-15 17:54:05 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010-12-15 17:54:05 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010-12-15 17:54:04 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010-12-15 17:54:04 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010-12-15 17:54:02 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010-12-15 17:53:59 | 000,467,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010-12-15 17:53:56 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2010-12-15 17:53:55 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010-12-15 17:53:55 | 000,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010-12-15 17:53:55 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2010-12-15 17:53:55 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010-12-15 17:53:55 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2010-12-15 17:53:55 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010-12-15 17:53:54 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010-12-15 17:53:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010-12-12 10:58:41 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2010-12-02 04:35:18 | 004,280,320 | ---- | C] (Google Inc.) -- C:\Windows\System32\GPhotos.scr [2008-11-03 08:03:27 | 000,013,880 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-12-28 14:06:29 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Paweł\Desktop\OTL.exe [2010-12-28 14:01:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010-12-28 14:01:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010-12-28 13:57:34 | 000,002,431 | ---- | M] () -- C:\Users\Paweł\Desktop\HiJackThis.lnk [2010-12-28 13:56:41 | 001,402,880 | ---- | M] () -- C:\Users\Paweł\Desktop\HiJackThis.msi [2010-12-28 13:18:26 | 000,048,639 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010-12-28 13:18:25 | 000,048,639 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010-12-28 11:53:22 | 000,672,140 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2010-12-28 11:53:22 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010-12-28 11:53:22 | 000,130,516 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2010-12-28 11:53:22 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010-12-28 11:47:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010-12-28 11:47:29 | 3220,410,368 | -HS- | M] () -- C:\hiberfil.sys [2010-12-28 00:03:41 | 000,735,553 | ---- | M] () -- C:\Users\Paweł\Desktop\IMG_57131.jpg [2010-12-28 00:01:06 | 001,043,927 | ---- | M] () -- C:\Users\Paweł\Desktop\IMG_5713.jpg [2010-12-27 13:25:42 | 000,030,720 | ---- | M] () -- C:\Users\Paweł\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-12-25 17:49:52 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe [2010-12-24 14:42:24 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf [2010-12-20 12:00:04 | 000,906,830 | ---- | M] () -- C:\Users\Paweł\113290.pdf [2010-12-20 11:59:05 | 000,305,630 | ---- | M] () -- C:\Users\Paweł\113289.pdf [2010-12-20 11:58:42 | 000,189,794 | ---- | M] () -- C:\Users\Paweł\113288.pdf [2010-12-20 11:21:38 | 000,445,216 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010-12-16 18:19:32 | 370,546,063 | ---- | M] () -- C:\Users\Paweł\Desktop\CS16_full-V40_DiGiTALZONE.exe [2010-12-11 20:35:07 | 005,239,568 | ---- | M] () -- C:\Users\Paweł\Desktop\Lorenc - Wieczory.mp3 [2010-12-09 21:14:23 | 000,084,765 | ---- | M] () -- C:\Users\Paweł\482997dfd44ac91291738716766.jpg [2010-12-02 04:35:18 | 004,280,320 | ---- | M] (Google Inc.) -- C:\Windows\System32\GPhotos.scr [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-12-28 13:57:27 | 000,002,431 | ---- | C] () -- C:\Users\Paweł\Desktop\HiJackThis.lnk [2010-12-28 13:56:33 | 001,402,880 | ---- | C] () -- C:\Users\Paweł\Desktop\HiJackThis.msi [2010-12-28 00:03:10 | 000,735,553 | ---- | C] () -- C:\Users\Paweł\Desktop\IMG_57131.jpg [2010-12-28 00:01:06 | 001,043,927 | ---- | C] () -- C:\Users\Paweł\Desktop\IMG_5713.jpg [2010-12-24 14:42:24 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf [2010-12-20 12:00:00 | 000,906,830 | ---- | C] () -- C:\Users\Paweł\113290.pdf [2010-12-20 11:59:04 | 000,305,630 | ---- | C] () -- C:\Users\Paweł\113289.pdf [2010-12-20 11:58:41 | 000,189,794 | ---- | C] () -- C:\Users\Paweł\113288.pdf [2010-12-16 18:14:46 | 370,546,063 | ---- | C] () -- C:\Users\Paweł\Desktop\CS16_full-V40_DiGiTALZONE.exe [2010-12-11 20:24:54 | 005,239,568 | ---- | C] () -- C:\Users\Paweł\Desktop\Lorenc - Wieczory.mp3 [2010-12-09 21:14:22 | 000,084,765 | ---- | C] () -- C:\Users\Paweł\482997dfd44ac91291738716766.jpg [2010-11-06 22:08:54 | 000,000,000 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempjX1600.html [2010-11-06 22:08:54 | 000,000,000 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempcK1600.html [2010-11-05 22:08:22 | 000,002,432 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempKX5172.html [2010-10-25 18:36:48 | 000,002,432 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempZo6044.html [2010-10-14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2010-09-14 13:36:12 | 000,002,432 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempYU3772.html [2010-09-14 13:36:12 | 000,002,089 | ---- | C] () -- C:\Users\Paweł\AppData\Local\Tempvw3772.html [2010-09-14 13:30:44 | 000,002,432 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TempHC4936.html [2010-09-14 13:30:44 | 000,002,089 | ---- | C] () -- C:\Users\Paweł\AppData\Local\Tempaq4936.html [2010-09-05 23:11:56 | 000,002,432 | ---- | C] () -- C:\Users\Paweł\AppData\Local\TemptGo304.html [2010-08-20 22:25:20 | 000,000,088 | RHS- | C] () -- C:\ProgramData\2C1AF0CC23.sys [2010-08-20 21:48:34 | 000,000,088 | RHS- | C] () -- C:\ProgramData\4803168F71.sys [2010-05-22 11:19:18 | 000,000,680 | ---- | C] () -- C:\Users\Paweł\AppData\Local\d3d9caps.dat [2010-02-23 12:00:41 | 000,782,336 | ---- | C] () -- C:\Windows\System32\IlmImf.dll [2010-02-23 12:00:41 | 000,446,464 | ---- | C] () -- C:\Windows\System32\Photomatix_jpg.dll [2010-02-23 12:00:41 | 000,353,280 | ---- | C] () -- C:\Windows\System32\pmtf2.dll [2010-02-23 12:00:41 | 000,266,240 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib.dll [2010-02-23 12:00:41 | 000,249,856 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib2.dll [2010-02-23 12:00:41 | 000,205,824 | ---- | C] () -- C:\Windows\System32\pmtf1.dll [2010-02-23 12:00:41 | 000,204,288 | ---- | C] () -- C:\Windows\System32\pmtf3.dll [2010-02-23 12:00:41 | 000,167,936 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib3.dll [2010-02-23 12:00:41 | 000,053,248 | ---- | C] () -- C:\Windows\System32\pmexr.dll [2010-02-23 12:00:41 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmbm.dll [2010-02-12 18:19:35 | 002,325,304 | ---- | C] () -- C:\Windows\System32\DK2INST.DLL [2010-02-01 16:25:59 | 000,001,376 | ---- | C] () -- C:\Windows\System32\wstcode16a.dll [2010-01-31 15:05:45 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys [2010-01-17 13:30:08 | 000,001,981 | ---- | C] () -- C:\Windows\TVEpaDrv.ini [2009-11-21 16:49:04 | 000,023,888 | ---- | C] () -- C:\Users\Paweł\AppData\Roaming\UserTile.png [2009-11-10 00:07:22 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009-11-10 00:07:22 | 000,022,328 | ---- | C] () -- C:\Users\Paweł\AppData\Roaming\PnkBstrK.sys [2009-11-10 00:07:00 | 000,000,271 | ---- | C] () -- C:\Windows\game.ini [2009-09-18 09:04:20 | 000,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2009-09-16 13:57:09 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009-09-04 12:31:33 | 000,030,720 | ---- | C] () -- C:\Users\Paweł\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-07-05 02:43:05 | 000,233,128 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys [2009-07-05 02:35:50 | 000,048,639 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009-07-05 02:35:38 | 000,048,639 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008-08-11 03:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2008-05-12 04:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008-04-17 21:06:52 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini [2008-04-07 07:00:45 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll [2006-11-02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll [2006-11-02 09:51:21 | 000,000,000 | ---- | C] () -- C:\Windows\System32\AuxiliaryDisplayClassInstaller.dll [2006-11-02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2003-01-28 00:09:20 | 000,053,248 | ---- | C] () -- C:\Windows\System32\libexpat.dll [2001-08-29 14:11:40 | 000,398,848 | R--- | C] () -- C:\Windows\System32\DK2WIN32.DLL [1996-04-03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\drivers\giveio.sys [color=#E56717]========== LOP Check ==========[/color] [2010-04-18 11:52:51 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\AnvSoft [2010-06-15 21:58:12 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\ASUSTek [2010-01-31 15:09:19 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Canneverbe Limited [2009-09-05 13:01:30 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Canneverbe_Limited [2010-06-29 15:58:06 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Canon [2009-09-18 09:07:43 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\DAEMON Tools Lite [2010-11-08 18:52:55 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\FireShot [2010-01-12 19:51:26 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\foobar2000 [2009-10-30 20:08:16 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\fretsonfire [2010-09-05 23:11:38 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Gadu-Gadu 10 [2009-09-16 22:55:31 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\GanymedeNet [2010-02-15 22:41:22 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\gtk-2.0 [2010-06-10 16:31:20 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\ipla [2010-05-08 11:16:30 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\JAlbum [2010-12-28 11:50:34 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Kadu [2010-02-13 01:40:00 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Nowe Gadu-Gadu [2009-09-05 13:18:13 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\OpenOffice.org [2009-11-21 16:49:03 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\PeerNetworking [2010-08-18 22:36:11 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\streamripper [2010-10-16 17:33:39 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Thinstall [2010-02-08 01:24:12 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\Tlen.pl [2010-08-29 19:05:48 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\uTorrent [2010-12-22 11:33:28 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\VSO [2010-08-03 15:26:49 | 000,000,000 | ---D | M] -- C:\Users\Paweł\AppData\Roaming\YoudaGames [2009-09-12 09:59:07 | 000,000,458 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job [2010-12-28 01:48:31 | 000,032,564 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 64 bytes -> C:\Users\Paweł\kawkader.mp4:TOC.WMV @Alternate Data Stream - 180 bytes -> C:\ProgramData\Temp:408F95E5 < End of report >

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-12-28 14:08:39 - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Paweł\Desktop Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 114,44 Gb Free Space | 49,14% Space Free | Partition Type: NTFS Drive D: | 221,16 Gb Total Space | 133,73 Gb Free Space | 60,47% Space Free | Partition Type: NTFS Computer Name: PAWEL-PC | User Name: Paweł | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .js [@ = JSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation) .jse [@ = JSEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation) .vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation) .vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation) .wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-1328102732-2651287775-1166834280-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- D:\Programy\Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) jsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation) jsefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation) vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation) wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation) Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [Digital Photo Professional] -- D:\Programy\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "D:\Programy\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "D:\Programy\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "D:\Programy\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{134039FB-25D3-4711-A79A-E1EB4071BF35}" = rport=137 | protocol=17 | dir=out | app=system | "{23BADA02-99E1-4191-A84D-FC177F10CB0C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{2F5DBC3D-81AE-4E61-B3B2-B370D04E283C}" = lport=139 | protocol=6 | dir=in | app=system | "{3014AA07-8561-41B0-82C9-0A422E43378C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{32957776-D1EA-4299-B21A-8556F596E621}" = lport=445 | protocol=6 | dir=in | app=system | "{3DD444CE-DC93-4668-A479-650CFCCBE423}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{428AE9F3-97DF-4201-BA66-B2E1EF0D5023}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{47C8402C-7684-4E48-A2D6-64C3D1FF69E6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{52993C6A-6A7C-41FE-9CAF-48F9780553EF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{569C6DB5-C9D6-4817-AE11-385BCFAE7408}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{59AD520B-AED0-430D-9366-011748724AAF}" = rport=445 | protocol=6 | dir=out | app=system | "{66F3E26F-43BD-4156-9E0F-46DADAA6B975}" = rport=138 | protocol=17 | dir=out | app=system | "{74394AC1-0365-4176-B40A-2749754851C5}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{99BB9A6A-136F-44FA-B43F-63CF3EDB67C1}" = lport=138 | protocol=17 | dir=in | app=system | "{9B7255A8-69DB-49E1-BF15-BBDE29C785B5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{A4BAA327-636E-42AE-B659-1F8D4E56A5F8}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{A8600233-9914-4998-BBD1-80822C7C0B67}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{CAF9F839-10F5-4449-A2F0-1E7B234F0525}" = lport=137 | protocol=17 | dir=in | app=system | "{D6242510-C07E-4FA6-A5B1-9F68985CE0D8}" = lport=2869 | protocol=6 | dir=in | app=system | "{F1A3BA38-3CBF-44D8-A9B1-20FC4D9A6650}" = rport=139 | protocol=6 | dir=out | app=system | "{F58BD8FC-97AC-460C-8D24-E6D632265E0D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{015E0A21-E892-4FD6-96EA-8064FC302CDF}" = protocol=6 | dir=in | app=d:\gry\game spy\aphex.exe | "{04431306-AA62-42FF-92A5-E478144D335F}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{0462820B-E300-4ECD-8F5B-4EC359111225}" = protocol=17 | dir=in | app=d:\programy\arcsoft\totalmedia.exe | "{07ADEB15-A6F0-46E6-9D1C-5CE1C764A800}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{10180426-6523-4EF8-90FD-413D480C2E2E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{16586089-B5D5-49F9-A823-F21B9820F30D}" = protocol=17 | dir=in | app=d:\programy\holdem indicator\holdemindicator.exe | "{18F53102-3ECC-419D-BB12-5C2AED55A742}" = protocol=6 | dir=in | app=d:\programy\holdem indicator\holdemindicator.exe | "{205EE19E-A2EA-4E0D-BAA6-35BAB7263F2B}" = protocol=6 | dir=in | app=d:\programy\torrent\utorrent.exe | "{21CF55EE-FB7B-4D29-B4A4-262D84187EEC}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{2DF9B211-CA6B-4CDE-A7CD-76E7F77AC7DB}" = protocol=6 | dir=in | app=d:\gry\bf\bfbc2updater.exe | "{372757EA-91DA-4433-AEE6-29B60D258503}" = protocol=6 | dir=in | app=d:\programy\arcsoft\totalmedia.exe | "{3A71FA77-9829-4F9B-8716-41ACCA7B9D6B}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{409EC2F7-6342-47E0-A2D1-7EC7F10CBD02}" = protocol=17 | dir=in | app=d:\gry\game spy\aphex.exe | "{4912E4CF-FF7F-4FFB-A354-1B1AE0650466}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{4C1A811D-EEBD-4990-BCF8-52E726C1DE8C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{53A2B9F7-B25B-47CD-AADD-554A136F4C6C}" = protocol=17 | dir=in | app=d:\programy\kadu\kadu.exe | "{56A41E02-B93A-472D-AC7B-C7FD8158487A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{573C7B15-5D06-467B-8B8A-24EBF6D318E9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{64998D72-4738-46A3-A7CD-A5910B3F1186}" = protocol=17 | dir=in | app=d:\gry\f1\f1_2010_game.exe | "{676CA863-D1A8-4A0A-85D6-9D45DE0D0C1D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{67FB6A08-C8A1-454F-B110-01A76F95D793}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{85FB054B-7F51-42AF-828A-3A5CFF734074}" = protocol=6 | dir=in | app=d:\programy\kadu\kadu.exe | "{88786F10-9843-4D7D-8BF9-FA6297B36185}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{90C95DA9-DE4D-4759-A169-65979D4DEB12}" = dir=in | app=c:\program files\asustek\asusdvd 8\powerdvd8.exe | "{B156B08D-4EF0-4A07-A0EF-0045173C1943}" = protocol=6 | dir=in | app=d:\gry\gta4\grand theft auto iv\launchgtaiv.exe | "{B3DD22BF-D0FA-43DB-A5C6-3B6556BCCA39}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{B8EADA71-016F-4382-93D8-905DBC779D2E}" = protocol=17 | dir=in | app=d:\gry\gta4\rockstar games social club\rgsclauncher.exe | "{BF82E294-B56E-48DD-A0FC-401828197E92}" = protocol=6 | dir=in | app=d:\gry\f1\f1_2010_game.exe | "{C07899C2-1580-484C-91FB-3F5F62FB9E32}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{C1975E94-55F0-46A2-B14B-EE18FC4D055D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{C4DB1476-94E8-4A41-A943-1F223EF71B71}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{D995A8B1-13C3-46B3-BC22-28C648664E22}" = protocol=17 | dir=in | app=d:\gry\cod4\iw3mp.exe | "{DA6BE812-CC64-468D-AB91-CE735F92A738}" = protocol=17 | dir=in | app=d:\programy\torrent\utorrent.exe | "{DFF80809-C065-407D-A386-F3A77176AD75}" = protocol=6 | dir=in | app=d:\gry\gta4\rockstar games social club\rgsclauncher.exe | "{E4BDA437-91E0-4D53-96E5-DBC2B30200BE}" = protocol=17 | dir=in | app=d:\gry\bf\bfbc2updater.exe | "{E5B18823-7821-4AB6-BD5C-296B7B0CF6C1}" = protocol=6 | dir=in | app=d:\gry\cod4\iw3mp.exe | "{FB33FD40-DA3C-4741-827E-2DCE0DB0CFF4}" = protocol=17 | dir=in | app=d:\gry\gta4\grand theft auto iv\launchgtaiv.exe | "TCP Query User{0E678E30-8C50-4501-97F5-E49AF0735F7C}C:\users\paweł\desktop\b18\volley.exe" = protocol=6 | dir=in | app=c:\users\paweł\desktop\b18\volley.exe | "TCP Query User{0F400364-B711-45E7-9081-2E57417A7EC7}D:\programy\firefox\firefox.exe" = protocol=6 | dir=in | app=d:\programy\firefox\firefox.exe | "TCP Query User{11ADD70C-E6EE-4CE6-B5AF-E52A8E62751F}C:\users\paweł\appdata\local\temp\rarsfx3\flash.exe" = protocol=6 | dir=in | app=c:\users\paweł\appdata\local\temp\rarsfx3\flash.exe | "TCP Query User{26DD92A7-0D1E-49DB-89AC-E72D14B3B392}C:\users\paweł\desktop\snooker\wcs2003.exe" = protocol=6 | dir=in | app=c:\users\paweł\desktop\snooker\wcs2003.exe | "TCP Query User{3E40742E-7FEC-4275-B24E-E969926A502B}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | "TCP Query User{444A1957-454F-444D-853E-E7965FB4738E}D:\gry\cs\hl.exe" = protocol=6 | dir=in | app=d:\gry\cs\hl.exe | "TCP Query User{463DA344-F283-461E-BCA0-67105456C1DC}C:\program files\microsoft office\office12\groove.exe" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "TCP Query User{48C42547-E247-413A-B62C-83CEF7EE37AA}D:\gry\hl\hl2\hl2.exe" = protocol=6 | dir=in | app=d:\gry\hl\hl2\hl2.exe | "TCP Query User{56DBED1C-0143-451B-8BF6-9FC3A42DAA15}D:\gry\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=d:\gry\wolfenstein - enemy territory\et.exe | "TCP Query User{67A3D1D9-4474-4D9C-9DC4-A3FC09B4F030}D:\programy\tlen.pl\tlen.exe" = protocol=6 | dir=in | app=d:\programy\tlen.pl\tlen.exe | "TCP Query User{689F8983-29CE-494B-B2CC-B59B0E27F33A}D:\gry\f1\f1_2010_game.exe" = protocol=6 | dir=in | app=d:\gry\f1\f1_2010_game.exe | "TCP Query User{6E0199BC-E136-4E55-92EA-526A5E3E4D38}D:\gry\mohaa\mohaa.exe" = protocol=6 | dir=in | app=d:\gry\mohaa\mohaa.exe | "TCP Query User{700182B8-30F0-41BC-B734-0AB37A612351}C:\program files\gadu-gadu 10\gg.exe" = protocol=6 | dir=in | app=c:\program files\gadu-gadu 10\gg.exe | "TCP Query User{8441A441-CE07-4023-BD29-19470BE9EC72}D:\programy\bearshare\bearshare.exe" = protocol=6 | dir=in | app=d:\programy\bearshare\bearshare.exe | "TCP Query User{905E30E3-7B72-4A30-8014-9FC3B23FF03B}D:\gry\hl\hl2\hl2.exe" = protocol=6 | dir=in | app=d:\gry\hl\hl2\hl2.exe | "TCP Query User{A2B41FFA-FA72-4E0B-809C-4CA797C919FB}D:\gry\mohaa\moh_spearhead.exe" = protocol=6 | dir=in | app=d:\gry\mohaa\moh_spearhead.exe | "TCP Query User{AE1AFF95-EE76-4283-BDA3-1822C0313919}C:\program files\gadu-gadu 10\gg.exe" = protocol=6 | dir=in | app=c:\program files\gadu-gadu 10\gg.exe | "TCP Query User{B648F759-27EC-4734-96E1-E82235EDAC60}D:\programy\nowe gadu-gadu\gg.exe" = protocol=6 | dir=in | app=d:\programy\nowe gadu-gadu\gg.exe | "TCP Query User{B68780A5-C822-4D2F-95F3-2330E176C9A9}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | "TCP Query User{C2CCDEA6-EA09-41B0-8C19-E8F9E58D3199}D:\programy\kadu\kadu.exe" = protocol=6 | dir=in | app=d:\programy\kadu\kadu.exe | "TCP Query User{D8294CA4-4AB4-40BF-8784-B70CC456E49C}D:\programy\nowe gadu-gadu\gg.exe" = protocol=6 | dir=in | app=d:\programy\nowe gadu-gadu\gg.exe | "TCP Query User{D865A8C5-6949-4EC5-BC48-80D29C5862CA}D:\programy\firefox\firefox.exe" = protocol=6 | dir=in | app=d:\programy\firefox\firefox.exe | "TCP Query User{DA3A679E-EF8C-4DD1-8E4E-ACC388449B6F}D:\gry\cs\hl.exe" = protocol=6 | dir=in | app=d:\gry\cs\hl.exe | "TCP Query User{E55D4B15-542C-472E-87E4-F000CA57DECE}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "TCP Query User{EDAD09CB-726D-41E3-98D3-DAFD5F9AB0C9}D:\gry\gta4\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=d:\gry\gta4\grand theft auto iv\gtaiv.exe | "TCP Query User{F6460BC8-7700-48AC-AA6F-F64C8AF412A1}D:\programy\tlen.pl\tlen.exe" = protocol=6 | dir=in | app=d:\programy\tlen.pl\tlen.exe | "TCP Query User{FCD0E4E8-B1D6-4439-A0A5-E540B64EE5AA}D:\gry\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=d:\gry\wolfenstein - enemy territory\et.exe | "TCP Query User{FDC255DF-7256-4D42-A3DF-0B5CFED464DE}C:\program files\konnekt\konnekt.exe" = protocol=6 | dir=in | app=c:\program files\konnekt\konnekt.exe | "UDP Query User{00FAAB78-2B4A-4105-BBE2-DC22735E5CE2}D:\gry\cs\hl.exe" = protocol=17 | dir=in | app=d:\gry\cs\hl.exe | "UDP Query User{07911C6E-B4EE-4B20-86F4-C65DA21D3799}D:\gry\mohaa\moh_spearhead.exe" = protocol=17 | dir=in | app=d:\gry\mohaa\moh_spearhead.exe | "UDP Query User{12803123-2F91-407D-BB28-9B98859ED5E8}D:\programy\bearshare\bearshare.exe" = protocol=17 | dir=in | app=d:\programy\bearshare\bearshare.exe | "UDP Query User{1E27487E-1CCC-46C9-A267-2975FD15108C}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | "UDP Query User{21086DC8-4633-4932-A4B1-FBAB08F3BB2D}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "UDP Query User{2431FCD1-DEAB-407F-A214-52D0C2983855}D:\programy\firefox\firefox.exe" = protocol=17 | dir=in | app=d:\programy\firefox\firefox.exe | "UDP Query User{38A2E7F8-53CA-4F21-BE7C-91E3FFAA66AD}D:\gry\hl\hl2\hl2.exe" = protocol=17 | dir=in | app=d:\gry\hl\hl2\hl2.exe | "UDP Query User{3B5F5EAB-8E4E-4FE0-AB14-3CF153A3C37A}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | "UDP Query User{3CA9DA98-9125-44AA-A3EE-138507388D6E}C:\program files\gadu-gadu 10\gg.exe" = protocol=17 | dir=in | app=c:\program files\gadu-gadu 10\gg.exe | "UDP Query User{40866ACF-D44D-4175-B26A-7236B1447858}D:\programy\nowe gadu-gadu\gg.exe" = protocol=17 | dir=in | app=d:\programy\nowe gadu-gadu\gg.exe | "UDP Query User{4742A6D5-0BBD-4F2C-BF60-E4DFC9938A98}D:\gry\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=d:\gry\wolfenstein - enemy territory\et.exe | "UDP Query User{4803616D-A0F4-439C-960E-1F7A73422EEA}D:\gry\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=d:\gry\wolfenstein - enemy territory\et.exe | "UDP Query User{54406978-4A0E-45A0-9479-BED1E61C80C4}D:\gry\cs\hl.exe" = protocol=17 | dir=in | app=d:\gry\cs\hl.exe | "UDP Query User{5764199D-254A-44F1-9AB8-710D80562C1F}D:\gry\gta4\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=d:\gry\gta4\grand theft auto iv\gtaiv.exe | "UDP Query User{7171543E-EDCF-4A15-8B29-0562258E4293}D:\gry\hl\hl2\hl2.exe" = protocol=17 | dir=in | app=d:\gry\hl\hl2\hl2.exe | "UDP Query User{73633FC4-06AE-46FD-ACE6-8B8F322EA545}D:\programy\tlen.pl\tlen.exe" = protocol=17 | dir=in | app=d:\programy\tlen.pl\tlen.exe | "UDP Query User{772CF9F3-28F4-49F4-BB91-B944F6FAB70E}D:\gry\f1\f1_2010_game.exe" = protocol=17 | dir=in | app=d:\gry\f1\f1_2010_game.exe | "UDP Query User{82B86D32-7379-4AE5-9520-2EE670863B90}D:\programy\nowe gadu-gadu\gg.exe" = protocol=17 | dir=in | app=d:\programy\nowe gadu-gadu\gg.exe | "UDP Query User{8E393755-C008-413A-9F20-26FA669DC4DE}C:\program files\gadu-gadu 10\gg.exe" = protocol=17 | dir=in | app=c:\program files\gadu-gadu 10\gg.exe | "UDP Query User{9B49BDFB-7B72-43FA-AE33-DFA4760905AC}D:\programy\firefox\firefox.exe" = protocol=17 | dir=in | app=d:\programy\firefox\firefox.exe | "UDP Query User{AC75F2DE-E362-4C4E-8E57-6A771715197D}C:\program files\konnekt\konnekt.exe" = protocol=17 | dir=in | app=c:\program files\konnekt\konnekt.exe | "UDP Query User{B1AA5A65-120D-45F4-B1D1-7D780009F0AF}D:\programy\tlen.pl\tlen.exe" = protocol=17 | dir=in | app=d:\programy\tlen.pl\tlen.exe | "UDP Query User{C7C4F0DF-ED5C-4A1D-83D4-1974DF4B1ADA}D:\programy\kadu\kadu.exe" = protocol=17 | dir=in | app=d:\programy\kadu\kadu.exe | "UDP Query User{DBBCF3F4-16A9-4291-8EEB-14C5DE27D7DE}D:\gry\mohaa\mohaa.exe" = protocol=17 | dir=in | app=d:\gry\mohaa\mohaa.exe | "UDP Query User{E3A1C574-98C6-4336-AD96-380EBEA08F9A}C:\users\paweł\desktop\b18\volley.exe" = protocol=17 | dir=in | app=c:\users\paweł\desktop\b18\volley.exe | "UDP Query User{F1704996-5DE6-4951-9093-7B0C6A32EE67}C:\program files\microsoft office\office12\groove.exe" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "UDP Query User{F9DAF5BE-EF63-464E-8BD6-8B525E137A8E}C:\users\paweł\desktop\snooker\wcs2003.exe" = protocol=17 | dir=in | app=c:\users\paweł\desktop\snooker\wcs2003.exe | "UDP Query User{FE11DFC9-6735-465B-97A4-E9384F0120D0}C:\users\paweł\appdata\local\temp\rarsfx3\flash.exe" = protocol=17 | dir=in | app=c:\users\paweł\appdata\local\temp\rarsfx3\flash.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier "{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant "{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club "{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology "{0B63BF75-9F0A-4E93-A69D-BDCC6A26C4B1}" = Podstawowe programy Windows Live "{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1 "{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Narzędzie do przekazywania usługi Windows Live "{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3 "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{268CF0B8-CA38-4E20-9E99-514A07F7C1F1}" = ArcSoft TotalMedia 3.5 "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18 "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program "{2A5FBE73-76DA-4A31-BD86-1B0E01DC33F8}" = Windows Live Messenger "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = ASUSTek ASUSDVD 8 "{2F8BE683-EF69-4D18-9974-DB0C1832A516}" = ICM Trainer Light "{321320E1-0E5A-36CB-9E52-F3B201B8C4D4}" = Microsoft .NET Framework 4 Client Profile PLK Language Pack "{3856DA80-86D2-4EBF-B33E-9F2C54BC9AC4}" = Bezpieczeństwo rodzinne usługi Windows Live "{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2 "{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2 "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 2.2.2.1 "{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{40CC0CC6-C1BA-476D-98CF-5430DA439B4F}" = Galeria fotografii usługi Windows Live "{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010 "{44C8ECE8-A840-44E5-BB02-CAE035DEA248}_is1" = ChrisTV PVR Professional 5.50 "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update "{4B6B024F-F6D4-4A7B-8ADA-F9F8370320CC}" = SRS Premium Sound "{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater "{51C91B84-7B46-4FE7-8999-8228CFA75F89}" = Intel(R) Integrated Performance Primitives RTI 4.0 "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features "{55D8440D-6577-46DC-9571-8E5E3046AC11}" = MyVision EM_USB Device Utilities "{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3 "{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{675C161A-889A-4D35-8361-EA74BADCE0E6}" = Half-Life(R) 2 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey "{7CE3498C-866B-427E-8273-9CA67B24BA01}" = Thief: Deadly Shadows "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime "{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0015-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-001F-0415-0000-0000000FF1CE}_ENTERPRISE_{E9EA2604-8AC9-47D2-8F4B-6BF60787A357}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-0044-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}_ENTERPRISE_{D45F91DE-F0FC-4D5F-9A0C-FDE5B251AAC6}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}_ENTERPRISE_{79EB535E-76E4-4356-8146-A24EE55AB69D}" = Microsoft Office 2007 Service Pack 2 (SP2) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6 "{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid "{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame "{9E35B051-C7EE-47CB-BA43-9A7FFD4E61DE}" = OpenOffice.org 3.1 "{9EFDFBA8-9174-3C61-8645-28376C5CA994}" = Microsoft .NET Framework 3.5 Language Pack SP1 - plk "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1" = VDownloader 2.7.333 "{A9FEB6D7-9C52-49FC-B956-7AB275B78890}" = ASUS FancyStart "{AC76BA86-7AD7-1045-7B44-A93000000001}" = Adobe Reader 9.3 - Polish "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver "{BCDB856C-D247-4DEE-9132-89C02F4D6B8C}_is1" = Sothink SWF Decompiler "{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun "{C08F4C18-EBC5-47F4-A760-A2DF3C39CA20}" = Windows Live Movie Maker Beta "{C3335EFB-008F-44DB-A87A-9EC8EE53D045}" = Windows Live Sync "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media "{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.4 Game "{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service "{D468367C-1278-4BD1-8FCD-85A0CD3D185E}" = Jalbum "{D65ACCE0-B9B4-4532-9FE9-92915A9223B4}" = Nokia Firmware RM-217 "{DA41F9E9-B878-467F-95E7-27E4D1943533}" = Multimedia Card Reader "{DB4690C5-9015-401D-A96C-A49909B7C372}" = Poczta usługi Windows Live "{DD49053A-0140-44EF-AE75-C4BC1FDB8286}" = Windows Live Writer "{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash "{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update "{EB5E9BF4-8D42-43F7-9178-99D9C7D2EF46}" = Kadu 0.6.5.4 "{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera "{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X "{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform "{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "AP Tuner 3.08" = AP Tuner 3.08 "Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver "Audacity_is1" = Audacity 1.2.6 "avast5" = avast! Free Antivirus "Budzik_is1" = Budzik 1.04 "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "DPP" = Canon Utilities Digital Photo Professional 3.4 "Dziobas Rar Player_is1" = Dziobas Rar Player 0.009.38 "Elantech" = ETDWare PS/2-x86 7.0.5.2 WHQL "ENTERPRISE" = Microsoft Office Enterprise 2007 "EOS USB WIA Driver" = EOS USB WIA Driver "EOS Utility" = Canon Utilities EOS Utility "FLV Player" = FLV Player 2.0 (build 25) "foobar2000" = foobar2000 v1.0 "FoxyTunesForFirefox" = FoxyTunes for Firefox "Free Video Converter_is1" = Free Video Converter V 1.0 "Frets on Fire" = Frets On Fire "Gadu-Gadu 10" = Gadu-Gadu 10 "GameDesire-Poker" = GameDesire-Poker "GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker "GameSpy Arcade" = GameSpy Arcade "GFWL_{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010 "Image Signature_is1" = Image Signature 1.5.1 "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = ASUSTek ASUSDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{7CE3498C-866B-427E-8273-9CA67B24BA01}" = Thief: Deadly Shadows "InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun "InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X "ipla" = ipla 2.1.3 "Kane and Lynch 2- Dog Days_is1" = Kane and Lynch 2- Dog Days "Mafia II DLC Jimmy's Vendetta_is1" = Mafia II DLC Jimmy's Vendetta "Mafia II_is1" = Mafia II "Mafia_is1" = Mafia "Mark IT Now!" = Mark IT Now! "Microsoft .NET Framework 3.5 Language Pack SP1 - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Client Profile "Mozilla Firefox (3.5.2)" = Mozilla Firefox (3.5.2) "Mozilla Firefox (4.0b1)" = Mozilla Firefox (4.0b1) "NapiProjekt_is1" = NapiProjekt 1.0.6.5 "Native Instruments Traktor DJ Studio 3" = Native Instruments Traktor DJ Studio 3 "NVIDIA Drivers" = NVIDIA Drivers "OpenAL" = OpenAL "Original Data Security Tools" = Canon Utilities Original Data Security Tools "PartyPoker" = PartyPoker "Photomatix Pro_is1" = Photomatix Pro version 2.5 "PhotoStitch" = Canon Utilities PhotoStitch "Picasa 3" = Picasa 3 "Picture Style Editor" = Canon Utilities Picture Style Editor "PokerStars" = PokerStars "RealAlt_is1" = Real Alternative 1.9.0 Lite "SnadBoy's Revelation v2" = SnadBoy's Revelation v2 "Streamripper" = Streamripper (Remove only) "SubEdit - Vista WMP Patch_is1" = SubEdit - Vista WMP Patch "SubEdit-Player_is1" = SubEdit-Player "TC PowerPack" = TC PowerPack 1.7 "Tlen.pl" = Tlen.pl "Tunatic" = Tunatic "TVEpaDrv" = MyVision PVR-TV BDA Drivers "USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam "USB Mass Storage Filter Driver" = Multimedia Card Reader "uTorrent" = µTorrent "Winamp" = Winamp "WinGimp-2.0_is1" = GIMP 2.6.7 "WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.43-9C "WinLiveSuite_Wave3" = Podstawowe programy Windows Live "WinRAR archiver" = Archiwizator WinRAR "Zajączek 4.1" = Zajączek 4.1 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1328102732-2651287775-1166834280-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13) [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2009-11-25 05:58:16 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2009-11-25 05:58:16 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2009-11-25 05:58:16 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2009-11-25 05:58:16 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2009-11-25 05:58:17 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2009-11-25 05:58:17 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2010-05-27 13:48:03 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2010-05-27 13:48:06 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2010-06-25 06:08:23 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = Error - 2010-10-05 15:27:54 | Computer Name = Paweł-PC | Source = avast! | ID = 33554522 Description = [color=#E56717]========== Last 10 Event Log Errors ==========[/color] Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report >

**Posty:** 18165 · przez **wojtas** 28 Gru 2010, 18:55

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe -- (Norton Internet Security)
DRV - File not found [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX)
DRV - File not found [File_System | System | Stopped] -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS -- (NAVENG)
O4 - HKU\S-1-5-21-1328102732-2651287775-1166834280-1000..\Run: [AASecuUFD] File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O33 - MountPoints2\{09c58eed-febf-11de-8d1d-0026185fd705}\Shell - "" = AutoRun
O33 - MountPoints2\{09c58eed-febf-11de-8d1d-0026185fd705}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{71d41ab4-c0b6-11de-ba17-0026185fd705}\Shell\AutoRun\command - "" = 6p2dxv.bat
O33 - MountPoints2\{71d41ab4-c0b6-11de-ba17-0026185fd705}\Shell\open\Command - "" = 6p2dxv.bat
O33 - MountPoints2\{e2ee17cb-695f-11df-9be6-0026185fd705}\Shell - "" = AutoRun
O33 - MountPoints2\{e2ee17cb-695f-11df-9be6-0026185fd705}\Shell\AutoRun\command - "" = F:\USBNB.exe -- File not found
O33 - MountPoints2\{fbda2fe1-a429-11de-9893-0026185fd705}\Shell - "" = AutoRun
O33 - MountPoints2\{fbda2fe1-a429-11de-9893-0026185fd705}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
@Alternate Data Stream - 64 bytes -> C:\Users\Paweł\kawkader.mp4:TOC.WMV
@Alternate Data Stream - 180 bytes -> C:\ProgramData\Temp:408F95E5

:Files
C:\Users\Paweł\AppData\Local\Temp*.html
:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). Zamiast Gmera spróbuj zamiennie wykonać log z Root Repeal jeśli system masz 32 bit, napisz czy dziennik zdarzeń Ci działa

**Posty:** 945 · przez **qrminator** 28 Gru 2010, 22:33

Załadowałem to do otl'a i po wykonaniu tych poleceń zawiesił się. 2x próbowałem, z tym samym skutkiem. Niby dochodzi do końca ale potem przestaje odpowiadać.
Dziennik zdarzeń działa.
W tym root repeal to z której zakładki mam wrzucić loga?

**Posty:** 18165 · przez **wojtas** 29 Gru 2010, 15:53

sekcja report opcja skan, zaznaczasz wszystkie ptaszki i dysk C i jedziesz

**Posty:** 945 · przez **qrminator** 29 Gru 2010, 16:13

Kod: Zaznacz wszystko: ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/12/29 14:48 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP1 ================================================== Drivers ------------------- Name: dump_diskdump.sys Image Path: C:\Windows\System32\Drivers\dump_diskdump.sys Address: 0x909CE000 Size: 40960 File Visible: No Signed: - Status: - Name: dump_nvstor32.sys Image Path: C:\Windows\System32\Drivers\dump_nvstor32.sys Address: 0x909D8000 Size: 155648 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0xA33A5000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: Volume C:\ Status: MBR Rootkit Detected! Path: Volume C:\, Sector 10 Status: Sector mismatch Path: C:\ADSM_PData_0150 Status: Invisible to the Windows API! Path: C:\Documents and Settings Status: Locked to the Windows API! Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: \\?\C:\ADSM_PData_0150\* Status: Could not enumerate files with the Windows API (0x00000006)! Path: C:\ADSM_PData_0150\DB Status: Invisible to the Windows API! Path: C:\ADSM_PData_0150\DragWait.exe Status: Invisible to the Windows API! Path: C:\ADSM_PData_0150\_avt Status: Invisible to the Windows API! Path: C:\ProgramData\Application Data Status: Locked to the Windows API! Path: C:\ProgramData\Start Menu Status: Locked to the Windows API! Path: C:\ProgramData\Templates Status: Locked to the Windows API! Path: C:\ProgramData\Desktop Status: Locked to the Windows API! Path: C:\ProgramData\Documents Status: Locked to the Windows API! Path: C:\ProgramData\Favorites Status: Locked to the Windows API! Path: C:\System Volume Information\{66721d50-0d2b-11e0-8828-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7596b25a-08f3-11e0-b4f9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797b5-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797bb-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797c1-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797c7-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797cd-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797d3-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797d9-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797df-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7f4797e5-0f3b-11e0-b06c-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{b82de44b-09c1-11e0-819b-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{be6a08a5-0c22-11e0-9f5d-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{d321eba8-126f-11e0-87c2-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{d321ebb2-126f-11e0-87c2-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{f0d6e26b-0511-11e0-b1dd-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{f29f9e31-0cdc-11e0-8ff9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{1c12bcaa-0a86-11e0-bf11-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{7FC30~1 Status: Locked to the Windows API! Path: C:\System Volume Information\{9902f9ce-0f61-11e0-aad9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{9902f9d4-0f61-11e0-aad9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{9902f9da-0f61-11e0-aad9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{9902f9f7-0f61-11e0-aad9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{9d10cc2c-075c-11e0-a0c4-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{a1cd3bac-044f-11e0-8ca9-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{ab70f9cb-0225-11e0-a247-0026185fd705}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\Users\All Users Status: Locked to the Windows API! Path: C:\Users\Default User Status: Locked to the Windows API! Path: C:\Users\Default\Application Data Status: Locked to the Windows API! Path: C:\Users\Default\Cookies Status: Locked to the Windows API! Path: C:\Users\Default\Local Settings Status: Locked to the Windows API! Path: C:\Users\Default\My Documents Status: Locked to the Windows API! Path: C:\Users\Default\NetHood Status: Locked to the Windows API! Path: C:\Users\Default\PrintHood Status: Locked to the Windows API! Path: C:\Users\Default\Recent Status: Locked to the Windows API! Path: C:\Users\Default\SendTo Status: Locked to the Windows API! Path: C:\Users\Default\Start Menu Status: Locked to the Windows API! Path: C:\Users\Default\Templates Status: Locked to the Windows API! Path: C:\Users\Default\Documents\My Music Status: Locked to the Windows API! Path: C:\Users\Default\Documents\My Pictures Status: Locked to the Windows API! Path: C:\Users\Default\Documents\My Videos Status: Locked to the Windows API! Path: C:\Users\Public\Documents\My Music Status: Locked to the Windows API! Path: C:\Users\Public\Documents\My Pictures Status: Locked to the Windows API! Path: C:\Users\Public\Documents\My Videos Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_81c25f21d3d46d84.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_7658964504b9f3b6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_8e053e8c6967ba9d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_54c11df268b7c6d9.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.30729.4148_none_0e9108e3b72e14d4.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.debugcrt_1fc8b3b9a1e18e3b_9.0.30729.1_none_bb1f6aa1308c35eb.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_43efccf17831d131.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f0efb442f8a0f46c.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_cbf21254470d8752.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9818.0_none_b7e811947b297f6d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.4.1.microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_8b7b15c031cda6db.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_60a5df56e60dc5df.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.debugcrt_1fc8b3b9a1e18e3b_9.0.30729.1_none_61305e07e4f1bc01.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_b7e610287b2b4ea5.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_a6dea5dc0ea08098.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_45e008191e507087.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.debugmfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_5c94f2bbe7d4aaf6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_818f59bf601aa775.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.flightsimulator.simconnect_67c7c14424d61b5b_10.0.60905.0_none_dd92b94d8a196297.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_516e2e610f48bda6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_58843c41d2730d3f.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_e29d1181971ae11e.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_8550c6b5d18a9128.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_none_abac38a907ee8801.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8dd7dea5d5a7a18a.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_7dd1e0ebd6590e0b.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4db266e67dd280ef.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.debugmfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_bfff6c932d60651e.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_58b19c2866332652.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_d6c3e7af9bae13a2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f47e1bd6f6571810.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.4053_none_3b0e32bdc9afe437.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8a14c0566bec5b24.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_49ef489714173a89.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.30729.4148_none_80b7c8a91e9dd16a.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_0e9c2a8d74fd3ce6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4973eb1d754a9dc9.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.4053_none_6b86c0e9b0196766.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.1.0.0_none_6c030d6fdc86522c.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_03ca5532205cb096.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_none_7b33aa7d218504d2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f0bcaee084e72e5d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_ecff360cfb2594f3.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_a6e4a7980e9b18a2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\bd83dce340498e7c363093c2fc74dfb58e1ec17770453905172c7471fadd9333.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\dd72f7ab2def5f75f58d01b24643b308750c38685daaed50bcddf61c18460dee.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\935df4549e21123a2efb986a707f54475380a037519679510e4b4dfc4bdb5767.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\88b03fe13d2710ad787d5d96cd0e5cbeda3a61c2a0a2bdc0c0984a48365242e2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_e2c358ab062e054b\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_cbfb6f4f1fd04a3e\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_e29e3d61068011ec\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_cbd2adfd20258aff\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_policy.1.2.microsof..op.security.azroles_31bf3856ad364e35_6.0.6000.16386_none_ea83414c2e75b887\Microsoft.Interop.Security.AzRoles.config Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.16720_none_ea4958dde0dcb61b\_DATAP~1.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.16720_none_ea4958dde0dcb61b\_DATAP~2.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.20883_none_d3816f81fa7efb0e\_DATAP~1.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.20883_none_d3816f81fa7efb0e\_DATAP~2.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.18111_none_ea243d93e12ec2bc\_DATAP~1.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.18111_none_ea243d93e12ec2bc\_DATAP~2.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.22230_none_d358ae2ffad43bcf\_DATAP~1.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.22230_none_d358ae2ffad43bcf\_DATAP~2.H Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6000.16720_none_879a188098bde787\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6000.20883_none_70d22f24b2602c7a\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6001.18111_none_8774fd36990ff428\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6001.22230_none_70a96dd2b2b56d3b\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-config_files_.._gacutil_exe_config_31bf3856ad364e35_6.0.6000.16720_none_9b01a5fdd9371aff\GACUTI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-config_files_.._gacutil_exe_config_31bf3856ad364e35_6.0.6000.20883_none_9b4d641ef282ae74\GACUTI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-config_files_.._gacutil_exe_config_31bf3856ad364e35_6.0.6001.18111_none_9cf3b4d9d654a956\GACUTI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-config_files_.._gacutil_exe_config_31bf3856ad364e35_6.0.6001.22230_none_9d66b182ef8367ab\GACUTI~1.CON Status: Locked to the Windows API! Path: C:\Windows\inf\.NET CLR Data\_DATAP~1.H Status: Locked to the Windows API! Path: C:\Windows\inf\.NET Data Provider for SqlServer\_DATAP~2.H Status: Locked to the Windows API! Path: C:\Users\Default\AppData\Local\Application Data Status: Locked to the Windows API! Path: C:\Users\Default\AppData\Local\History Status: Locked to the Windows API! Path: C:\Users\Default\AppData\Local\Temporary Internet Files Status: Locked to the Windows API! Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\SYSTEM~1.DLL Status: Locked to the Windows API! Path: c:\windows\system32\wdi\logfiles\wdicontextlog.etl.001 Status: Allocation size mismatch (API: 1572864, Raw: 1310720) Path: C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.config Status: Locked to the Windows API! Path: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\SYSTEM~1.DLL Status: Locked to the Windows API! Path: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Status: Locked to the Windows API! Path: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Status: Locked to the Windows API! Path: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Status: Locked to the Windows API! Path: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Status: Locked to the Windows API! Path: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl Status: Locked to the Windows API! Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-ChannelInfoService.asmx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-ChannelInfoService.aspx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-crossdomain-1.xml Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-crossdomain.xml Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-flashmenugenerator.aspx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-PlaylistInfoService-1.asmx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-PlaylistInfoService-2.asmx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-PlaylistInfoService.asmx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-PlaylistInfoService.aspx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-SiteInfoService-1.asmx Status: Visible to the Windows API, but not on disk. Path: C:\Users\Paweł\AppData\Local\Temp\plugtmp-68\plugin-SiteInfoService.asmx Status: Visible to the Windows API, but not on disk. Processes ------------------- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1132 Status: Locked to the Windows API! ==EOF==

**Posty:** 18165 · przez **wojtas** 29 Gru 2010, 16:19

tylko widzę że nie usunęłeś:

DRV - [2009-09-18 09:04:20 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

poczytaj programy emulujące napędy dlatego Gmer nie działa. więc usuń i jeszcze raz zrób

**Posty:** 945 · przez **qrminator** 29 Gru 2010, 16:30

wojtas napisał(a):tylko widzę że nie usunęłeś:

usunąłem, wczoraj, zanim odpaliłem gmera

usunąłem po skanie otl'em dlatego może być w logu z otla, bo nie było napisane, że powoduje konflikt, dopiero przy gmerze była taka informacja.

Path: Volume C:\
Status: MBR Rootkit Detected!
coś takiego zauważyłem w tym logu ostatnim..

**Posty:** 18165 · przez **wojtas** 29 Gru 2010, 19:54

pokaż raport z MBRCheck

http://www.fixitpc.pl/topic/8-dezynfekcja-zbior-narzedzi-usuwajacych/page__p__6557&#entry6557

zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )

**Posty:** 945 · przez **qrminator** 29 Gru 2010, 20:51

zrobiłem jak było napisane o tym mbrcheck'u i... system w ogóle nie startuje :lipa:

teraz chociaż chciałbym uniknąć reinstalacji systemu.. jak wkładałem płytę recovery to mnie postraszyli utratą danych z dysku więc nie przywracałem systemu. Potrzebuję naprawić w jakiś sposób ten mbr.
Wrzuciłem płytkę instalacyjną, odpaliłem naprawianie start-upu. Teraz dla odmiany nie miga kreska tylko mam info Error loading operating system..

**Posty:** 18165 · przez **wojtas** 30 Gru 2010, 00:42

zobacz tu:

http://support.microsoft.com/kb/927392/en-us

**Posty:** 945 · przez **qrminator** 30 Gru 2010, 01:38

gdybym mógł wejść na c: to mógłbym to zastosować.
płyta recovery widzi dysk jako niepodzielony RAW
naprawa-mbr-vt123994.html

piszemy w tamtym temacie

Kto jest na forum