Olhrwef.exe

[qrminator]

Witam,
avast wyrzucił mi komunikat o jakimś wirusie w katalogu windowsa.. usunąłem go, potem podczas skanu przy rozruchu znalazł coś jeszcze w drivers.. teraz skanując sobie hijackthisem znalazłem jeszcze coś takiego: C:\WINDOWS\system32\olhrwef.exe.

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Paweł at 2009-06-21 13:49:05
Microsoft Windows XP Professional Dodatek Service Pack 2
System drive C: has 394 MB (4%) free of 10 GB
Total RAM: 1023 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:49:11, on 2009-06-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Programy\Tlen\Tlen.pl\tlen.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programy\DAEMON Tools Lite\daemon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\Programy\tclock\tclock.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Programy\firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Paweł\Pulpit\RSIT.exe
C:\Program Files\trend micro\Paweł.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe
O4 - HKCU\..\Run: [Komunikator] D:\Programy\Tlen\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Skrót do tclock.lnk = D:\Programy\tclock\tclock.exe
O4 - Startup: Speedtouch Connection.lnk = C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B624C2D-EB3C-452C-A373-845B4E493184}: NameServer = 217.8.168.244 157.25.5.18
O17 - HKLM\System\CS2\Services\Tcpip\..\{4B624C2D-EB3C-452C-A373-845B4E493184}: NameServer = 217.8.168.244 157.25.5.18
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 4529 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-12 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-12 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"=C:\WINDOWS\system32\atiptaxx.exe [2002-07-25 290816]
"SpeedTouch USB Diagnostics"=C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-03-23 888832]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-04-12 148888]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-12-22 77824]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"=D:\Programy\Tlen\Tlen.pl\tlen.exe [2008-11-28 5837800]
"DAEMON Tools Lite"=D:\Programy\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"cdoosoft"=C:\WINDOWS\system32\olhrwef.exe [2009-06-20 105283]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-06 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HEXelon MAX]
C:\Documents and Settings\Paweł\Pulpit\HEXelonMAX_pack\HEXelonMAX6\hexelon.exe /auto []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [2001-09-12 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]
C:\Program Files\ScannerU\TBRIDGE\BIN\InstantAccess.exe [1998-07-08 37376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]
C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe [1998-07-08 22528]

C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart
Skrót do tclock.lnk - D:\Programy\tclock\tclock.exe
Speedtouch Connection.lnk - C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Programy\Tlen\Tlen.pl\tlen.exe"="D:\Programy\Tlen\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"D:\Programy\gadulec\Gadu-Gadu\Gadu-Gadu\gg.exe"="D:\Programy\gadulec\Gadu-Gadu\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\Documents and Settings\Paweł\Pulpit\nfsu-lan\NFSU Lan 0.9.9\Server.exe"="C:\Documents and Settings\Paweł\Pulpit\nfsu-lan\NFSU Lan 0.9.9\Server.exe:*:Enabled:Server"
"C:\Documents and Settings\Paweł\Pulpit\nfsu-lan\NFSU Lan 0.9.9\Client.exe"="C:\Documents and Settings\Paweł\Pulpit\nfsu-lan\NFSU Lan 0.9.9\Client.exe:*:Enabled:Client"
"F:\IGI\Project_IGI_2_-_Covert_Strike\Project_IGI_2_-_Covert_Strike\pc\igi2.exe"="F:\IGI\Project_IGI_2_-_Covert_Strike\Project_IGI_2_-_Covert_Strike\pc\igi2.exe:*:Enabled:IGI2:Covert Strike"
"D:\Gry\cs\hl.exe"="D:\Gry\cs\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\Programy\bearshare\BearShare.exe"="D:\Programy\bearshare\BearShare.exe:*:Enabled:BearShare"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}]
shell\AutoRun\command - J:\d9c.bat
shell\open\command - J:\d9c.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}]
shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
shell\open\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe


======List of files/folders created in the last 1 months======

2009-06-21 13:49:05 ----D---- C:\rsit
2009-06-21 13:49:05 ----D---- C:\Program Files\trend micro
2009-06-20 19:20:45 ----RSH---- C:\cahpcg.cmd
2009-06-20 19:20:19 ----RSH---- C:\WINDOWS\system32\nmdfgds1.dll
2009-06-20 19:20:05 ----RSH---- C:\d9c.bat
2009-06-20 19:19:38 ----RSH---- C:\WINDOWS\system32\olhrwef.exe
2009-06-20 19:19:38 ----RSH---- C:\WINDOWS\system32\nmdfgds0.dll
2009-06-20 16:38:31 ----D---- C:\Program Files\directx
2009-06-20 13:33:52 ----A---- C:\WINDOWS\system32\ptpusb.dll
2009-06-20 13:33:51 ----A---- C:\WINDOWS\system32\ptpusd.dll
2009-06-19 13:45:20 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\OpenFM
2009-06-19 13:43:51 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\Nowe Gadu-Gadu
2009-06-07 22:24:47 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
2009-06-07 15:47:15 ----A---- C:\error.txt
2009-06-07 15:46:51 ----A---- C:\WINDOWS\system32\SIntfNT.dll
2009-06-07 15:46:51 ----A---- C:\WINDOWS\system32\SIntf32.dll
2009-06-07 15:46:51 ----A---- C:\WINDOWS\system32\SIntf16.dll
2009-06-07 15:44:53 ----A---- C:\WINDOWS\system32\MSOSS.DLL
2009-06-06 14:26:07 ----A---- C:\WINDOWS\system32\wmv8dmod.dll
2009-06-06 14:26:05 ----A---- C:\WINDOWS\system32\mpg4c32.dll
2009-06-06 14:19:02 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
2009-06-06 14:18:58 ----D---- C:\Program Files\DAEMON Tools Toolbar
2009-06-06 14:16:30 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\DAEMON Tools Lite
2009-06-05 15:29:56 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\Apple Computer
2009-05-30 16:59:07 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-05-22 14:39:02 ----A---- C:\WINDOWS\WINCMD.INI

======List of files/folders modified in the last 1 months======

2009-06-21 13:49:05 ----RD---- C:\Program Files
2009-06-21 13:46:23 ----D---- C:\WINDOWS\system32
2009-06-21 13:46:22 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-21 13:43:47 ----D---- C:\WINDOWS\Prefetch
2009-06-21 13:43:16 ----D---- C:\WINDOWS\Temp
2009-06-21 13:42:35 ----D---- C:\WINDOWS\system32\drivers
2009-06-21 13:42:31 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-21 13:08:52 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-21 00:08:32 ----A---- C:\WINDOWS\winamp.ini
2009-06-20 16:38:31 ----D---- C:\WINDOWS
2009-06-20 16:37:32 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-20 13:33:56 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-19 13:44:02 ----SHD---- C:\WINDOWS\Installer
2009-06-19 13:44:01 ----D---- C:\WINDOWS\WinSxS
2009-06-19 13:44:01 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-06-17 17:24:15 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\Tlen.pl
2009-06-14 09:41:35 ----HD---- C:\WINDOWS\inf
2009-06-07 22:43:13 ----D---- C:\Documents and Settings\Paweł\Dane aplikacji\gtk-2.0
2009-05-26 13:49:25 ----A---- C:\WINDOWS\GTA-SA_Trn_Settings.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2003-12-08 53600]
R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2003-12-08 70688]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-12-22 2304320]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S2 USB680x;USB Scanner; C:\WINDOWS\system32\DRIVERS\UScanner.SYS [2000-06-22 17332]
S3 au4zjxha;au4zjxha; C:\WINDOWS\system32\drivers\au4zjxha.sys []
S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys []
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-04-12 152984]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]

-----------------EOF-----------------


podczas pisania tego posta pojawił się znowu komunikat z avasta o rootkicie tym samym co poprzednio.
proszę o pomoc co wyrzucić i ew. jakieś poprawki kosmetyczne usprawniające system.

[wojtas]

Pobierz OTL i daj z niego loga

[qrminator]

Kod: Zaznacz wszystko

OTL logfile created on: 2009-06-21 14:48:07 - Run 1
OTL by OldTimer - Version 3.0.2.0     Folder = C:\Documents and Settings\Paweł\Pulpit
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1023,48 Mb Total Physical Memory | 620,00 Mb Available Physical Memory | 60,58% Memory free
2,40 Gb Paging File | 2,02 Gb Available in Paging File | 84,27% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 9,77 Gb Total Space | 0,38 Gb Free Space | 3,90% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 2,60 Gb Free Space | 13,29% Space Free | Partition Type: NTFS
Drive E: | 9,77 Gb Total Space | 1,22 Gb Free Space | 12,44% Space Free | Partition Type: NTFS
Drive F: | 35,44 Gb Total Space | 1,59 Gb Free Space | 4,48% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PAWE-1085DD023C
Current User Name: Paweł
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2004-08-04 00:44:20 | 00,975,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2002-07-25 11:04:34 | 00,290,816 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atiptaxx.exe
PRC - [2004-03-23 12:06:12 | 00,888,832 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
PRC - [2009-02-05 22:08:45 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009-04-12 00:13:34 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2004-12-22 11:09:44 | 00,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2008-11-28 12:48:54 | 05,837,800 | ---- | M] (o2.pl Sp. z o.o.) -- D:\Programy\Tlen\Tlen.pl\tlen.exe
PRC - [2009-04-23 15:51:38 | 00,691,656 | ---- | M] (DT Soft Ltd) -- D:\Programy\DAEMON Tools Lite\daemon.exe
PRC - [2009-04-12 00:13:33 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2004-09-07 17:16:52 | 00,044,544 | ---- | M] (Kazubon) -- D:\Programy\tclock\tclock.exe
PRC - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2003-06-25 06:22:10 | 00,854,016 | ---- | M] (Nullsoft) -- D:\Programy\Winamp\winamp.exe
PRC - [2009-03-19 17:11:24 | 01,138,688 | ---- | M] (Last.fm) -- D:\Programy\Last.fm\LastFM.exe
PRC - [2009-06-13 11:20:22 | 00,307,704 | ---- | M] (Mozilla Corporation) -- D:\Programy\firefox\firefox.exe
PRC - [2009-06-21 14:48:02 | 00,512,512 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2005-08-05 21:05:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Running])
SRV - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Running])
SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2009-04-12 00:13:33 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-02-05 22:05:11 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running])
DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running])
DRV - [2004-12-22 11:07:12 | 02,304,320 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running])
DRV - [2001-08-18 01:51:54 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde [Boot | Running])
DRV - [2009-02-05 22:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009-02-05 22:08:10 | 00,094,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009-02-05 22:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Running])
DRV - [2009-02-05 22:07:23 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-02-05 22:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2005-08-04 05:10:16 | 01,273,344 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2004-08-04 01:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running])
DRV - [2001-08-18 01:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - File not found --  -- (sdpiosys [Unknown | Running])
DRV - [2009-04-15 23:10:02 | 00,012,400 | ---- | M] (Macrovision Europe Ltd) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running])
DRV - [2009-06-06 14:16:35 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2000-06-22 11:42:48 | 00,017,332 | ---- | M] (   ) -- C:\WINDOWS\System32\DRIVERS\UScanner.SYS -- (USB680x [Auto | Stopped])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-04-12 00:13:34 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: D:\Programy\firefox\components [2009-06-13 11:20:28 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: D:\Programy\firefox\plugins [2009-06-17 17:07:55 | 00,000,000 | ---D | M]

[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Extensions
[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-06-20 20:26:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2009-05-30 10:02:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}
[2009-05-07 22:05:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2009-04-11 23:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{469CEB59-8266-438b-91D9-82F56D595E15}
[2009-04-11 23:33:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}
[2009-06-02 22:27:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2009-04-24 10:07:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2009-04-11 23:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2009-04-16 16:14:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\cache@status.org
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\firenes@facundo.zaldo
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\xuuizyu0.default\extensions

O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [cdoosoft] C:\WINDOWS\System32\olhrwef.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] D:\Programy\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Komunikator] D:\Programy\Tlen\Tlen.pl\tlen.exe (o2.pl Sp. z o.o.)
O4 - HKLM..\RunServices: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe ()
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\Skrót do tclock.lnk = D:\Programy\tclock\tclock.exe (Kazubon)
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\Speedtouch Connection.lnk = C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe (THOMSON Telecom Belgium)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-04-11 22:19:03 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\Shell\AutoRun\command - "" = J:\d9c.bat -- File not found
O33 - MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\Shell\open\Command - "" = J:\d9c.bat -- File not found
O33 - MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\Shell\AutoRun\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
O33 - MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\Shell\open\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
O33 - MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = D:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = D:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = E:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = E:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = F:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = F:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = C:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = C:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-06-21 14:47:56 | 00,512,512 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe
[2009-06-21 13:49:05 | 00,000,000 | ---D | C] -- C:\rsit
[2009-06-21 13:49:05 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro
[2009-06-21 13:48:42 | 00,781,909 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\RSIT.exe
[2009-06-20 19:20:45 | 00,105,283 | RHS- | C] () -- C:\cahpcg.cmd
[2009-06-20 19:20:19 | 00,099,328 | RHS- | C] () -- C:\WINDOWS\System32\nmdfgds1.dll
[2009-06-20 19:20:05 | 00,105,528 | RHS- | C] () -- C:\d9c.bat
[2009-06-20 19:20:05 | 00,000,059 | RHS- | C] () -- C:\autorun.inf
[2009-06-20 19:19:38 | 00,105,283 | RHS- | C] () -- C:\WINDOWS\System32\olhrwef.exe
[2009-06-20 19:19:38 | 00,099,328 | RHS- | C] () -- C:\WINDOWS\System32\nmdfgds0.dll
[2009-06-20 18:03:59 | 00,000,453 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do gta2 manager.lnk
[2009-06-20 18:01:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\pls
[2009-06-20 16:38:31 | 00,000,000 | ---D | C] -- C:\Program Files\directx
[2009-06-20 16:35:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\GTA2INSTALLER
[2009-06-20 13:52:57 | 03,243,812 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\czeslaw niemen - sen o warszawielarn%11.mp3
[2009-06-20 13:52:41 | 01,878,966 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\piasek - chodz przytul przebaczularn%11.mp3
[2009-06-20 13:40:26 | 03,647,111 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\glenn medeiros - nothing's gonna change my love for you [www.musicishere.fora.pl].mp3
[2009-06-20 13:33:52 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2009-06-20 13:33:51 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2009-06-20 13:33:50 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbscan.sys
[2009-06-20 13:33:50 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2009-06-19 13:45:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\OpenFM
[2009-06-19 13:44:02 | 00,000,499 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk
[2009-06-19 13:44:02 | 00,000,480 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk
[2009-06-19 13:43:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Nowe Gadu-Gadu
[2009-06-19 13:39:21 | 19,845,880 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\nowegg.exe
[2009-06-18 22:11:04 | 01,925,040 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Obraz 021.jpg
[2009-06-14 20:46:14 | 00,038,712 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za czerwiec 2009.pdf
[2009-06-14 20:46:10 | 00,051,007 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za maj 2009.pdf
[2009-06-13 15:32:37 | 00,154,151 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\ClipBoard-1.jpg
[2009-06-13 13:02:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Moje dokumenty\My Received Files
[2009-06-13 13:02:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Moje dokumenty\BearShare
[2009-06-13 13:02:14 | 00,483,328 | ---- | C] (SoftShape Development) -- C:\WINDOWS\System32\actskn45.ocx
[2009-06-13 12:28:13 | 03,835,352 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\thomas haardell - blow your mind.mp3
[2009-06-07 22:43:13 | 00,039,857 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\foto.jpg
[2009-06-07 22:39:44 | 00,088,544 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\629eecae70.jpeg
[2009-06-07 22:24:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
[2009-06-07 22:24:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Last.fm
[2009-06-07 15:46:51 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009-06-07 15:46:51 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009-06-07 15:46:51 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009-06-07 15:44:54 | 00,000,329 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2  [ Tylko sieć ].lnk
[2009-06-07 15:44:53 | 00,151,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSOSS.DLL
[2009-06-07 15:44:53 | 00,000,295 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2.lnk
[2009-06-06 22:49:08 | 00,554,800 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\BOARDS_2_0_0_35.exe
[2009-06-06 15:20:53 | 00,015,925 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\cmr3gen.zip
[2009-06-06 14:26:07 | 00,309,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmv8dmod.dll
[2009-06-06 14:26:07 | 00,245,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mp4sds32.ax
[2009-06-06 14:26:05 | 00,420,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mpg4c32.dll
[2009-06-06 14:25:59 | 00,000,503 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 3.lnk
[2009-06-06 14:19:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2009-06-06 14:18:58 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar
[2009-06-06 14:16:35 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-06-06 14:16:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\DAEMON Tools Lite
[2009-06-05 15:29:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Apple Computer
[2009-06-01 13:00:12 | 00,000,553 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do tunatic.lnk
[2009-05-31 17:53:02 | 01,496,576 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Anemie.ppt
[2009-05-31 14:12:32 | 00,061,704 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\1192.gif
[2009-05-30 16:59:07 | 00,000,182 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-28 22:12:09 | 00,013,312 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\zasw.doc
[2009-05-28 19:09:39 | 00,022,630 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx.htm
[2009-05-28 19:09:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx_pliki
[2009-05-27 18:35:51 | 06,783,090 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\07 dash berlin feat. cerf, mitsika & jaren - man on the run.mp3
[2009-05-26 17:14:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\humberdink
[2009-05-23 12:20:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\v1r00z
[2009-05-23 11:47:27 | 05,260,883 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\flo rida feat. kesha - right round (max mafia remix).mp3
[2009-05-23 11:38:39 | 05,508,315 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\beyonce - halo (edson pride & enrry mix) skrocon8.mp3
[2009-05-23 11:31:10 | 05,967,652 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\cansis pres. carefree - broken strings (sebo reed electro mix).mp3
[2009-05-22 19:19:18 | 03,567,731 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\mr. zoob - moj jest ten kawalek podlo.php%0E9.mp3
[2009-05-22 14:39:02 | 00,000,252 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2009-05-20 10:42:56 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-05-20 10:42:54 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-05-20 10:42:53 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-05-20 10:42:53 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-05-20 10:42:51 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-05-20 10:42:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-04-26 19:21:32 | 00,000,035 | ---- | C] () -- C:\WINDOWS\GTA-SA_Trn_Settings.ini
[2009-04-21 17:46:22 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009-04-17 20:47:44 | 00,000,354 | ---- | C] () -- C:\WINDOWS\SCNDRVU.INI
[2009-04-17 20:47:40 | 00,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL
[2009-04-17 20:47:40 | 00,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL
[2009-04-17 20:47:40 | 00,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL
[2009-04-17 20:47:40 | 00,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[2009-04-17 20:47:40 | 00,000,093 | ---- | C] () -- C:\WINDOWS\Tb98.ini
[2009-04-17 20:47:29 | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\Ppiv30.dll
[2009-04-17 20:47:28 | 01,513,984 | ---- | C] () -- C:\WINDOWS\System32\Mgxrdr80.dll
[2009-04-17 20:47:27 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL
[2009-04-17 20:47:27 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2009-04-17 20:47:11 | 00,017,332 | ---- | C] (   ) -- C:\WINDOWS\System32\drivers\UScanner.SYS
[2009-04-12 01:04:15 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009-04-12 00:07:43 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009-04-11 23:21:40 | 00,000,084 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2009-04-11 22:53:59 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll
[2009-04-11 22:50:55 | 00,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2003-01-28 01:09:20 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\libexpat.dll
[2001-07-22 02:16:20 | 00,000,621 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 02:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009-06-21 14:49:02 | 00,000,059 | RHS- | M] () -- C:\autorun.inf
[2009-06-21 14:48:02 | 00,512,512 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe
[2009-06-21 13:48:52 | 00,781,909 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\RSIT.exe
[2009-06-21 13:46:23 | 00,355,486 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-06-21 13:46:23 | 00,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-06-21 13:46:23 | 00,049,492 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-06-21 13:46:23 | 00,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-06-21 13:46:22 | 00,763,990 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-06-21 13:42:28 | 00,099,328 | RHS- | M] () -- C:\WINDOWS\System32\nmdfgds0.dll
[2009-06-21 13:42:14 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-21 13:42:07 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-21 13:42:05 | 10,732,70784 | -HS- | M] () -- C:\hiberfil.sys
[2009-06-21 13:08:46 | 03,742,620 | -H-- | M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-06-21 12:59:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-06-21 00:08:32 | 00,000,084 | ---- | M] () -- C:\WINDOWS\winamp.ini
[2009-06-20 19:20:19 | 00,099,328 | RHS- | M] () -- C:\WINDOWS\System32\nmdfgds1.dll
[2009-06-20 19:20:18 | 00,105,283 | RHS- | M] () -- C:\WINDOWS\System32\olhrwef.exe
[2009-06-20 19:20:18 | 00,105,283 | RHS- | M] () -- C:\cahpcg.cmd
[2009-06-20 18:03:59 | 00,000,453 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do gta2 manager.lnk
[2009-06-20 13:55:39 | 03,243,812 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\czeslaw niemen - sen o warszawielarn%11.mp3
[2009-06-20 13:54:14 | 01,878,966 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\piasek - chodz przytul przebaczularn%11.mp3
[2009-06-20 13:43:28 | 03,647,111 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\glenn medeiros - nothing's gonna change my love for you [www.musicishere.fora.pl].mp3
[2009-06-19 13:44:02 | 00,000,499 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk
[2009-06-19 13:44:02 | 00,000,480 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk
[2009-06-19 13:41:58 | 19,845,880 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\nowegg.exe
[2009-06-18 18:43:32 | 00,105,528 | RHS- | M] () -- C:\d9c.bat
[2009-06-14 20:46:14 | 00,038,712 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za czerwiec 2009.pdf
[2009-06-14 20:46:11 | 00,051,007 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za maj 2009.pdf
[2009-06-14 10:05:03 | 00,010,752 | ---- | M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-06-13 15:32:37 | 00,154,151 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\ClipBoard-1.jpg
[2009-06-13 14:54:43 | 03,835,352 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\thomas haardell - blow your mind.mp3
[2009-06-07 22:44:04 | 00,039,857 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\foto.jpg
[2009-06-07 22:39:44 | 00,088,544 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\629eecae70.jpeg
[2009-06-07 15:46:51 | 00,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009-06-07 15:46:51 | 00,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll
[2009-06-07 15:46:51 | 00,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll
[2009-06-07 15:44:54 | 00,000,329 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2  [ Tylko sieć ].lnk
[2009-06-07 15:44:53 | 00,000,295 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2.lnk
[2009-06-06 22:49:11 | 00,554,800 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\BOARDS_2_0_0_35.exe
[2009-06-06 15:20:54 | 00,015,925 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\cmr3gen.zip
[2009-06-06 14:26:17 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009-06-06 14:25:59 | 00,000,503 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 3.lnk
[2009-06-06 14:16:35 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-06-01 13:00:12 | 00,000,553 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do tunatic.lnk
[2009-05-31 14:12:33 | 00,061,704 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\1192.gif
[2009-05-30 17:00:27 | 00,000,252 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2009-05-30 17:00:22 | 00,000,182 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-28 22:12:12 | 00,013,312 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\zasw.doc
[2009-05-28 19:09:40 | 00,022,630 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx.htm
[2009-05-27 18:41:31 | 06,783,090 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\07 dash berlin feat. cerf, mitsika & jaren - man on the run.mp3
[2009-05-26 13:49:25 | 00,000,035 | ---- | M] () -- C:\WINDOWS\GTA-SA_Trn_Settings.ini
[2009-05-23 11:51:50 | 05,260,883 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\flo rida feat. kesha - right round (max mafia remix).mp3
[2009-05-23 11:43:14 | 05,508,315 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\beyonce - halo (edson pride & enrry mix) skrocon8.mp3
[2009-05-23 11:36:10 | 05,967,652 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\cansis pres. carefree - broken strings (sebo reed electro mix).mp3
[2009-05-22 19:22:16 | 03,567,731 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\mr. zoob - moj jest ten kawalek podlo.php%0E9.mp3
< End of report >


[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKCU..\Run: [cdoosoft] C:\WINDOWS\System32\olhrwef.exe ()
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-06-21 14:48:12 | 00,000,059 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\Shell\AutoRun\command - "" = J:\d9c.bat -- File not found
O33 - MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\Shell\open\Command - "" = J:\d9c.bat -- File not found
O33 - MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\Shell\AutoRun\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
O33 - MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\Shell\open\command - "" = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
O33 - MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = D:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = D:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = E:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = E:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = F:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = F:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\Shell\AutoRun\command - "" = C:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()
O33 - MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\Shell\open\Command - "" = C:\cahpcg.cmd -- [2009-06-20 19:20:18 | 00,105,283 | RHS- | M] ()

:Files
C:\cahpcg.cmd
C:\d9c.bat
C:\autorun.inf
d:\cahpcg.cmd
d:\d9c.bat
d:\autorun.inf
e:\cahpcg.cmd
e:\d9c.bat
e:\autorun.inf
f:\cahpcg.cmd
f:\d9c.bat
f:\autorun.inf
C:\WINDOWS\System32\olhrwef.exe
C:\WINDOWS\System32\nmdfgds0.dll
C:\WINDOWS\System32\nmdfgds1.dll

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

[qrminator]

Gdy klikam na Run Fix, program zamyka mi explorera i się zawiesza.. jest (bez odpowiedzi), po 5 minutach dalej wisi..

EDIT:
za którymś razem z kolei poszło

Kod: Zaznacz wszystko

All processes killed
========== OTL ==========
Process explorer.exe killed successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cdoosoft deleted successfully.
C:\WINDOWS\System32\olhrwef.exe moved successfully.
C:\autorun.inf moved successfully.
D:\autorun.inf moved successfully.
E:\autorun.inf moved successfully.
F:\autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\ not found.
File J:\d9c.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bfe0b27-5d8e-11de-bdce-000e50fa1bfb}\ not found.
File J:\d9c.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\ not found.
File C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53a383e5-4ddc-11de-bdc7-000e50fa1bfb}\ not found.
File C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\ not found.
D:\cahpcg.cmd moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1c8-26e3-11de-b4bc-806d6172696f}\ not found.
File D:\cahpcg.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\ not found.
E:\cahpcg.cmd moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1c9-26e3-11de-b4bc-806d6172696f}\ not found.
File E:\cahpcg.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\ not found.
F:\cahpcg.cmd moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1ca-26e3-11de-b4bc-806d6172696f}\ not found.
File F:\cahpcg.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\ not found.
C:\cahpcg.cmd moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c83cf1cc-26e3-11de-b4bc-806d6172696f}\ not found.
File C:\cahpcg.cmd not found.
========== FILES ==========
File\Folder C:\cahpcg.cmd not found.
C:\d9c.bat moved successfully.
File\Folder C:\autorun.inf not found.
File\Folder d:\cahpcg.cmd not found.
d:\d9c.bat moved successfully.
File\Folder d:\autorun.inf not found.
File\Folder e:\cahpcg.cmd not found.
e:\d9c.bat moved successfully.
File\Folder e:\autorun.inf not found.
File\Folder f:\cahpcg.cmd not found.
f:\d9c.bat moved successfully.
File\Folder f:\autorun.inf not found.
File\Folder C:\WINDOWS\System32\olhrwef.exe not found.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\nmdfgds0.dll
C:\WINDOWS\System32\nmdfgds0.dll NOT unregistered.
C:\WINDOWS\System32\nmdfgds0.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\nmdfgds1.dll
C:\WINDOWS\System32\nmdfgds1.dll NOT unregistered.
C:\WINDOWS\System32\nmdfgds1.dll moved successfully.
========== REGISTRY ==========
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 334056 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: Paweł
->Temp folder emptied: 197559198 bytes
->Temporary Internet Files folder emptied: 8442827 bytes
->Java cache emptied: 7947822 bytes
->FireFox cache emptied: 70833604 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114584 bytes
%systemroot%\System32 .tmp files removed: 2596 bytes
Windows Temp folder emptied: 35259979 bytes

RecycleBin emptied: 361557287 bytes

Total Files Cleaned = 652,46 mb

Error: Unable to interpret <[start explorer]> in the current context!

OTL by OldTimer - Version 3.0.2.0 log created on 06212009_151805

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


kolejny log:

Kod: Zaznacz wszystko

OTL logfile created on: 2009-06-21 15:21:27 - Run 2
OTL by OldTimer - Version 3.0.2.0     Folder = C:\Documents and Settings\Paweł\Pulpit
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1023,48 Mb Total Physical Memory | 605,91 Mb Available Physical Memory | 59,20% Memory free
2,40 Gb Paging File | 2,07 Gb Available in Paging File | 86,22% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 9,77 Gb Total Space | 1,00 Gb Free Space | 10,27% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 2,60 Gb Free Space | 13,30% Space Free | Partition Type: NTFS
Drive E: | 9,77 Gb Total Space | 1,22 Gb Free Space | 12,44% Space Free | Partition Type: NTFS
Drive F: | 35,44 Gb Total Space | 1,59 Gb Free Space | 4,48% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PAWE-1085DD023C
Current User Name: Paweł
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2004-08-04 00:44:20 | 00,975,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-04-12 00:13:33 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe
PRC - [2004-08-04 00:44:26 | 00,156,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe
PRC - [2002-07-25 11:04:34 | 00,290,816 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atiptaxx.exe
PRC - [2004-03-23 12:06:12 | 00,888,832 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
PRC - [2009-02-05 22:08:45 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009-04-12 00:13:34 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2004-12-22 11:09:44 | 00,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2008-11-28 12:48:54 | 05,837,800 | ---- | M] (o2.pl Sp. z o.o.) -- D:\Programy\Tlen\Tlen.pl\tlen.exe
PRC - [2004-09-07 17:16:52 | 00,044,544 | ---- | M] (Kazubon) -- D:\Programy\tclock\tclock.exe
PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe
PRC - [2009-06-13 11:20:22 | 00,307,704 | ---- | M] (Mozilla Corporation) -- D:\Programy\firefox\firefox.exe
PRC - [2009-06-21 14:48:02 | 00,512,512 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2005-08-04 05:02:57 | 00,380,928 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2005-08-05 21:05:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Running])
SRV - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Running])
SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005-11-14 01:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2009-04-12 00:13:33 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-02-05 22:05:11 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running])
DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running])
DRV - [2004-12-22 11:07:12 | 02,304,320 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running])
DRV - [2001-08-18 01:51:54 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde [Boot | Running])
DRV - [2009-02-05 22:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009-02-05 22:08:10 | 00,094,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009-02-05 22:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Running])
DRV - [2009-02-05 22:07:23 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-02-05 22:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2005-08-04 05:10:16 | 01,273,344 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2004-08-04 01:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running])
DRV - [2001-08-18 01:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2009-04-15 23:10:02 | 00,012,400 | ---- | M] (Macrovision Europe Ltd) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running])
DRV - [2009-06-06 14:16:35 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2000-06-22 11:42:48 | 00,017,332 | ---- | M] (   ) -- C:\WINDOWS\System32\DRIVERS\UScanner.SYS -- (USB680x [Auto | Stopped])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-04-12 00:13:34 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: D:\Programy\firefox\components [2009-06-13 11:20:28 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: D:\Programy\firefox\plugins [2009-06-17 17:07:55 | 00,000,000 | ---D | M]

[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Extensions
[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-06-20 20:26:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2009-05-30 10:02:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}
[2009-05-07 22:05:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2009-04-11 23:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{469CEB59-8266-438b-91D9-82F56D595E15}
[2009-04-11 23:33:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}
[2009-06-02 22:27:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2009-04-24 10:07:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2009-04-11 23:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2009-04-16 16:14:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\cache@status.org
[2009-04-11 23:02:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\5mq0rd13.Paweł\extensions\firenes@facundo.zaldo
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009-04-11 23:02:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2009-04-11 23:02:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\uc2r4x1y.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-04-11 22:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Paweł\Dane aplikacji\mozilla\Firefox\Profiles\xuuizyu0.default\extensions

O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [Komunikator] D:\Programy\Tlen\Tlen.pl\tlen.exe (o2.pl Sp. z o.o.)
O4 - HKLM..\RunServices: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe ()
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\Skrót do tclock.lnk = D:\Programy\tclock\tclock.exe (Kazubon)
O4 - Startup: C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\Speedtouch Connection.lnk = C:\Program Files\Thomson\SpeedTouch USB\stdialup.exe (THOMSON Telecom Belgium)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-04-11 22:19:03 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-06-21 15:05:32 | 00,000,000 | ---D | C] -- C:\_OTL
[2009-06-21 14:47:56 | 00,512,512 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe
[2009-06-21 13:49:05 | 00,000,000 | ---D | C] -- C:\rsit
[2009-06-21 13:49:05 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro
[2009-06-21 13:48:42 | 00,781,909 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\RSIT.exe
[2009-06-20 18:03:59 | 00,000,453 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do gta2 manager.lnk
[2009-06-20 18:01:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\pls
[2009-06-20 16:38:31 | 00,000,000 | ---D | C] -- C:\Program Files\directx
[2009-06-20 16:35:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\GTA2INSTALLER
[2009-06-20 13:52:57 | 03,243,812 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\czeslaw niemen - sen o warszawielarn%11.mp3
[2009-06-20 13:52:41 | 01,878,966 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\piasek - chodz przytul przebaczularn%11.mp3
[2009-06-20 13:40:26 | 03,647,111 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\glenn medeiros - nothing's gonna change my love for you [www.musicishere.fora.pl].mp3
[2009-06-20 13:33:52 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2009-06-20 13:33:51 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2009-06-20 13:33:50 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbscan.sys
[2009-06-20 13:33:50 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2009-06-19 13:45:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\OpenFM
[2009-06-19 13:44:02 | 00,000,499 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk
[2009-06-19 13:44:02 | 00,000,480 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk
[2009-06-19 13:43:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Nowe Gadu-Gadu
[2009-06-19 13:39:21 | 19,845,880 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\nowegg.exe
[2009-06-18 22:11:04 | 01,925,040 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Obraz 021.jpg
[2009-06-14 20:46:14 | 00,038,712 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za czerwiec 2009.pdf
[2009-06-14 20:46:10 | 00,051,007 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za maj 2009.pdf
[2009-06-13 15:32:37 | 00,154,151 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\ClipBoard-1.jpg
[2009-06-13 13:02:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Moje dokumenty\My Received Files
[2009-06-13 13:02:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Moje dokumenty\BearShare
[2009-06-13 13:02:14 | 00,483,328 | ---- | C] (SoftShape Development) -- C:\WINDOWS\System32\actskn45.ocx
[2009-06-13 12:28:13 | 03,835,352 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\thomas haardell - blow your mind.mp3
[2009-06-07 22:43:13 | 00,039,857 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\foto.jpg
[2009-06-07 22:39:44 | 00,088,544 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\629eecae70.jpeg
[2009-06-07 22:24:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
[2009-06-07 22:24:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Last.fm
[2009-06-07 15:46:51 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009-06-07 15:46:51 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009-06-07 15:46:51 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009-06-07 15:44:54 | 00,000,329 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2  [ Tylko sieć ].lnk
[2009-06-07 15:44:53 | 00,151,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSOSS.DLL
[2009-06-07 15:44:53 | 00,000,295 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2.lnk
[2009-06-06 22:49:08 | 00,554,800 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\BOARDS_2_0_0_35.exe
[2009-06-06 15:20:53 | 00,015,925 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\cmr3gen.zip
[2009-06-06 14:26:07 | 00,309,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmv8dmod.dll
[2009-06-06 14:26:07 | 00,245,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mp4sds32.ax
[2009-06-06 14:26:05 | 00,420,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mpg4c32.dll
[2009-06-06 14:25:59 | 00,000,503 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 3.lnk
[2009-06-06 14:19:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2009-06-06 14:18:58 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar
[2009-06-06 14:16:35 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-06-06 14:16:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\DAEMON Tools Lite
[2009-06-05 15:29:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Dane aplikacji\Apple Computer
[2009-06-01 13:00:12 | 00,000,553 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do tunatic.lnk
[2009-05-31 17:53:02 | 01,496,576 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Anemie.ppt
[2009-05-31 14:12:32 | 00,061,704 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\1192.gif
[2009-05-30 16:59:07 | 00,000,182 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-28 22:12:09 | 00,013,312 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\zasw.doc
[2009-05-28 19:09:39 | 00,022,630 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx.htm
[2009-05-28 19:09:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx_pliki
[2009-05-27 18:35:51 | 06,783,090 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\07 dash berlin feat. cerf, mitsika & jaren - man on the run.mp3
[2009-05-26 17:14:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\humberdink
[2009-05-23 12:20:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Paweł\Pulpit\v1r00z
[2009-05-23 11:47:27 | 05,260,883 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\flo rida feat. kesha - right round (max mafia remix).mp3
[2009-05-23 11:38:39 | 05,508,315 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\beyonce - halo (edson pride & enrry mix) skrocon8.mp3
[2009-05-23 11:31:10 | 05,967,652 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\cansis pres. carefree - broken strings (sebo reed electro mix).mp3
[2009-05-22 19:19:18 | 03,567,731 | ---- | C] () -- C:\Documents and Settings\Paweł\Pulpit\mr. zoob - moj jest ten kawalek podlo.php%0E9.mp3
[2009-05-22 14:39:02 | 00,000,252 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2009-05-20 10:42:56 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-05-20 10:42:54 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-05-20 10:42:53 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-05-20 10:42:53 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-05-20 10:42:51 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-05-20 10:42:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-04-26 19:21:32 | 00,000,035 | ---- | C] () -- C:\WINDOWS\GTA-SA_Trn_Settings.ini
[2009-04-21 17:46:22 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009-04-17 20:47:44 | 00,000,354 | ---- | C] () -- C:\WINDOWS\SCNDRVU.INI
[2009-04-17 20:47:40 | 00,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL
[2009-04-17 20:47:40 | 00,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL
[2009-04-17 20:47:40 | 00,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL
[2009-04-17 20:47:40 | 00,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[2009-04-17 20:47:40 | 00,000,093 | ---- | C] () -- C:\WINDOWS\Tb98.ini
[2009-04-17 20:47:29 | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\Ppiv30.dll
[2009-04-17 20:47:28 | 01,513,984 | ---- | C] () -- C:\WINDOWS\System32\Mgxrdr80.dll
[2009-04-17 20:47:27 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL
[2009-04-17 20:47:27 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2009-04-17 20:47:11 | 00,017,332 | ---- | C] (   ) -- C:\WINDOWS\System32\drivers\UScanner.SYS
[2009-04-12 01:04:15 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009-04-12 00:07:43 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009-04-11 23:21:40 | 00,000,084 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2009-04-11 22:53:59 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll
[2009-04-11 22:50:55 | 00,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2003-01-28 01:09:20 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\libexpat.dll
[2001-07-22 02:16:20 | 00,000,621 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 02:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2009-06-21 15:19:40 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-21 15:19:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-21 15:19:32 | 10,732,70784 | -HS- | M] () -- C:\hiberfil.sys
[2009-06-21 15:11:50 | 00,763,990 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-06-21 15:11:50 | 00,355,486 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-06-21 15:11:50 | 00,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-06-21 15:11:50 | 00,049,492 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-06-21 15:11:50 | 00,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-06-21 14:52:47 | 00,000,621 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-06-21 14:52:47 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-06-21 14:52:47 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-06-21 14:48:02 | 00,512,512 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paweł\Pulpit\OTL.exe
[2009-06-21 13:48:52 | 00,781,909 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\RSIT.exe
[2009-06-21 13:08:46 | 03,742,620 | -H-- | M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-06-21 12:59:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-06-21 00:08:32 | 00,000,084 | ---- | M] () -- C:\WINDOWS\winamp.ini
[2009-06-20 18:03:59 | 00,000,453 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do gta2 manager.lnk
[2009-06-20 13:55:39 | 03,243,812 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\czeslaw niemen - sen o warszawielarn%11.mp3
[2009-06-20 13:54:14 | 01,878,966 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\piasek - chodz przytul przebaczularn%11.mp3
[2009-06-20 13:43:28 | 03,647,111 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\glenn medeiros - nothing's gonna change my love for you [www.musicishere.fora.pl].mp3
[2009-06-19 13:44:02 | 00,000,499 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk
[2009-06-19 13:44:02 | 00,000,480 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk
[2009-06-19 13:41:58 | 19,845,880 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\nowegg.exe
[2009-06-14 20:46:14 | 00,038,712 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za czerwiec 2009.pdf
[2009-06-14 20:46:11 | 00,051,007 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Faktura za maj 2009.pdf
[2009-06-14 10:05:03 | 00,010,752 | ---- | M] () -- C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-06-13 15:32:37 | 00,154,151 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\ClipBoard-1.jpg
[2009-06-13 14:54:43 | 03,835,352 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\thomas haardell - blow your mind.mp3
[2009-06-07 22:44:04 | 00,039,857 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\foto.jpg
[2009-06-07 22:39:44 | 00,088,544 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\629eecae70.jpeg
[2009-06-07 15:46:51 | 00,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009-06-07 15:46:51 | 00,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll
[2009-06-07 15:46:51 | 00,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll
[2009-06-07 15:44:54 | 00,000,329 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2  [ Tylko sieć ].lnk
[2009-06-07 15:44:53 | 00,000,295 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 2.lnk
[2009-06-06 22:49:11 | 00,554,800 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\BOARDS_2_0_0_35.exe
[2009-06-06 15:20:54 | 00,015,925 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\cmr3gen.zip
[2009-06-06 14:26:17 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009-06-06 14:25:59 | 00,000,503 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 3.lnk
[2009-06-06 14:16:35 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-06-01 13:00:12 | 00,000,553 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Skrót do tunatic.lnk
[2009-05-31 14:12:33 | 00,061,704 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\1192.gif
[2009-05-30 17:00:27 | 00,000,252 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2009-05-30 17:00:22 | 00,000,182 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-28 22:12:12 | 00,013,312 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\zasw.doc
[2009-05-28 19:09:40 | 00,022,630 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\Printform.aspx.htm
[2009-05-27 18:41:31 | 06,783,090 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\07 dash berlin feat. cerf, mitsika & jaren - man on the run.mp3
[2009-05-26 13:49:25 | 00,000,035 | ---- | M] () -- C:\WINDOWS\GTA-SA_Trn_Settings.ini
[2009-05-23 11:51:50 | 05,260,883 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\flo rida feat. kesha - right round (max mafia remix).mp3
[2009-05-23 11:43:14 | 05,508,315 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\beyonce - halo (edson pride & enrry mix) skrocon8.mp3
[2009-05-23 11:36:10 | 05,967,652 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\cansis pres. carefree - broken strings (sebo reed electro mix).mp3
[2009-05-22 19:22:16 | 03,567,731 | ---- | M] () -- C:\Documents and Settings\Paweł\Pulpit\mr. zoob - moj jest ten kawalek podlo.php%0E9.mp3
< End of report >


[wojtas]

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

Autor postu otrzymał pochwałę

[qrminator]

Przeskanowałem. Czysto. Dzięki.