Ostra zamułka + 100% zużycie procesora [log]

**Posty:** 79 · przez **LOL3K** 11 Gru 2009, 21:24

Witam.
Otóż dziś w godzinach popołudniowych po otworzeniu jakiejś tam strony komputer dostał świra.
Zaczął zamulać oporowo, zaczęło się włączać wszystko pół godziny.
Poszedł restart, drugi, trzeci, lecz nie pomagało.
W końcu odkryłem zużycie procesora 100%
Wyczyściłem komputer CWShredderem, Spy Botem, Ad-Aware SE Personal 1.06, Odkurzaczem oraz CCleanerem.
Nie pomogło dlatego zdecydowałem się umieścić tu loga

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:17:31, on 2009-12-11 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16850) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\RbtProt\sgsrv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\explorer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll O3 - Toolbar: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: siszyd32.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 7278 bytes

Ten log z EXTRAS nie chce wejść gdyż jest napisane, iż post posiada za dużo znaków...

**Posty:** 2183 · przez **NieWiem** 11 Gru 2009, 21:32

HJT to przestarzały program i nie używamy go już jako tako.

Pobierz aplikację OTL i zapisz ją na pulpicie.
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Gdy pojawi sie okno, skonfiguruj go następująco:
- Zaznacz opcje LOP Check i Purity Check
- Zaznacz opcje Scan All Users.
- Upewnij się, że w okienku Extra Registry jest zaznaczone Use Safelist.
Upewnij się, że wszystkie pozostałe okna są zamknięte i pozwól mu pracować bez zakłóceń - nie stukaj w klawiaturę, nie ruszaj myszką.
Kliknij Run Scan i poczekaj cierpliwie aż program wykona swoje.
Kiedy skanowanie sie skończy, pojawią sie 2 okna notatnika, zatytułowane OTL.txt i Extras.txt. Będą one zapisane w tym samym miejscu, co aplikacja OTL.
Skopiuj (Edycja => Zaznacz wszystko, Edycja => Kopiuj) zawartość tych plików i wklej na http://www.wklej.org lub w poście w tagach [code].

**Posty:** 79 · przez **LOL3K** 11 Gru 2009, 22:01

Po długim czasie się udało

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-11 20:47:28 - Run 1 OTL by OldTimer - Version 3.1.15.1 Folder = C:\Documents and Settings\Kuba\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,48 Mb Total Physical Memory | 586,52 Mb Available Physical Memory | 76,42% Memory free 1,83 Gb Paging File | 1,46 Gb Available in Paging File | 79,69% Paging File free Paging file location(s): C:\pagefile.sys 1152 2304 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 28,63 Gb Total Space | 2,60 Gb Free Space | 9,08% Space Free | Partition Type: NTFS Drive D: | 115,03 Gb Total Space | 4,00 Gb Free Space | 3,47% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LOL3K Current User Name: Kuba Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-11 20:43:55 | 00,537,600 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kuba\Pulpit\OTL.exe PRC - [2009-02-05 22:08:45 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-05-22 15:16:36 | 00,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe PRC - [2008-04-14 18:21:50 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008-04-14 18:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-11-21 19:08:56 | 02,119,104 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2007-08-08 09:25:08 | 00,836,904 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe PRC - [2007-01-08 22:39:44 | 00,171,040 | ---- | M] () -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe PRC - [2006-10-22 12:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2004-09-21 14:32:42 | 00,155,648 | ---- | M] () -- C:\Program Files\Common Files\RbtProt\sgsrv.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-11 20:43:55 | 00,537,600 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kuba\Pulpit\OTL.exe MOD - [2009-02-05 22:07:43 | 00,139,264 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll MOD - [2006-12-21 13:30:44 | 00,102,400 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\ggwhook.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-02-05 22:08:40 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-02-05 22:08:26 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-02-05 22:06:04 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-02-05 22:01:25 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2008-05-22 15:16:36 | 00,611,664 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice) SRV - [2007-08-08 09:25:08 | 00,836,904 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3) SRV - [2007-08-03 12:51:18 | 00,382,248 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007-01-08 22:39:44 | 00,171,040 | ---- | M] () [Auto | Running] -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- (RichVideo) Cyberlink RichVideo Service(CRVS) SRV - [2006-10-22 12:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2006-06-05 13:59:18 | 00,174,080 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- (ServiceLayer) SRV - [2004-09-21 14:32:42 | 00,155,648 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\RbtProt\sgsrv.exe -- (SG_Service) SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-29 12:59:10 | 00,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-06-13 01:09:45 | 00,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\44ff0251.sys -- (44ff0251) DRV - [2009-02-05 22:08:10 | 00,094,032 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-02-05 22:07:23 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-02-05 22:07:12 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-02-05 22:06:20 | 00,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-02-05 22:06:10 | 00,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-02-05 22:05:11 | 00,026,944 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2008-04-13 19:45:36 | 00,026,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2008-04-13 19:45:29 | 00,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008-04-13 19:36:39 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp) DRV - [2007-11-13 11:25:55 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2006-10-22 12:22:00 | 03,994,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006-09-13 19:18:54 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2006-09-13 19:17:20 | 00,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401) DRV - [2006-05-29 08:26:38 | 00,127,488 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (Nokia USB Phone Parent) DRV - [2006-05-29 08:26:36 | 00,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (Nokia USB Port) DRV - [2006-05-29 08:26:36 | 00,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (Nokia USB Modem) DRV - [2006-05-29 08:26:36 | 00,008,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (Nokia USB Generic) DRV - [2002-03-06 07:27:02 | 00,389,135 | R--- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cmuda.sys -- (cmuda) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1229272821-1202660629-1060284298-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/ IE - HKU\S-1-5-21-1229272821-1202660629-1060284298-1003\S-1-5-21-1229272821-1202660629-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "iMesh Web Search" FF - prefs.js..browser.search.order.1: "iMesh Web Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "http://legialive.pl/" FF - prefs.js..extensions.enabledItems: {28D35620-51D9-11DE-9D13-2DB156D89593}:3.0 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 4 FF - prefs.js..extensions.enabledItems: 9 FF - prefs.js..extensions.enabledItems: 1 FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20091031 FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.48 FF - prefs.js..keyword.URL: "http://search.imesh.com/webResults.html?src=ffb&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-09-26 17:39:28 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-09-26 17:39:28 | 00,000,000 | ---D | M] [2008-06-18 21:35:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Extensions [2009-12-11 01:37:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions [2009-06-30 19:21:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb} [2009-08-21 13:57:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{28D35620-51D9-11DE-9D13-2DB156D89593} [2008-06-18 21:54:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{4AB21F99-91C5-4a9d-813E-425841874FB1} [2008-06-18 21:56:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{526fd696-27a0-11dc-8314-0800200c9a66} [2008-03-20 15:16:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{80A5A058-5A63-4E19-9295-DCF59B534588} [2007-11-18 01:23:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\{cdb55f50-8164-11db-9fe1-0800200c9a66} [2009-11-11 19:33:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com [2009-11-05 18:27:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\nasanightlaunch@example.com [2008-01-08 21:48:24 | 00,001,878 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\searchplugins\aolsearch.xml [2009-11-29 12:59:20 | 00,002,055 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\searchplugins\daemon-search.xml [2009-12-05 14:23:02 | 00,000,950 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\searchplugins\icqplugin-1.xml [2008-02-19 17:16:46 | 00,000,951 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\searchplugins\icqplugin.xml [2009-07-18 00:02:48 | 00,002,456 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\searchplugins\iMeshWebSearch.xml [2009-12-11 01:37:02 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008-01-23 07:20:30 | 00,491,520 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll [2009-07-16 17:23:28 | 00,927,232 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPBOARDS.dll [2008-06-24 18:07:26 | 00,873,976 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPCARDS.dll [2008-07-09 14:43:20 | 00,120,296 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll [2007-11-11 11:40:00 | 00,679,936 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPMAKAOV2.dll [2007-07-03 12:22:00 | 00,524,288 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPNAVY.dll [2007-08-28 18:42:00 | 00,598,016 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll [2008-11-18 13:42:58 | 00,155,648 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\NPQUEST3D.DLL [2008-06-24 17:32:00 | 00,630,784 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPSNOOKER.dll [2008-06-24 18:07:50 | 00,620,016 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPSOCCER.dll [2009-07-16 17:23:12 | 00,669,176 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPWORDS.dll [2006-06-03 17:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2008-04-03 18:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-18 00:02:48 | 00,002,456 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml [2007-03-31 18:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2006-06-03 17:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2008-03-28 22:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2007-01-05 12:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll (BitComet) O2 - BHO: (UrlHelper Class) - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll File not found O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll () O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll () O3 - HKU\S-1-5-21-1229272821-1202660629-1060284298-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-21-1229272821-1202660629-1060284298-1003..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O4 - HKU\.DEFAULT..\RunOnce: [nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O4 - HKU\S-1-5-18..\RunOnce: [nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\Kuba\Menu Start\Programy\Autostart\siszyd32.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1229272821-1202660629-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll (BitComet) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (ICQ, Inc.) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab (System Requirements Lab Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.254.247 10.1.254.248 10.1.254.129 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007-11-17 22:33:27 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-11 20:43:38 | 00,537,600 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kuba\Pulpit\OTL.exe [2009-12-11 20:29:26 | 00,000,000 | ---D | C] -- C:\!FixIEDef [2009-12-11 20:28:45 | 01,130,036 | ---- | C] (Malwareteks.com) -- C:\Documents and Settings\Kuba\Pulpit\FixIEDef.exe [2009-12-11 20:17:00 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2009-12-11 18:51:37 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2009-12-11 18:51:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2009-12-11 18:46:33 | 00,532,480 | ---- | C] (Trend Micro Incorporated) -- C:\Documents and Settings\Kuba\Pulpit\cwshredder.exe [2009-12-11 18:22:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Dane aplikacji\WinRAR [2009-12-11 18:20:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Dane aplikacji\Lavasoft [2009-12-11 17:27:34 | 00,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2009-12-11 17:19:11 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Kuba\Recent [2009-12-07 19:27:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Ustawienia lokalne\Dane aplikacji\BVRP Software [2009-12-07 19:26:01 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys [2009-12-07 19:26:01 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbser.sys [2009-12-07 19:24:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software [2009-12-07 19:24:19 | 00,005,936 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmwhnt.sys [2009-12-07 19:24:18 | 00,092,064 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmmdm.sys [2009-12-07 19:24:18 | 00,079,328 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmserd.sys [2009-12-07 19:24:18 | 00,066,656 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmbus.sys [2009-12-07 19:24:18 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Kuba\usbsermptxp.sys [2009-12-07 19:24:18 | 00,009,232 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmmdfl.sys [2009-12-07 19:24:18 | 00,006,208 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmcmnt.sys [2009-12-07 19:24:18 | 00,004,048 | ---- | C] (MCCI) -- C:\Documents and Settings\Kuba\mqdmcr.sys [2009-12-07 19:24:17 | 00,022,768 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Kuba\usbsermpt.sys [2009-12-07 19:19:11 | 00,000,000 | ---D | C] -- C:\Program Files\Słownik SuperMemo [2009-11-29 12:59:20 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar [2009-11-29 12:58:57 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2009-11-29 12:58:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Dane aplikacji\DAEMON Tools Lite [2009-11-29 12:58:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-11-27 11:27:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2009-11-27 11:23:51 | 01,846,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_41.dll [2009-11-27 11:23:51 | 00,453,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_41.dll [2009-11-27 11:23:50 | 04,178,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_41.dll [2009-11-27 11:23:49 | 00,517,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_4.dll [2009-11-27 11:23:49 | 00,069,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_3.dll [2009-11-27 11:23:48 | 00,235,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_4.dll [2009-11-27 11:23:48 | 00,022,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_6.dll [2009-11-27 11:07:06 | 00,000,000 | ---D | C] -- C:\Program Files\Sports Interactive [2009-11-26 23:11:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Pulpit\Football.Manager.2010-RELOADED [2009-11-26 00:43:54 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-11-18 19:34:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Pulpit\Peja Slums Attack - Piętnastak LIVE (2008) [mp3@256kbs] [nan0boy] [2009-11-15 13:45:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Kuba\Pulpit\Demotywatory [2008-11-03 00:32:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2007-12-01 13:41:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple [2007-11-17 22:43:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2007-11-17 22:33:20 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-11 20:43:55 | 00,537,600 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kuba\Pulpit\OTL.exe [2009-12-11 20:38:05 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-11 20:36:47 | 00,039,258 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-12-11 20:36:27 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-11 20:36:26 | 80,483,5328 | -HS- | M] () -- C:\hiberfil.sys [2009-12-11 20:28:51 | 01,130,036 | ---- | M] (Malwareteks.com) -- C:\Documents and Settings\Kuba\Pulpit\FixIEDef.exe [2009-12-11 20:17:00 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\HijackThis.lnk [2009-12-11 18:51:46 | 00,000,933 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\Spybot - Search & Destroy.lnk [2009-12-11 18:46:42 | 00,532,480 | ---- | M] (Trend Micro Incorporated) -- C:\Documents and Settings\Kuba\Pulpit\cwshredder.exe [2009-12-11 18:20:37 | 00,000,841 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-12-11 18:11:07 | 00,272,576 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-12-11 18:09:44 | 15,990,784 | -H-- | M] () -- C:\Documents and Settings\Kuba\NTUSER.DAT [2009-12-11 18:09:44 | 00,000,292 | -HS- | M] () -- C:\Documents and Settings\Kuba\ntuser.ini [2009-12-11 17:27:53 | 00,000,702 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\Odkurzacz.lnk [2009-12-11 17:14:34 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\CCleaner.lnk [2009-12-11 16:58:26 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2009-12-11 15:25:36 | 00,000,004 | ---- | M] () -- C:\Documents and Settings\Kuba\Dane aplikacji\avdrn.dat [2009-12-10 21:37:03 | 00,092,410 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\33.JPG [2009-12-10 21:36:35 | 00,112,042 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\3.JPG [2009-12-10 15:38:34 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-12-10 01:08:23 | 00,083,843 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\lazur.JPG [2009-12-10 00:51:08 | 00,098,933 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\mafia2.JPG [2009-12-10 00:50:48 | 00,114,664 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\mafia.JPG [2009-12-10 00:33:28 | 00,098,654 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\22.JPG [2009-12-10 00:29:17 | 00,099,943 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\2.JPG [2009-12-09 21:24:21 | 00,652,119 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\vlepka fin.psd [2009-12-09 02:20:18 | 00,003,318 | ---- | M] () -- C:\WINDOWS\bestplayer.bbt [2009-12-09 02:20:18 | 00,002,510 | ---- | M] () -- C:\WINDOWS\bestplayer.ini [2009-12-09 02:20:18 | 00,000,048 | ---- | M] () -- C:\WINDOWS\bestplayer.bpp [2009-12-07 19:28:15 | 00,092,064 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmmdm.sys [2009-12-07 19:28:15 | 00,079,328 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmserd.sys [2009-12-07 19:28:15 | 00,009,232 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmmdfl.sys [2009-12-07 19:28:15 | 00,006,208 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmcmnt.sys [2009-12-07 19:28:15 | 00,005,936 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmwhnt.sys [2009-12-07 19:28:15 | 00,004,048 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmcr.sys [2009-12-07 19:28:14 | 00,066,656 | ---- | M] (MCCI) -- C:\Documents and Settings\Kuba\mqdmbus.sys [2009-12-07 19:28:14 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Kuba\usbsermptxp.sys [2009-12-07 19:28:14 | 00,022,768 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Kuba\usbsermpt.sys [2009-12-07 19:28:14 | 00,009,913 | ---- | M] () -- C:\Documents and Settings\Kuba\MCCI_MDM.INF [2009-12-07 19:28:14 | 00,009,232 | ---- | M] () -- C:\Documents and Settings\Kuba\USB_MOT_BRIT.INF [2009-12-07 19:28:14 | 00,007,201 | ---- | M] () -- C:\Documents and Settings\Kuba\USBMOT2000.INF [2009-12-07 19:28:14 | 00,006,989 | ---- | M] () -- C:\Documents and Settings\Kuba\MCCI_BUS.INF [2009-12-07 19:28:14 | 00,006,141 | ---- | M] () -- C:\Documents and Settings\Kuba\USBMOT2000XP.INF [2009-12-07 19:28:14 | 00,005,960 | ---- | M] () -- C:\Documents and Settings\Kuba\USB_MOT_A1000.INF [2009-12-07 19:28:14 | 00,005,880 | ---- | M] () -- C:\Documents and Settings\Kuba\USB_CMCS_2000.INF [2009-12-07 19:28:14 | 00,004,477 | ---- | M] () -- C:\Documents and Settings\Kuba\MCCI_SDM.INF [2009-12-07 19:25:08 | 00,016,002 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem27.PNF [2009-12-07 19:25:07 | 00,007,754 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem25.PNF [2009-12-07 19:25:07 | 00,007,314 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem26.PNF [2009-12-07 19:25:06 | 00,015,682 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem24.PNF [2009-12-07 19:25:05 | 00,012,348 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem23.PNF [2009-12-07 19:25:02 | 00,012,866 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem22.PNF [2009-12-07 19:24:47 | 00,012,828 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem21.PNF [2009-12-07 19:24:37 | 00,014,334 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem20.PNF [2009-12-07 19:24:18 | 00,009,913 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem27.inf [2009-12-07 19:24:18 | 00,009,232 | ---- | M] () -- C:\Documents and Settings\Kuba\1260210494-(null) [2009-12-07 19:24:18 | 00,006,989 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem25.inf [2009-12-07 19:24:18 | 00,006,209 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem22.inf [2009-12-07 19:24:18 | 00,005,880 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem21.inf [2009-12-07 19:24:18 | 00,005,813 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem23.inf [2009-12-07 19:24:18 | 00,004,477 | ---- | M] () -- C:\Documents and Settings\Kuba\Kopia oem26.inf [2009-12-07 19:24:17 | 00,007,201 | ---- | M] () -- C:\Documents and Settings\Kuba\1260210493-(null) [2009-12-03 01:47:22 | 06,612,330 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\prawoadministracyjne_wykad29_10_2009.zip [2009-12-03 01:46:25 | 25,367,336 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\prawoadministracyjne_wykad5_11_2009.zip [2009-11-30 22:45:07 | 00,121,206 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\srax2.JPG [2009-11-30 22:43:28 | 00,104,095 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\srax.JPG [2009-11-29 13:01:11 | 00,000,745 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\DAEMON Tools Lite.lnk [2009-11-29 12:59:10 | 00,691,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-11-27 11:21:56 | 00,000,918 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2010.lnk [2009-11-26 23:17:19 | 28,975,646 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\polish.ltc [2009-11-22 13:51:52 | 20,037,854 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\Student's Book.pdf [2009-11-22 13:49:44 | 00,036,352 | ---- | M] () -- C:\Documents and Settings\Kuba\Pulpit\WIARA.doc [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-11 20:17:00 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\HijackThis.lnk [2009-12-11 18:51:46 | 00,000,933 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\Spybot - Search & Destroy.lnk [2009-12-11 18:20:36 | 00,000,841 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-12-11 17:27:53 | 00,000,702 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\Odkurzacz.lnk [2009-12-11 15:25:54 | 00,000,016 | ---- | C] () -- C:\Documents and Settings\NetworkService\Dane aplikacji\fvgqad.dat [2009-12-11 15:25:36 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Kuba\Dane aplikacji\avdrn.dat [2009-12-10 21:37:03 | 00,092,410 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\33.JPG [2009-12-10 21:36:35 | 00,112,042 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\3.JPG [2009-12-10 01:08:23 | 00,083,843 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\lazur.JPG [2009-12-10 00:51:08 | 00,098,933 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\mafia2.JPG [2009-12-10 00:50:47 | 00,114,664 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\mafia.JPG [2009-12-10 00:33:28 | 00,098,654 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\22.JPG [2009-12-10 00:29:15 | 00,099,943 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\2.JPG [2009-12-09 21:24:17 | 00,652,119 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\vlepka fin.psd [2009-12-07 19:28:14 | 00,016,002 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem27.PNF [2009-12-07 19:28:14 | 00,015,682 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem24.PNF [2009-12-07 19:28:14 | 00,012,348 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem23.PNF [2009-12-07 19:28:14 | 00,009,913 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem27.inf [2009-12-07 19:28:14 | 00,009,232 | ---- | C] () -- C:\Documents and Settings\Kuba\1260210494-(null) [2009-12-07 19:28:14 | 00,007,754 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem25.PNF [2009-12-07 19:28:14 | 00,007,314 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem26.PNF [2009-12-07 19:28:14 | 00,006,989 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem25.inf [2009-12-07 19:28:14 | 00,005,813 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem23.inf [2009-12-07 19:28:14 | 00,004,477 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem26.inf [2009-12-07 19:28:13 | 00,014,334 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem20.PNF [2009-12-07 19:28:13 | 00,012,866 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem22.PNF [2009-12-07 19:28:13 | 00,012,828 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem21.PNF [2009-12-07 19:28:13 | 00,007,201 | ---- | C] () -- C:\Documents and Settings\Kuba\1260210493-(null) [2009-12-07 19:28:13 | 00,006,209 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem22.inf [2009-12-07 19:28:13 | 00,005,880 | ---- | C] () -- C:\Documents and Settings\Kuba\Kopia oem21.inf [2009-12-07 19:24:18 | 00,009,913 | ---- | C] () -- C:\Documents and Settings\Kuba\MCCI_MDM.INF [2009-12-07 19:24:18 | 00,009,232 | ---- | C] () -- C:\Documents and Settings\Kuba\USB_MOT_BRIT.INF [2009-12-07 19:24:18 | 00,006,989 | ---- | C] () -- C:\Documents and Settings\Kuba\MCCI_BUS.INF [2009-12-07 19:24:18 | 00,006,141 | ---- | C] () -- C:\Documents and Settings\Kuba\USBMOT2000XP.INF [2009-12-07 19:24:18 | 00,005,960 | ---- | C] () -- C:\Documents and Settings\Kuba\USB_MOT_A1000.INF [2009-12-07 19:24:18 | 00,005,880 | ---- | C] () -- C:\Documents and Settings\Kuba\USB_CMCS_2000.INF [2009-12-07 19:24:18 | 00,004,477 | ---- | C] () -- C:\Documents and Settings\Kuba\MCCI_SDM.INF [2009-12-07 19:24:17 | 00,007,201 | ---- | C] () -- C:\Documents and Settings\Kuba\USBMOT2000.INF [2009-12-03 01:47:20 | 06,612,330 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\prawoadministracyjne_wykad29_10_2009.zip [2009-12-03 01:46:21 | 25,367,336 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\prawoadministracyjne_wykad5_11_2009.zip [2009-11-30 22:45:06 | 00,121,206 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\srax2.JPG [2009-11-30 22:43:28 | 00,104,095 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\srax.JPG [2009-11-29 13:01:11 | 00,000,745 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\DAEMON Tools Lite.lnk [2009-11-27 11:21:56 | 00,000,918 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2010.lnk [2009-11-26 23:11:09 | 28,975,646 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\polish.ltc [2009-11-22 13:50:25 | 20,037,854 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\Student's Book.pdf [2009-11-22 13:49:43 | 00,036,352 | ---- | C] () -- C:\Documents and Settings\Kuba\Pulpit\WIARA.doc [2009-08-04 07:13:53 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-07-07 15:49:47 | 00,000,015 | ---- | C] () -- C:\WINDOWS\Robot Office Common.ini [2009-06-10 08:28:28 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\44ff0251.sys [2009-06-10 08:27:46 | 00,000,008 | ---- | C] () -- C:\Documents and Settings\Kuba\Dane aplikacji\wiaserva.log [2009-03-26 20:09:27 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\callrun.dll [2009-03-26 20:09:01 | 00,000,065 | ---- | C] () -- C:\WINDOWS\DICWORD.INI [2009-03-26 20:09:01 | 00,000,012 | ---- | C] () -- C:\WINDOWS\RUNTEST.INI [2009-03-16 19:38:50 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2009-03-16 19:37:32 | 00,000,740 | ---- | C] () -- C:\WINDOWS\disney.ini [2009-02-12 21:46:05 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2008-12-22 17:49:27 | 00,061,440 | --S- | C] () -- C:\WINDOWS\System32\fhrrc.dll [2008-12-22 17:49:26 | 00,640,957 | RHS- | C] () -- C:\WINDOWS\System32\sysfhr.sys [2008-11-24 20:15:19 | 00,001,058 | ---- | C] () -- C:\WINDOWS\VPlayer.INI [2008-11-05 00:38:06 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL [2008-09-29 00:43:08 | 00,001,382 | ---- | C] () -- C:\WINDOWS\kaillera.ini [2008-09-03 14:50:00 | 00,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI [2008-09-03 12:09:36 | 00,000,243 | ---- | C] () -- C:\WINDOWS\7thlevel.ini [2008-09-02 09:15:25 | 00,000,056 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008-04-21 19:31:02 | 01,867,776 | ---- | C] () -- C:\WINDOWS\System32\python24.dll [2008-03-28 20:14:20 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-03-28 20:14:14 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-03-28 20:14:10 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-03-28 20:14:10 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-02-21 23:44:58 | 00,002,510 | ---- | C] () -- C:\WINDOWS\bestplayer.ini [2008-01-19 19:15:43 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2008-01-19 19:15:42 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2008-01-19 19:15:42 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2007-11-21 21:53:59 | 00,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2007-11-19 23:11:56 | 00,158,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2007-11-18 18:44:00 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Kuba\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007-11-18 16:49:32 | 00,000,405 | ---- | C] () -- C:\WINDOWS\Ausba4.ini [2007-11-18 15:57:38 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007-11-18 12:42:24 | 00,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat [2007-11-18 12:40:46 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007-11-17 23:54:57 | 00,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2007-11-17 23:51:20 | 00,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2007-11-17 23:08:35 | 00,000,199 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2007-11-17 23:08:35 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2007-10-20 01:56:16 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007-10-20 01:54:28 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2007-10-20 01:54:28 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2006-10-22 12:22:00 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2005-12-07 12:31:00 | 00,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2005-06-15 17:20:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-06-15 17:20:00 | 01,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-06-15 17:20:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-06-15 17:20:00 | 00,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2005-06-15 17:20:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-06-15 17:20:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002-03-05 10:43:10 | 00,167,936 | ---- | C] () -- C:\WINDOWS\A4.dll [2001-10-18 18:01:16 | 00,045,056 | ---- | C] () -- C:\WINDOWS\GetKey.dll [color=#E56717]========== LOP Check ==========[/color] [2009-12-11 17:08:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software [2009-11-29 12:58:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2008-11-14 09:02:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations [2008-09-04 16:51:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\n7-89-o9-3r-4t-r9 [2008-01-08 21:48:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks [2008-11-14 09:03:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2009-11-27 11:27:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2009-09-29 23:07:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\BESTplayer [2007-11-18 01:40:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\BitTorrent [2007-11-21 18:21:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Business Logic [2009-11-29 14:08:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\DAEMON Tools Lite [2007-11-17 23:56:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\DAEMON Tools Pro [2008-12-22 17:15:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Datalayer [2009-12-01 00:30:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\DC++ [2009-10-28 22:39:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Eidos [2007-11-17 23:59:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Gadu-Gadu [2009-07-24 20:27:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\GanymedeNet [2009-05-20 20:50:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\HEXelon [2008-05-21 22:54:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\ICQ [2009-09-29 21:10:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\iMeshMediabarTb [2009-10-30 22:56:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\My Games [2008-12-01 15:37:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Nokia Multimedia Player [2008-12-02 12:45:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Nowe Gadu-Gadu [2008-11-14 09:03:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\PC Suite [2008-06-19 23:37:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\pl-soft [2009-11-27 11:26:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Sports Interactive [2009-04-22 22:19:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Thinstall [2008-04-21 21:55:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Kuba\Dane aplikacji\Tibia [2009-12-11 16:58:26 | 00,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Drugi log z EXTRAS nie chce wejść, gdyż jest napisane, że post ma za dużo znaków

**Posty:** 2183 · przez **NieWiem** 11 Gru 2009, 22:08

No siedzi sobie pan szkodnik

Wykonaj po kolei, tak jak piszę:

Pliki

C:\WINDOWS\System32\drivers\44ff0251.sys
C:\WINDOWS\System32\drivers\atapi.sys

proszę przeskanować na www.virusscan.jotti.org albo na www.virscan.org i pokazać wyniki.

Przeczytaj uważnie instrukcję programu ComboFix, po czym wyłącz swój program antywirusowy, firewall i inne programy, które mogą zakłócać nawet pobieranie ComboFixa twierdząc, że jest wirusem. Nie jest! Spokojnie go ściągnij i zapisz na pulpicie.
Pobierz z któregoś poniższego linku:
- LINK #1
- LINK #2
Pozamykaj wszystkie otwarte okna, komunikatory, programy. ComboFixowi nie powinno sie przeszkadzać.
Uruchom program z dwukliku (VISTA: prawoklik i 'uruchom jako administrator').
Pozwól mu spokojnie działać, nie klikaj ani nie stukaj w klawiaturę - to może spwodować zawieszenie się komputera.
Zalecane jest też instalowanie konsoli odzyskiwania, jeśli ComboFix o nią poprosi. Dzięki niej można odrolować zmiany w przypadku pomyłki narzędzia.
Jeśli będzie potrzeba - zgódź się na restart.
Kiedy program skończy, wytworzy loga (będzie on także w pliku C:\ComboFix.txt), którego wklej w odpowiedzi, pamiętając o tagach [code] lub na http://www.wklej.org.

Pobierz program DDS:
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Wyskoczy DOSowe okienko informujące, że w tle odbywa się nieingerencyjne skanowanie. Gdy zostanie zakończone, zostanie pokazane okno z komunikatem.
Wygenerowane przez program logi DDS.txt oraz Attach.txt proszę załączyć w poście w tagach [code] lub wkleić na stronie http://www.wklej.org.

**Posty:** 79 · przez **LOL3K** 11 Gru 2009, 22:17

Kod: Zaznacz wszystko: Nazwa pliku: atapi.sys Stan: Skanowanie zakończone. 0 z 22 skanerów zgłaszają wirusy. Skanowanie podjęte w: czw 10 gru 2009 19:57:05 (CET) Rozmiar pliku: 96512 bajtów Typ pliku: PE32 executable for MS Windows (native) Intel 80386 32-bit MD5: 9f3a2f5aa6875c72bf062c712cfa2674 SHA1: a719156e8ad67456556a02c34e762944234e7a44 Packer (Kaspersky): PE_Patch

Plik ten 44ff0251.sys jest plikiem pustym
Stan:
Plik jest pusty (0 bajtów)!

**Posty:** 2183 · przez **NieWiem** 11 Gru 2009, 22:25

LOL3K, pokaż jeszcze logi

**Posty:** 79 · przez **LOL3K** 11 Gru 2009, 22:27

Są w trakcie 'robienia'.
Teraz piszę z laptopa

Edit: ale to długo trwa...

Dodano 11.12.2009 22:04:49:
Wreszcie...

Kod: Zaznacz wszystko: ComboFix 09-12-11.01 - Kuba 2009-12-11 21:31:58.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.767.569 [GMT 1:00] Uruchomiony z: c:\documents and settings\Kuba\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090702-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Kuba\Dane aplikacji\wiaserva.log c:\documents and settings\Kuba\Menu Start\Programy\Autostart\siszyd32.exe c:\program files\Mozilla Firefox\plc4.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SYSDRV ((((((((((((((((((((((((( Pliki utworzone od 2009-11-11 do 2009-12-11 ))))))))))))))))))))))))))))))) . 2009-12-11 19:29 . 2009-12-11 19:29 -------- d-----w- C:\!FixIEDef 2009-12-11 19:17 . 2009-12-11 19:17 -------- d-----w- c:\program files\Trend Micro 2009-12-11 17:51 . 2009-12-11 19:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-12-11 17:51 . 2009-12-11 17:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-12-11 17:20 . 2009-12-11 17:20 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Lavasoft 2009-12-11 16:27 . 2009-12-11 16:58 -------- d-----w- c:\program files\Odkurzacz 2009-12-07 18:27 . 2009-12-07 18:27 -------- d-----w- c:\documents and settings\Kuba\Ustawienia lokalne\Dane aplikacji\BVRP Software 2009-12-07 18:26 . 2008-04-13 18:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-12-07 18:26 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-12-07 18:24 . 2009-12-11 16:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2009-12-07 18:24 . 2009-12-07 18:28 5936 ----a-w- c:\documents and settings\Kuba\mqdmwhnt.sys 2009-12-07 18:24 . 2009-12-07 18:28 9232 ----a-w- c:\documents and settings\Kuba\mqdmmdfl.sys 2009-12-07 18:24 . 2009-12-07 18:28 92064 ----a-w- c:\documents and settings\Kuba\mqdmmdm.sys 2009-12-07 18:24 . 2009-12-07 18:28 79328 ----a-w- c:\documents and settings\Kuba\mqdmserd.sys 2009-12-07 18:24 . 2009-12-07 18:28 6208 ----a-w- c:\documents and settings\Kuba\mqdmcmnt.sys 2009-12-07 18:24 . 2009-12-07 18:28 4048 ----a-w- c:\documents and settings\Kuba\mqdmcr.sys 2009-12-07 18:24 . 2009-12-07 18:28 66656 ----a-w- c:\documents and settings\Kuba\mqdmbus.sys 2009-12-07 18:24 . 2009-12-07 18:28 25600 ----a-w- c:\documents and settings\Kuba\usbsermptxp.sys 2009-12-07 18:24 . 2009-12-07 18:28 22768 ----a-w- c:\documents and settings\Kuba\usbsermpt.sys 2009-12-07 18:19 . 2009-12-07 18:19 -------- d-----w- c:\program files\Słownik SuperMemo 2009-11-29 11:59 . 2009-11-29 11:59 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-11-29 11:58 . 2009-11-29 11:59 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-11-29 11:58 . 2009-11-29 13:08 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\DAEMON Tools Lite 2009-11-29 11:58 . 2009-11-29 11:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2009-11-27 10:27 . 2009-11-27 10:27 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2009-11-27 10:23 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-11-27 10:23 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-11-27 10:23 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-11-27 10:23 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-11-27 10:23 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-11-27 10:23 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-11-27 10:23 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-11-27 10:07 . 2009-11-27 10:07 -------- d-----w- c:\program files\Sports Interactive . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-11 17:20 . 2007-11-17 22:39 -------- d-----w- c:\program files\Lavasoft 2009-12-11 17:04 . 2007-11-18 00:50 -------- d-----w- c:\program files\Steam 2009-12-11 16:41 . 2009-08-01 17:30 -------- d-----w- c:\program files\PokerStars 2009-12-11 16:41 . 2009-10-30 21:52 -------- d-----w- c:\program files\Anti-Blaxx 2009-12-11 16:41 . 2009-04-03 20:51 -------- d-----w- c:\program files\DC++ 2009-12-11 16:41 . 2007-11-18 00:41 -------- d-----w- c:\program files\BitComet 2009-12-11 16:41 . 2007-11-18 00:37 -------- d-----w- c:\program files\eMule 2009-12-11 16:41 . 2009-07-06 11:13 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-12-11 16:41 . 2007-12-11 18:38 -------- d-----w- c:\program files\SopCast 2009-12-11 16:41 . 2009-08-04 17:42 -------- d-----w- c:\program files\QuickTime 2009-12-11 16:14 . 2007-12-14 18:35 -------- d-----w- c:\program files\CCleaner 2009-12-11 16:09 . 2007-11-17 23:16 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-12-11 14:26 . 2009-12-11 14:25 16 ----a-w- c:\documents and settings\NetworkService\Dane aplikacji\fvgqad.dat 2009-12-11 14:25 . 2009-12-11 14:25 4 ----a-w- c:\documents and settings\Kuba\Dane aplikacji\avdrn.dat 2009-11-30 23:30 . 2009-04-03 20:52 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\DC++ 2009-11-29 11:59 . 2007-11-17 22:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-11-27 10:26 . 2007-11-17 23:33 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Sports Interactive 2009-11-10 22:00 . 2008-05-22 14:15 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-11-02 18:34 . 2007-11-17 21:47 70064 -c--a-w- c:\documents and settings\Kuba\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-10-30 21:56 . 2009-10-30 21:56 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\My Games 2009-10-30 21:48 . 2009-10-30 21:48 -------- d-----w- c:\program files\Firaxis Games 2009-10-29 00:16 . 2001-10-26 17:15 85244 ----a-w- c:\windows\system32\perfc015.dat 2009-10-29 00:16 . 2001-10-26 17:15 494024 ----a-w- c:\windows\system32\perfh015.dat 2009-10-28 23:32 . 2009-02-11 11:42 -------- d-----w- c:\program files\EA GAMES 2009-10-28 21:39 . 2009-10-28 21:39 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Eidos 2009-10-28 21:38 . 2009-10-28 21:38 93184 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut3_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 93184 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut2_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 65536 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut1_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 170790 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut11_8D2AC4F20BBA4A94A8668B54263FAE87_1.exe 2009-10-28 21:38 . 2009-10-28 21:38 16958 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut5_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 16958 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\ARPPRODUCTICON.exe 2009-10-28 21:24 . 2009-10-28 21:24 -------- d-----w- c:\program files\Eidos 2009-10-21 18:08 . 2007-11-17 22:02 -------- d-----w- c:\program files\Gadu-Gadu 2009-10-16 14:50 . 2009-11-11 18:33 2520888 ----a-w- c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll 2008-12-22 16:49 . 2008-12-22 16:49 5188 --sh--r- c:\windows\system32\sysfhr.dat 2008-12-22 16:49 . 2008-12-22 16:49 640957 --sh--r- c:\windows\system32\sysfhr.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}] 2009-07-31 11:58 91568 ----a-w- c:\program files\iMeshMediabarTb\iMeshMediaBarDx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMeshMediabarTb\iMeshMediaBarDx.dll" [2009-07-31 91568] [HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-21 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2009-04-29 124928] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Steam\\SteamApps\\kuba_13@o2.pl\\counter-strike\\hl.exe"= "c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\ICQ6\\ICQ.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Documents and Settings\\Kuba\\Pulpit\\NovoGames_Full\\Novogames_Full\\gameunp.exe"= "c:\\Documents and Settings\\Kuba\\Pulpit\\NovoGames_Full\\Novogames_Full\\reszta gier\\gameunp.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2010\\fm.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26335:TCP"= 26335:TCP:BitComet 26335 TCP "26335:UDP"= 26335:UDP:BitComet 26335 UDP R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2007-11-17 691696] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-29 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-09-29 20560] R2 SG_Service;SoftGuard Service;c:\program files\Common Files\RbtProt\sgsrv.exe [2004-09-21 155648] S1 44ff0251;44ff0251;c:\windows\system32\drivers\44ff0251.sys [2009-06-10 0] . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.imesh.com/ IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://legialive.pl/ FF - prefs.js: keyword.URL - hxxp://search.imesh.com/webResults.html?src=ffb&q= FF - plugin: c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPBOARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMAKAOV2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPNAVY.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPOKER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQUEST3D.DLL FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSNOOKER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSOCCER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPWORDS.dll . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{474597C5-AB09-49d6-A4D5-2E8D7341384E} - c:\program files\iMesh Applications\iMesh\iMeshIEHelper.dll AddRemove-FIFA RTWC 98 - c:\program files\EA SPORTS\FIFA RTWC 98\DeIsL1.isu AddRemove-iMesh - c:\program files\iMesh Applications\iMesh\UninstallSurvey.exe AddRemove-BitTorrent DNA - c:\program files\BitTorrent_DNA\dna.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-11 21:44 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... c:\windows\system32\wuauclt.exe.wusetup.755836.bak 51224 bytes executable c:\windows\system32\wuaueng.dll.wusetup.761014.bak 1809944 bytes executable skanowanie pomyślnie ukończone ukryte pliki: 2 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spoy.sys >>UNKNOWN [0x82F90938]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf7573f28 \Driver\ACPI -> ACPI.sys @ 0xf73dacb8 \Driver\atapi -> atapi.sys @ 0xf736fb40 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8 ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8 ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6 NDIS: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf7279bd4 PacketIndicateHandler -> NDIS.sys @ 0xf7285a21 SendHandler -> NDIS.sys @ 0xf7279d44 user & kernel MBR OK ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2932) c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll c:\program files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL c:\program files\Microsoft Office\OFFICE11\msohev.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\RUNDLL32.EXE c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\windows\system32\nvsvc32.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\windows\system32\wdfmgr.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\windows\system32\wscntfy.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Czas ukończenia: 2009-12-11 21:54:39 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-12-11 20:54 Przed: 2 699 366 400 bajtów wolnych Po: 2 655 502 336 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - B06A81A95371BF14AD4639665DBCF9A6

Kod: Zaznacz wszystko: DDS (Ver_09-12-01.01) - NTFSx86 Run by Kuba at 22:05:39,09 on 2009-12-11 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_03 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.767.471 [GMT 1:00] AV: avast! antivirus 4.8.1335 [VPS 090702-0] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Common Files\RbtProt\sgsrv.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\93927ffa759a1bca5e140b35fbf5c705\update\update.exe C:\Documents and Settings\Kuba\Pulpit\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://search.imesh.com/ BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.2.28.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File uRun: [Gadu-Gadu] "c:\program files\gadu-gadu\gg.exe" /tray uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.2.2.28.dll/206 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6\ICQ.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kuba\daneap~1\mozilla\firefox\profiles\btjhrbyn.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://legialive.pl/ FF - prefs.js: keyword.URL - hxxp://search.imesh.com/webResults.html?src=ffb&q= FF - plugin: c:\documents and settings\kuba\dane aplikacji\mozilla\firefox\profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPBOARDS.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\mozilla firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMAKAOV2.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPNAVY.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPPOKER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPQUEST3D.DLL FF - plugin: c:\program files\mozilla firefox\plugins\NPSNOOKER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPSOCCER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPWORDS.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-9-29 114768] R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-9-29 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2007-11-18 138680] R2 SG_Service;SoftGuard Service;c:\program files\common files\rbtprot\sgsrv.exe [2004-9-21 155648] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2007-11-18 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2007-11-18 352920] S1 44ff0251;44ff0251;c:\windows\system32\drivers\44ff0251.sys [2009-6-10 0] =============== Created Last 30 ================ 2009-12-11 21:05:48 0 d--h--w- c:\windows\$hf_mig$ 2009-12-11 20:29:31 0 d-sha-r- C:\cmdcons 2009-12-11 20:27:47 77312 ----a-w- c:\windows\MBR.exe 2009-12-11 20:27:46 98816 ----a-w- c:\windows\sed.exe 2009-12-11 20:27:46 261632 ----a-w- c:\windows\PEV.exe 2009-12-11 20:27:46 161792 ----a-w- c:\windows\SWREG.exe 2009-12-11 19:29:26 0 d-----w- C:\!FixIEDef 2009-12-11 19:17:00 0 d-----w- c:\program files\Trend Micro 2009-12-11 17:51:37 0 d-----w- c:\program files\Spybot - Search & Destroy 2009-12-11 17:51:37 0 d-----w- c:\docume~1\alluse~1\daneap~1\Spybot - Search & Destroy 2009-12-11 16:27:34 0 d-----w- c:\program files\Odkurzacz 2009-12-11 14:25:36 4 ----a-w- c:\docume~1\kuba\daneap~1\avdrn.dat 2009-12-07 18:26:01 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-12-07 18:26:01 26112 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-12-07 18:19:11 0 d-----w- c:\program files\Słownik SuperMemo 2009-11-29 11:59:20 0 d-----w- c:\program files\DAEMON Tools Toolbar 2009-11-29 11:58:57 0 d-----w- c:\program files\DAEMON Tools Lite 2009-11-29 11:58:33 0 d-----w- c:\docume~1\kuba\daneap~1\DAEMON Tools Lite 2009-11-29 11:58:20 0 d-----w- c:\docume~1\alluse~1\daneap~1\DAEMON Tools Lite 2009-11-27 10:27:24 0 d-----w- c:\docume~1\alluse~1\daneap~1\Sports Interactive 2009-11-27 10:23:51 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-11-27 10:23:51 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-11-27 10:23:50 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-11-27 10:23:49 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-11-27 10:23:49 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-11-27 10:23:48 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-11-27 10:23:48 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-11-27 10:07:06 0 d-----w- c:\program files\Sports Interactive ==================== Find3M ==================== 2009-12-07 18:28:15 9232 ----a-w- c:\documents and settings\kuba\mqdmmdfl.sys 2009-12-07 18:28:15 92064 ----a-w- c:\documents and settings\kuba\mqdmmdm.sys 2009-12-07 18:28:15 79328 ----a-w- c:\documents and settings\kuba\mqdmserd.sys 2009-12-07 18:28:15 6208 ----a-w- c:\documents and settings\kuba\mqdmcmnt.sys 2009-12-07 18:28:15 5936 ----a-w- c:\documents and settings\kuba\mqdmwhnt.sys 2009-12-07 18:28:15 4048 ----a-w- c:\documents and settings\kuba\mqdmcr.sys 2009-12-07 18:28:14 66656 ----a-w- c:\documents and settings\kuba\mqdmbus.sys 2009-12-07 18:28:14 25600 ----a-w- c:\documents and settings\kuba\usbsermptxp.sys 2009-12-07 18:28:14 22768 ----a-w- c:\documents and settings\kuba\usbsermpt.sys 2009-11-29 11:59:10 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-29 00:16:26 85244 ----a-w- c:\windows\system32\perfc015.dat 2009-10-29 00:16:26 494024 ----a-w- c:\windows\system32\perfh015.dat 2001-11-23 04:08:20 712704 -c--a-r- c:\windows\inf\other\AUDIO3D.DLL 2008-12-22 16:49:28 5188 --sh--r- c:\windows\system32\sysfhr.dat 2008-12-22 16:49:22 640957 --sh--r- c:\windows\system32\sysfhr.sys 2008-11-02 23:30:54 32768 -csha-w- c:\windows\system32\config\systemprofile\ustawienia lokalne\historia\history.ie5\mshist012008110320081104\index.dat ============= FINISH: 22:07:38,69 ===============

Dodano 11.12.2009 22:12:16:
DDS plik Attach

Kod: Zaznacz wszystko: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 2007-11-17 22:42:47 System Uptime: 2009-12-11 21:56:17 (1 hours ago) Motherboard: ECS | | K7S5A Processor: AMD Athlon(tm) XP 2000+ | Socket-A | 1659/66mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 29 GiB total, 2,45 GiB free. D: is FIXED (NTFS) - 115 GiB total, 3,995 GiB free. E: is CDROM () F: is CDROM () G: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP673: 2009-12-11 17:52:09 - Usunięte Anno 1701 RP674: 2009-12-11 17:53:00 - Installed Sid Meier's Civilization 4 RP675: 2009-12-11 17:52:12 - Punkt kontrolny systemu RP676: 2009-12-11 17:52:14 - Punkt kontrolny systemu RP677: 2009-12-11 17:52:15 - Punkt kontrolny systemu RP678: 2009-12-11 17:52:17 - Punkt kontrolny systemu RP679: 2009-12-11 17:52:18 - Punkt kontrolny systemu RP680: 2009-12-11 17:52:20 - Punkt kontrolny systemu RP681: 2009-12-11 17:52:21 - Punkt kontrolny systemu RP682: 2009-12-11 17:52:23 - Punkt kontrolny systemu RP683: 2009-12-11 17:52:24 - Punkt kontrolny systemu RP684: 2009-12-11 17:52:00 - Zainstalowano: IKEA Home Planner RP685: 2009-12-11 17:52:05 - Usunięto: IKEA Home Planner RP686: 2009-12-11 17:52:26 - Punkt kontrolny systemu RP687: 2009-12-11 17:52:27 - Punkt kontrolny systemu RP688: 2009-12-11 17:52:29 - Punkt kontrolny systemu RP689: 2009-12-11 17:52:31 - Punkt kontrolny systemu RP690: 2009-12-11 17:52:32 - Punkt kontrolny systemu RP691: 2009-12-11 17:52:34 - Punkt kontrolny systemu RP692: 2009-12-11 17:52:35 - Punkt kontrolny systemu RP693: 2009-12-11 17:52:37 - Punkt kontrolny systemu RP694: 2009-12-11 17:52:39 - Punkt kontrolny systemu RP695: 2009-12-11 17:52:40 - Punkt kontrolny systemu RP696: 2009-12-11 17:52:42 - Punkt kontrolny systemu RP697: 2009-12-11 17:52:43 - Punkt kontrolny systemu RP698: 2009-12-11 17:52:45 - Punkt kontrolny systemu RP699: 2009-12-11 17:51:58 - Zainstalowany program DirectX RP700: 2009-12-11 17:52:46 - Punkt kontrolny systemu RP701: 2009-12-11 17:52:11 - SPTD setup V1.62 RP702: 2009-12-11 17:52:47 - Punkt kontrolny systemu RP703: 2009-12-11 17:52:49 - Punkt kontrolny systemu RP704: 2009-12-11 17:52:50 - Punkt kontrolny systemu RP705: 2009-12-11 17:52:52 - Punkt kontrolny systemu RP706: 2009-12-11 17:52:53 - Punkt kontrolny systemu RP707: 2009-12-11 17:52:54 - Punkt kontrolny systemu RP708: 2009-12-11 17:52:01 - Zainstalowane Motorola Phone Tools RP709: 2009-12-11 17:52:03 - Zainstalowane Motorola Phone Tools RP710: 2009-12-11 17:52:04 - Zainstalowane Motorola Phone Tools RP711: 2009-12-11 17:53:02 - Instalacja niepodpisanego sterownika RP712: 2009-12-11 17:52:56 - Punkt kontrolny systemu RP713: 2009-12-11 17:52:57 - Punkt kontrolny systemu RP714: 2009-12-11 17:52:59 - Punkt kontrolny systemu RP715: 2009-12-11 17:52:07 - Usunięte Motorola Phone Tools RP716: 2009-12-11 17:52:08 - Usunięte Motorola Phone Tools RP717: 2009-12-11 17:08:24 - Usunięte Motorola Phone Tools RP718: 2009-12-11 20:30:11 - Created By FixIEDef ==== Installed Programs ====================== Ad-Aware Ad-Aware SE Personal Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Reader 8 - Polish Adobe Reader 8.1.2 Security Update 1 (KB403742) Adobe Shockwave Player Aktualizacja dla systemu Windows XP (KB951072-v2) Aktualizacja dla systemu Windows XP (KB951978) Aktualizacja dla systemu Windows XP (KB955839) Aktualizacja dla systemu Windows XP (KB967715) Aktualizacja zabezpieczeń dla programu Windows Media Player (KB952069) Aktualizacja zabezpieczeń dla programu Windows Media Player 10 (KB936782) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB950759) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB953838) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB956390) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB958215) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB960714) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB961260) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB963027) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB969897) Aktualizacja zabezpieczeń dla systemu Windows XP (KB923561) Aktualizacja zabezpieczeń dla systemu Windows XP (KB923789) Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464-v2) Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464) Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950760) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748) Aktualizacja zabezpieczeń dla systemu Windows XP (KB952004) Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954) Aktualizacja zabezpieczeń dla systemu Windows XP (KB953839) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954600) Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956391) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956572) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956802) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841) Aktualizacja zabezpieczeń dla systemu Windows XP (KB957095) Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958687) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958690) Aktualizacja zabezpieczeń dla systemu Windows XP (KB959426) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960225) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960715) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960803) Aktualizacja zabezpieczeń dla systemu Windows XP (KB961373) Aktualizacja zabezpieczeń dla systemu Windows XP (KB961501) Aktualizacja zabezpieczeń dla systemu Windows XP (KB968537) Aktualizacja zabezpieczeń dla systemu Windows XP (KB969898) Aktualizacja zabezpieczeń dla systemu Windows XP (KB970238) Aktualizacja zabezpieczeń dla Windows XP (KB923689) Aktualizacja zabezpieczeń dla Windows XP (KB941569) ALLPlayer V4.X Anti-Blaxx 1.17 Apple Software Update Archiwizator WinRAR AutoUpdate avast! Antivirus BitComet 1.01 CCleaner DAEMON Tools Toolbar DC++ 0.750 Deluxe Ski Jump 3 v1.5.0 DivX Content Uploader DivX Converter DivX Player DivX Web Player EasyCleaner eMule eMule 0.48a EVEREST Home Edition v2.20 Football Manager 2010 Gadu-Gadu 7.7 GameDesire-Bingo GameDesire-Poker GameDesire-Pool & Snooker Gronzo ver 1.02 HijackThis 2.0.2 ICQ6 Java(TM) 6 Update 3 K-Lite Codec Pack 3.8.5 Full MediaBar Microsoft .NET Framework 2.0 Language Pack - PLK Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 2.0 — pakiet języka polskiego Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.0 Polish Language Pack Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 mIRC Monopoly by Parker Brothers Mozilla Firefox (3.0.2) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6.0 Parser (KB933579) Nero 8 Nokia Connectivity Cable Driver Nokia Lifeblog 2.1 Nokia MTP driver Nokia N73 highlights Nokia Nseries Skin for Microsoft Windows Media Player Nokia PC Connectivity Solution Nokia PC Suite Nokia themes for your device NVIDIA Drivers Odkurzacz 11.3 Pakiet języka polskiego dla systemu Microsoft .NET Framework 3.0 PokerStars Poprawka dla systemu Windows Internet Explorer 7 (KB947864) Poprawka dla systemu Windows XP (KB952287) PowerDVD Quest3D Web Viewers 4.2 QuickTime Real Alternative 1.7.5 Reservoir Dogs Rhapsody Player Engine Słownik SuperMemo Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Sid Meier's Civilization 4 Skype™ 3.6 SopCast 2.0.4 Spolszczenie DC++ 0.699 Spybot - Search & Destroy Steam System Requirements Lab The Sims Gwiazda Tibia WebFldrs XP Winamp Windows Communication Foundation Windows Communication Foundation Language Pack - PLK Windows Imaging Component Windows Internet Explorer 7 Windows Media Format Runtime Windows Media Player 10 Windows Presentation Foundation Windows Presentation Foundation Language Pack (PLK) Windows Workflow Foundation Windows Workflow Foundation PL Language Pack Windows XP Service Pack 3 WinISO 5.3 Worms World Party XML Paper Specification Shared Components Language Pack 1.0 XML Paper Specification Shared Components Pack 1.0 ==== Event Viewer Messages From Past Week ======== 2009-12-11 17:09:36, informacje: Windows File Protection [64002] - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\usbser.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.5512. 2009-12-07 19:26:11, informacje: Windows File Protection [64001] - Podjęto próbę zamiany chronionego pliku systemowego usbser.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.1330, wersja pliku systemowego: 5.1.2600.5512. ==== End Of File ===========================

**Posty:** 2183 · przez **NieWiem** 11 Gru 2009, 23:16

Otwórz systemowy notatnik (i tylko on, ponieważ ComboFix jest niekompatybilny z innymi) i wklej do niego poniższy skrypt:
http://forum.programosy.pl/ostra-zamulka-100-zuzycie-procesora-log-vt115351.html

File::
c:\documents and settings\NetworkService\Dane aplikacji\fvgqad.dat
c:\documents and settings\Kuba\Dane aplikacji\avdrn.dat

Folder::
C:\!FixIEDef
c:\program files\DAEMON Tools Toolbar

DDS::
TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
Plik zapisz jako CFScript.txt
Obowiązują te same zasady, jak przy normalnym używaniu ComboFixa, czyli:
- nie klikać myszką
- nie walić w klawiaturę
- pozamykać wszystko co możliwe (to, co teraz czytasz też!)
- wyłączyć antywirusa, firewalla i wszystko podobne
Plik CFScript.txt przeciągnij i upuść na ikonę ComboFixa, jak na obrazku poniżej:
To go uruchomi i rozpocznie się normalne działanie ComboFixa.
Jeśli komputer poprosi o zgodę na resart - zgodzić się!
Program wytworzy loga, którego wklejamy na forum w tagach [code] lub na stronie http://www.wklej.org

W Panelu Sterowania ręcznie odinstaluj

iMeshMediaBar

Plik

C:\WINDOWS\SoftwareDistribution\Download\93927ffa759a1bca5e140b35fbf5c705\update\update.exe

sprawdzić na http://www.virscan.org i pokazać wyniki.

Pobierz program Malwarebytes' Anti-Malware i zainstaluj.
Wersja freeware nie ma opcji automatycznych aktualizacji, dlatego pod koniec instalacji upewnij się, że zaznaczone są opcje:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Wciśnij Finish.
Przeprowadź pełne skanowanie komputera.
Raport z tego skanowania proszę wkleić na forum w tagach [code], lub na stronie http://www.wklej.org a w odpowiedzi podać tylko linka do tej strony.

**Posty:** 79 · przez **LOL3K** 11 Gru 2009, 23:18

Już to robię tylko dodam jeszcze to czego wcześniej nie dałem z tego EXTRAS

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2009-12-11 20:47:28 - Run 1 OTL by OldTimer - Version 3.1.15.1 Folder = C:\Documents and Settings\Kuba\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,48 Mb Total Physical Memory | 586,52 Mb Available Physical Memory | 76,42% Memory free 1,83 Gb Paging File | 1,46 Gb Available in Paging File | 79,69% Paging File free Paging file location(s): C:\pagefile.sys 1152 2304 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 28,63 Gb Total Space | 2,60 Gb Free Space | 9,08% Space Free | Partition Type: NTFS Drive D: | 115,03 Gb Total Space | 4,00 Gb Free Space | 3,47% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LOL3K Current User Name: Kuba Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) htmlfile [print] -- Reg Error: Key error. http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Odkurz tutaj] -- C:\Program Files\Odkurzacz\odkurzacz.exe %1 (Franmo Software) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "26335:TCP" = 26335:TCP:*:Enabled:BitComet 26335 TCP "26335:UDP" = 26335:UDP:*:Enabled:BitComet 26335 UDP [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny -- (Gadu-Gadu S.A.) "C:\Program Files\DC++\DCPlusPlus.exe" = C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DCPlusPlus -- () "C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- File not found "C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (http://www.emule-project.net) "C:\Program Files\BitTorrent_DNA\dna.exe" = C:\Program Files\BitTorrent_DNA\dna.exe:*:Enabled:BitTorrent DNA -- File not found "C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found "C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client -- (www.BitComet.com) "C:\Program Files\Steam\SteamApps\kuba_13@o2.pl\counter-strike\hl.exe" = C:\Program Files\Steam\SteamApps\kuba_13@o2.pl\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "C:\Program Files\Common Files\Nero\Nero Web\SetupX.exe" = C:\Program Files\Common Files\Nero\Nero Web\SetupX.exe:*:Enabled:Nero ControlCenter -- (Nero AG) "C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com) "C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com) "C:\Program Files\Winamp Remote\bin\Orb.exe" = C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- File not found "C:\Program Files\Winamp Remote\bin\OrbTray.exe" = C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- (Orb Networks) "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- File not found "C:\Program Files\Tlen.pl\tlen.exe" = C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl -- File not found "C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe" = C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:*:Disabled:Football Manager 2008 -- File not found "C:\Program Files\ICQ6\ICQ.exe" = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.) "C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.) "C:\Documents and Settings\Kuba\Ustawienia lokalne\Temp\Rar$EX00.157\Softick PPP & Samsung Java Uploader\Samsung Java - Uploader.exe" = C:\Documents and Settings\Kuba\Ustawienia lokalne\Temp\Rar$EX00.157\Softick PPP & Samsung Java Uploader\Samsung Java - Uploader.exe:*:Enabled:Samsung Java - Uploader -- File not found "C:\Documents and Settings\Kuba\Pulpit\Samsung Java - Uploader.exe" = C:\Documents and Settings\Kuba\Pulpit\Samsung Java - Uploader.exe:*:Enabled:Samsung Java - Uploader -- File not found "C:\Program Files\Team17\Worms 2\frontend.exe" = C:\Program Files\Team17\Worms 2\frontend.exe:*:Enabled:Worms 2 Frontend -- File not found "C:\Program Files\Team17\Worms 2\Binaries\landgen.exe" = C:\Program Files\Team17\Worms 2\Binaries\landgen.exe:*:Enabled:landgen -- File not found "C:\Program Files\Team17\Worms 2\worms2.exe" = C:\Program Files\Team17\Worms 2\worms2.exe:*:Enabled:worms2 -- File not found "C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation) "C:\Documents and Settings\Kuba\Pulpit\NovoGames_Full\Novogames_Full\gameunp.exe" = C:\Documents and Settings\Kuba\Pulpit\NovoGames_Full\Novogames_Full\gameunp.exe:*:Enabled:gameunp -- () "C:\Documents and Settings\Kuba\Pulpit\NovoGames_Full\Novogames_Full\reszta gier\gameunp.exe" = C:\Documents and Settings\Kuba\Pulpit\NovoGames_Full\Novogames_Full\reszta gier\gameunp.exe:*:Enabled:gameunp -- () "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath -- (Skype Technologies S.A.) "C:\Program Files\iMesh Applications\iMesh\iMesh.exe" = C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh -- File not found "C:\Program Files\Anno 1701\Anno1701.exe" = C:\Program Files\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701 -- File not found "C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe" = C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 -- (Firaxis Games) "C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe" = C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe:*:Enabled:Football Manager 2010 -- (Sports Interactive) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02B71D92-A84B-4DFB-9A10-D12BB01AC1F2}" = Nokia N73 highlights "{0D80391C-0A72-43BB-9BC2-143F63CC111D}" = Nokia PC Connectivity Solution "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate "{1A7F8DF6-5A3E-4CDF-BC82-BE26B407E21B}" = The Sims Gwiazda "{2D43FD89-B225-4334-B4AA-0983400BE61B}" = Windows Presentation Foundation Language Pack (PLK) "{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4 "{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation "{495998C4-FC8A-4302-82E0-53DE4D7A8F56}" = Windows Communication Foundation Language Pack - PLK "{531317A5-586A-4E36-87C1-CA823447B375}" = Nokia PC Suite "{59359B3D-ABE7-46BF-AB55-43B67A64DC68}" = Nokia MTP driver "{5AF71003-1797-4D93-9F37-4F2125CBF539}" = Microsoft .NET Framework 2.0 Language Pack - PLK "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6 "{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6 "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{6882DD11-33B8-4DEA-8305-7E765BF74BD3}" = Nokia Connectivity Cable Driver "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{73E30715-9EC4-4DAE-BE67-64500AEB8012}" = Nokia Nseries Skin for Microsoft Windows Media Player "{77F5816C-64A6-4FBE-BBE5-52EFE5EB84E8}" = Nokia themes for your device "{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1045}" = Nero 8 "{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}" = Reservoir Dogs "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{9A200E68-D5F4-4E70-910F-2871753A0E2B}" = Worms World Party "{9DE9E293-5D7B-4312-88C2-BDFAEC5310AE}" = Microsoft .NET Framework 3.0 "{AC76BA86-7AD7-1045-7B44-A81200000003}" = Adobe Reader 8 - Polish "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1 "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation "{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime "{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4 "{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader "{DB76863D-D4D9-4AB3-AFDC-26717BA1E11C}" = Windows Workflow Foundation PL Language Pack "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{EE565795-2776-415A-B31C-EB3A8D7C6FA4}" = Nokia Lifeblog 2.1 "{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner "{FD593DE6-C3A0-4722-8E86-9DEEF0A93290}" = Microsoft .NET Framework 3.0 Polish Language Pack "Ad-Aware SE Personal" = Ad-Aware SE Personal "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player "ALLPlayer_is1" = ALLPlayer V4.X "Anti-Blaxx_is1" = Anti-Blaxx 1.17 "avast!" = avast! Antivirus "BitComet" = BitComet 1.01 "CCleaner" = CCleaner "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "DC++" = DC++ 0.750 "Deluxe Ski Jump 3_is1" = Deluxe Ski Jump 3 v1.5.0 "eMule" = eMule "eMuleKL_is1" = eMule 0.48a "EVEREST Home Edition_is1" = EVEREST Home Edition v2.20 "Football Manager 2010" = Football Manager 2010 "Gadu-Gadu" = Gadu-Gadu 7.7 "GameDesire-Bingo" = GameDesire-Bingo "GameDesire-Poker" = GameDesire-Poker "GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker "Gronzo_is1" = Gronzo ver 1.02 "HijackThis" = HijackThis 2.0.2 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "iMesh" = iMesh "imeshmediabartb" = MediaBar "InstallShield_{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.5 Full "Microsoft .NET Framework 2.0 Language Pack - PLK" = Microsoft .NET Framework 2.0 — pakiet języka polskiego "Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0 "Microsoft .NET Framework 3.0 Polish Language Pack" = Pakiet języka polskiego dla systemu Microsoft .NET Framework 3.0 "mIRC" = mIRC "Monopoly by Parker Brothers" = Monopoly by Parker Brothers "Mozilla Firefox (3.0.2)" = Mozilla Firefox (3.0.2) "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "Odkurzacz 11.3_is1" = Odkurzacz 11.3 "PokerStars" = PokerStars "Quest3D Web Viewers 4.2_is1" = Quest3D Web Viewers 4.2 "RealAlt_is1" = Real Alternative 1.7.5 "Słownik SuperMemo" = Słownik SuperMemo "SopCast" = SopCast 2.0.4 "Spolszczenie DC++" = Spolszczenie DC++ 0.699 "Steam" = Steam "SystemRequirementsLab" = System Requirements Lab "Tibia_is1" = Tibia "WIC" = Windows Imaging Component "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "Windows Media Player" = Windows Media Player 10 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinISO_is1" = WinISO 5.3 "WinRAR archiver" = Archiwizator WinRAR "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1229272821-1202660629-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BitTorrent DNA" = BitTorrent DNA [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2009-02-09 18:06:05 | Computer Name = LOL3K | Source = avast! | ID = 33554522 Description = AAVM - initialization error: AavmStart: avworkInitialize failed, 0000A438. Error - 2009-08-23 11:08:43 | Computer Name = LOL3K | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of G:\m-bank.ppt failed, 0000001E. Error - 2009-12-11 13:45:33 | Computer Name = LOL3K | Source = avast! | ID = 33554522 Description = AAVM - scanning error: Aavm: FetchGlobalCounters cannot open mapping - server DOWN???, 00000002. [ Application Events ] Error - 2009-12-07 14:53:22 | Computer Name = LOL3K | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd acrord32.exe, wersja 8.1.0.137, moduł powodujący błąd acrord32.dll, wersja 8.1.2.86, adres błędu 0x003831da. Error - 2009-12-07 15:07:32 | Computer Name = LOL3K | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ApplicationInstaller.exe, wersja 6.81.91.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-12-08 15:44:57 | Computer Name = LOL3K | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3163, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-12-11 12:21:51 | Computer Name = LOL3K | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ad-aware.exe, wersja 7.1.0.8, moduł powodujący błąd ad-aware.exe, wersja 7.1.0.8, adres błędu 0x0009928a. Error - 2009-12-11 12:24:19 | Computer Name = LOL3K | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ad-aware.exe, wersja 7.1.0.8, moduł powodujący błąd ad-aware.exe, wersja 7.1.0.8, adres błędu 0x0009928a. Error - 2009-12-11 12:24:46 | Computer Name = LOL3K | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ad-aware.exe, wersja 7.1.0.8, moduł powodujący błąd ad-aware.exe, wersja 7.1.0.8, adres błędu 0x00165100. Error - 2009-12-11 12:25:02 | Computer Name = LOL3K | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ad-aware.exe, wersja 7.1.0.8, moduł powodujący błąd ad-aware.exe, wersja 7.1.0.8, adres błędu 0x00165100. Error - 2009-12-11 13:08:56 | Computer Name = LOL3K | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca Steam.exe, wersja 1.0.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-12-11 15:46:57 | Computer Name = LOL3K | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca OTL.exe, wersja 3.1.15.1, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-12-11 15:46:58 | Computer Name = LOL3K | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca OTL.exe, wersja 3.1.15.1, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2009-12-11 15:25:37 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7034 Description = Usługa Nero BackItUp Scheduler 3 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2009-12-11 15:26:04 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Mail Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2009-12-11 15:26:13 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7034 Description = Usługa SoftGuard Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2009-12-11 15:26:23 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7034 Description = Usługa avast! iAVS4 Control Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2009-12-11 15:26:30 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7031 Description = Usługa Lavasoft Ad-Aware Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 5000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error - 2009-12-11 15:40:19 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego błędu: %%2 Error - 2009-12-11 15:42:09 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2009-12-11 15:42:09 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2009-12-11 15:42:52 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2009-12-11 15:42:52 | Computer Name = LOL3K | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 < End of report >

I w dodawaniu i usuwaniu programów nie ma tego imesh coś tam coś tam

Dodano 11.12.2009 22:42:10:

Kod: Zaznacz wszystko: ComboFix 09-12-11.01 - Kuba 2009-12-11 22:30:56.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.767.568 [GMT 1:00] Uruchomiony z: c:\documents and settings\Kuba\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Kuba\Pulpit\CFScript.txt AV: avast! antivirus 4.8.1335 [VPS 090702-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FILE :: "c:\documents and settings\Kuba\Dane aplikacji\avdrn.dat" "c:\documents and settings\NetworkService\Dane aplikacji\fvgqad.dat" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\!FixIEDef c:\documents and settings\Kuba\Dane aplikacji\avdrn.dat c:\documents and settings\NetworkService\Dane aplikacji\fvgqad.dat c:\program files\DAEMON Tools Toolbar c:\program files\DAEMON Tools Toolbar\_DTLite.xml c:\program files\DAEMON Tools Toolbar\DTToolbar.dll c:\program files\DAEMON Tools Toolbar\Resources\about.ico c:\program files\DAEMON Tools Toolbar\Resources\AboutWindow.ico c:\program files\DAEMON Tools Toolbar\Resources\accept.ico c:\program files\DAEMON Tools Toolbar\Resources\AddRadioStation.ico c:\program files\DAEMON Tools Toolbar\Resources\as.ico c:\program files\DAEMON Tools Toolbar\Resources\as.png c:\program files\DAEMON Tools Toolbar\Resources\astro.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_buy.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_download.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_feedback.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_forum.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_home.ico c:\program files\DAEMON Tools Toolbar\Resources\astro_lite.ico c:\program files\DAEMON Tools Toolbar\Resources\astroburn_site.ico c:\program files\DAEMON Tools Toolbar\Resources\astroLite_16.ico c:\program files\DAEMON Tools Toolbar\Resources\az.ico c:\program files\DAEMON Tools Toolbar\Resources\b1.png c:\program files\DAEMON Tools Toolbar\Resources\burn_files.ico c:\program files\DAEMON Tools Toolbar\Resources\burn_image.ico c:\program files\DAEMON Tools Toolbar\Resources\burn_imgs.ico c:\program files\DAEMON Tools Toolbar\Resources\BurnImage.ico c:\program files\DAEMON Tools Toolbar\Resources\buy.ico c:\program files\DAEMON Tools Toolbar\Resources\Config.ico c:\program files\DAEMON Tools Toolbar\Resources\d.ico c:\program files\DAEMON Tools Toolbar\Resources\d2.ico c:\program files\DAEMON Tools Toolbar\Resources\daemon.ico c:\program files\DAEMON Tools Toolbar\Resources\daemon_search.ico c:\program files\DAEMON Tools Toolbar\Resources\daemon_search_site.ico c:\program files\DAEMON Tools Toolbar\Resources\dot_disabled.bmp c:\program files\DAEMON Tools Toolbar\Resources\dot_enabled.bmp c:\program files\DAEMON Tools Toolbar\Resources\dot_on_over.bmp c:\program files\DAEMON Tools Toolbar\Resources\download.ico c:\program files\DAEMON Tools Toolbar\Resources\ds.ico c:\program files\DAEMON Tools Toolbar\Resources\dsearch.ico c:\program files\DAEMON Tools Toolbar\Resources\dt-home.ico c:\program files\DAEMON Tools Toolbar\Resources\dt.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_about.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_buy.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_download.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_faq.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_feedback.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_forum.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_line.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_lite.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_manual.ico c:\program files\DAEMON Tools Toolbar\Resources\dt_pro.ico c:\program files\DAEMON Tools Toolbar\Resources\DTPro.ico c:\program files\DAEMON Tools Toolbar\Resources\dtt16.ico c:\program files\DAEMON Tools Toolbar\Resources\dtt32.ico c:\program files\DAEMON Tools Toolbar\Resources\Dwnl.ico c:\program files\DAEMON Tools Toolbar\Resources\emulation.ico c:\program files\DAEMON Tools Toolbar\Resources\favicon.ico c:\program files\DAEMON Tools Toolbar\Resources\features.ico c:\program files\DAEMON Tools Toolbar\Resources\feedback.ico c:\program files\DAEMON Tools Toolbar\Resources\forum.ico c:\program files\DAEMON Tools Toolbar\Resources\GameCentrix.ico c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixCristals.ico c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixDownload.ico c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixPlayOnline.ico c:\program files\DAEMON Tools Toolbar\Resources\GameCentrixTop.ico c:\program files\DAEMON Tools Toolbar\Resources\GameS.ico c:\program files\DAEMON Tools Toolbar\Resources\games_search.ico c:\program files\DAEMON Tools Toolbar\Resources\games_search_SA.ico c:\program files\DAEMON Tools Toolbar\Resources\GameSA.ico c:\program files\DAEMON Tools Toolbar\Resources\gct16.ico c:\program files\DAEMON Tools Toolbar\Resources\gd.ico c:\program files\DAEMON Tools Toolbar\Resources\genre.xml c:\program files\DAEMON Tools Toolbar\Resources\globe.ico c:\program files\DAEMON Tools Toolbar\Resources\GrabImage.ico c:\program files\DAEMON Tools Toolbar\Resources\hb.bmp c:\program files\DAEMON Tools Toolbar\Resources\hb.ico c:\program files\DAEMON Tools Toolbar\Resources\help.ico c:\program files\DAEMON Tools Toolbar\Resources\hide.ico c:\program files\DAEMON Tools Toolbar\Resources\home.ico c:\program files\DAEMON Tools Toolbar\Resources\image_search.ico c:\program files\DAEMON Tools Toolbar\Resources\image_search_SA.ico c:\program files\DAEMON Tools Toolbar\Resources\ImageS.ico c:\program files\DAEMON Tools Toolbar\Resources\ImageSA.ico c:\program files\DAEMON Tools Toolbar\Resources\ip.ico c:\program files\DAEMON Tools Toolbar\Resources\lang.xml c:\program files\DAEMON Tools Toolbar\Resources\lingvo.ico c:\program files\DAEMON Tools Toolbar\Resources\m.ico c:\program files\DAEMON Tools Toolbar\Resources\mail.bmp c:\program files\DAEMON Tools Toolbar\Resources\mail_disable.bmp c:\program files\DAEMON Tools Toolbar\Resources\mail_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\mail_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\mail_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\mailc.bmp c:\program files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp c:\program files\DAEMON Tools Toolbar\Resources\mailc_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\mailc_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\mailc_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico c:\program files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico c:\program files\DAEMON Tools Toolbar\Resources\MenuRSCur.ico c:\program files\DAEMON Tools Toolbar\Resources\MenuTr.ico c:\program files\DAEMON Tools Toolbar\Resources\mount.ico c:\program files\DAEMON Tools Toolbar\Resources\mount_n_drive.ico c:\program files\DAEMON Tools Toolbar\Resources\next.bmp c:\program files\DAEMON Tools Toolbar\Resources\next_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\next_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\next_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\none.bmp c:\program files\DAEMON Tools Toolbar\Resources\none_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\op.ico c:\program files\DAEMON Tools Toolbar\Resources\play.bmp c:\program files\DAEMON Tools Toolbar\Resources\play.ico c:\program files\DAEMON Tools Toolbar\Resources\play_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\play_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\play_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\pragma.ico c:\program files\DAEMON Tools Toolbar\Resources\prev.bmp c:\program files\DAEMON Tools Toolbar\Resources\prev_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\prev_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\prev_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\prod.ico c:\program files\DAEMON Tools Toolbar\Resources\Radio.ico c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioBg.ico c:\program files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDown.ico c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioE.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioG.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioL.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioLDotMask.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioLeft.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioLeftMask.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioLM.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioM.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioN.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioR.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioR.ico c:\program files\DAEMON Tools Toolbar\Resources\RadioRM.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioRU.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\RadioW.bmp c:\program files\DAEMON Tools Toolbar\Resources\rbcheck.ico c:\program files\DAEMON Tools Toolbar\Resources\rbtxt.ico c:\program files\DAEMON Tools Toolbar\Resources\refresh.bmp c:\program files\DAEMON Tools Toolbar\Resources\refresh_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\refresh_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\refresh_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\Rss.ico c:\program files\DAEMON Tools Toolbar\Resources\Rss1.ico c:\program files\DAEMON Tools Toolbar\Resources\RssA.ico c:\program files\DAEMON Tools Toolbar\Resources\RssA1.ico c:\program files\DAEMON Tools Toolbar\Resources\rssClose.ico c:\program files\DAEMON Tools Toolbar\Resources\rssL.bmp c:\program files\DAEMON Tools Toolbar\Resources\rssOpen.ico c:\program files\DAEMON Tools Toolbar\Resources\RssRefresh.ico c:\program files\DAEMON Tools Toolbar\Resources\s2.ico c:\program files\DAEMON Tools Toolbar\Resources\show.ico c:\program files\DAEMON Tools Toolbar\Resources\size.bmp c:\program files\DAEMON Tools Toolbar\Resources\size_lr.ico c:\program files\DAEMON Tools Toolbar\Resources\size_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\size_rl.ico c:\program files\DAEMON Tools Toolbar\Resources\skins.ico c:\program files\DAEMON Tools Toolbar\Resources\spt.ico c:\program files\DAEMON Tools Toolbar\Resources\stop.bmp c:\program files\DAEMON Tools Toolbar\Resources\stop.ico c:\program files\DAEMON Tools Toolbar\Resources\stop_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\stop_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\stop_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\style.ico c:\program files\DAEMON Tools Toolbar\Resources\SupportRequest.ico c:\program files\DAEMON Tools Toolbar\Resources\timer.ico c:\program files\DAEMON Tools Toolbar\Resources\TitleIcon.ico c:\program files\DAEMON Tools Toolbar\Resources\toolbar.xml c:\program files\DAEMON Tools Toolbar\Resources\trans.ico c:\program files\DAEMON Tools Toolbar\Resources\Trash.bmp c:\program files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp c:\program files\DAEMON Tools Toolbar\Resources\Trash_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\Trash_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\Trash_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\u.ico c:\program files\DAEMON Tools Toolbar\Resources\unmount-all.ico c:\program files\DAEMON Tools Toolbar\Resources\vol.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol.ico c:\program files\DAEMON Tools Toolbar\Resources\vol_back.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_dott.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_mute.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_mute_check.bmp c:\program files\DAEMON Tools Toolbar\Resources\vol_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtClose.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtText.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp c:\program files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp c:\program files\DAEMON Tools Toolbar\Resources\web_resources.ico c:\program files\DAEMON Tools Toolbar\Resources\web_search.ico c:\program files\DAEMON Tools Toolbar\Resources\web_search_SA.ico c:\program files\DAEMON Tools Toolbar\Resources\WebS.ico c:\program files\DAEMON Tools Toolbar\Resources\WebSa.ico c:\program files\DAEMON Tools Toolbar\Resources\wi.ico c:\program files\DAEMON Tools Toolbar\Resources\wi0.ico c:\program files\DAEMON Tools Toolbar\Resources\wi1.ico c:\program files\DAEMON Tools Toolbar\Resources\wi10.ico c:\program files\DAEMON Tools Toolbar\Resources\wi11.ico c:\program files\DAEMON Tools Toolbar\Resources\wi12.ico c:\program files\DAEMON Tools Toolbar\Resources\wi13.ico c:\program files\DAEMON Tools Toolbar\Resources\wi14.ico c:\program files\DAEMON Tools Toolbar\Resources\wi2.ico c:\program files\DAEMON Tools Toolbar\Resources\wi3.ico c:\program files\DAEMON Tools Toolbar\Resources\wi4.ico c:\program files\DAEMON Tools Toolbar\Resources\wi5.ico c:\program files\DAEMON Tools Toolbar\Resources\wi6.ico c:\program files\DAEMON Tools Toolbar\Resources\wi7.ico c:\program files\DAEMON Tools Toolbar\Resources\wi8.ico c:\program files\DAEMON Tools Toolbar\Resources\wi9.ico c:\program files\DAEMON Tools Toolbar\uninst.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-11-11 do 2009-12-11 ))))))))))))))))))))))))))))))) . 2009-12-11 21:05 . 2009-12-11 21:11 -------- d--h--w- c:\windows\$hf_mig$ 2009-12-11 19:17 . 2009-12-11 19:17 -------- d-----w- c:\program files\Trend Micro 2009-12-11 17:51 . 2009-12-11 19:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-12-11 17:51 . 2009-12-11 17:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-12-11 17:20 . 2009-12-11 17:20 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Lavasoft 2009-12-11 16:27 . 2009-12-11 16:58 -------- d-----w- c:\program files\Odkurzacz 2009-12-07 18:27 . 2009-12-07 18:27 -------- d-----w- c:\documents and settings\Kuba\Ustawienia lokalne\Dane aplikacji\BVRP Software 2009-12-07 18:26 . 2008-04-13 18:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-12-07 18:26 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-12-07 18:24 . 2009-12-11 16:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2009-12-07 18:24 . 2009-12-07 18:28 5936 ----a-w- c:\documents and settings\Kuba\mqdmwhnt.sys 2009-12-07 18:24 . 2009-12-07 18:28 9232 ----a-w- c:\documents and settings\Kuba\mqdmmdfl.sys 2009-12-07 18:24 . 2009-12-07 18:28 92064 ----a-w- c:\documents and settings\Kuba\mqdmmdm.sys 2009-12-07 18:24 . 2009-12-07 18:28 79328 ----a-w- c:\documents and settings\Kuba\mqdmserd.sys 2009-12-07 18:24 . 2009-12-07 18:28 6208 ----a-w- c:\documents and settings\Kuba\mqdmcmnt.sys 2009-12-07 18:24 . 2009-12-07 18:28 4048 ----a-w- c:\documents and settings\Kuba\mqdmcr.sys 2009-12-07 18:24 . 2009-12-07 18:28 66656 ----a-w- c:\documents and settings\Kuba\mqdmbus.sys 2009-12-07 18:24 . 2009-12-07 18:28 25600 ----a-w- c:\documents and settings\Kuba\usbsermptxp.sys 2009-12-07 18:24 . 2009-12-07 18:28 22768 ----a-w- c:\documents and settings\Kuba\usbsermpt.sys 2009-12-07 18:19 . 2009-12-07 18:19 -------- d-----w- c:\program files\Słownik SuperMemo 2009-11-29 11:58 . 2009-11-29 11:59 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-11-29 11:58 . 2009-11-29 13:08 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\DAEMON Tools Lite 2009-11-29 11:58 . 2009-11-29 11:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2009-11-27 10:27 . 2009-11-27 10:27 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2009-11-27 10:23 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-11-27 10:23 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-11-27 10:23 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-11-27 10:23 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-11-27 10:23 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-11-27 10:23 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-11-27 10:23 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-11-27 10:07 . 2009-11-27 10:07 -------- d-----w- c:\program files\Sports Interactive . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-11 17:20 . 2007-11-17 22:39 -------- d-----w- c:\program files\Lavasoft 2009-12-11 17:04 . 2007-11-18 00:50 -------- d-----w- c:\program files\Steam 2009-12-11 16:41 . 2009-08-01 17:30 -------- d-----w- c:\program files\PokerStars 2009-12-11 16:41 . 2009-10-30 21:52 -------- d-----w- c:\program files\Anti-Blaxx 2009-12-11 16:41 . 2009-04-03 20:51 -------- d-----w- c:\program files\DC++ 2009-12-11 16:41 . 2007-11-18 00:41 -------- d-----w- c:\program files\BitComet 2009-12-11 16:41 . 2007-11-18 00:37 -------- d-----w- c:\program files\eMule 2009-12-11 16:41 . 2009-07-06 11:13 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-12-11 16:41 . 2007-12-11 18:38 -------- d-----w- c:\program files\SopCast 2009-12-11 16:41 . 2009-08-04 17:42 -------- d-----w- c:\program files\QuickTime 2009-12-11 16:14 . 2007-12-14 18:35 -------- d-----w- c:\program files\CCleaner 2009-12-11 16:09 . 2007-11-17 23:16 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-30 23:30 . 2009-04-03 20:52 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\DC++ 2009-11-29 11:59 . 2007-11-17 22:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-11-27 10:26 . 2007-11-17 23:33 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Sports Interactive 2009-11-10 22:00 . 2008-05-22 14:15 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-11-02 18:34 . 2007-11-17 21:47 70064 -c--a-w- c:\documents and settings\Kuba\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-10-30 21:56 . 2009-10-30 21:56 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\My Games 2009-10-30 21:48 . 2009-10-30 21:48 -------- d-----w- c:\program files\Firaxis Games 2009-10-29 00:16 . 2001-10-26 17:15 85244 ----a-w- c:\windows\system32\perfc015.dat 2009-10-29 00:16 . 2001-10-26 17:15 494024 ----a-w- c:\windows\system32\perfh015.dat 2009-10-28 23:32 . 2009-02-11 11:42 -------- d-----w- c:\program files\EA GAMES 2009-10-28 21:39 . 2009-10-28 21:39 -------- d-----w- c:\documents and settings\Kuba\Dane aplikacji\Eidos 2009-10-28 21:38 . 2009-10-28 21:38 93184 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut3_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 93184 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut2_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 65536 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut1_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 170790 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut11_8D2AC4F20BBA4A94A8668B54263FAE87_1.exe 2009-10-28 21:38 . 2009-10-28 21:38 16958 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\NewShortcut5_8D2AC4F20BBA4A94A8668B54263FAE87.exe 2009-10-28 21:38 . 2009-10-28 21:38 16958 ----a-r- c:\documents and settings\Kuba\Dane aplikacji\Microsoft\Installer\{8D2AC4F2-0BBA-4A94-A866-8B54263FAE87}\ARPPRODUCTICON.exe 2009-10-28 21:24 . 2009-10-28 21:24 -------- d-----w- c:\program files\Eidos 2009-10-21 18:08 . 2007-11-17 22:02 -------- d-----w- c:\program files\Gadu-Gadu 2009-10-16 14:50 . 2009-11-11 18:33 2520888 ----a-w- c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll 2008-12-22 16:49 . 2008-12-22 16:49 5188 --sh--r- c:\windows\system32\sysfhr.dat 2008-12-22 16:49 . 2008-12-22 16:49 640957 --sh--r- c:\windows\system32\sysfhr.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}] 2009-07-31 11:58 91568 ----a-w- c:\program files\iMeshMediabarTb\iMeshMediaBarDx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMeshMediabarTb\iMeshMediaBarDx.dll" [2009-07-31 91568] [HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-21 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2009-04-29 124928] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Steam\\SteamApps\\kuba_13@o2.pl\\counter-strike\\hl.exe"= "c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\ICQ6\\ICQ.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Documents and Settings\\Kuba\\Pulpit\\NovoGames_Full\\Novogames_Full\\gameunp.exe"= "c:\\Documents and Settings\\Kuba\\Pulpit\\NovoGames_Full\\Novogames_Full\\reszta gier\\gameunp.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2010\\fm.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26335:TCP"= 26335:TCP:BitComet 26335 TCP "26335:UDP"= 26335:UDP:BitComet 26335 UDP R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-29 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-09-29 20560] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2007-11-17 691696] S1 44ff0251;44ff0251;c:\windows\system32\drivers\44ff0251.sys [2009-06-10 0] S2 SG_Service;SoftGuard Service;c:\program files\Common Files\RbtProt\sgsrv.exe [2004-09-21 155648] . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.imesh.com/ IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://legialive.pl/ FF - prefs.js: keyword.URL - hxxp://search.imesh.com/webResults.html?src=ffb&q= FF - plugin: c:\documents and settings\Kuba\Dane aplikacji\Mozilla\Firefox\Profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPBOARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMAKAOV2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPNAVY.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPOKER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQUEST3D.DLL FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSNOOKER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSOCCER.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPWORDS.dll . - - - - USUNIĘTO PUSTE WPISY - - - - AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-11 22:38 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-12-11 22:40:21 ComboFix-quarantined-files.txt 2009-12-11 21:40 ComboFix2.txt 2009-12-11 20:54 Przed: 2 297 262 080 bajtów wolnych Po: 2 262 122 496 bajtów wolnych - - End Of File - - 40553033F21E9540E0DDB6E1896D722B

Dodano 11.12.2009 22:44:59:
C:\WINDOWS\SoftwareDistribution\Download\93927ffa759a1bca5e140b35fbf5c705

Taki folder nie istnieje...

Dodano 11.12.2009 23:13:30:
I dodatkowo zauważyłem, że na pulpicie pojawiły się jakieś dziwne pliki...
Tak jakby wycięte.
Jakieś: czasowniki.doc.sha, NAJwazniejsze.doc.sha, jakaś mp3 z końcówką mp3.ha oraz podanie o prawko.doc.sha :|

Teraz trwa skanowanie tym Malwerebytes

Da to wszystko coś

?

**Posty:** 2183 · przez **NieWiem** 12 Gru 2009, 00:48

Nie narzekaj, tylko wykonuj

Te pliki po prostu ktoś ukrył, były cały czas na pulpicie, tylko były ukryte.

**Posty:** 79 · przez **LOL3K** 12 Gru 2009, 00:56

Nareszcie

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.42 Wersja bazy definicji: 3347 Windows 5.1.2600 Dodatek Service Pack 3 Internet Explorer 7.0.5730.13 2009-12-11 23:53:22 mbam-log-2009-12-11 (23-53-15).txt Typ skanowania: Pełne skanowanie (C:\|D:\|) Przeskanowane obiekty: 189048 Upłynęło: 1 hour(s), 5 minute(s), 15 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 3 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\Program Files\Gadu-Gadu\plugs\emchecker.dll (Malware.Packer.Morphine) -> No action taken. D:\Telefon\Nokia n73\Applications\n73\keygen bestcrypto_s60_3.exe (Trojan.Agent) -> No action taken. D:\Telefon\Nokia n73\Applications\nokia73\keygenbesttaskman_s60_3.exe (Trojan.Agent) -> No action taken.

I do tego przestał mi działać firefox i jest napisane, że plc4.dll nie znaleziono

**Posty:** 2183 · przez **NieWiem** 12 Gru 2009, 01:08

Przeinstaluj, a jak nie pomoże to:
sposob-na-problemy-z-firefoxem-vt79402.html

Co do tego z MBAMu - sam zdecyduj czy usunąć.

W sumie w CF prawie nic już nie ma... Pobierz narzędzie ToolBar S&D, uruchom z opcji 1 i pokaż z niego loga

**Posty:** 79 · przez **LOL3K** 12 Gru 2009, 01:14

Kod: Zaznacz wszystko: -----------\\ ToolBar S&D 1.2.9 XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Dodatek Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2000+ ) BIOS : Version 1.00 USER : Kuba ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1335 [VPS 090702-0] 4.8.1335 (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:28 Go (Free:2 Go) D:\ (Local Disk) - NTFS - Total:115 Go (Free:3 Go) E:\ (CD or DVD) F:\ (CD or DVD) "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 ) Option : [1] ( 2009-12-12| 0:12 ) -----------\\ Searching for Files - Folders ... -----------\\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://search.imesh.com/" "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" "ICQ Search"="http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd" "Url"="http://go.microsoft.com/fwlink/?LinkId=68928" "Url"="http://go.microsoft.com/fwlink/?LinkId=68929" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" "Search Bar"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm" --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Spybot - Search & Destroy\Recovery\DAEMONToolsProCrack.zip 1 - "C:\ToolBar SD\TB_1.txt" - 2009-12-12| 0:13 - Option : [1] -----------\\ Scan completed at 0:13:12,15

**Posty:** 2183 · przez **NieWiem** 12 Gru 2009, 01:16

Świetnie. To teraz odpal ten sam program z opcji 2 i też pokaż raport, oraz nowy log z DDS.

**Posty:** 79 · przez **LOL3K** 12 Gru 2009, 01:19

Kod: Zaznacz wszystko: -----------\\ ToolBar S&D 1.2.9 XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Dodatek Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2000+ ) BIOS : Version 1.00 USER : Kuba ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1335 [VPS 090702-0] 4.8.1335 (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:28 Go (Free:2 Go) D:\ (Local Disk) - NTFS - Total:115 Go (Free:3 Go) E:\ (CD or DVD) F:\ (CD or DVD) "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 ) Option : [2] ( 2009-12-12| 0:17 ) -----------\\ Searching for Files - Folders ... -----------\\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://search.imesh.com/" "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" "ICQ Search"="http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd" "Url"="http://go.microsoft.com/fwlink/?LinkId=68928" "Url"="http://go.microsoft.com/fwlink/?LinkId=68929" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Start Page"="http://www.msn.com/" "Search Bar"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm" --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Spybot - Search & Destroy\Recovery\DAEMONToolsProCrack.zip 1 - "C:\ToolBar SD\TB_1.txt" - 2009-12-12| 0:13 - Option : [1] 2 - "C:\ToolBar SD\TB_2.txt" - 2009-12-12| 0:18 - Option : [2] -----------\\ Scan completed at 0:18:13,92

Dodano 12.12.2009 00:20:43:

Kod: Zaznacz wszystko: DDS (Ver_09-12-01.01) - NTFSx86 Run by Kuba at 0:19:43,75 on 2009-12-12 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_03 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.767.406 [GMT 1:00] AV: avast! antivirus 4.8.1335 [VPS 090702-0] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Kuba\Pulpit\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://search.imesh.com/ mWindow Title = BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.2.28.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll uRun: [Gadu-Gadu] "c:\program files\gadu-gadu\gg.exe" /tray uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.2.2.28.dll/206 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6\ICQ.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kuba\daneap~1\mozilla\firefox\profiles\btjhrbyn.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://legialive.pl/ FF - prefs.js: keyword.URL - hxxp://search.imesh.com/webResults.html?src=ffb&q= FF - plugin: c:\documents and settings\kuba\dane aplikacji\mozilla\firefox\profiles\btjhrbyn.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPBOARDS.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\mozilla firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPMAKAOV2.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPNAVY.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPPOKER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPQUEST3D.DLL FF - plugin: c:\program files\mozilla firefox\plugins\NPSNOOKER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPSOCCER.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPWORDS.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-9-29 114768] R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-9-29 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2007-11-18 138680] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2007-11-18 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2007-11-18 352920] S1 44ff0251;44ff0251;c:\windows\system32\drivers\44ff0251.sys [2009-6-10 0] S2 SG_Service;SoftGuard Service;c:\program files\common files\rbtprot\sgsrv.exe [2004-9-21 155648] =============== Created Last 30 ================ 2009-12-11 23:12:00 0 d-----w- C:\ToolBar SD 2009-12-11 23:11:55 54016 ----a-w- c:\windows\system32\drivers\ypixgs.sys 2009-12-11 21:46:18 0 d-----w- c:\docume~1\kuba\daneap~1\Malwarebytes 2009-12-11 21:46:13 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-11 21:46:11 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-12-11 21:46:11 0 d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-12-11 21:46:11 0 d-----w- c:\docume~1\alluse~1\daneap~1\Malwarebytes 2009-12-11 21:05:48 0 d--h--w- c:\windows\$hf_mig$ 2009-12-11 20:29:31 0 d-sha-r- C:\cmdcons 2009-12-11 20:27:47 77312 ----a-w- c:\windows\MBR.exe 2009-12-11 20:27:46 98816 ----a-w- c:\windows\sed.exe 2009-12-11 20:27:46 261632 ----a-w- c:\windows\PEV.exe 2009-12-11 20:27:46 161792 ----a-w- c:\windows\SWREG.exe 2009-12-11 19:17:00 0 d-----w- c:\program files\Trend Micro 2009-12-11 17:51:37 0 d-----w- c:\program files\Spybot - Search & Destroy 2009-12-11 17:51:37 0 d-----w- c:\docume~1\alluse~1\daneap~1\Spybot - Search & Destroy 2009-12-11 16:27:34 0 d-----w- c:\program files\Odkurzacz 2009-12-07 18:26:01 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-12-07 18:26:01 26112 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-12-07 18:19:11 0 d-----w- c:\program files\Słownik SuperMemo 2009-11-29 11:58:57 0 d-----w- c:\program files\DAEMON Tools Lite 2009-11-29 11:58:33 0 d-----w- c:\docume~1\kuba\daneap~1\DAEMON Tools Lite 2009-11-29 11:58:20 0 d-----w- c:\docume~1\alluse~1\daneap~1\DAEMON Tools Lite 2009-11-27 10:27:24 0 d-----w- c:\docume~1\alluse~1\daneap~1\Sports Interactive 2009-11-27 10:23:51 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-11-27 10:23:51 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-11-27 10:23:50 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-11-27 10:23:49 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-11-27 10:23:49 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-11-27 10:23:48 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-11-27 10:23:48 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-11-27 10:07:06 0 d-----w- c:\program files\Sports Interactive ==================== Find3M ==================== 2009-12-07 18:28:15 9232 ----a-w- c:\documents and settings\kuba\mqdmmdfl.sys 2009-12-07 18:28:15 92064 ----a-w- c:\documents and settings\kuba\mqdmmdm.sys 2009-12-07 18:28:15 79328 ----a-w- c:\documents and settings\kuba\mqdmserd.sys 2009-12-07 18:28:15 6208 ----a-w- c:\documents and settings\kuba\mqdmcmnt.sys 2009-12-07 18:28:15 5936 ----a-w- c:\documents and settings\kuba\mqdmwhnt.sys 2009-12-07 18:28:15 4048 ----a-w- c:\documents and settings\kuba\mqdmcr.sys 2009-12-07 18:28:14 66656 ----a-w- c:\documents and settings\kuba\mqdmbus.sys 2009-12-07 18:28:14 25600 ----a-w- c:\documents and settings\kuba\usbsermptxp.sys 2009-12-07 18:28:14 22768 ----a-w- c:\documents and settings\kuba\usbsermpt.sys 2009-11-29 11:59:10 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-29 00:16:26 85244 ----a-w- c:\windows\system32\perfc015.dat 2009-10-29 00:16:26 494024 ----a-w- c:\windows\system32\perfh015.dat 2001-11-23 04:08:20 712704 -c--a-r- c:\windows\inf\other\AUDIO3D.DLL 2008-12-22 16:49:28 5188 --sh--r- c:\windows\system32\sysfhr.dat 2008-12-22 16:49:22 640957 --sh--r- c:\windows\system32\sysfhr.sys 2008-11-02 23:30:54 32768 -csha-w- c:\windows\system32\config\systemprofile\ustawienia lokalne\historia\history.ie5\mshist012008110320081104\index.dat ============= FINISH: 0:20:06,52 ===============

Kod: Zaznacz wszystko: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 2007-11-17 22:42:47 System Uptime: 2009-12-11 22:24:31 (2 hours ago) Motherboard: ECS | | K7S5A Processor: AMD Athlon(tm) XP 2000+ | Socket-A | 1659/66mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 29 GiB total, 2,08 GiB free. D: is FIXED (NTFS) - 115 GiB total, 3,995 GiB free. E: is CDROM () F: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP673: 2009-12-11 17:52:09 - Usunięte Anno 1701 RP674: 2009-12-11 17:53:00 - Installed Sid Meier's Civilization 4 RP675: 2009-12-11 17:52:12 - Punkt kontrolny systemu RP676: 2009-12-11 17:52:14 - Punkt kontrolny systemu RP677: 2009-12-11 17:52:15 - Punkt kontrolny systemu RP678: 2009-12-11 17:52:17 - Punkt kontrolny systemu RP679: 2009-12-11 17:52:18 - Punkt kontrolny systemu RP680: 2009-12-11 17:52:20 - Punkt kontrolny systemu RP681: 2009-12-11 17:52:21 - Punkt kontrolny systemu RP682: 2009-12-11 17:52:23 - Punkt kontrolny systemu RP683: 2009-12-11 17:52:24 - Punkt kontrolny systemu RP684: 2009-12-11 17:52:00 - Zainstalowano: IKEA Home Planner RP685: 2009-12-11 17:52:05 - Usunięto: IKEA Home Planner RP686: 2009-12-11 17:52:26 - Punkt kontrolny systemu RP687: 2009-12-11 17:52:27 - Punkt kontrolny systemu RP688: 2009-12-11 17:52:29 - Punkt kontrolny systemu RP689: 2009-12-11 17:52:31 - Punkt kontrolny systemu RP690: 2009-12-11 17:52:32 - Punkt kontrolny systemu RP691: 2009-12-11 17:52:34 - Punkt kontrolny systemu RP692: 2009-12-11 17:52:35 - Punkt kontrolny systemu RP693: 2009-12-11 17:52:37 - Punkt kontrolny systemu RP694: 2009-12-11 17:52:39 - Punkt kontrolny systemu RP695: 2009-12-11 17:52:40 - Punkt kontrolny systemu RP696: 2009-12-11 17:52:42 - Punkt kontrolny systemu RP697: 2009-12-11 17:52:43 - Punkt kontrolny systemu RP698: 2009-12-11 17:52:45 - Punkt kontrolny systemu RP699: 2009-12-11 17:51:58 - Zainstalowany program DirectX RP700: 2009-12-11 17:52:46 - Punkt kontrolny systemu RP701: 2009-12-11 17:52:11 - SPTD setup V1.62 RP702: 2009-12-11 17:52:47 - Punkt kontrolny systemu RP703: 2009-12-11 17:52:49 - Punkt kontrolny systemu RP704: 2009-12-11 17:52:50 - Punkt kontrolny systemu RP705: 2009-12-11 17:52:52 - Punkt kontrolny systemu RP706: 2009-12-11 17:52:53 - Punkt kontrolny systemu RP707: 2009-12-11 17:52:54 - Punkt kontrolny systemu RP708: 2009-12-11 17:52:01 - Zainstalowane Motorola Phone Tools RP709: 2009-12-11 17:52:03 - Zainstalowane Motorola Phone Tools RP710: 2009-12-11 17:52:04 - Zainstalowane Motorola Phone Tools RP711: 2009-12-11 17:53:02 - Instalacja niepodpisanego sterownika RP712: 2009-12-11 17:52:56 - Punkt kontrolny systemu RP713: 2009-12-11 17:52:57 - Punkt kontrolny systemu RP714: 2009-12-11 17:52:59 - Punkt kontrolny systemu RP715: 2009-12-11 17:52:07 - Usunięte Motorola Phone Tools RP716: 2009-12-11 17:52:08 - Usunięte Motorola Phone Tools RP717: 2009-12-11 17:08:24 - Usunięte Motorola Phone Tools RP718: 2009-12-11 20:30:11 - Created By FixIEDef ==== Installed Programs ====================== Ad-Aware Ad-Aware SE Personal Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Reader 8 - Polish Adobe Reader 8.1.2 Security Update 1 (KB403742) Adobe Shockwave Player Aktualizacja dla systemu Windows XP (KB951072-v2) Aktualizacja dla systemu Windows XP (KB951978) Aktualizacja dla systemu Windows XP (KB955839) Aktualizacja dla systemu Windows XP (KB967715) Aktualizacja zabezpieczeń dla programu Windows Media Player (KB952069) Aktualizacja zabezpieczeń dla programu Windows Media Player 10 (KB936782) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB950759) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB953838) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB956390) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB958215) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB960714) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB961260) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB963027) Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB969897) Aktualizacja zabezpieczeń dla systemu Windows XP (KB923561) Aktualizacja zabezpieczeń dla systemu Windows XP (KB923789) Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464-v2) Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464) Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950760) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762) Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698) Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748) Aktualizacja zabezpieczeń dla systemu Windows XP (KB952004) Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954) Aktualizacja zabezpieczeń dla systemu Windows XP (KB953839) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459) Aktualizacja zabezpieczeń dla systemu Windows XP (KB954600) Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956391) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956572) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956802) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803) Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841) Aktualizacja zabezpieczeń dla systemu Windows XP (KB957095) Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958687) Aktualizacja zabezpieczeń dla systemu Windows XP (KB958690) Aktualizacja zabezpieczeń dla systemu Windows XP (KB959426) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960225) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960715) Aktualizacja zabezpieczeń dla systemu Windows XP (KB960803) Aktualizacja zabezpieczeń dla systemu Windows XP (KB961373) Aktualizacja zabezpieczeń dla systemu Windows XP (KB961501) Aktualizacja zabezpieczeń dla systemu Windows XP (KB968537) Aktualizacja zabezpieczeń dla systemu Windows XP (KB969898) Aktualizacja zabezpieczeń dla systemu Windows XP (KB970238) Aktualizacja zabezpieczeń dla Windows XP (KB923689) Aktualizacja zabezpieczeń dla Windows XP (KB941569) ALLPlayer V4.X Anti-Blaxx 1.17 Apple Software Update Archiwizator WinRAR AutoUpdate avast! Antivirus BitComet 1.01 CCleaner DC++ 0.750 Deluxe Ski Jump 3 v1.5.0 DivX Content Uploader DivX Converter DivX Player DivX Web Player EasyCleaner eMule eMule 0.48a EVEREST Home Edition v2.20 Football Manager 2010 Gadu-Gadu 7.7 GameDesire-Bingo GameDesire-Poker GameDesire-Pool & Snooker Gronzo ver 1.02 HijackThis 2.0.2 ICQ6 Java(TM) 6 Update 3 K-Lite Codec Pack 3.8.5 Full Malwarebytes' Anti-Malware MediaBar Microsoft .NET Framework 2.0 Language Pack - PLK Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 2.0 — pakiet języka polskiego Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.0 Polish Language Pack Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 mIRC Monopoly by Parker Brothers Mozilla Firefox (3.0.2) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6.0 Parser (KB933579) Nero 8 Nokia Connectivity Cable Driver Nokia Lifeblog 2.1 Nokia MTP driver Nokia N73 highlights Nokia Nseries Skin for Microsoft Windows Media Player Nokia PC Connectivity Solution Nokia PC Suite Nokia themes for your device NVIDIA Drivers Odkurzacz 11.3 Pakiet języka polskiego dla systemu Microsoft .NET Framework 3.0 PokerStars Poprawka dla systemu Windows Internet Explorer 7 (KB947864) Poprawka dla systemu Windows XP (KB952287) PowerDVD Quest3D Web Viewers 4.2 QuickTime Real Alternative 1.7.5 Reservoir Dogs Rhapsody Player Engine Słownik SuperMemo Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Sid Meier's Civilization 4 Skype™ 3.6 SopCast 2.0.4 Spolszczenie DC++ 0.699 Spybot - Search & Destroy Steam System Requirements Lab The Sims Gwiazda Tibia WebFldrs XP Winamp Windows Communication Foundation Windows Communication Foundation Language Pack - PLK Windows Imaging Component Windows Internet Explorer 7 Windows Media Format Runtime Windows Media Player 10 Windows Presentation Foundation Windows Presentation Foundation Language Pack (PLK) Windows Workflow Foundation Windows Workflow Foundation PL Language Pack Windows XP Service Pack 3 WinISO 5.3 Worms World Party XML Paper Specification Shared Components Language Pack 1.0 XML Paper Specification Shared Components Pack 1.0 ==== Event Viewer Messages From Past Week ======== 2009-12-11 17:09:36, informacje: Windows File Protection [64002] - Podjęto próbę zamiany chronionego pliku systemowego c:\windows\system32\drivers\usbser.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.5512. 2009-12-07 19:26:11, informacje: Windows File Protection [64001] - Podjęto próbę zamiany chronionego pliku systemowego usbser.sys. Dla zachowania stabilności systemu została przywrócona wersja oryginalna pliku. Wersja złego pliku: 5.1.2600.1330, wersja pliku systemowego: 5.1.2600.5512. ==== End Of File ===========================

**Posty:** 2183 · przez **NieWiem** 12 Gru 2009, 01:32

Dobra, zmontuj jeszcze taki skrypt w notatniku:

Folder::
c:\program files\daemon tools toolbar
c:\program files\imeshmediabartb

DDS::
uStart Page = hxxp://search.imesh.com/
BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll
TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll
TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

Firefox::
FF - prefs.js: keyword.URL - hxxp://search.imesh.com/webResults.html?src=ffb&q=

Suspect::

Zapisz jako CFScript.txt i ta sama procedura. Tyle, że tu w zasadzie już nic nie ma

**Posty:** 79 · przez **LOL3K** 12 Gru 2009, 04:22

Udało się

http://ctrlv.it/id/MzU0MA==

**Posty:** 18165 · przez **wojtas** 12 Gru 2009, 11:25

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu

**Posty:** 79 · przez **LOL3K** 13 Gru 2009, 01:53

Baaardzo długo to trwało.
Znalazło jakiegoś wirusa w plikach z telefonu to dałem kwarantannę.
Oto log z Malwarebytes'a

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.42 Wersja bazy definicji: 3347 Windows 5.1.2600 Dodatek Service Pack 3 Internet Explorer 7.0.5730.13 2009-12-13 00:50:51 mbam-log-2009-12-13 (00-50-51).txt Typ skanowania: Pełne skanowanie (C:\|D:\|) Przeskanowane obiekty: 181399 Upłynęło: 9 hour(s), 11 minute(s), 31 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 0 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: (Nie wykryto groźnych plików)

Dodano 13.12.2009 01:24:09:
I jeszcze zauważyłem, iż włączając komputer mam tak jakby do wyboru dwa windowsy, lecz nie są to windowsy...
Jedno to Microsoft Wndows Recover Console, a drugie Microsoft Windowsa Proffessional XP - które to wybiera się samo i jakoś ładuje się windows...

**Posty:** 18165 · przez **wojtas** 13 Gru 2009, 12:09

LOL3K napisał(a):I jeszcze zauważyłem, iż włączając komputer mam tak jakby do wyboru dwa windowsy, lecz nie są to windowsy...
Jedno to Microsoft Wndows Recover Console, a drugie Microsoft Windowsa Proffessional XP - które to wybiera się samo i jakoś ładuje się windows...

bo to konsola odzyskiwania

wszystko jest ok

Kto jest na forum