Pośba o sprawdzenie loga - komputer się zamula

[becik23]

Witam.
Komputer mi się ostatnio zamula..
Avast niczego nie wykrywa.
Gdy wyłączam komputer, wyświetla się komunikat, że "Trwa zamykanie programu - n", i trzeba później, to okienko samemu zamykać..a nie mam pojęcia co to jest ten program "n".
I jeszcze mnie dziwi to, że gdy wyłączam Firefoxa..a za chwilę chcę go ponownie włączyć, pojawia mi się czasami komunikat "Firefox został już uruchomiony...", wciskam Ctrl+Alt+Del i patrzę w procesy, no i rzeczywiście widać, że Firefox sobie działa mimo, że go wyłączyłam, i jeszcze ma największe użycie procesora...

Także prosiłabym o pomoc, bo ja jak zwykle jestem zielona

Kod: Zaznacz wszystko

DDS (Ver_09-09-29.01) - NTFSx86 
Run by ppp at 23:57:30,51 on 2010-01-20
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1023.451 [GMT 1:00]

AV: avast! antivirus 4.8.1356 [VPS 100120-1] *On-access scanning enabled* (Updated)   {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Nowe Gadu-Gadu\gg.exe
C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
D:\DOWNLOADS\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.atcomet.com/b/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
uURLSearchHooks: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [InCD] c:\program files\nero\nero 7\incd\InCD.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Photo Downloader] "c:\program files\adobe\adobe photoshop lightroom 1.3\apdproxy.exe"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [SetDefPrt] c:\program files\brother\brmfl05a\BrStDvPt.exe
mRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorun
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [UVS11 Preload] c:\program files\ulead systems\ulead videostudio 11\uvPL.exe
mRun: [SearchSettings] c:\program files\search settings\SearchSettings.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
IE: &Winamp Search - c:\documents and settings\all users\dane aplikacji\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1042051534828
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ppp\daneap~1\mozilla\firefox\profiles\k5z82wgb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\ppp\dane aplikacji\mozilla\firefox\profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\ppp\dane aplikacji\mozilla\firefox\profiles\k5z82wgb.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\program files\search settings\ff\components\SearchSettingsFF.dll
FF - plugin: c:\documents and settings\all users\dane aplikacji\zylom\zylomgamesplayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-14 114768]
R2 Application Updater;Application Updater;c:\program files\application updater\ApplicationUpdater.exe [2010-1-8 380928]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-14 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-14 138680]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-14 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-14 352920]

=============== Created Last 30 ================

2010-01-20 23:51   <DIR>   --d-----   c:\program files\TrendMicro
2010-01-17 21:44   <DIR>   --d-----   c:\docume~1\ppp\daneap~1\Search Settings
2010-01-17 18:27   <DIR>   --d-----   c:\program files\Application Updater
2010-01-17 18:27   <DIR>   --d-----   c:\program files\Search Settings
2010-01-03 20:40   56   a---h---   c:\windows\system32\ezsidmv.dat
2010-01-03 20:37   <DIR>   --d--r--   c:\program files\Skype

==================== Find3M  ====================

2010-01-19 20:18   525,860   a-------   c:\windows\system32\perfh015.dat
2010-01-19 20:18   99,020   a-------   c:\windows\system32\perfc015.dat
2009-09-28 14:14   87,608   a-------   c:\docume~1\ppp\daneap~1\inst.exe
2009-09-28 14:14   47,360   a-------   c:\docume~1\ppp\daneap~1\pcouffin.sys
2009-02-21 22:45   88   ---shr--   c:\windows\system32\E0F75EB49B.sys
2009-05-30 20:11   2,828   a--sh---   c:\windows\system32\KGyGaAvL.sys
2003-01-08 19:10   16,384   a--sh---   c:\windows\system32\config\systemprofile\cookies\index.dat
2003-01-08 19:10   32,768   a--sh---   c:\windows\system32\config\systemprofile\ustawienia lokalne\historia\history.ie5\index.dat
2003-01-08 19:10   32,768   a--sh---   c:\windows\system32\config\systemprofile\ustawienia lokalne\historia\history.ie5\mshist012003010820030109\index.dat
2003-01-08 19:10   32,768   a--sh---   c:\windows\system32\config\systemprofile\ustawienia lokalne\temporary internet files\content.ie5\index.dat

============= FINISH: 23:57:57,59 ===============


Kod: Zaznacz wszystko

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-09-29.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2003-01-08 19:09:02
System Uptime: 2010-01-20 21:08:46 (2 hours ago)

Motherboard:   |  | MS-7030
Processor: AMD Sempron(tm) Processor 3300+ | Socket 940 | 2009/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 38 GiB total, 13,417 GiB free.
D: is FIXED (NTFS) - 34 GiB total, 10,405 GiB free.
E: is FIXED (NTFS) - 40 GiB total, 32,668 GiB free.
F: is CDROM ()
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP175: 2009-11-12 14:24:00 - Punkt kontrolny systemu
RP176: 2009-11-14 11:46:50 - Punkt kontrolny systemu
RP177: 2009-11-15 17:46:25 - Punkt kontrolny systemu
RP178: 2009-11-17 13:02:49 - Punkt kontrolny systemu
RP179: 2009-11-18 21:20:11 - Punkt kontrolny systemu
RP180: 2009-11-20 11:04:45 - Installed Ulead VideoStudio
RP181: 2009-11-21 16:34:48 - Punkt kontrolny systemu
RP182: 2009-11-22 18:03:24 - Punkt kontrolny systemu
RP183: 2009-11-24 11:13:07 - Punkt kontrolny systemu
RP184: 2009-11-25 11:55:05 - Punkt kontrolny systemu
RP185: 2009-11-26 14:56:36 - Punkt kontrolny systemu
RP186: 2009-11-27 15:00:09 - Punkt kontrolny systemu
RP187: 2009-11-28 15:17:00 - Punkt kontrolny systemu
RP188: 2009-11-28 17:42:48 - Zainstalowane The Sims 3
RP189: 2009-11-28 18:09:44 - Usunięte The Sims 3
RP190: 2009-11-30 17:11:03 - Punkt kontrolny systemu
RP191: 2009-12-01 10:49:57 - Usunięte Rollercoaster Tycoon 3 ZE
RP192: 2009-12-01 22:07:50 - Installed Alcohol 120%
RP193: 2009-12-03 21:04:32 - Punkt kontrolny systemu
RP194: 2009-12-05 15:09:12 - Punkt kontrolny systemu
RP195: 2009-12-06 15:43:15 - Punkt kontrolny systemu
RP196: 2009-12-07 16:30:51 - Punkt kontrolny systemu
RP197: 2009-12-10 20:41:03 - Punkt kontrolny systemu
RP198: 2009-12-12 15:16:01 - Punkt kontrolny systemu
RP199: 2009-12-13 16:02:18 - Punkt kontrolny systemu
RP200: 2009-12-14 20:37:58 - Punkt kontrolny systemu
RP201: 2009-12-15 20:38:15 - Punkt kontrolny systemu
RP202: 2009-12-17 20:01:30 - Punkt kontrolny systemu
RP203: 2009-12-19 16:12:07 - Punkt kontrolny systemu
RP204: 2009-12-20 20:10:02 - Punkt kontrolny systemu
RP205: 2009-12-21 21:23:13 - Punkt kontrolny systemu
RP206: 2009-12-22 22:16:00 - Punkt kontrolny systemu
RP207: 2009-12-23 23:31:38 - Punkt kontrolny systemu
RP208: 2009-12-25 12:27:38 - Punkt kontrolny systemu
RP209: 2009-12-26 12:31:52 - Punkt kontrolny systemu
RP210: 2009-12-27 13:29:09 - Punkt kontrolny systemu
RP211: 2009-12-28 23:34:35 - Punkt kontrolny systemu
RP212: 2009-12-30 19:06:18 - Punkt kontrolny systemu
RP213: 2010-01-01 15:10:13 - Punkt kontrolny systemu
RP214: 2010-01-03 15:00:31 - Punkt kontrolny systemu
RP215: 2010-01-04 15:18:33 - Punkt kontrolny systemu
RP216: 2010-01-05 15:22:15 - Punkt kontrolny systemu
RP217: 2010-01-07 15:14:41 - Punkt kontrolny systemu
RP218: 2010-01-08 16:56:17 - Punkt kontrolny systemu
RP219: 2010-01-09 17:29:01 - Punkt kontrolny systemu
RP220: 2010-01-10 17:47:18 - Punkt kontrolny systemu
RP221: 2010-01-11 18:10:05 - Punkt kontrolny systemu
RP222: 2010-01-13 09:23:48 - Punkt kontrolny systemu
RP223: 2010-01-16 12:41:49 - Punkt kontrolny systemu
RP224: 2010-01-17 15:22:46 - Punkt kontrolny systemu
RP225: 2010-01-18 15:33:13 - Punkt kontrolny systemu
RP226: 2010-01-19 17:25:35 - Punkt kontrolny systemu
RP227: 2010-01-20 23:51:58 - Installed HiJackThis

==== Installed Programs ======================

           
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 9
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Aktualizacja dla systemu Windows XP (KB898461)
Aktualizacja dla systemu Windows XP (KB951978)
Aktualizacja dla systemu Windows XP (KB955839)
Aktualizacja systemu Windows XP (KB943729)
Aktualizacja zabezpieczeń dla programu Windows Media Player (KB952069)
Aktualizacja zabezpieczeń dla programu Windows Media Player 11 (KB936782)
Aktualizacja zabezpieczeń dla programu Windows Media Player 11 (KB954154)
Aktualizacja zabezpieczeń dla systemu Windows Internet Explorer 7 (KB938127-v2)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923789)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB950760)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB954600)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956802)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB958687)
Aktualizacja zabezpieczeń dla systemu Windows XP (KB960715)
Aktualizacja zabezpieczeń dla Windows XP (KB941569)
Apple Software Update
Archiwizator WinRAR
ATI Control Panel
ATI Display Driver
avast! Antivirus
BitComet 1.14
Brother MFL-Pro Suite
Canon Camera Access Library
Canon Camera Support Core Library
Canon MOV Decoder
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Digital Photo Professional 3.5
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities Original Data Security Tools
Canon Utilities PhotoStitch
Canon Utilities Picture Style Editor
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities WFT-E1/E2/E3/E4 Utility
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CCleaner
Cole2k Media - Codec Pack (Advanced) 7.4.0
Color Efex Pro 3.0 Complete
ConvertXtoDVD 3.8.0.193g
Corel Paint Shop Pro Photo XI
Dfine 2.0
FastStone Image Viewer 3.7
FILERECOVERY® Professional 3.2
foobar2000 v0.9.6.2
HiJackThis
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB954550-v5)
InterVideo DeviceService
Java(TM) 6 Update 16
LightScribe System Software  1.10.13.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Polish Language Pack
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PLK
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PLK
Microsoft .NET Framework 3.5 Language Pack SP1 - plk
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (Polish) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Polish) 2007
Microsoft Office Groove MUI (Polish) 2007
Microsoft Office InfoPath MUI (Polish) 2007
Microsoft Office OneNote MUI (Polish) 2007
Microsoft Office Outlook MUI (Polish) 2007
Microsoft Office PowerPoint MUI (Polish) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Polish) 2007
Microsoft Office Proofing (Polish) 2007
Microsoft Office Publisher MUI (Polish) 2007
Microsoft Office Shared MUI (Polish) 2007
Microsoft Office Visio Professional 2003
Microsoft Office Word MUI (Polish) 2007
Microsoft Software Update for Web Folders  (Polish) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft WSE 3.0 Runtime
Mozilla Firefox (3.5.7)
NAPIPROJEKT 1.0.6.2
Narzędzie Software Uninstall Utility firmy ATI
Nero 7 Essentials
neroxml
Nowe Gadu-Gadu
NVIDIA Drivers
OpenOffice.org 3.0
Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK
PaperPort
PDF Settings
Poprawka dla programu Windows Media Player 11 (KB939683)
Poprawka dla systemu Windows XP (KB952287)
QuickTime
Real Alternative 2.0.1
Search Settings v1.2.3
Sharpener Pro 3.0
Silver Efex Pro
Skype web features
Skype™ 4.1
SmartSound Quicktracks Plugin
SubEdit-Player
Supermarket Mania
Total Commander (Remove or Repair)
Ulead VideoStudio 11
VideoStudio
WebFldrs XP
Wedding Dash 2
Wielki słownik polsko-angielski i angielsko-polski PWN-OXFORD
Winamp
Winamp Toolbar
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Search 4.0
XML Paper Specification Shared Components Language Pack 1.0
Zylom Games Player Plugin

==== End Of File ===========================


[wojtas]

Daj loga z OTL

[becik23]

już..

Kod: Zaznacz wszystko

OTL logfile created on: 2010-01-21 00:27:28 - Run 1
OTL by OldTimer - Version 3.1.25.2     Folder = D:\DOWNLOADS
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1 023,00 Mb Total Physical Memory | 306,00 Mb Available Physical Memory | 30,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38,28 Gb Total Space | 13,41 Gb Free Space | 35,02% Space Free | Partition Type: NTFS
Drive D: | 34,18 Gb Total Space | 10,41 Gb Free Space | 30,44% Space Free | Partition Type: NTFS
Drive E: | 40,34 Gb Total Space | 32,67 Gb Free Space | 80,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PPP-67D47D15313
Current User Name: ppp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2010-01-21 00:25:29 | 00,547,328 | ---- | M] (OldTimer Tools) -- D:\DOWNLOADS\OTL.exe
PRC - [2010-01-08 00:51:02 | 00,380,928 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe
PRC - [2010-01-07 14:23:57 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-09-15 11:56:48 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009-09-15 11:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-09-15 11:56:28 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-09-15 11:54:13 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009-09-15 11:49:40 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-09-04 12:35:14 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009-09-04 12:35:14 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009-08-03 20:05:02 | 00,238,888 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
PRC - [2009-03-23 11:39:21 | 02,521,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
PRC - [2009-02-16 15:06:52 | 09,302,632 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe
PRC - [2009-02-16 14:25:28 | 00,014,336 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
PRC - [2008-06-12 02:47:22 | 00,349,544 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
PRC - [2008-04-14 23:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007-08-23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2007-08-23 17:36:30 | 00,455,968 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
PRC - [2007-06-27 19:04:00 | 01,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
PRC - [2007-06-27 19:03:40 | 00,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2007-06-25 08:47:24 | 01,629,480 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
PRC - [2007-06-25 08:47:12 | 01,552,680 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2007-06-25 08:47:02 | 01,057,064 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCD.exe
PRC - [2007-03-06 10:35:02 | 00,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2007-03-03 13:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2007-01-31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2006-11-02 20:40:12 | 00,174,656 | ---- | M] () -- C:\WINDOWS\system32\PSIService.exe
PRC - [2006-10-27 00:47:42 | 00,031,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2005-04-15 04:01:46 | 00,077,824 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005-04-01 05:12:00 | 00,352,256 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005-03-17 21:05:00 | 00,339,968 | ---- | M] (ATI Technologies, Inc.) -- C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
PRC - [2005-03-17 14:25:54 | 00,057,393 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2001-12-13 00:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2010-01-21 00:25:29 | 00,547,328 | ---- | M] (OldTimer Tools) -- D:\DOWNLOADS\OTL.exe


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2010-01-08 00:51:02 | 00,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2009-09-15 11:56:43 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009-09-15 11:56:28 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009-09-15 11:54:13 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009-09-15 11:49:40 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009-09-04 12:35:14 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009-02-21 23:32:18 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007-08-23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007-06-29 19:16:56 | 00,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007-06-25 08:47:12 | 01,552,680 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2007-03-06 10:35:02 | 00,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
SRV - [2007-03-03 13:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2007-01-31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2006-11-02 20:40:12 | 00,174,656 | ---- | M] () [Auto | Start_Pending] -- C:\WINDOWS\system32\PSIService.exe -- (ProtexisLicensing)
SRV - [2006-10-27 00:47:54 | 00,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006-10-26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2005-04-01 05:12:00 | 00,352,256 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005-03-17 21:05:00 | 00,516,096 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)
SRV - [2002-04-12 00:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) [Auto | Stopped] -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-09-28 14:14:36 | 00,047,360 | ---- | M] (VSO Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin)
DRV - [2009-09-15 11:56:14 | 00,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009-09-15 11:55:30 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2009-09-15 11:55:19 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009-09-15 11:54:30 | 00,052,368 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009-09-15 11:54:21 | 00,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009-09-15 11:53:24 | 00,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009-05-17 10:23:13 | 00,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008-08-20 18:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2008-04-13 23:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008-04-13 23:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C)
DRV - [2007-06-25 08:47:12 | 00,038,440 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007-06-25 08:47:12 | 00,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007-06-25 08:47:02 | 00,119,080 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2005-04-19 03:40:52 | 02,317,504 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005-04-01 05:12:00 | 01,032,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005-03-09 07:53:00 | 00,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004-10-15 12:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)
DRV - [2004-06-03 03:40:46 | 00,079,360 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus)
DRV - [2004-04-30 09:37:02 | 00,160,640 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\a347bus.sys -- (a347bus)
DRV - [2004-04-30 09:33:00 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi)
DRV - [2004-04-13 13:14:12 | 00,070,144 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2003-10-29 06:02:00 | 00,021,120 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2001-08-18 01:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\S-1-5-21-1757981266-1715567821-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\S-1-5-21-1757981266-1715567821-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034"
FF - prefs.js..browser.search.selectedEngine: "Winamp Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.10
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-01-09 21:15:52 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-01-07 14:24:10 | 00,000,000 | ---D | M]

[2009-02-21 13:17:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Extensions
[2010-01-20 15:36:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions
[2009-07-22 08:42:28 | 00,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009-08-27 14:52:29 | 00,000,000 | ---D | M] (BitComet Video Downloader) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009-08-27 14:52:29 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2010-01-08 10:13:42 | 00,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-03-20 14:46:04 | 00,001,196 | ---- | M] () -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\searchplugins\winamp-search.xml
[2010-01-20 23:45:22 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009-07-17 09:40:12 | 00,704,512 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009-03-24 10:10:44 | 00,114,688 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2009-11-03 02:54:10 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2009-11-03 02:54:10 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2009-11-03 02:54:10 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2009-11-03 02:54:10 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2009-11-03 02:54:10 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2009-11-03 02:54:10 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml

O1 HOSTS File: ([2001-10-26 19:45:16 | 00,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll (Spigot, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe (InterVideo Digital Technology Corporation)
O4 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
O4 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2]  File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Pobierz za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([www.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1042051534828 (WUWebControl Class)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnline/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003-01-08 19:06:23 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{ae4b56c2-2339-11d7-95d6-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{ae4b56c2-2339-11d7-95d6-806d6172696f}\Shell\AutoRun\command - "" = F:\Setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2010-01-20 23:51:59 | 00,000,000 | ---D | C] -- C:\Program Files\TrendMicro
[2010-01-20 23:44:08 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ppp\Recent
[2010-01-19 22:03:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Wybrane MAMA
[2010-01-17 22:08:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\ciocia druty
[2010-01-17 21:44:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Dane aplikacji\Search Settings
[2010-01-17 18:27:32 | 00,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2010-01-17 18:27:30 | 00,000,000 | ---D | C] -- C:\Program Files\Search Settings
[2010-01-15 22:11:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\wesele
[2010-01-11 12:31:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Artur strona www
[2010-01-10 20:40:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Nowy folder (2)
[2010-01-04 17:10:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Agnessa www
[2010-01-03 20:40:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Dane aplikacji\skypePM
[2010-01-03 20:38:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Dane aplikacji\Skype
[2010-01-03 20:37:21 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010-01-03 20:37:16 | 00,000,000 | R--D | C] -- C:\Program Files\Skype
[2010-01-03 20:37:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype
[2009-12-28 22:08:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\KALENDARZ
[2009-12-24 16:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\KOMORKA OPROGMRAM
[2009-12-01 22:08:06 | 00,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys
[2009-12-01 22:08:06 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys
[2009-09-28 14:14:36 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.sys
[2009-04-02 07:03:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple
[2009-02-22 20:03:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Adobe
[2009-02-21 22:26:19 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2010-01-20 21:09:39 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010-01-20 21:09:15 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-01-20 21:09:10 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-01-20 21:09:09 | 10,732,70784 | -HS- | M] () -- C:\hiberfil.sys
[2010-01-20 18:38:43 | 09,961,472 | -H-- | M] () -- C:\Documents and Settings\ppp\NTUSER.DAT
[2010-01-20 18:38:35 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\ppp\ntuser.ini
[2010-01-19 20:18:26 | 01,156,500 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010-01-19 20:18:26 | 00,525,860 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2010-01-19 20:18:26 | 00,444,164 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010-01-19 20:18:26 | 00,099,020 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2010-01-19 20:18:26 | 00,072,040 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010-01-19 15:02:08 | 00,118,166 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\1.JPG
[2010-01-19 14:42:19 | 00,651,264 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\załacznik_2.doc
[2010-01-18 18:21:24 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010-01-17 18:10:53 | 00,664,826 | ---- | M] () -- E:\Moje dokumenty\Kopia DSC05754.JPG
[2010-01-17 18:10:16 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\Kopia DSC05754.JPG
[2010-01-17 18:00:20 | 00,070,656 | ---- | M] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-01-16 15:52:56 | 03,959,591 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\DSCN8803.JPG
[2010-01-13 21:09:09 | 00,154,688 | ---- | M] () -- E:\Moje dokumenty\b.JPG
[2010-01-13 21:09:02 | 00,072,372 | ---- | M] () -- E:\Moje dokumenty\a.JPG
[2010-01-11 15:14:28 | 00,001,044 | ---- | M] () -- C:\Documents and Settings\ppp\Dane aplikacji\vso_ts_preview.xml
[2010-01-10 16:27:01 | 00,000,293 | ---- | M] () -- C:\Documents and Settings\ppp\.jupload.properties
[2010-01-06 23:47:48 | 00,011,865 | ---- | M] () -- E:\Moje dokumenty\Kurczak tajski.docx
[2010-01-03 21:07:02 | 02,670,367 | ---- | M] () -- E:\Moje dokumenty\DSC_6137.JPG
[2010-01-03 21:06:30 | 02,862,732 | ---- | M] () -- E:\Moje dokumenty\DSC_6067.JPG
[2010-01-03 21:05:35 | 02,638,657 | ---- | M] () -- E:\Moje dokumenty\DSC_6053.JPG
[2010-01-03 21:05:26 | 02,691,987 | ---- | M] () -- E:\Moje dokumenty\DSC_6024.JPG
[2010-01-03 21:05:05 | 02,841,864 | ---- | M] () -- E:\Moje dokumenty\DSC_5977.JPG
[2010-01-03 21:03:42 | 02,685,163 | ---- | M] () -- E:\Moje dokumenty\DSC_5952.JPG
[2010-01-03 21:02:49 | 02,540,175 | ---- | M] () -- E:\Moje dokumenty\DSC_5935.JPG
[2010-01-03 21:01:40 | 02,507,412 | ---- | M] () -- E:\Moje dokumenty\DSC_5934.JPG
[2010-01-03 20:49:41 | 02,997,200 | ---- | M] () -- E:\Moje dokumenty\DSC_6043.JPG
[2010-01-03 20:48:03 | 02,776,667 | ---- | M] () -- E:\Moje dokumenty\DSC_5948.JPG
[2010-01-03 20:47:57 | 02,614,124 | ---- | M] () -- E:\Moje dokumenty\DSC_6088.JPG
[2010-01-03 20:46:27 | 02,308,835 | ---- | M] () -- E:\Moje dokumenty\DSC_6054.JPG
[2010-01-03 20:45:05 | 02,669,007 | ---- | M] () -- E:\Moje dokumenty\DSC_6044.JPG
[2010-01-03 20:44:44 | 00,924,542 | ---- | M] () -- E:\Moje dokumenty\DSCN5056.JPG
[2010-01-03 20:40:25 | 00,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-12-30 21:48:34 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5017.JPG
[2009-12-30 21:48:18 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5045.JPG
[2009-12-30 21:45:40 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5042.JPG
[2009-12-30 21:44:43 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\P1120586.JPG
[2009-12-30 21:44:06 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5032.JPG
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2010-01-19 15:02:06 | 00,118,166 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\1.JPG
[2010-01-19 14:42:18 | 00,651,264 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\załacznik_2.doc
[2010-01-17 21:25:14 | 03,959,591 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\DSCN8803.JPG
[2010-01-17 18:10:21 | 00,664,826 | ---- | C] () -- E:\Moje dokumenty\Kopia DSC05754.JPG
[2010-01-17 18:10:16 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\Kopia DSC05754.JPG
[2010-01-13 21:09:01 | 00,154,688 | ---- | C] () -- E:\Moje dokumenty\b.JPG
[2010-01-13 21:08:58 | 00,072,372 | ---- | C] () -- E:\Moje dokumenty\a.JPG
[2010-01-11 13:56:08 | 02,096,044 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\Dziadek016.jpg
[2010-01-06 23:47:48 | 00,011,865 | ---- | C] () -- E:\Moje dokumenty\Kurczak tajski.docx
[2010-01-03 21:02:25 | 02,670,367 | ---- | C] () -- E:\Moje dokumenty\DSC_6137.JPG
[2010-01-03 20:57:59 | 02,862,732 | ---- | C] () -- E:\Moje dokumenty\DSC_6067.JPG
[2010-01-03 20:56:20 | 02,638,657 | ---- | C] () -- E:\Moje dokumenty\DSC_6053.JPG
[2010-01-03 20:55:49 | 02,691,987 | ---- | C] () -- E:\Moje dokumenty\DSC_6024.JPG
[2010-01-03 20:55:16 | 02,841,864 | ---- | C] () -- E:\Moje dokumenty\DSC_5977.JPG
[2010-01-03 20:54:46 | 02,685,163 | ---- | C] () -- E:\Moje dokumenty\DSC_5952.JPG
[2010-01-03 20:54:39 | 02,540,175 | ---- | C] () -- E:\Moje dokumenty\DSC_5935.JPG
[2010-01-03 20:54:36 | 02,507,412 | ---- | C] () -- E:\Moje dokumenty\DSC_5934.JPG
[2010-01-03 20:47:49 | 02,997,200 | ---- | C] () -- E:\Moje dokumenty\DSC_6043.JPG
[2010-01-03 20:44:33 | 02,614,124 | ---- | C] () -- E:\Moje dokumenty\DSC_6088.JPG
[2010-01-03 20:43:53 | 02,776,667 | ---- | C] () -- E:\Moje dokumenty\DSC_5948.JPG
[2010-01-03 20:42:58 | 00,924,542 | ---- | C] () -- E:\Moje dokumenty\DSCN5056.JPG
[2010-01-03 20:42:38 | 02,308,835 | ---- | C] () -- E:\Moje dokumenty\DSC_6054.JPG
[2010-01-03 20:41:55 | 02,669,007 | ---- | C] () -- E:\Moje dokumenty\DSC_6044.JPG
[2010-01-03 20:40:25 | 00,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-12-30 21:48:34 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5017.JPG
[2009-12-30 21:48:18 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5045.JPG
[2009-12-30 21:45:40 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5042.JPG
[2009-12-30 21:44:43 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\P1120586.JPG
[2009-12-30 21:44:06 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5032.JPG
[2009-11-20 11:07:50 | 00,210,456 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2009-11-20 11:07:50 | 00,194,072 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2009-11-20 11:07:49 | 00,206,360 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2009-11-20 11:07:49 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2009-11-20 11:07:49 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2009-11-20 11:07:49 | 00,026,136 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2009-09-28 14:15:08 | 00,001,044 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\vso_ts_preview.xml
[2009-09-28 14:14:46 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.log
[2009-09-28 14:14:36 | 00,087,608 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\inst.exe
[2009-09-28 14:14:36 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.cat
[2009-09-28 14:14:36 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.inf
[2009-07-09 16:12:10 | 00,000,169 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-17 10:41:56 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009-05-17 10:23:12 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-02-22 17:10:23 | 00,000,462 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009-02-22 17:10:23 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009-02-22 17:10:23 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009-02-22 17:06:40 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2009-02-21 22:41:47 | 00,002,828 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2009-02-21 22:41:47 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\E0F75EB49B.sys
[2009-02-21 22:23:35 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009-02-21 22:23:30 | 00,070,656 | ---- | C] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-02-20 16:21:05 | 00,000,756 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2009-02-16 18:19:42 | 00,790,190 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-02-16 17:32:20 | 00,425,040 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2009-02-16 17:30:30 | 00,903,703 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2009-02-16 17:27:28 | 00,557,451 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2009-02-16 17:23:50 | 00,145,081 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2009-02-16 15:49:30 | 00,328,334 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
[2009-02-16 15:47:42 | 04,451,209 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2009-02-14 16:15:42 | 00,486,400 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
[2009-02-09 23:28:18 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2009-02-09 21:19:18 | 00,183,296 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
[2009-02-09 21:19:12 | 00,178,688 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
[2009-02-09 21:18:52 | 00,113,152 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
[2009-02-09 21:18:32 | 00,146,944 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
[2009-02-09 21:18:24 | 00,257,024 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
[2009-02-09 21:18:20 | 00,142,848 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
[2009-02-09 20:56:22 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-01-10 23:17:32 | 00,163,840 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
[2009-01-10 23:16:56 | 00,148,480 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
[2009-01-10 23:16:50 | 00,108,032 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
[2009-01-10 23:16:14 | 00,141,312 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
[2009-01-10 23:15:54 | 00,120,832 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
[2009-01-10 23:15:44 | 00,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
[2009-01-10 23:15:32 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
[2009-01-10 23:15:28 | 00,246,784 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
[2009-01-10 23:15:12 | 00,097,280 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
[2009-01-10 23:14:08 | 00,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2009-01-10 23:14:06 | 00,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2008-12-03 23:11:50 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008-11-06 17:37:32 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008-11-06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008-11-06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008-05-26 22:22:36 | 00,016,222 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008-05-26 22:22:34 | 00,021,728 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008-05-26 22:22:32 | 00,016,164 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008-01-31 17:18:14 | 00,009,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\FlashSys.sys
[2007-10-13 10:30:20 | 00,000,137 | ---- | C] () -- C:\WINDOWS\System32\Registration.ini
[2007-07-10 18:10:12 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2003-01-08 19:25:05 | 00,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2002-03-04 10:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll

[color=#E56717]========== LOP Check ==========[/color]

[2009-05-17 10:35:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2009-11-28 23:21:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts
[2009-06-16 22:37:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\GameHouse
[2009-11-20 11:07:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InterVideo
[2009-02-15 00:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
[2009-07-02 22:25:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst
[2009-02-22 17:06:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft
[2009-11-20 11:08:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SmartSound Software Inc
[2009-11-20 11:21:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
[2009-10-22 14:24:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\vsosdk
[2009-06-16 21:57:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Zylom
[2009-07-06 20:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Atari
[2009-02-22 16:38:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Canon
[2009-05-17 10:36:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools
[2009-05-17 10:39:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools Lite
[2009-05-17 10:36:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools Pro
[2010-01-03 00:39:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\foobar2000
[2009-02-22 00:39:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Nik Software
[2009-11-22 13:47:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Nowe Gadu-Gadu
[2009-02-14 20:01:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\OpenOffice.org
[2009-07-02 23:33:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\PlayFirst
[2010-01-17 21:44:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Search Settings
[2009-11-20 11:53:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Ulead Systems
[2010-01-11 15:14:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Vso
[2009-02-14 20:03:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Windows Desktop Search
[2009-02-15 01:01:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Windows Search

[color=#E56717]========== Purity Check ==========[/color]


< End of report >


oj, a ten drugi się nie zmieścił, więc daję link
http://wklej.org/id/265803/

[NieWiem]

Coś tu siedzi niefajnego. Wykonaj w tej kolejności:

1. Usuń z dysku program DDS.

2. Pobierz ComboFix, uruchom i pokaż z niego loga.

3. Pobierz nowego DDSa i pokaż z niego logi.

W sekcji plików tworzonych/modyfikowanych jest widoczne sporo plików *.jpg. Zainteresuj się nimi, powiedz czy są to jakieś Twoje zdjęcia, czy może wyglądają jak "screenshoty" podczas Twojej pracy na komputerze.

[becik23]

Jeśli chodzi o te pliki *jpg.. jestem fotografem, więc na moim komputerze jest bardzo wiele zdjęć. Mniej więcej zerknęłam czy nie są tą screeny (te wypisane w logach), ale całe szczęście nie, to tylko moje zdjęcia.

Daję log z ComboFix..

Kod: Zaznacz wszystko

ComboFix 10-01-20.05 - ppp 2010-01-21  11:11:55.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1023.571 [GMT 1:00]
Uruchomiony z: d:\downloads\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 100121-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ppp\Dane aplikacji\inst.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\History\search
c:\program files\Search Settings
c:\program files\Search Settings\FF\chrome.manifest
c:\program files\Search Settings\FF\chrome\content\plugin.js
c:\program files\Search Settings\FF\chrome\content\plugin.xul
c:\program files\Search Settings\FF\chrome\content\protection.js
c:\program files\Search Settings\FF\chrome\content\utils.js
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\program files\Search Settings\FF\components\IFBHOSearch.xpt
c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt
c:\program files\Search Settings\FF\components\SearchSettingsFF.dll
c:\program files\Search Settings\FF\install.rdf
c:\program files\Search Settings\SearchSettings.dll
c:\program files\Search Settings\SearchSettings.exe
c:\program files\Search Settings\SearchSettingsRes409.dll
c:\recycled\Recycled
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
C:\userinit.exe
c:\windows\system32\twain_32.dll
C:\winlogon.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-12-21 do 2010-01-21  )))))))))))))))))))))))))))))))
.

2010-01-20 22:52 . 2010-01-20 22:52   388096   ----a-r-   c:\documents and settings\ppp\Dane aplikacji\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-20 22:51 . 2010-01-20 22:51   --------   d-----w-   c:\program files\TrendMicro
2010-01-17 20:44 . 2010-01-17 20:44   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Search Settings
2010-01-17 17:27 . 2010-01-17 17:27   --------   d-----w-   c:\windows\system32\config\systemprofile\Dane aplikacji\Application Updater
2010-01-17 17:27 . 2010-01-17 17:27   --------   d-----w-   c:\program files\Application Updater
2010-01-03 19:40 . 2010-01-03 19:40   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2010-01-03 19:40 . 2010-01-13 23:05   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\skypePM
2010-01-03 19:38 . 2010-01-13 23:29   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Skype
2010-01-03 19:37 . 2010-01-03 19:37   --------   d-----w-   c:\program files\Common Files\Skype
2010-01-03 19:37 . 2010-01-03 19:38   --------   d-----r-   c:\program files\Skype
2010-01-03 19:37 . 2010-01-03 19:37   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-19 19:18 . 2001-10-26 19:15   99020   ----a-w-   c:\windows\system32\perfc015.dat
2010-01-19 19:18 . 2001-10-26 19:15   525860   ----a-w-   c:\windows\system32\perfh015.dat
2010-01-18 17:20 . 2009-02-22 19:15   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\U3
2010-01-15 21:31 . 2009-02-21 19:05   --------   d-----w-   c:\program files\BitComet
2010-01-11 14:14 . 2009-09-28 13:14   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Vso
2010-01-02 23:39 . 2009-02-22 19:02   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\foobar2000
2009-12-21 20:05 . 2009-12-21 20:05   --------   d-----w-   c:\program files\SubEdit-Player
2009-12-21 20:03 . 2009-12-21 20:03   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Media Player Classic
2009-12-21 20:01 . 2009-12-21 20:01   --------   d-----w-   c:\program files\Real Alternative
2009-12-01 21:07 . 2009-12-01 21:07   --------   d-----w-   c:\program files\Alcohol Soft
2009-12-01 09:50 . 2003-01-08 18:26   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-11-28 22:21 . 2009-11-28 17:01   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Electronic Arts
2009-11-28 17:09 . 2009-11-28 16:42   --------   d-----w-   c:\program files\Electronic Arts
2009-11-28 16:59 . 2009-11-28 16:59   10134   ----a-r-   c:\documents and settings\ppp\Dane aplikacji\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-11-28 16:59 . 2009-11-28 16:59   --------   d-----w-   c:\program files\Microsoft WSE
2009-11-22 12:47 . 2009-02-21 17:40   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Nowe Gadu-Gadu
2009-11-20 12:48 . 2003-01-08 18:21   122368   ----a-w-   c:\documents and settings\ppp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-10-31 18:32 . 2009-02-14 19:02   1   ----a-w-   c:\documents and settings\ppp\Dane aplikacji\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-02-21 21:45 . 2009-02-21 21:41   88   --sh--r-   c:\windows\system32\E0F75EB49B.sys
2009-05-30 19:11 . 2009-02-21 21:41   2828   --sha-w-   c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2008-04-25 . C8BDAD4065118558B3DC360FC96D81DB . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-02-19 1262888]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 77824]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-17 339968]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 933888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-04 149280]
"UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16911:TCP"= 16911:TCP:BitComet 16911 TCP
"16911:UDP"= 16911:UDP:BitComet 16911 UDP
"12688:TCP"= 12688:TCP:BitComet 12688 TCP
"12688:UDP"= 12688:UDP:BitComet 12688 UDP
"9993:TCP"= 9993:TCP:BitComet 9993 TCP
"9993:UDP"= 9993:UDP:BitComet 9993 UDP

R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2009-12-01 5248]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-14 114768]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-08 380928]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-14 20560]
S0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2009-12-01 160640]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-05-17 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 16:34   451872   ----a-w-   c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Zawartość folderu 'Zaplanowane zadania'

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://google.atcomet.com/b/
uInternet Settings,ProxyOverride = *.local
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - c:\program files\Search Settings\SearchSettings.dll
BHO-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - c:\program files\Search Settings\SearchSettings.dll
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKLM-Run-Adobe Photo Downloader - c:\program files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
ActiveSetup-{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} - c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\isi32.exe
AddRemove-HijackThis - d:\downloads\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 11:16
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2010-01-21  11:19:07
ComboFix-quarantined-files.txt  2010-01-21 10:18

Przed: 14 310 547 456 bajtów wolnych
Po: 14 276 988 928 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8A9CAF04F39C1BECBEC21ADE91CFC688


a tutaj z DDS
1. http://wklej.org/id/265904/
2. http://wklej.org/id/265905/

[NieWiem]

Montuj w notatniku taki skrypt:

Folder::
c:\documents and settings\ppp\Dane aplikacji\Search Settings
c:\windows\system32\config\systemprofile\Dane aplikacji\Application Updater
c:\program files\Application Updater

DDS::
uStart Page = hxxp://google.atcomet.com/b/
uURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
IE: &Winamp Search - c:\documents and settings\all users\dane aplikacji\winamp toolbar\ietoolbar\resources\en-us\local\search.html

Firefox::
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search

Driver::
Application Updater

Plik -> zapisz jako -> CFScript.txt, na pulpicie. przeciągasz go i upuszczasz na ikonę CF. Dasz log, który powstanie.

Potem pobierasz program OTS, konfigurujesz analogicznie jak OTL (w przyklejonym) i pokazujesz też tego loga.

[becik23]

Więc tutaj combo

Kod: Zaznacz wszystko

ComboFix 10-01-20.05 - ppp 2010-01-21  12:55:57.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1023.676 [GMT 1:00]
Uruchomiony z: d:\downloads\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\ppp\Pulpit\CFScript.txt
AV: avast! antivirus 4.8.1356 [VPS 100121-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\all users\dane aplikacji\winamp toolbar\ietoolbar\resources\en-us\local\search.html
c:\documents and settings\ppp\Dane aplikacji\Search Settings
c:\documents and settings\ppp\Dane aplikacji\Search Settings\kb130\temp\ws-14626.log
c:\documents and settings\ppp\Dane aplikacji\Search Settings\kb130\temp\ws-14627.log
c:\documents and settings\ppp\Dane aplikacji\Search Settings\kb130\temp\ws-14628.log
c:\documents and settings\ppp\Dane aplikacji\Search Settings\kb130\temp\ws-14629.log
c:\documents and settings\ppp\Dane aplikacji\Search Settings\kb130\temp\ws-14630.log
c:\program files\Application Updater
c:\program files\Application Updater\ApplicationUpdater.exe
c:\program files\Application Updater\config.ini
c:\program files\winamp toolbar\winamptb.dll
c:\windows\system32\config\systemprofile\Dane aplikacji\Application Updater

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_APPLICATION_UPDATER
-------\Service_Application Updater


(((((((((((((((((((((((((   Pliki utworzone od 2009-12-21 do 2010-01-21  )))))))))))))))))))))))))))))))
.

2010-01-20 22:51 . 2010-01-20 22:51   --------   d-----w-   c:\program files\TrendMicro
2010-01-03 19:40 . 2010-01-03 19:40   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2010-01-03 19:40 . 2010-01-13 23:05   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\skypePM
2010-01-03 19:38 . 2010-01-13 23:29   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Skype
2010-01-03 19:37 . 2010-01-03 19:37   --------   d-----w-   c:\program files\Common Files\Skype
2010-01-03 19:37 . 2010-01-03 19:38   --------   d-----r-   c:\program files\Skype
2010-01-03 19:37 . 2010-01-03 19:37   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 12:02 . 2009-03-20 13:35   --------   d-----w-   c:\program files\Winamp Toolbar
2010-01-21 11:46 . 2003-01-08 18:21   122368   ----a-w-   c:\documents and settings\ppp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-01-20 22:52 . 2010-01-20 22:52   388096   ----a-r-   c:\documents and settings\ppp\Dane aplikacji\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-19 19:18 . 2001-10-26 19:15   99020   ----a-w-   c:\windows\system32\perfc015.dat
2010-01-19 19:18 . 2001-10-26 19:15   525860   ----a-w-   c:\windows\system32\perfh015.dat
2010-01-18 17:20 . 2009-02-22 19:15   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\U3
2010-01-15 21:31 . 2009-02-21 19:05   --------   d-----w-   c:\program files\BitComet
2010-01-11 14:14 . 2009-09-28 13:14   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Vso
2010-01-02 23:39 . 2009-02-22 19:02   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\foobar2000
2009-12-21 20:05 . 2009-12-21 20:05   --------   d-----w-   c:\program files\SubEdit-Player
2009-12-21 20:03 . 2009-12-21 20:03   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Media Player Classic
2009-12-21 20:01 . 2009-12-21 20:01   --------   d-----w-   c:\program files\Real Alternative
2009-12-01 21:07 . 2009-12-01 21:07   --------   d-----w-   c:\program files\Alcohol Soft
2009-12-01 09:50 . 2003-01-08 18:26   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-11-28 22:21 . 2009-11-28 17:01   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Electronic Arts
2009-11-28 17:09 . 2009-11-28 16:42   --------   d-----w-   c:\program files\Electronic Arts
2009-11-28 16:59 . 2009-11-28 16:59   10134   ----a-r-   c:\documents and settings\ppp\Dane aplikacji\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-11-28 16:59 . 2009-11-28 16:59   --------   d-----w-   c:\program files\Microsoft WSE
2009-11-22 12:47 . 2009-02-21 17:40   --------   d-----w-   c:\documents and settings\ppp\Dane aplikacji\Nowe Gadu-Gadu
2009-10-31 18:32 . 2009-02-14 19:02   1   ----a-w-   c:\documents and settings\ppp\Dane aplikacji\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-02-21 21:45 . 2009-02-21 21:41   88   --sh--r-   c:\windows\system32\E0F75EB49B.sys
2009-05-30 19:11 . 2009-02-21 21:41   2828   --sha-w-   c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2008-04-25 . C8BDAD4065118558B3DC360FC96D81DB . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((   SnapShot@2010-01-21_10.16.26   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-21 12:04 . 2010-01-21 12:04   16384              c:\windows\Temp\Perflib_Perfdata_500.dat
+ 2010-01-21 11:49 . 2010-01-21 11:49   16384              c:\windows\Temp\Perflib_Perfdata_4d0.dat
+ 2010-01-21 12:04 . 2010-01-21 12:04   16384              c:\windows\Temp\Perflib_Perfdata_4a0.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 77824]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-17 339968]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 933888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-04 149280]
"UVS11 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16911:TCP"= 16911:TCP:BitComet 16911 TCP
"16911:UDP"= 16911:UDP:BitComet 16911 UDP
"12688:TCP"= 12688:TCP:BitComet 12688 TCP
"12688:UDP"= 12688:UDP:BitComet 12688 UDP
"9993:TCP"= 9993:TCP:BitComet 9993 TCP
"9993:UDP"= 9993:UDP:BitComet 9993 UDP

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2009-12-01 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2009-12-01 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-05-17 717296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-14 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-14 20560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 16:34   451872   ----a-w-   c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Zawartość folderu 'Zaplanowane zadania'

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
.
------- Skan uzupełniający -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

URLSearchHooks-{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - c:\program files\Winamp Toolbar\winamptb.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 13:04
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x863260C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7620f28
\Driver\ACPI -> ACPI.sys @ 0xf7372cb8
\Driver\atapi -> atapi.sys @ 0xf7307b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf71fdbd4
PacketIndicateHandler -> NDIS.sys @ 0xf7209a21
SendHandler -> NDIS.sys @ 0xf71fdd44
user & kernel MBR OK

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(588)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3100)
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\brss01a.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Czas ukończenia: 2010-01-21  13:10:43 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2010-01-21 12:10
ComboFix2.txt  2010-01-21 10:19

Przed: 14 322 905 088 bajtów wolnych
Po: 14 187 143 168 bajtów wolnych

- - End Of File - - 1DC5245309F8DD3415B4244F8D4F6755


a tutaj OTS
http://wklej.org/id/265945/

[NieWiem]

• Start -> uruchom -> wpisujesz
  

  ComboFix /uninstall

  i enter.
  
• Uruchom ponownie OTS.
  
  Do okienka Paste Fix here wklej:
  

  [Kill All Processes]
  [Unregister DLLs]
  [Driver Services - Safe List]
  YN -> (catchme) catchme [Kernel | On_Demand | Running] -> -> File not found
  [Registry - Safe List]
  < FireFox Settings [Prefs.js] > -> C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\FireFox\Profiles\k5z82wgb.default\prefs.js ->
  NY -> browser.search.defaultenginename -> "Winamp Search" ->
  NY -> browser.search.defaulturl -> "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" ->
  < FireFox Extensions [User Folders] > ->
  YY -> Winamp Toolbar -> C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} -> [2009-07-22 08:42:28 | 00,000,000 | ---D | M]
  < FireFox SearchPlugins [User Folders] > ->
  YY -> winamp-search.xml -> C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\searchplugins\winamp-search.xml -> [2009-03-20 14:46:04 | 00,001,196 | ---- | M] ()
  < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks ->
  YN -> "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" [HKLM] -> Reg Error: Key error. [] -> File not found
  [empty temp folders]
  [start explorer]
  [reboot]

  
  i klikasz Run Fix.-> raport z czyszczenia do wglądu.
  
• Nowy log z OTL tym razem

[becik23]

usunęłam ComboFix i chciałam zrobić w OTS, ten RunFix...
Po skopiowaniu tego co miałam skopiować do "Paste Fix here" i wciśnięciu Run Fix, program się zawiesza. Na dole programu wyświetla się komunikat (choć nie wiem czy ta informacja jest istotna):
"Fixing service/driver: YN->(catchme) catchme [Kernel | On_Demand | Running] ->-> File not found..."

I muszę restartować komputer..

[NieWiem]

Usuń ze skryptu te dwie linijki:

[Driver Services - Safe List]
YN -> (catchme) catchme [Kernel | On_Demand | Running] -> -> File not found

po czym spróbuj jeszcze raz.

[becik23]

OTS

Kod: Zaznacz wszystko

All Processes Killed
[Registry - Safe List]
File "Winamp Search" -> not found.
File "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" -> not found.
File C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} -> not found.
File C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\searchplugins\winamp-search.xml -> not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> not found.
[empty temp folders]


User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: ppp
->Temp folder emptied: 10966709 bytes
->Temporary Internet Files folder emptied: 149415 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 58456161 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352022 bytes
%systemroot%\System32 .tmp files removed: 2596 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49663 bytes
RecycleBin emptied: 116792 bytes

Total Files Cleaned = 69,00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.19.2 fix logfile created on 01212010_151615

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_4cc.dat not found!

Registry entries deleted on Reboot...


OTL

Kod: Zaznacz wszystko

OTL logfile created on: 2010-01-21 15:28:25 - Run 2
OTL by OldTimer - Version 3.1.25.3     Folder = D:\DOWNLOADS
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1 023,00 Mb Total Physical Memory | 470,00 Mb Available Physical Memory | 46,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38,28 Gb Total Space | 12,26 Gb Free Space | 32,03% Space Free | Partition Type: NTFS
Drive D: | 34,18 Gb Total Space | 10,40 Gb Free Space | 30,44% Space Free | Partition Type: NTFS
Drive E: | 40,34 Gb Total Space | 32,67 Gb Free Space | 80,98% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PPP-67D47D15313
Current User Name: ppp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2010-01-21 15:28:02 | 00,546,816 | ---- | M] (OldTimer Tools) -- D:\DOWNLOADS\OTL.exe
PRC - [2010-01-07 14:23:57 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-09-15 11:56:48 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009-09-15 11:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-09-15 11:56:28 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-09-15 11:54:13 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009-09-15 11:49:40 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-09-04 12:35:14 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009-09-04 12:35:14 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2008-06-12 02:38:00 | 00,034,672 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
PRC - [2008-04-14 23:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007-08-23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2007-08-23 17:36:30 | 00,455,968 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
PRC - [2007-06-27 19:04:00 | 01,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
PRC - [2007-06-27 19:03:40 | 00,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2007-06-25 08:47:24 | 01,629,480 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
PRC - [2007-06-25 08:47:12 | 01,552,680 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2007-06-25 08:47:02 | 01,057,064 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCD.exe
PRC - [2007-03-06 10:35:02 | 00,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2007-03-03 13:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2007-01-31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2006-11-02 20:40:12 | 00,174,656 | ---- | M] () -- C:\WINDOWS\system32\PSIService.exe
PRC - [2006-10-27 00:47:42 | 00,031,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2005-04-15 04:01:46 | 00,077,824 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005-04-01 05:12:00 | 00,352,256 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005-03-17 21:05:00 | 00,339,968 | ---- | M] (ATI Technologies, Inc.) -- C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
PRC - [2005-03-17 14:25:54 | 00,057,393 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2002-04-12 00:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001-12-13 00:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2010-01-21 15:28:02 | 00,546,816 | ---- | M] (OldTimer Tools) -- D:\DOWNLOADS\OTL.exe


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-09-15 11:56:43 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009-09-15 11:56:28 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009-09-15 11:54:13 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009-09-15 11:49:40 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009-09-04 12:35:14 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009-02-21 23:32:18 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007-08-23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007-06-29 19:16:56 | 00,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007-06-25 08:47:12 | 01,552,680 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2007-03-06 10:35:02 | 00,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
SRV - [2007-03-03 13:48:28 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2007-01-31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2006-11-02 20:40:12 | 00,174,656 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PSIService.exe -- (ProtexisLicensing)
SRV - [2006-10-27 00:47:54 | 00,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006-10-26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2005-04-01 05:12:00 | 00,352,256 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005-03-17 21:05:00 | 00,516,096 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)
SRV - [2002-04-12 00:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) [Auto | Running] -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-09-28 14:14:36 | 00,047,360 | ---- | M] (VSO Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin)
DRV - [2009-09-15 11:56:14 | 00,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009-09-15 11:55:30 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2009-09-15 11:55:19 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009-09-15 11:54:30 | 00,052,368 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009-09-15 11:54:21 | 00,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009-09-15 11:53:24 | 00,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009-05-17 10:23:13 | 00,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008-08-20 18:58:58 | 00,044,944 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2008-04-13 23:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008-04-13 23:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C)
DRV - [2007-06-25 08:47:12 | 00,038,440 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007-06-25 08:47:12 | 00,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007-06-25 08:47:02 | 00,119,080 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2005-04-19 03:40:52 | 02,317,504 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005-04-01 05:12:00 | 01,032,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005-03-09 07:53:00 | 00,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004-10-15 12:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)
DRV - [2004-06-03 03:40:46 | 00,079,360 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus)
DRV - [2004-04-30 09:37:02 | 00,160,640 | ---- | M] ( ) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\a347bus.sys -- (a347bus)
DRV - [2004-04-30 09:33:00 | 00,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi)
DRV - [2004-04-13 13:14:12 | 00,070,144 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2003-10-29 06:02:00 | 00,021,120 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2001-08-18 01:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - Reg Error: Key error. File not found


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\S-1-5-21-1757981266-1715567821-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\S-1-5-21-1757981266-1715567821-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034"
FF - prefs.js..browser.search.selectedEngine: "Winamp Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.10
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-01-09 21:15:52 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-01-07 14:24:10 | 00,000,000 | ---D | M]

[2009-02-21 13:17:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Extensions
[2010-01-20 15:36:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions
[2009-07-22 08:42:28 | 00,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009-08-27 14:52:29 | 00,000,000 | ---D | M] (BitComet Video Downloader) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009-08-27 14:52:29 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2010-01-08 10:13:42 | 00,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009-03-20 14:46:04 | 00,001,196 | ---- | M] () -- C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\searchplugins\winamp-search.xml
[2010-01-21 15:26:31 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009-07-17 09:40:12 | 00,704,512 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009-03-24 10:10:44 | 00,114,688 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2009-11-03 02:54:10 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2009-11-03 02:54:10 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2009-11-03 02:54:10 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2009-11-03 02:54:10 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2009-11-03 02:54:10 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2009-11-03 02:54:10 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml

O1 HOSTS File: ([2010-01-21 13:04:14 | 00,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [combofix] C:\ComboFix\CF6514.cfx File not found
O4 - HKLM..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe (InterVideo Digital Technology Corporation)
O4 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Pobierz za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: com.tw ([www.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-1757981266-1715567821-1177238915-1003\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1042051534828 (WUWebControl Class)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnline/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003-01-08 19:06:23 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2010-01-21 15:16:20 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2010-01-21 13:44:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\ApplicationHistory
[2010-01-21 13:42:20 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2010-01-21 13:41:37 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010-01-21 11:09:52 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2010-01-21 11:07:53 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010-01-20 23:51:59 | 00,000,000 | ---D | C] -- C:\Program Files\TrendMicro
[2010-01-20 23:44:08 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ppp\Recent
[2010-01-19 22:03:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Wybrane MAMA
[2010-01-17 22:08:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\ciocia druty
[2010-01-15 22:11:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\wesele
[2010-01-11 12:31:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Artur strona www
[2010-01-10 20:40:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Nowy folder (2)
[2010-01-04 17:10:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\Agnessa www
[2010-01-03 20:40:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Dane aplikacji\skypePM
[2010-01-03 20:38:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Dane aplikacji\Skype
[2010-01-03 20:37:21 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010-01-03 20:37:16 | 00,000,000 | R--D | C] -- C:\Program Files\Skype
[2010-01-03 20:37:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype
[2009-12-28 22:08:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\KALENDARZ
[2009-12-24 16:45:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ppp\Pulpit\KOMORKA OPROGMRAM
[2009-12-01 22:08:06 | 00,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys
[2009-12-01 22:08:06 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys
[2009-09-28 14:14:36 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.sys
[2009-04-02 07:03:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple
[2009-02-22 20:03:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Adobe
[2009-02-21 22:26:19 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft
[2003-01-08 19:06:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2010-01-21 15:24:57 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010-01-21 15:24:10 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-01-21 15:24:04 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-01-21 15:24:03 | 10,732,70784 | -HS- | M] () -- C:\hiberfil.sys
[2010-01-21 15:16:30 | 09,961,472 | -H-- | M] () -- C:\Documents and Settings\ppp\NTUSER.DAT
[2010-01-21 15:16:30 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\ppp\ntuser.ini
[2010-01-21 14:11:56 | 00,525,860 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2010-01-21 14:11:56 | 00,444,164 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010-01-21 14:11:56 | 00,099,020 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2010-01-21 14:11:55 | 00,072,040 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010-01-21 14:11:53 | 01,156,500 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010-01-21 14:07:23 | 01,680,136 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010-01-21 14:05:13 | 00,013,113 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\ZDROWIA.docx
[2010-01-21 13:56:40 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010-01-21 13:44:37 | 00,000,128 | ---- | M] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
[2010-01-21 13:04:40 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010-01-21 13:04:14 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010-01-21 12:46:04 | 00,122,368 | ---- | M] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
[2010-01-21 11:10:07 | 00,000,281 | RHS- | M] () -- C:\boot.ini
[2010-01-19 15:02:08 | 00,118,166 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\1.JPG
[2010-01-19 14:42:19 | 00,651,264 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\załacznik_2.doc
[2010-01-18 18:21:24 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010-01-17 18:10:53 | 00,664,826 | ---- | M] () -- E:\Moje dokumenty\Kopia DSC05754.JPG
[2010-01-17 18:10:16 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\Kopia DSC05754.JPG
[2010-01-17 18:00:20 | 00,070,656 | ---- | M] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-01-16 15:52:56 | 03,959,591 | ---- | M] () -- C:\Documents and Settings\ppp\Pulpit\DSCN8803.JPG
[2010-01-13 21:09:09 | 00,154,688 | ---- | M] () -- E:\Moje dokumenty\b.JPG
[2010-01-13 21:09:02 | 00,072,372 | ---- | M] () -- E:\Moje dokumenty\a.JPG
[2010-01-11 15:14:28 | 00,001,044 | ---- | M] () -- C:\Documents and Settings\ppp\Dane aplikacji\vso_ts_preview.xml
[2010-01-10 16:27:01 | 00,000,293 | ---- | M] () -- C:\Documents and Settings\ppp\.jupload.properties
[2010-01-06 23:47:48 | 00,011,865 | ---- | M] () -- E:\Moje dokumenty\Kurczak tajski.docx
[2010-01-03 21:07:02 | 02,670,367 | ---- | M] () -- E:\Moje dokumenty\DSC_6137.JPG
[2010-01-03 21:06:30 | 02,862,732 | ---- | M] () -- E:\Moje dokumenty\DSC_6067.JPG
[2010-01-03 21:05:35 | 02,638,657 | ---- | M] () -- E:\Moje dokumenty\DSC_6053.JPG
[2010-01-03 21:05:26 | 02,691,987 | ---- | M] () -- E:\Moje dokumenty\DSC_6024.JPG
[2010-01-03 21:05:05 | 02,841,864 | ---- | M] () -- E:\Moje dokumenty\DSC_5977.JPG
[2010-01-03 21:03:42 | 02,685,163 | ---- | M] () -- E:\Moje dokumenty\DSC_5952.JPG
[2010-01-03 21:02:49 | 02,540,175 | ---- | M] () -- E:\Moje dokumenty\DSC_5935.JPG
[2010-01-03 21:01:40 | 02,507,412 | ---- | M] () -- E:\Moje dokumenty\DSC_5934.JPG
[2010-01-03 20:49:41 | 02,997,200 | ---- | M] () -- E:\Moje dokumenty\DSC_6043.JPG
[2010-01-03 20:48:03 | 02,776,667 | ---- | M] () -- E:\Moje dokumenty\DSC_5948.JPG
[2010-01-03 20:47:57 | 02,614,124 | ---- | M] () -- E:\Moje dokumenty\DSC_6088.JPG
[2010-01-03 20:46:27 | 02,308,835 | ---- | M] () -- E:\Moje dokumenty\DSC_6054.JPG
[2010-01-03 20:45:05 | 02,669,007 | ---- | M] () -- E:\Moje dokumenty\DSC_6044.JPG
[2010-01-03 20:44:44 | 00,924,542 | ---- | M] () -- E:\Moje dokumenty\DSCN5056.JPG
[2010-01-03 20:40:25 | 00,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-12-30 21:48:34 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5017.JPG
[2009-12-30 21:48:18 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5045.JPG
[2009-12-30 21:45:40 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5042.JPG
[2009-12-30 21:44:43 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\P1120586.JPG
[2009-12-30 21:44:06 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\ppp\DSCN5032.JPG

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2010-01-21 13:59:44 | 00,013,113 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\ZDROWIA.docx
[2010-01-21 13:44:37 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
[2010-01-21 13:40:54 | 00,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010-01-21 11:10:06 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2010-01-21 11:10:02 | 00,262,400 | ---- | C] () -- C:\cmldr
[2010-01-19 15:02:06 | 00,118,166 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\1.JPG
[2010-01-19 14:42:18 | 00,651,264 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\załacznik_2.doc
[2010-01-17 21:25:14 | 03,959,591 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\DSCN8803.JPG
[2010-01-17 18:10:21 | 00,664,826 | ---- | C] () -- E:\Moje dokumenty\Kopia DSC05754.JPG
[2010-01-17 18:10:16 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\Kopia DSC05754.JPG
[2010-01-13 21:09:01 | 00,154,688 | ---- | C] () -- E:\Moje dokumenty\b.JPG
[2010-01-13 21:08:58 | 00,072,372 | ---- | C] () -- E:\Moje dokumenty\a.JPG
[2010-01-11 13:56:08 | 02,096,044 | ---- | C] () -- C:\Documents and Settings\ppp\Pulpit\Dziadek016.jpg
[2010-01-06 23:47:48 | 00,011,865 | ---- | C] () -- E:\Moje dokumenty\Kurczak tajski.docx
[2010-01-03 21:02:25 | 02,670,367 | ---- | C] () -- E:\Moje dokumenty\DSC_6137.JPG
[2010-01-03 20:57:59 | 02,862,732 | ---- | C] () -- E:\Moje dokumenty\DSC_6067.JPG
[2010-01-03 20:56:20 | 02,638,657 | ---- | C] () -- E:\Moje dokumenty\DSC_6053.JPG
[2010-01-03 20:55:49 | 02,691,987 | ---- | C] () -- E:\Moje dokumenty\DSC_6024.JPG
[2010-01-03 20:55:16 | 02,841,864 | ---- | C] () -- E:\Moje dokumenty\DSC_5977.JPG
[2010-01-03 20:54:46 | 02,685,163 | ---- | C] () -- E:\Moje dokumenty\DSC_5952.JPG
[2010-01-03 20:54:39 | 02,540,175 | ---- | C] () -- E:\Moje dokumenty\DSC_5935.JPG
[2010-01-03 20:54:36 | 02,507,412 | ---- | C] () -- E:\Moje dokumenty\DSC_5934.JPG
[2010-01-03 20:47:49 | 02,997,200 | ---- | C] () -- E:\Moje dokumenty\DSC_6043.JPG
[2010-01-03 20:44:33 | 02,614,124 | ---- | C] () -- E:\Moje dokumenty\DSC_6088.JPG
[2010-01-03 20:43:53 | 02,776,667 | ---- | C] () -- E:\Moje dokumenty\DSC_5948.JPG
[2010-01-03 20:42:58 | 00,924,542 | ---- | C] () -- E:\Moje dokumenty\DSCN5056.JPG
[2010-01-03 20:42:38 | 02,308,835 | ---- | C] () -- E:\Moje dokumenty\DSC_6054.JPG
[2010-01-03 20:41:55 | 02,669,007 | ---- | C] () -- E:\Moje dokumenty\DSC_6044.JPG
[2010-01-03 20:40:25 | 00,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009-12-30 21:48:34 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5017.JPG
[2009-12-30 21:48:18 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5045.JPG
[2009-12-30 21:45:40 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5042.JPG
[2009-12-30 21:44:43 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\P1120586.JPG
[2009-12-30 21:44:06 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\ppp\DSCN5032.JPG
[2009-11-20 11:07:50 | 00,210,456 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2009-11-20 11:07:50 | 00,194,072 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2009-11-20 11:07:49 | 00,206,360 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2009-11-20 11:07:49 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2009-11-20 11:07:49 | 00,198,168 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2009-11-20 11:07:49 | 00,026,136 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2009-09-28 14:15:08 | 00,001,044 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\vso_ts_preview.xml
[2009-09-28 14:14:46 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.log
[2009-09-28 14:14:36 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.cat
[2009-09-28 14:14:36 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\ppp\Dane aplikacji\pcouffin.inf
[2009-07-09 16:12:10 | 00,000,169 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-17 10:41:56 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009-02-22 17:10:23 | 00,000,462 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009-02-22 17:10:23 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009-02-22 17:10:23 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009-02-22 17:06:40 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2009-02-21 22:41:47 | 00,002,828 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2009-02-21 22:41:47 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\E0F75EB49B.sys
[2009-02-21 22:23:35 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009-02-21 22:23:30 | 00,070,656 | ---- | C] () -- C:\Documents and Settings\ppp\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-02-20 16:21:05 | 00,000,756 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2009-02-16 18:19:42 | 00,790,190 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-02-16 17:32:20 | 00,425,040 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2009-02-16 17:30:30 | 00,903,703 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2009-02-16 17:27:28 | 00,557,451 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2009-02-16 17:23:50 | 00,145,081 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2009-02-16 15:49:30 | 00,328,334 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
[2009-02-16 15:47:42 | 04,451,209 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2009-02-14 16:15:42 | 00,486,400 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
[2009-02-09 23:28:18 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2009-02-09 21:19:18 | 00,183,296 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
[2009-02-09 21:19:12 | 00,178,688 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
[2009-02-09 21:18:52 | 00,113,152 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
[2009-02-09 21:18:32 | 00,146,944 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
[2009-02-09 21:18:24 | 00,257,024 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
[2009-02-09 21:18:20 | 00,142,848 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
[2009-02-09 20:56:22 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-01-10 23:17:32 | 00,163,840 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
[2009-01-10 23:16:56 | 00,148,480 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
[2009-01-10 23:16:50 | 00,108,032 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
[2009-01-10 23:16:14 | 00,141,312 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
[2009-01-10 23:15:54 | 00,120,832 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
[2009-01-10 23:15:44 | 00,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
[2009-01-10 23:15:32 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
[2009-01-10 23:15:28 | 00,246,784 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
[2009-01-10 23:15:12 | 00,097,280 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
[2009-01-10 23:14:08 | 00,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2009-01-10 23:14:06 | 00,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2008-12-03 23:11:50 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008-11-06 17:37:32 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008-11-06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008-11-06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008-05-26 22:22:36 | 00,016,222 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008-05-26 22:22:34 | 00,021,728 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008-05-26 22:22:32 | 00,016,164 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008-01-31 17:18:14 | 00,009,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\FlashSys.sys
[2007-10-13 10:30:20 | 00,000,137 | ---- | C] () -- C:\WINDOWS\System32\Registration.ini
[2007-07-10 18:10:12 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2003-01-08 19:25:05 | 00,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2002-03-04 10:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll

[color=#E56717]========== LOP Check ==========[/color]

[2009-05-17 10:35:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2009-11-28 23:21:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts
[2009-06-16 22:37:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\GameHouse
[2009-11-20 11:07:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InterVideo
[2009-02-15 00:59:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
[2009-07-02 22:25:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst
[2009-02-22 17:06:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft
[2009-11-20 11:08:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SmartSound Software Inc
[2009-11-20 11:21:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems
[2009-10-22 14:24:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\vsosdk
[2009-06-16 21:57:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Zylom
[2009-07-06 20:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Atari
[2009-02-22 16:38:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Canon
[2009-05-17 10:36:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools
[2009-05-17 10:39:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools Lite
[2009-05-17 10:36:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\DAEMON Tools Pro
[2010-01-03 00:39:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\foobar2000
[2009-02-22 00:39:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Nik Software
[2009-11-22 13:47:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Nowe Gadu-Gadu
[2009-02-14 20:01:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\OpenOffice.org
[2009-07-02 23:33:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\PlayFirst
[2009-11-20 11:53:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Ulead Systems
[2010-01-11 15:14:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Vso
[2009-02-14 20:03:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Windows Desktop Search
[2009-02-15 01:01:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ppp\Dane aplikacji\Windows Search

[color=#E56717]========== Purity Check ==========[/color]


< End of report >
 


[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034"
FF - prefs.js..browser.search.selectedEngine: "Winamp Search"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.10
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
O4 - HKLM..\Run: [combofix] C:\ComboFix\CF6514.cfx File not found
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found

:Files
C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
C:\Documents and Settings\ppp\Dane aplikacji\Mozilla\Firefox\Profiles\k5z82wgb.default\searchplugins\winamp-search.xml

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdz reset kompa .

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie ) i daj raport ze skanu

[becik23]

troszkę to trwało, ale już daję log po skanie
(wykrył jakieś 4 zarazione pliki, usunęłam)

Kod: Zaznacz wszystko

Malwarebytes' Anti-Malware 1.44
Wersja bazy definicji: 3610
Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 7.0.5730.13

2010-01-21 23:01:39
mbam-log-2010-01-21 (23-01-39).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|)
Przeskanowane obiekty: 201865
Upłynęło: 1 hour(s), 19 minute(s), 41 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 0
Zainfekowane klucze rejestru: 4
Zainfekowane wartości rejestru: 0
Zainfekowane pliki rejestru: 0
Zainfekowane foldery: 0
Zainfekowane pliki: 0

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
(Nie wykryto groźnych plików)

Zainfekowane klucze rejestru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully.

Zainfekowane wartości rejestru:
(Nie wykryto groźnych plików)

Zainfekowane pliki rejestru:
(Nie wykryto groźnych plików)

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
(Nie wykryto groźnych plików)


Teraz tak...zoptymalizowałam Windows według instrukcji..ale teraz przy uruchomieniu włącza mi się taki komunikat:
http://img717.imageshack.us/img717/8052/87606216.jpg

gdy wciskam "OK" pojawia się takie okno:
http://img695.imageshack.us/img695/2979/47432437.jpg

Co z tym zrobić?

[wojtas]

daj w lewym rogu nie pokazuj tego komunikatu...

[becik23]

Tak zrobiłam, zobaczymy co będzie się działo przy kolejnym włączeniu.
Tak czy siak...wnioskuję, że ta sprawa z logami, jakimiś paskudztwami itp jest już zamknięta i komputer ozdrowiał.
Ślicznie Wam dziękuję po raz kolejny za pomoc

Jesteście boscy!