Problem mój z rootkitami. komp muli.

**Posty:** 17 · przez **dvoorek** 05 Mar 2010, 21:45

Nie było mnie kilka dni w domu i po powrocie niemiła niespodzianka...
Włączam mój sprzęcik kochany a tu wyskakuje masa wirusów. U większości z nich pojawia się nazwa rootkit...
Zazwyczaj znajdują się w win32 i driversach...

Komp strasznie muli i tnie się coraz częściej. Szalenie przeszkadza mi to w mojej pracy gdzie liczy się czas i refleks. (dziennikarz)

Widziałem podobny temat na forum ale kazano mi założyć osobny i tak też czynię

Wiem, że muszę przedstawić jakieś logi, dostałem nawet odpowiedni namiar jak, ale i tak tego nie rozumiem...
Niestety słaby jestem w komputerowych sprawach.

Czy ktoś może mi pomóc...?

Na jakie pytania mam odpowiedzieć by ułatwić Wam pomoc?

**Posty:** 12734 · przez **Mikou@j** 05 Mar 2010, 22:10

Przeczytaj i się zastosuj do zasady-wstawiania-logow-vt93842.html

**Posty:** 17 · przez **dvoorek** 06 Mar 2010, 00:07

O tym mówiłem... Dostałem już wcześniej link ale nie wiem co mam dalej z tym zrobić...

No ale spróbowałem podziałać tym gramerem. Wyskoczyły jakieś zaklęcia, które wyglądają tak.

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-03-05 23:05:41 Windows 5.1.2600 Dodatek Service Pack 2 Running: c55pyirb.exe; Driver: C:\DOCUME~1\dvoorek\USTAWI~1\Temp\ffnorpow.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF3E7C6B8] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF3E7CA52] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF3E7C14C] SSDT spyc.sys ZwEnumerateKey [0xF73D3CA4] SSDT spyc.sys ZwEnumerateValueKey [0xF73D4032] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF3E7C64E] SSDT spyc.sys ZwQueryKey [0xF73D410A] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF3E7C76E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF3E7C72E] INT 0x62 ? 8458DBF8 INT 0x63 ? 84150BF8 INT 0x83 ? 8458DBF8 INT 0x83 ? 8458DBF8 INT 0x83 ? 8458DBF8 INT 0xB4 ? 84150BF8 ---- Kernel code sections - GMER 1.0.15 ---- ? spyc.sys Nie można odnaleźć określonego pliku. ! .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6DE8360, 0x20469D, 0xE8000020] .text USBPORT.SYS!DllUnload F6DA462C 5 Bytes JMP 841501D8 .text a49fho3d.SYS F6C65386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...] .text a49fho3d.SYS F6C653AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...] .text a49fho3d.SYS F6C653C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH} .text a49fho3d.SYS F6C653C9 1 Byte [2E] .text a49fho3d.SYS F6C653C9 11 Bytes [2E, 00, 00, 00, 5C, 02, 00, ...] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL} .text ... ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\Explorer.EXE[1544] ntdll.dll!NtQueryDirectoryFile + 6 7C90DF64 4 Bytes [90, 61, 3B, 02] {NOP ; POPA ; CMP EAX, [EDX]} ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F73B6042] spyc.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F73B613E] spyc.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F73B60C0] spyc.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F73B6800] spyc.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F73B66D6] spyc.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F73C5E9C] spyc.sys IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KfAcquireSpinLock] 8A000002 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!READ_PORT_UCHAR] 83880846 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KeGetCurrentIrql] 000001C0 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KfRaiseIrql] 2C4EB70F IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KfLowerIrql] 8303C183 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!HalGetInterruptVector] D103FCE1 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!HalTranslateBusAddress] 2E7E8366 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KeStallExecutionProcessor] 8D1C7400 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!KfReleaseSpinLock] 83893204 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00000218 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!READ_PORT_USHORT] 2E4EB70F IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 021C8B89 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[HAL.dll!WRITE_PORT_UCHAR] B70F0000 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[WMILIB.SYS!WmiSystemControl] 03D00304 IAT \SystemRoot\System32\Drivers\a49fho3d.SYS[WMILIB.SYS!WmiCompleteRequest] 0CB389F2 ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\system32\services.exe[760] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003C0002 IAT C:\WINDOWS\system32\services.exe[760] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003C0000 ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 836C21F8 AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) Device \FileSystem\Fastfat \FatCdrom 8458B1F8 Device \FileSystem\Udfs \UdfsCdRom 83555500 Device \FileSystem\Udfs \UdfsDisk 83555500 AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) Device \Driver\usbohci \Device\USBPDO-0 8414F1F8 Device \Driver\usbehci \Device\USBPDO-1 841431F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 8458E1F8 Device \Driver\dmio \Device\DmControl\DmConfig 8458E1F8 Device \Driver\dmio \Device\DmControl\DmPnP 8458E1F8 Device \Driver\dmio \Device\DmControl\DmInfo 8458E1F8 AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) Device \Driver\Ftdisk \Device\HarddiskVolume1 8458F1F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8458F1F8 Device \Driver\Cdrom \Device\CdRom0 841371F8 Device \Driver\Cdrom \Device\CdRom1 841371F8 Device \Driver\atapi \Device\Ide\IdePort0 8458D1F8 Device \Driver\atapi \Device\Ide\IdePort1 8458D1F8 Device \Driver\atapi \Device\Ide\IdePort2 8458D1F8 Device \Driver\atapi \Device\Ide\IdePort3 8458D1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e 8458D1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 8458D1F8 Device \Driver\PCI_PNP8446 \Device\0000003b spyc.sys Device \Driver\NetBT \Device\NetBt_Wins_Export 8373C1F8 Device \Driver\NetBT \Device\NetbiosSmb 8373C1F8 AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) Device \Driver\sptd \Device\1774967196 spyc.sys AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) Device \Driver\usbohci \Device\USBFDO-0 8414F1F8 Device \Driver\usbehci \Device\USBFDO-1 841431F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8371F1F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 8371F1F8 Device \Driver\Ftdisk \Device\FtControl 8458F1F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{033BF642-CF3B-4710-89E7-CAB7E36D2408} 8373C1F8 Device \Driver\a49fho3d \Device\Scsi\a49fho3d1 841321F8 Device \Driver\a49fho3d \Device\Scsi\a49fho3d1Port4Path0Target0Lun0 841321F8 Device \FileSystem\Fastfat \Fat 8458B1F8 AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) Device \FileSystem\Cdfs \Cdfs 842C9408 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x2F 0x6E 0x0C ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x62 0xBA 0xD0 0x2F ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB8 0x97 0x5D 0xE7 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xBB 0x9E 0x8C 0x22 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xAC 0xBC 0x99 0x36 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x2F 0x6E 0x0C ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x62 0xBA 0xD0 0x2F ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB8 0x97 0x5D 0xE7 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xF7 0x2E 0xA1 0x3C ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xAC 0xBC 0x99 0x36 ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION 08F26C89A40E332C947D3D2C4B899D4478AE6FB2F5F3A0ED669DA60ECC6C0E37AB64FE125AC4A5AFAFA8916B2C8C059B3FA0C7A2D1A365C135B7832DA1E326C761BB121052D5A896D3186C92E276FDDCE1ABD101D490E392121CA80032208E18C1D0366D69C84ADCADE79D53F0E0E21F41CAB96AC404E02F3247FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808FEBC9E127BECC74CA9C6AECB7A5D1407549FB1C6D950C381646EE095DFE977D44831B76B9B0BEB72F2384E73CAC9EAD3FE284CEC75B1F12008FBE5C7280B57CFC798A4C80237B3D612EEFB3C939B2A6715AD3644059870BEED052B281999B6008E77C43EF6AA552B703E60E2C5274C929C3C6EFD997095ED7B7C70173339C37AFCC93F7F0563F2250BCDA48A1A660C4B5044C1CCB8CAD009C8BEC977E4B5C01829F48BC12C84C4BF9429C5D7BCF334CC1E9A52E75BDBA32A1E869F34987C83F5593CF6BD5E5415B7F0BE16F6CD0F2517A8F6180CEEFCA1B17E77ADB9A49E77768BCCA232823E4390B963BB96621D53ECC676DDF8D32B75C49C1502F659D21ABC703402DFF3D0C38FBC4DB0687FA547D5031942715E07DB4B5E4A816277727E32EB63DE8C82409CBF7C9942A2A3D31D9C9B44B7BCD8D6A670E064E473B57B490596B25603706 ---- EOF - GMER 1.0.15 ----

I co dalej?

**Posty:** 18165 · przez **wojtas** 06 Mar 2010, 13:13

przecież w zasadach jest napisane jakie logi są wymagane ... czytać

**Posty:** 17 · przez **dvoorek** 06 Mar 2010, 15:11

Ok, ale to i tak dla mnie jest mało zrozumiane... Z tym gramerem jeszcze jakoś skumałem, z tym pierwszym gorzej.
Nie ma 12 lat ani nie jestem leniwy zaręczam.

**Posty:** 12734 · przez **Mikou@j** 06 Mar 2010, 15:13

Wystarczy ściągnąć OTL, zaznaczyć wszystko jak na obrazku i kliknąć Run Scan:
http://www.searchengines.pl/ComboFix-vs-DDS-OTListIt2-t86306.html#1
Co w tym jest niezrozumiałe ? :roll:

**Posty:** 17 · przez **dvoorek** 06 Mar 2010, 18:40

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-03-06 16:35:50 - Run 1 OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\dvoorek\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 447,00 Mb Total Physical Memory | 81,00 Mb Available Physical Memory | 18,00% Memory free 1,00 Gb Paging File | 0,00 Gb Available in Paging File | 36,00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,76 Gb Total Space | 2,31 Gb Free Space | 23,69% Space Free | Partition Type: FAT32 Drive D: | 64,75 Gb Total Space | 49,14 Gb Free Space | 75,89% Space Free | Partition Type: NTFS Drive E: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: X-9E65661479C94 Current User Name: dvoorek Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "D:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "D:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "D:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "D:\Program Files\gadu-gadu\Nowe Gadu-Gadu\gg.exe" = D:\Program Files\gadu-gadu\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- File not found "D:\Program Files\Bearshare\BearShare.exe" = D:\Program Files\Bearshare\BearShare.exe:*:Enabled:BearShare -- (Free Peers, Inc.) "D:\Program Files\netsoccer\Netsoccer\server.exe" = D:\Program Files\netsoccer\Netsoccer\server.exe:*:Enabled:server -- () "D:\Program Files\settlers IV\Exe\S4_Main.exe" = D:\Program Files\settlers IV\Exe\S4_Main.exe:*:Enabled:S4_Main -- File not found "D:\Program Files\Football Manager 2008\fm.exe" = D:\Program Files\Football Manager 2008\fm.exe:*:Enabled:Football Manager 2008 -- (Sports Interactive) "D:\Program Files\Freeciv-2.1.9-gtk2\civserver.exe" = D:\Program Files\Freeciv-2.1.9-gtk2\civserver.exe:*:Enabled:civserver -- File not found "C:\Program Files\Nowe Gadu-Gadu\gg.exe" = C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- (GG Network S.A.) "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\Documents and Settings\DVOOREK\Pulpit\ofiszjeli dig&spike\zsnesw141\zsnesw.exe" = C:\Documents and Settings\DVOOREK\Pulpit\ofiszjeli dig&spike\zsnesw141\zsnesw.exe:*:Enabled:zsnesw -- File not found "C:\Documents and Settings\DVOOREK\Pulpit\D&S\ofiszjeli dig&spike\zsnesw141\zsnesw.exe" = C:\Documents and Settings\DVOOREK\Pulpit\D&S\ofiszjeli dig&spike\zsnesw141\zsnesw.exe:*:Enabled:zsnesw -- () "C:\Documents and Settings\DVOOREK\Pulpit\DigAndSpike2010BETA\zsnesw.exe" = C:\Documents and Settings\DVOOREK\Pulpit\DigAndSpike2010BETA\zsnesw.exe:*:Enabled:zsnesw -- File not found "C:\Documents and Settings\DVOOREK\Pulpit\Dig&Spike 2010 beta v0.2\zsnesw.exe" = C:\Documents and Settings\DVOOREK\Pulpit\Dig&Spike 2010 beta v0.2\zsnesw.exe:*:Enabled:zsnesw -- () [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime "{2225F5C5-E738-4132-B8AB-428046BE7534}" = Beach Volleyball "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13 "{2AC22CBC-1E34-4942-BC27-890E5DD3F8BC}}_is1" = New Star GP 1.0 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O Defrag Professional Edition "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features "{5A62499F-1D61-4319-9718-592BC99DAC47}_is1" = New Star Soccer 4.05 "{5E4EF02B-4C5F-4B35-AB77-41284456165A}" = Skoki Narciarskie 2002 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{71A51A91-E7D3-11DB-A386-005056C00008}" = Media-Tech Camera "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{792BF55D-113E-43DD-B686-F13DAFDEE1A4}}_is1" = New Star Soccer 2010 v4.13 "{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1038-7B44-CEA000000001}" = Adobe Reader 6.0.2 CE "{AE86AE81-CD7F-496F-A39F-0210C985E71B}" = FM Modifier 2.25 "{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver "{CB3331BE-811F-4633-A391-1B6CD974D143}_is1" = DivX PowerPack Lite 1.28 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{D2D3D146-67BC-43D0-9015-2E7BAC2E032B}" = OpenOffice.org 3.1 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F77F95C8-C493-11D8-88E4-0004769F25D1}" = Mroczne Wieki "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "Adobe Acrobat 5.0" = Adobe Acrobat 5.0 CE "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11 "avast!" = avast! Antivirus "BearShare" = BearShare "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "DOSShell" = DOSShell 1.4 "Football Manager 2008" = Football Manager 2008 "free-downloads.net Toolbar" = free-downloads.net Toolbar "Glary Utilities_is1" = Glary Utilities Pro 2.3.3 "Google Chrome" = Google Chrome "Google Updater" = Aktualizator Google "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Mozilla Firefox (3.0.18)" = Mozilla Firefox (3.0.18) "My Global Search Uninstall" = My Global Search Bar "Niezbędnik CD_is1" = Niezbędnik CD "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "NVIDIA Drivers" = NVIDIA Drivers "OpenTTD" = OpenTTD 0.6.1 "Pizza Connection 2" = Pizza Connection 2 "pycairo-py2.6" = Python 2.6 pycairo-1.4.12 "pygobject-py2.6" = Python 2.6 pygobject-2.14.2 "pygtk-py2.6" = Python 2.6 pygtk-2.12.1 "RADVideo" = RAD Video Tools "Skoki Narciarskie 2006" = Skoki Narciarskie 2006 "SQLAlchemy-py2.6" = Python 2.6 SQLAlchemy-0.5.2 "SystemRequirementsLab" = System Requirements Lab "TacView - WibWobly Tactic Viewer_is1" = TacView 0.431 "Tennis Elbow 2009" = Tennis Elbow 2009 1.0b "Universal Boxing Manager_is1" = Universal Boxing Manager "Winamp" = Winamp (remove only) "WinGimp-2.0_is1" = GIMP 2.6.7 "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Volleyball Manager 2009" = Volleyball Manager 2009 [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2009-09-11 09:01:33 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of G:\DCIM\100OLYMP\P3080055.JPG failed, 0000001E. Error - 2009-11-06 06:05:51 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://translate.google.pl/translate_a/t?client=t&text=test&sl=pl&tl=en&pc=0&oc=1 failed, 0000A413. Error - 2009-11-06 13:15:05 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://suggestqueries.google.com/complete/search?hl=pl&client=youtube&hjson=t&ds=yt&jsonp=window.yt.www.suggest.handleResponse&q=cheri%20lady%20orchestr&cp=19 failed, 0000A413. Error - 2009-11-07 17:03:33 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://nasza-klasa.pl/friends_online_list2/2719693?t=4afeeeac236e4a7130ff50ea failed, 0000A413. Error - 2009-11-09 03:18:23 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://nasza-klasa.pl/url_validator failed, 0000A413. Error - 2009-11-09 12:40:59 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://poczta10.o2.pl/a?cmd=get_widgets&fmt=jsbg&xsfr-cookie=m01R9u6n02Plq1QfCJ0000tQI1DJbwggLKWwnJ5xq29lrayhp2gcNN0k0l& failed, 0000A413. Error - 2010-01-14 14:43:35 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Documents and Settings\dvoorek\Dane aplikacji\OpenOffice.org\3\user\registry\data\org\openoffice\Office\Histories.xcu.bak failed, 00000570. Error - 2010-01-29 14:52:42 | Computer Name = X-9E65661479C94 | Source = avast! | ID = 33554522 Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://s32.hotfile.com/get/83fa90e5f5263a650e12ff95a2d014400a3f65ec/4b632d17//050794ce332d4c03/168acc6/Skoki.Narciarskie.2006.PL.iso failed, 00000084. [ Application Events ] Error - 2010-03-04 15:22:22 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-04 15:22:22 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 01:51:53 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 02:00:58 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 05:20:16 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 05:27:19 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 10:03:56 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-05 10:13:32 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-06 05:14:42 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. Error - 2010-03-06 05:23:49 | Computer Name = X-9E65661479C94 | Source = PerfNet | ID = 2004 Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0. [ System Events ] Error - 2010-03-05 10:06:43 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-03-05 15:09:42 | Computer Name = X-9E65661479C94 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1053” podczas próby uruchomienia usługi gusvc z argumentami „” w celu uruchomienia serwera: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8} Error - 2010-03-05 15:09:55 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Google Software Updater. Error - 2010-03-06 05:14:17 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7023 Description = Usługa Serwer zakończyła działanie; wystąpił następujący błąd: %%2 Error - 2010-03-06 05:14:17 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7001 Description = Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu: %%2 Error - 2010-03-06 05:15:07 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-03-06 05:15:07 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-03-06 05:15:40 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-03-06 05:15:40 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-03-06 05:17:26 | Computer Name = X-9E65661479C94 | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Web Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. < End of report >

Kod: Zaznacz wszystko: OTL logfile created on: 2010-03-06 16:35:50 - Run 1 OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\dvoorek\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 447,00 Mb Total Physical Memory | 81,00 Mb Available Physical Memory | 18,00% Memory free 1,00 Gb Paging File | 0,00 Gb Available in Paging File | 36,00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,76 Gb Total Space | 2,31 Gb Free Space | 23,69% Space Free | Partition Type: FAT32 Drive D: | 64,75 Gb Total Space | 49,14 Gb Free Space | 75,89% Space Free | Partition Type: NTFS Drive E: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: X-9E65661479C94 Current User Name: dvoorek Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe PRC - [2010-02-18 18:15:16 | 000,307,672 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2010-02-15 00:16:29 | 002,752,560 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\Setup\avast.setup PRC - [2009-07-27 17:42:10 | 010,719,848 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe PRC - [2009-07-27 16:39:44 | 000,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2009-03-02 10:39:02 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009-02-05 22:08:46 | 000,081,000 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-02-05 22:08:40 | 000,138,680 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-02-05 22:08:26 | 000,254,040 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-02-05 22:06:04 | 000,352,920 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-02-05 22:01:26 | 000,018,752 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-12-29 12:40:30 | 000,687,560 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe PRC - [2008-03-26 17:33:00 | 000,135,168 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe PRC - [2006-06-02 01:52:58 | 000,339,456 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe PRC - [2004-08-03 22:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe MOD - [2004-08-03 22:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-02-05 22:08:40 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- D:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-02-05 22:08:26 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-02-05 22:06:04 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- D:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-02-05 22:01:26 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2006-06-02 01:52:58 | 000,339,456 | ---- | M] (O&O Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-07-07 22:39:50 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-02-13 16:49:30 | 005,029,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2009-02-05 22:08:10 | 000,094,032 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-02-05 22:07:24 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-02-05 22:07:12 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-02-05 22:06:20 | 000,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-02-05 22:06:10 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-02-05 22:05:12 | 000,026,944 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2008-04-03 14:35:24 | 000,250,240 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VMUVC.sys -- (VMUVC) DRV - [2007-11-14 18:08:46 | 000,476,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvftUVC.sys -- (vvftUVC) DRV - [2005-10-10 21:49:00 | 003,530,432 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2005-07-29 17:11:00 | 000,034,048 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2005-07-29 17:11:00 | 000,012,928 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-03-09 15:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005-01-07 17:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus) DRV - [2004-08-03 23:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.0.7.0088 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-03-01 14:23:04 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-03-01 14:23:04 | 000,000,000 | ---D | M] [2009-03-01 14:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Extensions [2009-03-01 14:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Firefox\Profiles\z8f8i38i.default\extensions [2009-03-30 21:43:18 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Firefox\Profiles\z8f8i38i.default\searchplugins\daemon-search.xml [2009-03-01 14:23:04 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-12-18 08:33:20 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-12-18 08:33:20 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-12-18 08:33:20 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-12-18 08:33:20 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-12-18 08:33:20 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-12-18 08:33:20 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 13:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Winamp\Reader\ActiveX\AcroIEHelper.ocx () O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (My Global Search Bar BHO) - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.) O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\dvoorek\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) O3 - HKLM\..\Toolbar: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) O3 - HKCU\..\Toolbar\WebBrowser: (free-downloads.net Toolbar) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [avast!] D:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) O4 - HKCU..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [reader_s] C:\WINDOWS\System32\config\systemprofile\reader_s.exe File not found O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\ADOBE\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -Mozilla\5.0 ( File not found O4 - Startup: C:\Documents and Settings\dvoorek\Menu Start\Programy\Autostart\winesm32.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\dvoorek\Moje dokumenty\IMG_0186.JPG O24 - Desktop BackupWallPaper: C:\Documents and Settings\dvoorek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-18 22:08:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2007-11-30 10:04:34 | 000,000,053 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH) O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-03-06 16:34:29 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe [2010-03-04 15:55:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\Dig&Spike 2010 beta v0.2 [2010-03-03 07:56:30 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys [2010-03-03 07:56:30 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys [2010-03-03 07:55:58 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys [2010-03-03 07:55:43 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Changer.sys [2010-03-03 07:55:43 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys [2010-02-14 11:48:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\turniej [2010-02-14 09:37:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\slownik [2010-02-11 09:35:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\int [2010-02-11 09:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\ticket2stargard [2010-02-06 15:38:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\spr [2009-02-18 21:58:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-02-18 21:58:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-03-06 17:30:10 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010-03-06 17:02:58 | 000,031,731 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\spojka_0.JPG [2010-03-06 16:44:18 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\Bansept 08.jpg [2010-03-06 16:38:24 | 000,116,267 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\Bansept 01.jpg [2010-03-06 16:38:08 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\Bansept 01.jpg [2010-03-06 16:36:46 | 000,107,272 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 01.jpg [2010-03-06 16:36:28 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 01.jpg [2010-03-06 16:36:04 | 000,068,392 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 02.jpg [2010-03-06 16:35:56 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 02.jpg [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe [2010-03-06 16:33:40 | 000,113,475 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\PLAC_WOL.JPG [2010-03-06 16:33:26 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\PLAC_WOL.JPG [2010-03-06 16:31:52 | 000,078,944 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\SZKO_A_M.JPG [2010-03-06 16:31:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\SZKO_A_M.JPG [2010-03-06 16:31:20 | 000,096,332 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\ULICA_MI.JPG [2010-03-06 16:30:48 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\ULICA_MI.JPG [2010-03-06 15:24:34 | 000,020,645 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\policja1.jpeg [2010-03-06 13:41:54 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-03-06 13:26:36 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2010-03-06 11:59:08 | 000,000,030 | ---- | M] () -- C:\WINDOWS\TextSpy.ini [2010-03-06 11:54:04 | 001,746,888 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\4.pdf [2010-03-06 11:52:04 | 001,131,330 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\12.pdf [2010-03-06 11:46:30 | 001,152,427 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\11.pdf [2010-03-06 11:40:50 | 001,283,738 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\3.pdf [2010-03-06 11:38:12 | 001,170,048 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\1.pdf [2010-03-06 10:28:40 | 001,751,637 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\sobota.pdf [2010-03-06 10:13:36 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010-03-06 10:13:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-03-06 10:12:40 | 000,039,291 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-03-06 10:12:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-03-06 10:12:28 | 000,255,498 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor [2010-03-05 23:18:30 | 005,242,880 | -H-- | M] () -- C:\Documents and Settings\dvoorek\NTUSER.DAT [2010-03-05 23:18:30 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\dvoorek\ntuser.ini [2010-03-05 21:41:00 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\c55pyirb.exe [2010-03-05 10:43:06 | 000,061,816 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\dzk.jpg [2010-03-05 07:17:54 | 000,005,626 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\szczepienie.jpg [2010-03-04 22:52:30 | 000,038,121 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\1267540964_by_wysio_500.jpg [2010-03-04 21:20:20 | 000,062,138 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo100.JPG [2010-03-04 21:16:24 | 000,045,977 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo.JPG [2010-03-04 16:38:14 | 000,051,200 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\test Stargard.xls [2010-03-04 15:54:02 | 001,129,249 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig&Spike 2010 beta v0.2.rar [2010-03-03 09:28:44 | 000,387,845 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ZAPROSZENIE.pdf [2010-03-02 17:41:26 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-03-01 11:48:12 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\rbuwzv.dat [2010-03-01 11:48:04 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\avdrn.dat [2010-02-27 19:10:04 | 000,232,803 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Pwt.W-wy.jpg [2010-02-27 19:10:04 | 000,001,503 | ---- | M] () -- C:\Documents and Settings\dvoorek\.recently-used.xbel [2010-02-25 14:33:28 | 000,049,571 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\spojnia-lukaszgrzegorzewski.jpg [2010-02-25 14:21:14 | 000,451,584 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Megapanel_PBI_-_wyniki_grudzień_2009.xls [2010-02-24 16:13:34 | 000,026,283 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\bilde.jpeg [2010-02-24 11:01:36 | 000,032,671 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\1266778853_by_qcharz00_500.jpg [2010-02-21 13:02:06 | 000,008,192 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig_and_Spike_Vollyball_(U).srm [2010-02-10 08:28:04 | 000,012,216 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Nowy OpenDocument Dokument tekstowy.odt [2010-02-09 21:41:24 | 000,159,232 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_formularz_testowy_v2.0.0_2010-01-18.xls [2010-02-09 20:45:38 | 000,029,184 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\formatka_zgloszenia_2009-05-22.doc [2010-02-09 13:26:54 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_testerzy.xls [2010-02-06 15:09:18 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Biathlon 3000.lnk [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-03-06 17:02:55 | 000,031,731 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\spojka_0.JPG [2010-03-06 16:44:17 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\Bansept 08.jpg [2010-03-06 16:38:10 | 000,116,267 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\Bansept 01.jpg [2010-03-06 16:38:06 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\Bansept 01.jpg [2010-03-06 16:36:39 | 000,107,272 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 01.jpg [2010-03-06 16:36:26 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 01.jpg [2010-03-06 16:35:57 | 000,068,392 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 02.jpg [2010-03-06 16:35:54 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 02.jpg [2010-03-06 16:33:27 | 000,113,475 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\PLAC_WOL.JPG [2010-03-06 16:33:24 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\PLAC_WOL.JPG [2010-03-06 16:31:41 | 000,078,944 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\SZKO_A_M.JPG [2010-03-06 16:31:31 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\SZKO_A_M.JPG [2010-03-06 16:30:51 | 000,096,332 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\ULICA_MI.JPG [2010-03-06 16:30:46 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\ULICA_MI.JPG [2010-03-06 15:24:29 | 000,020,645 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\policja1.jpeg [2010-03-06 11:54:00 | 001,746,888 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\4.pdf [2010-03-06 11:52:01 | 001,131,330 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\12.pdf [2010-03-06 11:46:28 | 001,152,427 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\11.pdf [2010-03-06 11:40:47 | 001,283,738 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\3.pdf [2010-03-06 11:38:09 | 001,170,048 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\1.pdf [2010-03-06 10:28:37 | 001,751,637 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\sobota.pdf [2010-03-05 21:40:54 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\c55pyirb.exe [2010-03-05 10:41:33 | 000,061,816 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\dzk.jpg [2010-03-05 07:16:24 | 000,005,626 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\szczepienie.jpg [2010-03-04 22:52:29 | 000,038,121 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\1267540964_by_wysio_500.jpg [2010-03-04 21:20:18 | 000,062,138 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo100.JPG [2010-03-04 21:16:23 | 000,045,977 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo.JPG [2010-03-04 15:53:46 | 001,129,249 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig&Spike 2010 beta v0.2.rar [2010-03-03 09:28:36 | 000,387,845 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ZAPROSZENIE.pdf [2010-03-03 07:52:37 | 000,000,012 | ---- | C] () -- C:\Documents and Settings\NetworkService\Dane aplikacji\rbuwzv.dat [2010-03-01 12:05:41 | 000,000,012 | ---- | C] () -- C:\Documents and Settings\LocalService\Dane aplikacji\rbuwzv.dat [2010-03-01 11:48:10 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\rbuwzv.dat [2010-03-01 11:48:03 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\avdrn.dat [2010-02-27 19:10:03 | 000,001,503 | ---- | C] () -- C:\Documents and Settings\dvoorek\.recently-used.xbel [2010-02-27 19:06:41 | 000,232,803 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Pwt.W-wy.jpg [2010-02-26 15:15:47 | 000,051,200 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\test Stargard.xls [2010-02-25 14:32:24 | 000,049,571 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\spojnia-lukaszgrzegorzewski.jpg [2010-02-25 14:21:11 | 000,451,584 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Megapanel_PBI_-_wyniki_grudzień_2009.xls [2010-02-24 14:06:59 | 000,026,283 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\bilde.jpeg [2010-02-24 11:01:32 | 000,032,671 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\1266778853_by_qcharz00_500.jpg [2010-02-10 07:43:21 | 000,012,216 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Nowy OpenDocument Dokument tekstowy.odt [2010-02-09 20:45:48 | 000,159,232 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_formularz_testowy_v2.0.0_2010-01-18.xls [2010-02-09 20:45:38 | 000,029,184 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\formatka_zgloszenia_2009-05-22.doc [2010-02-09 13:26:54 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_testerzy.xls [2010-02-06 15:09:17 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Biathlon 3000.lnk [2009-11-28 09:48:26 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll [2009-11-28 09:48:26 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2009-11-28 09:48:26 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2009-11-28 09:48:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2009-10-04 19:24:02 | 000,001,572 | ---- | C] () -- C:\WINDOWS\kaillera.ini [2009-08-26 22:53:12 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2009-07-08 06:03:54 | 000,000,030 | ---- | C] () -- C:\WINDOWS\TextSpy.ini [2009-07-06 23:57:26 | 000,007,880 | ---- | C] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\.civclientrc [2009-06-22 16:19:53 | 000,000,053 | ---- | C] () -- C:\WINDOWS\GPMMICP.INI [2009-03-30 21:29:57 | 000,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-02-18 22:56:01 | 000,000,192 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-02-18 22:21:55 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2009-02-18 22:21:55 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2009-02-18 22:21:53 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2009-02-18 22:21:52 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2009-02-18 22:21:52 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2009-02-18 22:21:52 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2009-02-18 22:21:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2004-08-28 13:05:14 | 000,112,128 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll [2004-08-28 13:04:52 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-08-28 13:04:26 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-28 13:03:58 | 002,012,672 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-08-28 13:00:30 | 000,395,264 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-08-28 12:57:38 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll [2004-08-28 12:40:48 | 000,071,168 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll [2004-08-28 12:40:40 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll [2004-08-28 12:40:38 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll [2004-08-28 12:40:34 | 000,483,328 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll [2004-08-28 12:40:18 | 000,044,032 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll [2004-08-28 12:40:16 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-08-28 12:39:48 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-08-28 12:39:38 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll [2004-08-03 22:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 09:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

Chyba mnie się udało:) O to magia z OTL-u

**Posty:** 18165 · przez **wojtas** 07 Mar 2010, 01:27

DRV - [2009-07-07 22:39:50 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

w zasadach wstawiania logów jest wyraźnie napisane że przed użyciem Gmera z komputera ma zostać skasowany program emulujący napędy + plik sptd . !

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
IE - HKCU\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.)
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.0.7.0088
O2 - BHO: (My Global Search Bar BHO) - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)
O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)
O3 - HKLM\..\Toolbar: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (My Global Search Bar) - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search)
O3 - HKCU\..\Toolbar\WebBrowser: (free-downloads.net Toolbar) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - C:\Program Files\free-downloads.net\tbfre1.dll (Conduit Ltd.)
O4 - HKCU..\Run: [reader_s] C:\WINDOWS\System32\config\systemprofile\reader_s.exe File not found
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\ADOBE\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\dvoorek\Menu Start\Programy\Autostart\winesm32.exe ()
O32 - AutoRun File - [2007-11-30 10:04:34 | 000,000,053 | R--- | M] () - E:\autorun.inf -- [ CDFS ]

:Files
c:\Documents and Settings\NetworkService\Dane aplikacji\rbuwzv.dat
C:\Documents and Settings\LocalService\Dane aplikacji\rbuwzv.dat
C:\Documents and Settings\dvoorek\Dane aplikacji\rbuwzv.dat
C:\Documents and Settings\dvoorek\Dane aplikacji\avdrn.dat
C:\WINDOWS\System32\drivers\lbrtfdc.sys
C:\WINDOWS\System32\dllcache\lbrtfdc.sys
C:\WINDOWS\System32\dllcache\i2omgmt.sys
C:\WINDOWS\System32\drivers\Changer.sys
C:\WINDOWS\System32\dllcache\changer.sys
C:\Program Files\DAEMON Tools Toolbar
C:\Program Files\free-downloads.net
C:\Program Files\MyGlobalSearch
C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Firefox\Profiles\z8f8i38i.default\searchplugins\daemon-search.xml

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdź reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + log z Gmera ( ale skasuj sptd + program emulujący ! )

**Posty:** 17 · przez **dvoorek** 11 Mar 2010, 19:12

Log po restarcie.

Kod: Zaznacz wszystko: OTL logfile created on: 2010-03-11 17:42:16 - Run 2 OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\dvoorek\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 447,00 Mb Total Physical Memory | 45,00 Mb Available Physical Memory | 10,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 49,00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,76 Gb Total Space | 2,32 Gb Free Space | 23,79% Space Free | Partition Type: FAT32 Drive D: | 64,75 Gb Total Space | 49,05 Gb Free Space | 75,75% Space Free | Partition Type: NTFS Drive E: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: X-9E65661479C94 Current User Name: dvoorek Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe PRC - [2010-02-18 18:15:16 | 000,307,672 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2010-02-15 00:16:29 | 002,752,560 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\Setup\avast.setup PRC - [2009-07-27 17:42:10 | 010,719,848 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe PRC - [2009-07-27 16:39:44 | 000,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2009-03-02 10:39:02 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009-02-05 22:08:46 | 000,081,000 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-02-05 22:08:40 | 000,138,680 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-02-05 22:08:26 | 000,254,040 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-02-05 22:06:04 | 000,352,920 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-02-05 22:01:26 | 000,018,752 | ---- | M] (ALWIL Software) -- D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-03-26 17:33:00 | 000,135,168 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe PRC - [2006-06-02 01:52:58 | 000,339,456 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe PRC - [2004-08-03 22:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe MOD - [2004-08-03 22:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-02-05 22:08:40 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- D:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-02-05 22:08:26 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-02-05 22:06:04 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- D:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-02-05 22:01:26 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2006-06-02 01:52:58 | 000,339,456 | ---- | M] (O&O Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-02-13 16:49:30 | 005,029,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2009-02-05 22:08:10 | 000,094,032 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-02-05 22:07:24 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-02-05 22:07:12 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-02-05 22:06:20 | 000,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-02-05 22:06:10 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-02-05 22:05:12 | 000,026,944 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2008-04-03 14:35:24 | 000,250,240 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VMUVC.sys -- (VMUVC) DRV - [2007-11-14 18:08:46 | 000,476,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvftUVC.sys -- (vvftUVC) DRV - [2005-10-10 21:49:00 | 003,530,432 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2005-07-29 17:11:00 | 000,034,048 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2005-07-29 17:11:00 | 000,012,928 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-03-09 15:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005-01-07 17:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus) DRV - [2004-08-03 23:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-03-01 14:23:04 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-03-01 14:23:04 | 000,000,000 | ---D | M] [2009-03-01 14:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Extensions [2009-03-01 14:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Firefox\Profiles\z8f8i38i.default\extensions [2009-03-01 14:23:04 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-12-18 08:33:20 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-12-18 08:33:20 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-12-18 08:33:20 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-12-18 08:33:20 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-12-18 08:33:20 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-12-18 08:33:20 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 13:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Winamp\Reader\ActiveX\AcroIEHelper.ocx () O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\dvoorek\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [avast!] D:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation) O4 - HKCU..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\dvoorek\Moje dokumenty\IMG_0186.JPG O24 - Desktop BackupWallPaper: C:\Documents and Settings\dvoorek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-18 22:08:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2007-11-30 10:04:34 | 000,000,053 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH) O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-03-11 17:34:36 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys [2010-03-11 17:34:36 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys [2010-03-11 17:34:35 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys [2010-03-11 17:34:35 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys [2010-03-11 16:51:32 | 000,000,000 | ---D | C] -- C:\_OTL [2010-03-11 16:42:33 | 000,026,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbstor.sys [2010-03-11 16:20:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\zsnesw142 [2010-03-10 16:45:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\taniec irlandzki [2010-03-07 19:53:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\box [2010-03-06 16:34:29 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe [2010-02-14 11:48:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\turniej [2010-02-14 09:37:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\slownik [2010-02-11 09:35:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\int [2010-02-11 09:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\dvoorek\Pulpit\ticket2stargard [2009-10-31 14:18:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Google [2009-10-31 13:58:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google [2009-07-11 13:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\free-downloads.net [2009-03-14 13:41:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple [2009-02-18 22:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-02-18 22:12:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-02-18 21:58:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-02-18 21:58:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-03-11 17:38:50 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2010-03-11 17:38:38 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010-03-11 17:38:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-03-11 17:38:18 | 000,039,291 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-03-11 17:38:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-03-11 17:38:00 | 000,259,572 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor [2010-03-11 17:35:44 | 005,242,880 | -H-- | M] () -- C:\Documents and Settings\dvoorek\NTUSER.DAT [2010-03-11 17:35:44 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\dvoorek\ntuser.ini [2010-03-11 17:30:12 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010-03-11 09:38:56 | 000,000,030 | ---- | M] () -- C:\WINDOWS\TextSpy.ini [2010-03-11 09:19:52 | 001,762,478 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\czwartek.pdf [2010-03-10 19:33:24 | 004,270,606 | -H-- | M] () -- C:\Documents and Settings\dvoorek\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-03-10 16:26:22 | 004,187,069 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Gealforce Dance.zip [2010-03-10 08:50:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-03-09 22:51:40 | 000,512,590 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Stargard Stadtplan.jpg [2010-03-09 18:38:08 | 000,079,045 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\reiestracia.JPG [2010-03-09 12:56:50 | 006,047,166 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\PDFy.zip [2010-03-09 12:53:38 | 000,776,704 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Linkowanie_materialow_z MM_ IGC_na_portalach_MR.doc [2010-03-07 22:09:46 | 000,025,203 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\bilde.jpeg [2010-03-07 19:51:50 | 000,418,817 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\4dboxing.zip [2010-03-07 19:35:00 | 001,402,282 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\poniedzialek.pdf [2010-03-07 14:20:16 | 001,129,742 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig_Spike_2010_v1.0a.rar [2010-03-06 16:44:18 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\Bansept 08.jpg [2010-03-06 16:38:24 | 000,116,267 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\Bansept 01.jpg [2010-03-06 16:38:08 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\Bansept 01.jpg [2010-03-06 16:36:46 | 000,107,272 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 01.jpg [2010-03-06 16:36:28 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 01.jpg [2010-03-06 16:36:04 | 000,068,392 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 02.jpg [2010-03-06 16:35:56 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 02.jpg [2010-03-06 16:34:38 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\dvoorek\Pulpit\OTL.exe [2010-03-06 16:33:40 | 000,113,475 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\PLAC_WOL.JPG [2010-03-06 16:33:26 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\PLAC_WOL.JPG [2010-03-06 16:31:52 | 000,078,944 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\SZKO_A_M.JPG [2010-03-06 16:31:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\SZKO_A_M.JPG [2010-03-06 16:31:20 | 000,096,332 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\ULICA_MI.JPG [2010-03-06 16:30:48 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\dvoorek\ULICA_MI.JPG [2010-03-06 15:24:34 | 000,020,645 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\policja1.jpeg [2010-03-06 13:41:54 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-03-06 11:54:04 | 001,746,888 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\4.pdf [2010-03-06 11:52:04 | 001,131,330 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\12.pdf [2010-03-06 11:46:30 | 001,152,427 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\11.pdf [2010-03-06 11:40:50 | 001,283,738 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\3.pdf [2010-03-06 11:38:12 | 001,170,048 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\1.pdf [2010-03-06 10:28:40 | 001,751,637 | ---- | M] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\sobota.pdf [2010-03-05 21:41:00 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\c55pyirb.exe [2010-03-05 10:43:06 | 000,061,816 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\dzk.jpg [2010-03-05 07:17:54 | 000,005,626 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\szczepienie.jpg [2010-03-04 22:52:30 | 000,038,121 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\1267540964_by_wysio_500.jpg [2010-03-04 21:20:20 | 000,062,138 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo100.JPG [2010-03-04 21:16:24 | 000,045,977 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo.JPG [2010-03-04 16:38:14 | 000,051,200 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\test Stargard.xls [2010-03-04 15:54:02 | 001,129,249 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig&Spike 2010 beta v0.2.rar [2010-03-03 09:28:44 | 000,387,845 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\ZAPROSZENIE.pdf [2010-02-27 19:10:04 | 000,232,803 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Pwt.W-wy.jpg [2010-02-27 19:10:04 | 000,001,503 | ---- | M] () -- C:\Documents and Settings\dvoorek\.recently-used.xbel [2010-02-25 14:33:28 | 000,049,571 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\spojnia-lukaszgrzegorzewski.jpg [2010-02-25 14:21:14 | 000,451,584 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Megapanel_PBI_-_wyniki_grudzień_2009.xls [2010-02-24 11:01:36 | 000,032,671 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\1266778853_by_qcharz00_500.jpg [2010-02-21 13:02:06 | 000,008,192 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig_and_Spike_Vollyball_(U).srm [2010-02-10 08:28:04 | 000,012,216 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\Nowy OpenDocument Dokument tekstowy.odt [2010-02-09 21:41:24 | 000,159,232 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_formularz_testowy_v2.0.0_2010-01-18.xls [2010-02-09 20:45:38 | 000,029,184 | ---- | M] () -- C:\Documents and Settings\dvoorek\Pulpit\formatka_zgloszenia_2009-05-22.doc [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-03-11 09:19:49 | 001,762,478 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\czwartek.pdf [2010-03-10 16:24:34 | 004,187,069 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Gealforce Dance.zip [2010-03-09 22:51:37 | 000,512,590 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Stargard Stadtplan.jpg [2010-03-09 18:38:07 | 000,079,045 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\reiestracia.JPG [2010-03-09 12:54:45 | 006,047,166 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\PDFy.zip [2010-03-09 12:53:21 | 000,776,704 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Linkowanie_materialow_z MM_ IGC_na_portalach_MR.doc [2010-03-07 19:52:28 | 000,000,660 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\HEAD1.DAT [2010-03-07 19:52:28 | 000,000,240 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\CONFIG2.DAT [2010-03-07 19:51:45 | 000,418,817 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\4dboxing.zip [2010-03-07 19:34:58 | 001,402,282 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\poniedzialek.pdf [2010-03-07 14:19:54 | 001,129,742 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig_Spike_2010_v1.0a.rar [2010-03-06 16:44:17 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\Bansept 08.jpg [2010-03-06 16:38:10 | 000,116,267 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\Bansept 01.jpg [2010-03-06 16:38:06 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\Bansept 01.jpg [2010-03-06 16:36:39 | 000,107,272 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 01.jpg [2010-03-06 16:36:26 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 01.jpg [2010-03-06 16:35:57 | 000,068,392 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\stargardzkie kapsle 02.jpg [2010-03-06 16:35:54 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\stargardzkie kapsle 02.jpg [2010-03-06 16:33:27 | 000,113,475 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\PLAC_WOL.JPG [2010-03-06 16:33:24 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\PLAC_WOL.JPG [2010-03-06 16:31:41 | 000,078,944 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\SZKO_A_M.JPG [2010-03-06 16:31:31 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\SZKO_A_M.JPG [2010-03-06 16:30:51 | 000,096,332 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\ULICA_MI.JPG [2010-03-06 16:30:46 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\dvoorek\ULICA_MI.JPG [2010-03-06 15:24:29 | 000,020,645 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\policja1.jpeg [2010-03-06 11:54:00 | 001,746,888 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\4.pdf [2010-03-06 11:52:01 | 001,131,330 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\12.pdf [2010-03-06 11:46:28 | 001,152,427 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\11.pdf [2010-03-06 11:40:47 | 001,283,738 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\3.pdf [2010-03-06 11:38:09 | 001,170,048 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\1.pdf [2010-03-06 10:28:37 | 001,751,637 | ---- | C] () -- C:\Documents and Settings\dvoorek\Moje dokumenty\sobota.pdf [2010-03-05 21:40:54 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\c55pyirb.exe [2010-03-05 10:41:33 | 000,061,816 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\dzk.jpg [2010-03-05 07:16:24 | 000,005,626 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\szczepienie.jpg [2010-03-04 22:52:29 | 000,038,121 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\1267540964_by_wysio_500.jpg [2010-03-04 21:20:18 | 000,062,138 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo100.JPG [2010-03-04 21:16:23 | 000,045,977 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ememka logo.JPG [2010-03-04 15:53:46 | 001,129,249 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Dig&Spike 2010 beta v0.2.rar [2010-03-03 09:28:36 | 000,387,845 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\ZAPROSZENIE.pdf [2010-02-27 19:10:03 | 000,001,503 | ---- | C] () -- C:\Documents and Settings\dvoorek\.recently-used.xbel [2010-02-27 19:06:41 | 000,232,803 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Pwt.W-wy.jpg [2010-02-26 15:15:47 | 000,051,200 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\test Stargard.xls [2010-02-25 14:32:24 | 000,049,571 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\spojnia-lukaszgrzegorzewski.jpg [2010-02-25 14:21:11 | 000,451,584 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Megapanel_PBI_-_wyniki_grudzień_2009.xls [2010-02-24 14:06:59 | 000,025,203 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\bilde.jpeg [2010-02-24 11:01:32 | 000,032,671 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\1266778853_by_qcharz00_500.jpg [2010-02-10 07:43:21 | 000,012,216 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\Nowy OpenDocument Dokument tekstowy.odt [2010-02-09 20:45:48 | 000,159,232 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\igc_formularz_testowy_v2.0.0_2010-01-18.xls [2010-02-09 20:45:38 | 000,029,184 | ---- | C] () -- C:\Documents and Settings\dvoorek\Pulpit\formatka_zgloszenia_2009-05-22.doc [2009-11-28 09:48:26 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll [2009-11-28 09:48:26 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2009-11-28 09:48:26 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2009-11-28 09:48:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2009-10-04 19:24:02 | 000,001,572 | ---- | C] () -- C:\WINDOWS\kaillera.ini [2009-08-26 22:53:12 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2009-07-08 06:03:54 | 000,000,030 | ---- | C] () -- C:\WINDOWS\TextSpy.ini [2009-07-06 23:57:26 | 000,007,880 | ---- | C] () -- C:\Documents and Settings\dvoorek\Dane aplikacji\.civclientrc [2009-06-22 16:19:53 | 000,000,053 | ---- | C] () -- C:\WINDOWS\GPMMICP.INI [2009-05-15 17:36:10 | 000,009,728 | ---- | C] () -- C:\Documents and Settings\dvoorek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-02-18 22:56:01 | 000,000,192 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-02-18 22:21:55 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2009-02-18 22:21:55 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2009-02-18 22:21:53 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2009-02-18 22:21:52 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2009-02-18 22:21:52 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2009-02-18 22:21:52 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2009-02-18 22:21:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2004-08-28 13:05:14 | 000,112,128 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll [2004-08-28 13:04:52 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-08-28 13:04:26 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-28 13:03:58 | 002,012,672 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-08-28 13:00:30 | 000,395,264 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-08-28 12:57:38 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll [2004-08-28 12:40:48 | 000,071,168 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll [2004-08-28 12:40:40 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll [2004-08-28 12:40:38 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll [2004-08-28 12:40:34 | 000,483,328 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll [2004-08-28 12:40:18 | 000,044,032 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll [2004-08-28 12:40:16 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-08-28 12:39:48 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-08-28 12:39:38 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll [2004-08-03 22:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 09:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys < End of report >

Coś co wyskoczyło zaraz po właczeniu kompa (po restarcie)

Kod: Zaznacz wszystko: ========== OTL ========== HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{ecdee021-0d17-467f-a1ff-c7a115230949} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ecdee021-0d17-467f-a1ff-c7a115230949}\ deleted successfully. C:\Program Files\free-downloads.net\tbfre1.dll moved successfully. Prefs.js: DTToolbar@toolbarnet.com:1.0.7.0088 removed from extensions.enabledItems Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37B85A21-692B-4205-9CAD-2626E4993404}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37B85A21-692B-4205-9CAD-2626E4993404}\ deleted successfully. C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ecdee021-0d17-467f-a1ff-c7a115230949}\ not found. File C:\Program Files\free-downloads.net\tbfre1.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{37B85A29-692B-4205-9CAD-2626E4993404} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404}\ deleted successfully. File C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ecdee021-0d17-467f-a1ff-c7a115230949} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ecdee021-0d17-467f-a1ff-c7a115230949}\ not found. File downloads.net\tbfre1.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{37B85A29-692B-4205-9CAD-2626E4993404} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404}\ not found. File C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{37B85A29-692B-4205-9CAD-2626E4993404} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404}\ not found. File C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{ECDEE021-0D17-467F-A1FF-C7A115230949} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECDEE021-0D17-467F-A1FF-C7A115230949}\ not found. File downloads.net\tbfre1.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\reader_s deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater not found. File move failed. C:\Documents and Settings\dvoorek\Menu Start\Programy\Autostart\winesm32.exe scheduled to be moved on reboot. File move failed. E:\autorun.inf scheduled to be moved on reboot. ========== FILES ========== c:\Documents and Settings\NetworkService\Dane aplikacji\rbuwzv.dat moved successfully. C:\Documents and Settings\LocalService\Dane aplikacji\rbuwzv.dat moved successfully. C:\Documents and Settings\dvoorek\Dane aplikacji\rbuwzv.dat moved successfully. C:\Documents and Settings\dvoorek\Dane aplikacji\avdrn.dat moved successfully. C:\WINDOWS\System32\drivers\lbrtfdc.sys moved successfully. C:\WINDOWS\System32\dllcache\lbrtfdc.sys moved successfully. C:\WINDOWS\System32\dllcache\i2omgmt.sys moved successfully. C:\WINDOWS\System32\drivers\Changer.sys moved successfully. C:\WINDOWS\System32\dllcache\changer.sys moved successfully. C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components folder moved successfully. C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT folder moved successfully. C:\Program Files\DAEMON Tools Toolbar folder moved successfully. C:\Program Files\free-downloads.net folder moved successfully. C:\Program Files\MyGlobalSearch\bar\Settings folder moved successfully. C:\Program Files\MyGlobalSearch\bar\History folder moved successfully. C:\Program Files\MyGlobalSearch\bar\Cache folder moved successfully. C:\Program Files\MyGlobalSearch\bar\1.bin folder moved successfully. C:\Program Files\MyGlobalSearch\bar folder moved successfully. C:\Program Files\MyGlobalSearch folder moved successfully. C:\Documents and Settings\dvoorek\Dane aplikacji\Mozilla\Firefox\Profiles\z8f8i38i.default\searchplugins\daemon-search.xml moved successfully. ========== COMMANDS ========== OTL by OldTimer - Version 3.1.34.0 log created on 03112010_173410 Files\Folders moved on Reboot... C:\Documents and Settings\dvoorek\Menu Start\Programy\Autostart\winesm32.exe moved successfully. File move failed. E:\autorun.inf scheduled to be moved on reboot. Registry entries deleted on Reboot...

Coś tam z Gmera

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-03-11 18:10:16 Windows 5.1.2600 Dodatek Service Pack 2 Running: c55pyirb.exe; Driver: C:\DOCUME~1\dvoorek\USTAWI~1\Temp\ffnorpow.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF40436B8] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF4043574] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF4043A52] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF404314C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF404364E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF404308C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF40430F0] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF404376E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF404372E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF40438AE] ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6F79360, 0x20469D, 0xE8000020] ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\system32\services.exe[752] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003C0002 IAT C:\WINDOWS\system32\services.exe[752] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003C0000 ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x2F 0x6E 0x0C ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5F 0x13 0xED 0xFC ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x2F 0x6E 0x0C ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5F 0x13 0xED 0xFC ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION 08F26C89A40E332C947D3D2C4B899D4478AE6FB2F5F3A0ED669DA60ECC6C0E37AB64FE125AC4A5AFAFA8916B2C8C059B3FA0C7A2D1A365C135B7832DA1E326C761BB121052D5A896D3186C92E276FDDCE1ABD101D490E392121CA80032208E18C1D0366D69C84ADCADE79D53F0E0E21F41CAB96AC404E02F3247FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808FEBC9E127BECC74CA9C6AECB7A5D1407549FB1C6D950C381646EE095DFE977D44831B76B9B0BEB72F2384E73CAC9EAD3FE284CEC75B1F12008FBE5C7280B57CFC798A4C80237B3D612EEFB3C939B2A6715AD3644059870BEED052B281999B6008E77C43EF6AA552B703E60E2C5274C929C3C6EFD997095ED7B7C70173339C37AFCC93F7F0563F2250BCDA48A1A660C4B5044C1CCB8CAD009C8BEC977E4B5C01829F48BC12C84C4BF9429C5D7BCF334CC1E9A52E75BDBA32A1E869F34987C83F5593CF6BD5E5415B7F0BE16F6CD0F2517A8F6180CEEFCA1B17E77ADB9A49E77768BCCA232823E4390B963BB96621D53ECC676DDF8D32B75C49C1502F659D21ABC703402DFF3D0C38FBC4DB0687FA547D5031942715E07DB4B5E4A816277727E32EB63DE8C82409CBF7C9942A2A3D31D9C9B44B7BCD8D6A670E064E473B57B490596B25603706 ---- EOF - GMER 1.0.15 ----

Mam nadzieję, że zrobiłem wszystko jak trzeba. Daemona odinstalowałem, a plik usunąłem.
Czekam na dalsze wskazówki

**Posty:** 18165 · przez **wojtas** 11 Mar 2010, 19:18

Czynności końcowe :

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )

Zaktualizuj zabezpieczenia:
>>> Adobe Reader 9.3
>>> Internet Explorer 8
>>> Service Pack 3
>>> Java™ 6 Update 18
>>> Avast 5

**Posty:** 17 · przez **dvoorek** 11 Mar 2010, 20:38

Dzięki wielkie, zrobiłem wszystko jak trzeba.
Mam teraz takie pytania.

Podczas skanowania malwarem, avast wykrył 2 konie trojańskie, czy to nie zakłóciło skanu malwara?
Sam malwar wykrył tylko 17 infekcji... dziwne, że tak mało.
Druga sprawa, otworzyłem OTL Clean Up, i komputer się zrestartował. Czy to wszystko co miałem zrobić odnośnie tego punktu?

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 11 Mar 2010, 20:49

tak wszystko ok

pokaż raport z MBAM'a

**Posty:** 17 · przez **dvoorek** 11 Mar 2010, 21:31

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.44 Wersja bazy definicji: 3853 Windows 5.1.2600 Dodatek Service Pack 2 Internet Explorer 6.0.2900.2180 2010-03-11 19:37:05 mbam-log-2010-03-11 (19-37-05).txt Typ skanowania: Pełne skanowanie (C:\|D:\|) Przeskanowane obiekty: 178172 Upłynęło: 27 minute(s), 3 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 15 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 2 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: HKEY_CLASSES_ROOT\myglobalsearchbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\myglobalsearchbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\myglobalsearchbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\myglobalsearchbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{37b85a2a-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{37b85a2c-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ef281620-a3a3-4f08-874f-d68cfc9b7945} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{37b85a20-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Global Search Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully. Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: D:\Program Files\EU\CrusadersENG.exe (Rogue.Crusader) -> Quarantined and deleted successfully. D:\Program Files\EU\CrusadersPOL.exe (Rogue.Crusader) -> Quarantined and deleted successfully.

Dzięki wielkie za cierpliwość w stosunku do mnie. Dzięki Wam z laika komputerowego stałem się prawie laikiem

Jeszcze takie pytanie, te zainfekowane pliki trzymać w kwarantannie czy w piz... z nimi? :>

**Posty:** 18165 · przez **wojtas** 11 Mar 2010, 23:38

możesz skasować:) gdy bedą w folderze kwarantanny są niegroźne

pozdro

Autor postu otrzymał pochwałę

Kto jest na forum