Problem z win32/heur.dropper

[WojaS_PL]

Witam ! Mam problem z tym wirusem, od wczoraj zostałem nim zawalony prawie po uszy. Tak jak mnie poprosił Okocza zrobiłem skana za pomocą RSIT i wklejam loga

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Darek at 2009-07-22 10:12:45
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 4 GB (14%) free of 30 GB
Total RAM: 1535 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:02, on 2009-07-22
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Darek\wlspbtn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Documents and Settings\Darek\Pulpit\ADSTOP.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Darek\Pulpit\RSIT.exe
C:\Program Files\trend micro\Darek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Darek\wlspbtn.exe \s
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ADSTOP] C:\Documents and Settings\Darek\Pulpit\ADSTOP.exe
O4 - HKLM\..\Run: [C6501Sound] RunDll32 c6501.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [sqkxybn] C:\WINDOWS\system32\sqkxybn.exe \u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "d:\wojas\gry\counter strike 1 anthology\steam.exe" -silent
O4 - HKCU\..\Run: [Expressivo] "D:\WojaS\Różne\Expressivo Demo\expressivo.exe" -t
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 11540 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader - C:\Program Files\Winamp Toolbar\winamptb.dll [2008-07-16 1266992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-07-20 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-26 1008896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-19 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-06-23 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-01-19 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-19 251504]
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - Winamp Toolbar - C:\Program Files\Winamp Toolbar\winamptb.dll [2008-07-16 1266992]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-26 1008896]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-06-23 1948440]
"DAEMON Tools-1033"=C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-08-04 36352]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"ADSTOP"=C:\Documents and Settings\Darek\Pulpit\ADSTOP.exe [2008-12-15 139264]
"C6501Sound"=RunDll32 c6501.cpl,CMICtrlWnd []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-05-01 86016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"sqkxybn"=C:\WINDOWS\system32\sqkxybn.exe [2009-07-21 29184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-16 68856]
"Steam"=d:\wojas\gry\counter strike 1 anthology\steam.exe [2009-06-10 1217784]
"Expressivo"=D:\WojaS\Różne\Expressivo Demo\expressivo.exe -t []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-05-26 24264488]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\Darek\Menu Start\Programy\Autostart
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2009-06-23 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-08 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDriveAutoRun"=4294967295

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\WojaS\Gry\BF2\BF2.exe"="D:\WojaS\Gry\BF2\BF2.exe:*:Enabled:Battlefield 2"
"D:\WojaS\Gry\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe"="D:\WojaS\Gry\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"D:\WojaS\Gry\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe"="D:\WojaS\Gry\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"
"D:\WojaS\Gry\Star Wars JK II Jedi Outcast\GameData\jk2mp.exe"="D:\WojaS\Gry\Star Wars JK II Jedi Outcast\GameData\jk2mp.exe:*:Enabled:jk2mp"
"D:\WojaS\Gry\half-life 2\hl2.exe"="D:\WojaS\Gry\half-life 2\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"D:\WojaS\Gry\Serious Sam 2\Bin\SeriousSam.exe"="D:\WojaS\Gry\Serious Sam 2\Bin\SeriousSam.exe:*:Enabled:SeriousSam"
"C:\Program Files\Steam\steamapps\wojas_pl14\condition zero\hl.exe"="C:\Program Files\Steam\steamapps\wojas_pl14\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"D:\WojaS\Gry\Star Wars Jedi Knight_Jedi Academy\GameData\jamp.exe"="D:\WojaS\Gry\Star Wars Jedi Knight_Jedi Academy\GameData\jamp.exe:*:Enabled:Jedi Academy MultiPlayer"
"C:\Program Files\Steam\steamapps\wojas_pl14\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\wojas_pl14\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"D:\WojaS\Gry\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe"="D:\WojaS\Gry\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"D:\WojaS\Gry\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe"="D:\WojaS\Gry\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\WojaS\Gry\Far Cry 2\bin\FarCry2.exe"="D:\WojaS\Gry\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2"
"D:\WojaS\Gry\Far Cry 2\bin\FC2Launcher.exe"="D:\WojaS\Gry\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"
"D:\WojaS\Gry\Far Cry 2\bin\FC2Editor.exe"="D:\WojaS\Gry\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\Darek\Pulpit\_Ygoow\Ygoow.0.1f.beta24\Ygoow.exe"="C:\Documents and Settings\Darek\Pulpit\_Ygoow\Ygoow.0.1f.beta24\Ygoow.exe:*:Enabled:Ygoow"
"C:\Program Files\Steam\steamapps\wojas_pl14\dedicated server\hlds.exe"="C:\Program Files\Steam\steamapps\wojas_pl14\dedicated server\hlds.exe:*:Enabled:HLDS Launcher"
"D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\condition zero\hl.exe"="D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\counter-strike\hl.exe"="D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"D:\WojaS\Gry\Call Of Duty\CoDMP.exe"="D:\WojaS\Gry\Call Of Duty\CoDMP.exe:*:Enabled:CoDMP"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"D:\WojaS\Gry\NFS MW\speed.exe"="D:\WojaS\Gry\NFS MW\speed.exe:*:Enabled:speed"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\Autodesk\Backburner\monitor.exe"="C:\Program Files\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\Program Files\Autodesk\Backburner\manager.exe"="C:\Program Files\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\Program Files\Autodesk\Backburner\server.exe"="C:\Program Files\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server"
"C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu"
"D:\WojaS\Gry\Left.4.Dead.Full-Rip.Skullptura\Left 4 Dead\left4dead.exe"="D:\WojaS\Gry\Left.4.Dead.Full-Rip.Skullptura\Left 4 Dead\left4dead.exe:*:Enabled:left4dead"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"D:\WojaS\Gry\[PC] Battlefield Vietnam [Green1991]\Battlefield Vietnam\BfVietnam.exe"="D:\WojaS\Gry\[PC] Battlefield Vietnam [Green1991]\Battlefield Vietnam\BfVietnam.exe:*:Enabled:BfVietnam"
"D:\WojaS\Gry\Battlefield 1942\BF1942.exe"="D:\WojaS\Gry\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\condition zero deleted scenes\hl.exe"="D:\WojaS\Gry\Counter Strike 1 Anthology\SteamApps\wojas_pl14\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"D:\WojaS\Gry\Quake 4\Quake4.exe"="D:\WojaS\Gry\Quake 4\Quake4.exe:*:Enabled:Quake 4"
"D:\WojaS\Gry\Call of Duty 4 - Modern Warfare\CoD4MW\iw3mp.exe"="D:\WojaS\Gry\Call of Duty 4 - Modern Warfare\CoD4MW\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"D:\WojaS\Gry\Call of Duty 2\CoD2MP_s.exe"="D:\WojaS\Gry\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\WINDOWS\system32\sqkxybn.exe"="C:\WINDOWS\system32\sqkxybn.exe:*:Enabled:ENABLE"
"C:\Documents and Settings\Darek\wlspbtn.exe"="C:\Documents and Settings\Darek\wlspbtn.exe:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f2432830-0586-11de-b304-001966890c80}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe


======List of files/folders created in the last 1 months======

2009-07-22 10:12:47 ----D---- C:\Program Files\trend micro
2009-07-22 10:12:45 ----D---- C:\rsit
2009-07-22 09:21:11 ----A---- C:\WINDOWS\system32\84119.exe
2009-07-22 09:20:17 ----A---- C:\WINDOWS\system32\21726.exe
2009-07-22 09:18:54 ----A---- C:\WINDOWS\system32\935968.exe
2009-07-22 09:18:00 ----A---- C:\WINDOWS\system32\345969.exe
2009-07-22 09:16:52 ----A---- C:\WINDOWS\system32\208270.exe
2009-07-22 09:15:18 ----A---- C:\WINDOWS\system32\429519.exe
2009-07-22 09:14:24 ----A---- C:\WINDOWS\system32\44978.exe
2009-07-22 09:11:53 ----A---- C:\WINDOWS\system32\463813.exe
2009-07-22 09:10:37 ----A---- C:\WINDOWS\system32\424569.exe
2009-07-22 09:09:43 ----A---- C:\WINDOWS\system32\57937.exe
2009-07-22 09:08:48 ----A---- C:\WINDOWS\system32\614196.exe
2009-07-22 09:07:55 ----A---- C:\WINDOWS\system32\93202.exe
2009-07-22 09:07:02 ----A---- C:\WINDOWS\system32\829149.exe
2009-07-22 09:05:44 ----A---- C:\WINDOWS\system32\988999.exe
2009-07-22 09:04:48 ----A---- C:\WINDOWS\system32\708767.exe
2009-07-22 09:03:56 ----A---- C:\WINDOWS\system32\521237.exe
2009-07-22 09:02:23 ----A---- C:\WINDOWS\system32\997510.exe
2009-07-22 09:01:29 ----A---- C:\WINDOWS\system32\551495.exe
2009-07-22 09:00:36 ----A---- C:\WINDOWS\system32\916119.exe
2009-07-22 08:59:18 ----A---- C:\WINDOWS\system32\64819.exe
2009-07-22 08:58:24 ----A---- C:\WINDOWS\system32\0856.exe
2009-07-22 08:55:56 ----A---- C:\WINDOWS\system32\896239.exe
2009-07-22 08:55:03 ----A---- C:\WINDOWS\system32\798658.exe
2009-07-22 08:54:09 ----A---- C:\WINDOWS\system32\544353.exe
2009-07-22 08:52:51 ----A---- C:\WINDOWS\system32\131949.exe
2009-07-22 08:51:56 ----A---- C:\WINDOWS\system32\57667.exe
2009-07-22 08:51:02 ----A---- C:\WINDOWS\system32\419193.exe
2009-07-22 08:49:59 ----A---- C:\WINDOWS\system32\563593.exe
2009-07-22 08:49:16 ----A---- C:\WINDOWS\system32\314763.exe
2009-07-22 08:48:11 ----A---- C:\WINDOWS\system32\857915.exe
2009-07-22 08:47:15 ----A---- C:\WINDOWS\system32\208990.exe
2009-07-22 08:46:22 ----A---- C:\WINDOWS\system32\975088.exe
2009-07-22 08:45:29 ----A---- C:\WINDOWS\system32\104252.exe
2009-07-22 08:44:09 ----A---- C:\WINDOWS\system32\919817.exe
2009-07-22 08:43:17 ----A---- C:\WINDOWS\system32\588931.exe
2009-07-22 08:41:45 ----A---- C:\WINDOWS\system32\353612.exe
2009-07-22 08:39:56 ----A---- C:\WINDOWS\system32\543697.exe
2009-07-22 08:39:03 ----A---- C:\WINDOWS\system32\462550.exe
2009-07-22 08:36:30 ----A---- C:\WINDOWS\system32\564167.exe
2009-07-22 08:35:36 ----A---- C:\WINDOWS\system32\69120.exe
2009-07-22 08:34:43 ----A---- C:\WINDOWS\system32\18737.exe
2009-07-22 08:33:41 ----A---- C:\WINDOWS\system32\864853.exe
2009-07-22 08:32:47 ----A---- C:\WINDOWS\system32\208941.exe
2009-07-22 08:31:54 ----A---- C:\WINDOWS\system32\71355.exe
2009-07-22 08:31:00 ----A---- C:\WINDOWS\system32\438471.exe
2009-07-22 08:30:08 ----A---- C:\WINDOWS\system32\17548.exe
2009-07-22 08:29:00 ----A---- C:\WINDOWS\system32\962216.exe
2009-07-22 08:28:07 ----A---- C:\WINDOWS\system32\593228.exe
2009-07-22 08:26:58 ----A---- C:\WINDOWS\system32\93427.exe
2009-07-22 08:26:05 ----A---- C:\WINDOWS\system32\607375.exe
2009-07-22 08:24:11 ----A---- C:\WINDOWS\system32\332255.exe
2009-07-22 08:22:27 ----A---- C:\WINDOWS\system32\587150.exe
2009-07-22 08:21:36 ----A---- C:\WINDOWS\system32\447.exe
2009-07-22 08:20:42 ----A---- C:\WINDOWS\system32\417695.exe
2009-07-22 08:19:43 ----A---- C:\WINDOWS\system32\695050.exe
2009-07-22 08:18:50 ----A---- C:\WINDOWS\system32\902421.exe
2009-07-22 08:17:46 ----A---- C:\WINDOWS\system32\506562.exe
2009-07-22 08:16:52 ----A---- C:\WINDOWS\system32\157442.exe
2009-07-22 08:15:54 ----A---- C:\WINDOWS\system32\123249.exe
2009-07-22 08:15:00 ----A---- C:\WINDOWS\system32\796677.exe
2009-07-22 08:13:30 ----A---- C:\WINDOWS\system32\9983.exe
2009-07-22 08:12:36 ----A---- C:\WINDOWS\system32\683583.exe
2009-07-22 08:11:42 ----A---- C:\WINDOWS\system32\76318.exe
2009-07-22 08:10:04 ----A---- C:\WINDOWS\system32\508844.exe
2009-07-22 08:09:10 ----A---- C:\WINDOWS\system32\91733.exe
2009-07-22 08:07:00 ----A---- C:\WINDOWS\system32\32140.exe
2009-07-22 08:06:07 ----A---- C:\WINDOWS\system32\68077.exe
2009-07-22 08:04:53 ----A---- C:\WINDOWS\system32\442274.exe
2009-07-22 08:04:00 ----A---- C:\WINDOWS\system32\857284.exe
2009-07-22 08:03:07 ----A---- C:\WINDOWS\system32\806045.exe
2009-07-22 08:02:14 ----A---- C:\WINDOWS\system32\99624.exe
2009-07-22 08:01:05 ----A---- C:\WINDOWS\system32\14681.exe
2009-07-22 08:00:12 ----A---- C:\WINDOWS\system32\342857.exe
2009-07-22 07:59:18 ----A---- C:\WINDOWS\system32\206590.exe
2009-07-22 07:58:25 ----A---- C:\WINDOWS\system32\21219.exe
2009-07-22 07:57:31 ----A---- C:\WINDOWS\system32\745418.exe
2009-07-22 07:56:10 ----A---- C:\WINDOWS\system32\91466.exe
2009-07-21 21:41:26 ----HD---- C:\WINDOWS\PIF
2009-07-21 21:40:24 ----A---- C:\WINDOWS\system32\866681.exe
2009-07-21 21:39:11 ----A---- C:\WINDOWS\system32\908413.exe
2009-07-21 21:38:22 ----A---- C:\WINDOWS\system32\853675.exe
2009-07-21 21:36:57 ----A---- C:\WINDOWS\system32\77966.exe
2009-07-21 21:35:47 ----A---- C:\WINDOWS\system32\427948.exe
2009-07-21 21:34:49 ----A---- C:\WINDOWS\system32\713652.exe
2009-07-21 21:33:56 ----A---- C:\WINDOWS\system32\818242.exe
2009-07-21 21:32:32 ----A---- C:\WINDOWS\system32\663138.exe
2009-07-21 21:31:44 ----A---- C:\WINDOWS\system32\271779.exe
2009-07-21 21:30:29 ----A---- C:\WINDOWS\system32\618766.exe
2009-07-21 21:29:10 ----A---- C:\WINDOWS\system32\252278.exe
2009-07-21 21:28:16 ----A---- C:\WINDOWS\system32\765377.exe
2009-07-21 21:27:23 ----A---- C:\WINDOWS\system32\349577.exe
2009-07-21 21:25:34 ----A---- C:\WINDOWS\system32\97029.exe
2009-07-21 21:23:24 ----A---- C:\WINDOWS\system32\771664.exe
2009-07-21 21:21:50 ----A---- C:\WINDOWS\system32\298982.exe
2009-07-21 21:20:47 ----A---- C:\WINDOWS\system32\295699.exe
2009-07-21 21:18:42 ----A---- C:\WINDOWS\system32\80855.exe
2009-07-21 21:17:49 ----A---- C:\WINDOWS\system32\421372.exe
2009-07-21 21:16:16 ----A---- C:\WINDOWS\system32\686774.exe
2009-07-21 21:14:50 ----A---- C:\WINDOWS\system32\983298.exe
2009-07-21 21:11:44 ----A---- C:\WINDOWS\system32\83751.exe
2009-07-21 21:10:54 ----A---- C:\WINDOWS\system32\12732.exe
2009-07-21 21:05:24 ----A---- C:\WINDOWS\system32\332964.exe
2009-07-21 21:04:28 ----A---- C:\WINDOWS\system32\425771.exe
2009-07-21 21:03:34 ----A---- C:\WINDOWS\system32\421219.exe
2009-07-21 21:01:51 ----A---- C:\WINDOWS\system32\315549.exe
2009-07-21 21:00:57 ----A---- C:\WINDOWS\system32\70094.exe
2009-07-21 21:00:03 ----A---- C:\WINDOWS\system32\794049.exe
2009-07-21 20:59:10 ----A---- C:\WINDOWS\system32\942535.exe
2009-07-21 20:56:57 ----A---- C:\WINDOWS\system32\229176.exe
2009-07-21 20:56:03 ----A---- C:\WINDOWS\system32\98039.exe
2009-07-21 20:54:21 ----A---- C:\WINDOWS\system32\492290.exe
2009-07-21 20:53:26 ----A---- C:\WINDOWS\system32\756872.exe
2009-07-21 20:51:02 ----A---- C:\WINDOWS\system32\217114.exe
2009-07-21 20:48:37 ----A---- C:\WINDOWS\system32\429355.exe
2009-07-21 20:47:44 ----A---- C:\WINDOWS\system32\77399.exe
2009-07-21 20:46:40 ----A---- C:\WINDOWS\system32\886463.exe
2009-07-21 20:45:45 ----A---- C:\WINDOWS\system32\573223.exe
2009-07-21 20:44:26 ----A---- C:\WINDOWS\system32\625452.exe
2009-07-21 20:43:33 ----A---- C:\WINDOWS\system32\3180.exe
2009-07-21 20:42:39 ----A---- C:\WINDOWS\system32\62223.exe
2009-07-21 20:41:16 ----A---- C:\WINDOWS\system32\982922.exe
2009-07-21 20:39:55 ----A---- C:\WINDOWS\system32\876691.exe
2009-07-21 20:38:59 ----A---- C:\WINDOWS\system32\711863.exe
2009-07-21 20:37:25 ----A---- C:\WINDOWS\system32\69329.exe
2009-07-21 20:36:31 ----A---- C:\WINDOWS\system32\746195.exe
2009-07-21 20:34:29 ----A---- C:\WINDOWS\system32\302057.exe
2009-07-21 20:33:35 ----A---- C:\WINDOWS\system32\226675.exe
2009-07-21 20:31:52 ----A---- C:\WINDOWS\system32\228978.exe
2009-07-21 20:30:49 ----A---- C:\WINDOWS\system32\77158.exe
2009-07-21 20:30:00 ----A---- C:\WINDOWS\system32\319476.exe
2009-07-21 20:29:04 ----A---- C:\WINDOWS\system32\413866.exe
2009-07-21 20:28:11 ----A---- C:\WINDOWS\system32\415786.exe
2009-07-21 20:27:17 ----A---- C:\WINDOWS\system32\4201.exe
2009-07-21 20:26:03 ----A---- C:\WINDOWS\system32\76153.exe
2009-07-21 20:25:10 ----A---- C:\WINDOWS\system32\962246.exe
2009-07-21 20:24:16 ----A---- C:\WINDOWS\system32\496049.exe
2009-07-21 20:21:32 ----A---- C:\WINDOWS\system32\485210.exe
2009-07-21 20:20:24 ----A---- C:\WINDOWS\system32\7757.exe
2009-07-21 20:18:38 ----A---- C:\WINDOWS\system32\731350.exe
2009-07-21 20:17:01 ----A---- C:\WINDOWS\system32\505334.exe
2009-07-21 20:16:02 ----A---- C:\WINDOWS\system32\60799.exe
2009-07-21 20:15:09 ----A---- C:\WINDOWS\system32\61010.exe
2009-07-21 20:13:08 ----A---- C:\WINDOWS\system32\524867.exe
2009-07-21 20:12:20 ----A---- C:\WINDOWS\system32\653753.exe
2009-07-21 20:10:32 ----A---- C:\WINDOWS\system32\79243.exe
2009-07-21 20:08:24 ----A---- C:\WINDOWS\system32\479152.exe
2009-07-21 20:07:30 ----A---- C:\WINDOWS\system32\718222.exe
2009-07-21 20:06:32 ----A---- C:\WINDOWS\system32\759587.exe
2009-07-21 20:05:30 ----A---- C:\WINDOWS\system32\488469.exe
2009-07-21 20:04:36 ----A---- C:\WINDOWS\system32\519955.exe
2009-07-21 20:03:43 ----A---- C:\WINDOWS\system32\391674.exe
2009-07-21 20:02:49 ----A---- C:\WINDOWS\system32\52389.exe
2009-07-21 20:01:55 ----A---- C:\WINDOWS\system32\652244.exe
2009-07-21 20:01:00 ----A---- C:\WINDOWS\system32\79897.exe
2009-07-21 19:58:51 ----A---- C:\WINDOWS\system32\944186.exe
2009-07-21 19:56:54 ----A---- C:\WINDOWS\system32\821061.exe
2009-07-21 19:54:52 ----A---- C:\WINDOWS\system32\70176.exe
2009-07-21 19:53:59 ----A---- C:\WINDOWS\system32\412558.exe
2009-07-21 19:52:15 ----A---- C:\WINDOWS\system32\811572.exe
2009-07-21 19:51:19 ----A---- C:\WINDOWS\system32\915618.exe
2009-07-21 19:49:41 ----A---- C:\WINDOWS\system32\978840.exe
2009-07-21 19:47:42 ----A---- C:\WINDOWS\system32\491511.exe
2009-07-21 19:46:44 ----A---- C:\WINDOWS\system32\82014.exe
2009-07-21 19:45:51 ----A---- C:\WINDOWS\system32\585351.exe
2009-07-21 19:44:52 ----A---- C:\WINDOWS\system32\724915.exe
2009-07-21 19:43:58 ----A---- C:\WINDOWS\system32\747654.exe
2009-07-21 19:42:50 ----A---- C:\WINDOWS\system32\707986.exe
2009-07-21 19:40:27 ----A---- C:\WINDOWS\system32\501445.exe
2009-07-21 19:39:32 ----A---- C:\WINDOWS\system32\504799.exe
2009-07-21 19:38:35 ----A---- C:\WINDOWS\system32\194054.exe
2009-07-21 19:36:42 ----A---- C:\WINDOWS\system32\662085.exe
2009-07-21 19:35:48 ----A---- C:\WINDOWS\system32\921676.exe
2009-07-21 19:34:45 ----A---- C:\WINDOWS\system32\985178.exe
2009-07-21 19:30:17 ----A---- C:\WINDOWS\system32\73377.exe
2009-07-21 19:29:23 ----A---- C:\WINDOWS\system32\206188.exe
2009-07-21 19:28:24 ----A---- C:\WINDOWS\system32\604518.exe
2009-07-21 19:27:25 ----A---- C:\WINDOWS\system32\388211.exe
2009-07-21 19:26:31 ----A---- C:\WINDOWS\system32\19627.exe
2009-07-21 19:24:44 ----A---- C:\WINDOWS\system32\54237.exe
2009-07-21 19:23:26 ----A---- C:\WINDOWS\system32\578840.exe
2009-07-21 19:22:22 ----A---- C:\WINDOWS\system32\46474.exe
2009-07-21 19:21:29 ----A---- C:\WINDOWS\system32\716717.exe
2009-07-21 19:20:20 ----A---- C:\WINDOWS\system32\56466.exe
2009-07-21 19:19:21 ----A---- C:\WINDOWS\system32\866563.exe
2009-07-21 19:18:28 ----A---- C:\WINDOWS\system32\631921.exe
2009-07-21 19:16:43 ----A---- C:\WINDOWS\system32\836973.exe
2009-07-21 19:15:19 ----A---- C:\WINDOWS\system32\905167.exe
2009-07-21 19:14:30 ----A---- C:\WINDOWS\system32\975096.exe
2009-07-21 19:13:16 ----A---- C:\WINDOWS\system32\588414.exe
2009-07-21 19:12:13 ----A---- C:\WINDOWS\system32\504293.exe
2009-07-21 19:11:19 ----A---- C:\WINDOWS\system32\85102.exe
2009-07-21 19:10:26 ----A---- C:\WINDOWS\system32\815922.exe
2009-07-21 19:09:33 ----A---- C:\WINDOWS\system32\232275.exe
2009-07-21 19:07:46 ----A---- C:\WINDOWS\system32\892914.exe
2009-07-21 19:06:53 ----A---- C:\WINDOWS\system32\99469.exe
2009-07-21 19:05:55 ----A---- C:\WINDOWS\system32\83939.exe
2009-07-21 19:03:42 ----A---- C:\WINDOWS\system32\424986.exe
2009-07-21 19:02:49 ----A---- C:\WINDOWS\system32\667874.exe
2009-07-21 19:01:03 ----A---- C:\WINDOWS\system32\861951.exe
2009-07-21 19:00:10 ----A---- C:\WINDOWS\system32\76994.exe
2009-07-21 18:58:47 ----A---- C:\WINDOWS\system32\722081.exe
2009-07-21 18:57:53 ----A---- C:\WINDOWS\system32\230.exe
2009-07-21 18:57:01 ----A---- C:\WINDOWS\system32\674199.exe
2009-07-21 18:54:59 ----A---- C:\WINDOWS\system32\69506.exe
2009-07-21 18:54:05 ----A---- C:\WINDOWS\system32\305931.exe
2009-07-21 18:52:57 ----A---- C:\WINDOWS\system32\91756.exe
2009-07-21 18:52:03 ----A---- C:\WINDOWS\system32\779447.exe
2009-07-21 18:50:50 ----A---- C:\WINDOWS\system32\663899.exe
2009-07-21 18:49:55 ----A---- C:\WINDOWS\system32\873319.exe
2009-07-21 18:49:02 ----A---- C:\WINDOWS\system32\98836.exe
2009-07-21 18:48:07 ----A---- C:\WINDOWS\system32\1756.exe
2009-07-21 18:47:09 ----A---- C:\WINDOWS\system32\227213.exe
2009-07-21 18:46:14 ----A---- C:\WINDOWS\system32\931543.exe
2009-07-21 18:44:16 ----A---- C:\WINDOWS\system32\571245.exe
2009-07-21 18:43:22 ----A---- C:\WINDOWS\system32\95038.exe
2009-07-21 18:42:29 ----A---- C:\WINDOWS\system32\98943.exe
2009-07-21 18:39:50 ----A---- C:\WINDOWS\system32\676843.exe
2009-07-21 18:38:57 ----A---- C:\WINDOWS\system32\742025.exe
2009-07-21 18:38:03 ----A---- C:\WINDOWS\system32\439926.exe
2009-07-21 18:37:13 ----A---- C:\WINDOWS\system32\317563.exe
2009-07-21 18:36:18 ----A---- C:\WINDOWS\system32\644296.exe
2009-07-21 18:35:28 ----A---- C:\WINDOWS\system32\94860.exe
2009-07-21 18:34:33 ----A---- C:\WINDOWS\system32\45796.exe
2009-07-21 18:33:39 ----A---- C:\WINDOWS\system32\782564.exe
2009-07-21 18:32:44 ----A---- C:\WINDOWS\system32\704045.exe
2009-07-21 18:31:54 ----A---- C:\WINDOWS\system32\904558.exe
2009-07-21 18:29:31 ----A---- C:\WINDOWS\system32\482447.exe
2009-07-21 18:28:01 ----A---- C:\WINDOWS\system32\451377.exe
2009-07-21 18:27:06 ----A---- C:\WINDOWS\system32\641038.exe
2009-07-21 18:26:11 ----A---- C:\WINDOWS\system32\22426.exe
2009-07-21 18:25:16 ----A---- C:\WINDOWS\system32\459574.exe
2009-07-21 18:24:22 ----A---- C:\WINDOWS\system32\567125.exe
2009-07-21 18:23:28 ----A---- C:\WINDOWS\system32\523411.exe
2009-07-21 18:22:35 ----A---- C:\WINDOWS\system32\907816.exe
2009-07-21 18:21:30 ----A---- C:\WINDOWS\system32\619463.exe
2009-07-21 18:20:36 ----A---- C:\WINDOWS\system32\791421.exe
2009-07-21 18:19:41 ----A---- C:\WINDOWS\system32\53863.exe
2009-07-21 18:18:02 ----A---- C:\WINDOWS\system32\769930.exe
2009-07-21 18:17:07 ----A---- C:\WINDOWS\system32\691081.exe
2009-07-21 18:14:35 ----A---- C:\WINDOWS\system32\47536.exe
2009-07-21 18:13:35 ----A---- C:\WINDOWS\system32\507753.exe
2009-07-21 18:11:09 ----A---- C:\WINDOWS\system32\498527.exe
2009-07-21 18:10:16 ----A---- C:\WINDOWS\system32\434345.exe
2009-07-21 18:09:04 ----A---- C:\WINDOWS\system32\646217.exe
2009-07-21 18:08:12 ----A---- C:\WINDOWS\system32\19844.exe
2009-07-21 18:05:42 ----A---- C:\WINDOWS\system32\718833.exe
2009-07-21 18:04:43 ----A---- C:\WINDOWS\system32\794888.exe
2009-07-21 18:01:22 ----A---- C:\WINDOWS\system32\71978.exe
2009-07-21 18:00:31 ----A---- C:\WINDOWS\system32\515790.exe
2009-07-21 17:59:39 ----A---- C:\WINDOWS\system32\994043.exe
2009-07-21 17:58:48 ----A---- C:\WINDOWS\system32\404089.exe
2009-07-21 17:54:04 ----A---- C:\WINDOWS\system32\88992.exe
2009-07-21 17:52:57 ----A---- C:\WINDOWS\system32\87734.exe
2009-07-21 17:50:09 ----A---- C:\WINDOWS\system32\406231.exe
2009-07-21 17:47:59 ----A---- C:\WINDOWS\system32\63452.exe
2009-07-21 17:47:07 ----A---- C:\WINDOWS\system32\515579.exe
2009-07-21 17:43:09 ----A---- C:\WINDOWS\system32\336173.exe
2009-07-21 17:41:24 ----A---- C:\WINDOWS\system32\459521.exe
2009-07-21 17:40:32 ----A---- C:\WINDOWS\system32\809638.exe
2009-07-21 17:39:41 ----A---- C:\WINDOWS\system32\692053.exe
2009-07-21 17:38:49 ----A---- C:\WINDOWS\system32\884123.exe
2009-07-21 17:35:11 ----A---- C:\WINDOWS\system32\843459.exe
2009-07-21 17:33:25 ----A---- C:\WINDOWS\system32\984167.exe
2009-07-21 17:32:31 ----A---- C:\WINDOWS\system32\68156.exe
2009-07-21 17:31:38 ----A---- C:\WINDOWS\system32\475495.exe
2009-07-21 17:30:14 ----A---- C:\WINDOWS\system32\894357.exe
2009-07-21 17:29:19 ----A---- C:\WINDOWS\system32\943591.exe
2009-07-21 17:28:25 ----A---- C:\WINDOWS\system32\935645.exe
2009-07-21 17:27:01 ----A---- C:\WINDOWS\system32\401867.exe
2009-07-21 17:25:15 ----A---- C:\WINDOWS\system32\477567.exe
2009-07-21 17:24:25 ----A---- C:\WINDOWS\system32\331648.exe
2009-07-21 17:22:44 ----A---- C:\WINDOWS\system32\169187.exe
2009-07-21 17:21:30 ----A---- C:\WINDOWS\system32\75483.exe
2009-07-21 17:20:35 ----A---- C:\WINDOWS\system32\404073.exe
2009-07-21 17:18:51 ----A---- C:\WINDOWS\system32\291176.exe
2009-07-21 17:17:57 ----A---- C:\WINDOWS\system32\317234.exe
2009-07-21 17:17:13 ----A---- C:\WINDOWS\system32\917138.exe
2009-07-21 17:16:01 ----A---- C:\WINDOWS\system32\499742.exe
2009-07-21 17:14:08 ----A---- C:\WINDOWS\system32\9093.exe
2009-07-21 17:12:24 ----A---- C:\WINDOWS\system32\22355.exe
2009-07-21 17:10:09 ----A---- C:\WINDOWS\system32\833640.exe
2009-07-21 17:09:15 ----A---- C:\WINDOWS\system32\492693.exe
2009-07-21 17:08:21 ----A---- C:\WINDOWS\system32\668058.exe
2009-07-21 17:05:49 ----A---- C:\WINDOWS\system32\934854.exe
2009-07-21 17:02:22 ----A---- C:\WINDOWS\system32\431750.exe
2009-07-21 16:59:47 ----A---- C:\WINDOWS\system32\2902.exe
2009-07-21 16:58:00 ----A---- C:\WINDOWS\system32\307076.exe
2009-07-21 16:56:11 ----A---- C:\WINDOWS\system32\659420.exe
2009-07-21 16:55:18 ----A---- C:\WINDOWS\system32\979349.exe
2009-07-21 16:51:53 ----A---- C:\WINDOWS\system32\234624.exe
2009-07-21 16:50:11 ----A---- C:\WINDOWS\system32\545569.exe
2009-07-21 16:49:12 ----A---- C:\WINDOWS\system32\875588.exe
2009-07-21 16:48:19 ----A---- C:\WINDOWS\system32\693728.exe
2009-07-21 16:46:56 ----A---- C:\WINDOWS\system32\494917.exe
2009-07-21 16:46:08 ----A---- C:\WINDOWS\system32\972870.exe
2009-07-21 16:45:11 ----A---- C:\WINDOWS\system32\461134.exe
2009-07-21 16:44:18 ----A---- C:\WINDOWS\system32\542247.exe
2009-07-21 16:43:25 ----A---- C:\WINDOWS\system32\236943.exe
2009-07-21 16:42:31 ----A---- C:\WINDOWS\system32\442543.exe
2009-07-21 16:39:40 ----A---- C:\WINDOWS\system32\68218.exe
2009-07-21 16:37:37 ----A---- C:\WINDOWS\system32\906542.exe
2009-07-21 16:36:44 ----A---- C:\WINDOWS\system32\663538.exe
2009-07-21 16:35:51 ----A---- C:\WINDOWS\system32\406092.exe
2009-07-21 16:34:57 ----A---- C:\WINDOWS\system32\392763.exe
2009-07-21 16:33:09 ----A---- C:\WINDOWS\system32\343720.exe
2009-07-21 16:32:18 ----A---- C:\WINDOWS\system32\782492.exe
2009-07-21 16:30:39 ----A---- C:\WINDOWS\system32\168343.exe
2009-07-21 16:27:17 ----A---- C:\WINDOWS\system32\212077.exe
2009-07-21 16:26:10 ----A---- C:\WINDOWS\system32\71800.exe
2009-07-21 16:25:17 ----A---- C:\WINDOWS\system32\441440.exe
2009-07-21 16:24:24 ----A---- C:\WINDOWS\system32\22714.exe
2009-07-21 16:23:33 ----A---- C:\WINDOWS\system32\5084.exe
2009-07-21 16:21:30 ----A---- C:\WINDOWS\system32\181239.exe
2009-07-21 16:19:32 ----A---- C:\WINDOWS\system32\3109.exe
2009-07-21 16:18:21 ----A---- C:\WINDOWS\system32\232447.exe
2009-07-21 16:17:28 ----A---- C:\WINDOWS\system32\4781.exe
2009-07-21 16:16:34 ----A---- C:\WINDOWS\system32\953884.exe
2009-07-21 16:15:40 ----A---- C:\WINDOWS\system32\514814.exe
2009-07-21 16:14:48 ----A---- C:\WINDOWS\system32\661997.exe
2009-07-21 16:13:01 ----A---- C:\WINDOWS\system32\699767.exe
2009-07-21 16:11:17 ----A---- C:\WINDOWS\system32\672446.exe
2009-07-21 16:10:28 ----A---- C:\WINDOWS\system32\926497.exe
2009-07-21 16:09:33 ----A---- C:\WINDOWS\system32\81528.exe
2009-07-21 16:08:40 ----A---- C:\WINDOWS\system32\86233.exe
2009-07-21 16:07:46 ----A---- C:\WINDOWS\system32\869513.exe
2009-07-21 16:06:52 ----A---- C:\WINDOWS\system32\984985.exe
2009-07-21 16:06:02 ----A---- C:\WINDOWS\system32\22184.exe
2009-07-21 16:05:09 ----A---- C:\WINDOWS\system32\44616.exe
2009-07-21 16:04:15 ----A---- C:\WINDOWS\system32\653424.exe
2009-07-21 16:03:22 ----A---- C:\WINDOWS\system32\386073.exe
2009-07-21 16:02:28 ----A---- C:\WINDOWS\system32\193315.exe
2009-07-21 16:00:05 ----A---- C:\WINDOWS\system32\777335.exe
2009-07-21 15:59:11 ----A---- C:\WINDOWS\system32\619177.exe
2009-07-21 15:58:17 ----A---- C:\WINDOWS\system32\80835.exe
2009-07-21 15:56:49 ----A---- C:\WINDOWS\system32\717030.exe
2009-07-21 15:55:55 ----A---- C:\WINDOWS\system32\959119.exe
2009-07-21 15:55:01 ----A---- C:\WINDOWS\system32\439873.exe
2009-07-21 15:53:09 ----A---- C:\WINDOWS\system32\83567.exe
2009-07-21 15:52:14 ----A---- C:\WINDOWS\system32\473857.exe
2009-07-21 15:51:20 ----A---- C:\WINDOWS\system32\46334.exe
2009-07-21 15:50:26 ----A---- C:\WINDOWS\system32\723318.exe
2009-07-21 15:49:07 ----A---- C:\WINDOWS\system32\212560.exe
2009-07-21 15:48:31 ----A---- C:\WINDOWS\system32\sqkxybn.exe
2009-07-21 15:36:21 ----D---- C:\Program Files\Game Cam v1.4.0.5
2009-07-16 00:19:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-16 00:19:18 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 00:16:39 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-14 16:58:49 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
2009-07-14 12:48:44 ----D---- C:\Sierra
2009-07-08 01:55:12 ----A---- C:\WINDOWS\system32\xfcodec.dll
2009-07-04 20:10:45 ----D---- C:\Program Files\Badongo
2009-07-03 00:05:46 ----A---- C:\WINDOWS\sierra.ini
2009-06-28 17:45:27 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\BESTplayer
2009-06-23 10:23:22 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\AVG Security Toolbar

======List of files/folders modified in the last 1 months======

2009-07-22 10:12:51 ----D---- C:\WINDOWS\Prefetch
2009-07-22 10:12:47 ----RD---- C:\Program Files
2009-07-22 10:07:59 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\uTorrent
2009-07-22 10:06:38 ----D---- C:\Program Files\Mozilla Firefox
2009-07-22 10:06:27 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\Skype
2009-07-22 10:06:03 ----D---- C:\WINDOWS\Temp
2009-07-22 09:21:11 ----D---- C:\WINDOWS\system32
2009-07-22 00:31:58 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-21 22:58:52 ----A---- C:\WINDOWS\system.ini
2009-07-21 21:41:26 ----D---- C:\WINDOWS
2009-07-21 21:09:36 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\skypePM
2009-07-21 20:16:51 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-07-21 16:19:45 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\Xfire
2009-07-21 15:48:14 ----HD---- C:\$AVG8.VAULT$
2009-07-21 15:36:52 ----SHD---- C:\WINDOWS\Installer
2009-07-21 15:36:52 ----HD---- C:\Config.Msi
2009-07-20 18:55:31 ----HD---- C:\Program Files\InstallShield Installation Information
2009-07-19 21:06:26 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-17 13:22:28 ----A---- C:\WINDOWS\NeroDigital.ini
2009-07-16 17:54:59 ----HD---- C:\WINDOWS\inf
2009-07-16 00:19:22 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-16 00:19:21 ----A---- C:\WINDOWS\imsins.BAK
2009-07-16 00:19:20 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-09 14:49:44 ----D---- C:\Program Files\MoorHunt
2009-07-09 09:25:11 ----D---- C:\Program Files\Xfire
2009-07-07 17:10:56 ----A---- C:\WINDOWS\system32\MRT.exe
2009-07-03 12:43:05 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\Google
2009-07-03 08:28:40 ----D---- C:\WINDOWS\system32\drivers
2009-06-28 17:51:41 ----D---- C:\Program Files\NAPI-PROJEKT
2009-06-28 12:28:58 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft
2009-06-23 21:00:34 ----D---- C:\Documents and Settings\Darek\Dane aplikacji\Adobe
2009-06-23 10:22:59 ----A---- C:\WINDOWS\system32\avgrsstx.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Sterownik procesora AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 43520]
R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-07-03 335752]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-06-23 27784]
R1 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-05-10 108552]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-09-29 279712]
R2 irda;Protokół IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-09-29 25888]
R3 cm102u32;C-Media CM6501 Like Sound Interface; C:\WINDOWS\system32\drivers\c6501.sys [2006-09-05 1419968]
R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 irsir;Sterownik portu szeregowego podczerwieni Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-09-30 34048]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-09-30 13056]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Standardowy sterownik koncentratora USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\Darek\USTAWI~1\Temp\cpuz130\cpuz_x32.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-02-05 25280]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
S3 sony_ssm.sys;sony_ssm.sys; \??\C:\DOCUME~1\Darek\USTAWI~1\Temp\sony_ssm.sys []
S3 usbaudio;Sterownik audio USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2008-05-08 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-08 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-07-03 907032]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-06-23 298776]
R2 Irmon;Monitor podczerwieni; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-18 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-07-21 189104]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2008-09-27 122880]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-10-05 72704]
S3 aspnet_state;„Usługa stanu ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-19 137200]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]

-----------------EOF-----------------


Dodam jeszcze że objawami tej infekcji, jakie mój sprzęt odczuwa, to spowolnienie systemu, długi czas oczekiwania na włączenie się niektórych programów w szczególności przeglądarek internetowych, oraz mój AVG E-mail scanner non-stop pokazuje mi komunikaty że łączy się z jakimiś IP lub wysyła wiadomości na adresy e-mail z Włoch, Izraelu itp. Za pomoc z góry dziękuję.

Pozdrawiam !

[Okocza]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

[WojaS_PL]

Oto log z ComboFix'a :

Kod: Zaznacz wszystko

ComboFix 09-07-21.03 - Darek 2009-07-22 13:11.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1535.1044 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Darek\Pulpit\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Darek\wlspbtn.exe
c:\windows\system32\0856.exe
c:\windows\system32\104252.exe
c:\windows\system32\123249.exe
c:\windows\system32\12732.exe
c:\windows\system32\131949.exe
c:\windows\system32\14681.exe
c:\windows\system32\157442.exe
c:\windows\system32\168343.exe
c:\windows\system32\169187.exe
c:\windows\system32\17548.exe
c:\windows\system32\1756.exe
c:\windows\system32\181239.exe
c:\windows\system32\18737.exe
c:\windows\system32\193315.exe
c:\windows\system32\194054.exe
c:\windows\system32\19627.exe
c:\windows\system32\19844.exe
c:\windows\system32\206188.exe
c:\windows\system32\206590.exe
c:\windows\system32\208270.exe
c:\windows\system32\208941.exe
c:\windows\system32\208990.exe
c:\windows\system32\212077.exe
c:\windows\system32\21219.exe
c:\windows\system32\212560.exe
c:\windows\system32\217114.exe
c:\windows\system32\21726.exe
c:\windows\system32\22184.exe
c:\windows\system32\22355.exe
c:\windows\system32\22426.exe
c:\windows\system32\226675.exe
c:\windows\system32\22714.exe
c:\windows\system32\227213.exe
c:\windows\system32\228978.exe
c:\windows\system32\229176.exe
c:\windows\system32\230.exe
c:\windows\system32\232275.exe
c:\windows\system32\232447.exe
c:\windows\system32\234624.exe
c:\windows\system32\236943.exe
c:\windows\system32\252278.exe
c:\windows\system32\271779.exe
c:\windows\system32\2902.exe
c:\windows\system32\291176.exe
c:\windows\system32\295699.exe
c:\windows\system32\298982.exe
c:\windows\system32\302057.exe
c:\windows\system32\305931.exe
c:\windows\system32\307076.exe
c:\windows\system32\3109.exe
c:\windows\system32\314763.exe
c:\windows\system32\315549.exe
c:\windows\system32\317234.exe
c:\windows\system32\317563.exe
c:\windows\system32\3180.exe
c:\windows\system32\319476.exe
c:\windows\system32\32140.exe
c:\windows\system32\331648.exe
c:\windows\system32\332255.exe
c:\windows\system32\332964.exe
c:\windows\system32\336173.exe
c:\windows\system32\342857.exe
c:\windows\system32\343720.exe
c:\windows\system32\345969.exe
c:\windows\system32\349577.exe
c:\windows\system32\353612.exe
c:\windows\system32\386073.exe
c:\windows\system32\388211.exe
c:\windows\system32\391674.exe
c:\windows\system32\392763.exe
c:\windows\system32\401867.exe
c:\windows\system32\404073.exe
c:\windows\system32\404089.exe
c:\windows\system32\406092.exe
c:\windows\system32\406231.exe
c:\windows\system32\412558.exe
c:\windows\system32\413866.exe
c:\windows\system32\415786.exe
c:\windows\system32\417695.exe
c:\windows\system32\419193.exe
c:\windows\system32\4201.exe
c:\windows\system32\421219.exe
c:\windows\system32\421372.exe
c:\windows\system32\424569.exe
c:\windows\system32\424986.exe
c:\windows\system32\425771.exe
c:\windows\system32\427948.exe
c:\windows\system32\429355.exe
c:\windows\system32\429519.exe
c:\windows\system32\431750.exe
c:\windows\system32\434345.exe
c:\windows\system32\438471.exe
c:\windows\system32\439873.exe
c:\windows\system32\439926.exe
c:\windows\system32\441440.exe
c:\windows\system32\442274.exe
c:\windows\system32\442543.exe
c:\windows\system32\44616.exe
c:\windows\system32\447.exe
c:\windows\system32\44978.exe
c:\windows\system32\451377.exe
c:\windows\system32\45796.exe
c:\windows\system32\459521.exe
c:\windows\system32\459574.exe
c:\windows\system32\461134.exe
c:\windows\system32\462550.exe
c:\windows\system32\46334.exe
c:\windows\system32\463813.exe
c:\windows\system32\46474.exe
c:\windows\system32\473857.exe
c:\windows\system32\47536.exe
c:\windows\system32\475495.exe
c:\windows\system32\477567.exe
c:\windows\system32\4781.exe
c:\windows\system32\479152.exe
c:\windows\system32\482447.exe
c:\windows\system32\485210.exe
c:\windows\system32\488469.exe
c:\windows\system32\491511.exe
c:\windows\system32\492290.exe
c:\windows\system32\492693.exe
c:\windows\system32\494917.exe
c:\windows\system32\496049.exe
c:\windows\system32\498527.exe
c:\windows\system32\499742.exe
c:\windows\system32\501445.exe
c:\windows\system32\504293.exe
c:\windows\system32\504799.exe
c:\windows\system32\505334.exe
c:\windows\system32\506562.exe
c:\windows\system32\507753.exe
c:\windows\system32\5084.exe
c:\windows\system32\508844.exe
c:\windows\system32\514814.exe
c:\windows\system32\515579.exe
c:\windows\system32\515790.exe
c:\windows\system32\519955.exe
c:\windows\system32\521237.exe
c:\windows\system32\523411.exe
c:\windows\system32\52389.exe
c:\windows\system32\524867.exe
c:\windows\system32\53863.exe
c:\windows\system32\542247.exe
c:\windows\system32\54237.exe
c:\windows\system32\543697.exe
c:\windows\system32\544353.exe
c:\windows\system32\545569.exe
c:\windows\system32\551495.exe
c:\windows\system32\563593.exe
c:\windows\system32\564167.exe
c:\windows\system32\56466.exe
c:\windows\system32\567125.exe
c:\windows\system32\571245.exe
c:\windows\system32\573223.exe
c:\windows\system32\57667.exe
c:\windows\system32\578840.exe
c:\windows\system32\57937.exe
c:\windows\system32\585351.exe
c:\windows\system32\587150.exe
c:\windows\system32\588414.exe
c:\windows\system32\588931.exe
c:\windows\system32\593228.exe
c:\windows\system32\604518.exe
c:\windows\system32\607375.exe
c:\windows\system32\60799.exe
c:\windows\system32\61010.exe
c:\windows\system32\614196.exe
c:\windows\system32\618766.exe
c:\windows\system32\619177.exe
c:\windows\system32\619463.exe
c:\windows\system32\62223.exe
c:\windows\system32\625452.exe
c:\windows\system32\631921.exe
c:\windows\system32\63452.exe
c:\windows\system32\641038.exe
c:\windows\system32\644296.exe
c:\windows\system32\646217.exe
c:\windows\system32\64819.exe
c:\windows\system32\652244.exe
c:\windows\system32\653424.exe
c:\windows\system32\653753.exe
c:\windows\system32\659420.exe
c:\windows\system32\661997.exe
c:\windows\system32\662085.exe
c:\windows\system32\663138.exe
c:\windows\system32\663538.exe
c:\windows\system32\663899.exe
c:\windows\system32\667874.exe
c:\windows\system32\668058.exe
c:\windows\system32\672446.exe
c:\windows\system32\674199.exe
c:\windows\system32\676843.exe
c:\windows\system32\68077.exe
c:\windows\system32\68156.exe
c:\windows\system32\68218.exe
c:\windows\system32\683583.exe
c:\windows\system32\686774.exe
c:\windows\system32\691081.exe
c:\windows\system32\69120.exe
c:\windows\system32\692053.exe
c:\windows\system32\69329.exe
c:\windows\system32\693728.exe
c:\windows\system32\695050.exe
c:\windows\system32\69506.exe
c:\windows\system32\699767.exe
c:\windows\system32\70094.exe
c:\windows\system32\70176.exe
c:\windows\system32\704045.exe
c:\windows\system32\707986.exe
c:\windows\system32\708767.exe
c:\windows\system32\711863.exe
c:\windows\system32\71355.exe
c:\windows\system32\713652.exe
c:\windows\system32\716717.exe
c:\windows\system32\717030.exe
c:\windows\system32\71800.exe
c:\windows\system32\718222.exe
c:\windows\system32\718833.exe
c:\windows\system32\71978.exe
c:\windows\system32\722081.exe
c:\windows\system32\723318.exe
c:\windows\system32\724915.exe
c:\windows\system32\731350.exe
c:\windows\system32\73377.exe
c:\windows\system32\742025.exe
c:\windows\system32\745418.exe
c:\windows\system32\746195.exe
c:\windows\system32\747654.exe
c:\windows\system32\75483.exe
c:\windows\system32\756872.exe
c:\windows\system32\759587.exe
c:\windows\system32\76153.exe
c:\windows\system32\76318.exe
c:\windows\system32\765377.exe
c:\windows\system32\769930.exe
c:\windows\system32\76994.exe
c:\windows\system32\77158.exe
c:\windows\system32\771664.exe
c:\windows\system32\77399.exe
c:\windows\system32\7757.exe
c:\windows\system32\777335.exe
c:\windows\system32\779447.exe
c:\windows\system32\77966.exe
c:\windows\system32\782492.exe
c:\windows\system32\782564.exe
c:\windows\system32\791421.exe
c:\windows\system32\79243.exe
c:\windows\system32\794049.exe
c:\windows\system32\794888.exe
c:\windows\system32\796677.exe
c:\windows\system32\798658.exe
c:\windows\system32\79897.exe
c:\windows\system32\806045.exe
c:\windows\system32\80835.exe
c:\windows\system32\80855.exe
c:\windows\system32\809638.exe
c:\windows\system32\811572.exe
c:\windows\system32\81528.exe
c:\windows\system32\815922.exe
c:\windows\system32\818242.exe
c:\windows\system32\82014.exe
c:\windows\system32\821061.exe
c:\windows\system32\829149.exe
c:\windows\system32\833640.exe
c:\windows\system32\83567.exe
c:\windows\system32\836973.exe
c:\windows\system32\83751.exe
c:\windows\system32\83939.exe
c:\windows\system32\84119.exe
c:\windows\system32\843459.exe
c:\windows\system32\85102.exe
c:\windows\system32\853675.exe
c:\windows\system32\857284.exe
c:\windows\system32\857915.exe
c:\windows\system32\861951.exe
c:\windows\system32\86233.exe
c:\windows\system32\864853.exe
c:\windows\system32\866563.exe
c:\windows\system32\866681.exe
c:\windows\system32\869513.exe
c:\windows\system32\873319.exe
c:\windows\system32\875588.exe
c:\windows\system32\876691.exe
c:\windows\system32\87734.exe
c:\windows\system32\884123.exe
c:\windows\system32\886463.exe
c:\windows\system32\88992.exe
c:\windows\system32\892914.exe
c:\windows\system32\894357.exe
c:\windows\system32\896239.exe
c:\windows\system32\902421.exe
c:\windows\system32\904558.exe
c:\windows\system32\905167.exe
c:\windows\system32\906542.exe
c:\windows\system32\907816.exe
c:\windows\system32\908413.exe
c:\windows\system32\9093.exe
c:\windows\system32\91466.exe
c:\windows\system32\915618.exe
c:\windows\system32\916119.exe
c:\windows\system32\917138.exe
c:\windows\system32\91733.exe
c:\windows\system32\91756.exe
c:\windows\system32\919817.exe
c:\windows\system32\921676.exe
c:\windows\system32\926497.exe
c:\windows\system32\931543.exe
c:\windows\system32\93202.exe
c:\windows\system32\93427.exe
c:\windows\system32\934854.exe
c:\windows\system32\935645.exe
c:\windows\system32\935968.exe
c:\windows\system32\942535.exe
c:\windows\system32\943591.exe
c:\windows\system32\944186.exe
c:\windows\system32\94860.exe
c:\windows\system32\95038.exe
c:\windows\system32\953884.exe
c:\windows\system32\959119.exe
c:\windows\system32\962216.exe
c:\windows\system32\962246.exe
c:\windows\system32\97029.exe
c:\windows\system32\972870.exe
c:\windows\system32\975088.exe
c:\windows\system32\975096.exe
c:\windows\system32\978840.exe
c:\windows\system32\979349.exe
c:\windows\system32\98039.exe
c:\windows\system32\982922.exe
c:\windows\system32\983298.exe
c:\windows\system32\984167.exe
c:\windows\system32\984985.exe
c:\windows\system32\985178.exe
c:\windows\system32\98836.exe
c:\windows\system32\988999.exe
c:\windows\system32\98943.exe
c:\windows\system32\994043.exe
c:\windows\system32\99469.exe
c:\windows\system32\99624.exe
c:\windows\system32\997510.exe
c:\windows\system32\9983.exe
c:\windows\system32\kr_done1

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-06-22 do 2009-07-22  )))))))))))))))))))))))))))))))
.

2009-07-22 09:49 . 2009-07-22 09:49   --------   d-----w-   c:\windows\LastGood
2009-07-22 08:12 . 2009-07-22 08:13   --------   d-----w-   c:\program files\trend micro
2009-07-22 08:12 . 2009-07-22 08:13   --------   d-----w-   C:\rsit
2009-07-21 19:41 . 2009-07-21 19:41   --------   d--h--w-   c:\windows\PIF
2009-07-21 13:48 . 2009-07-21 13:48   29184   ----a-w-   c:\windows\system32\sqkxybn.exe
2009-07-21 13:36 . 2009-07-21 13:41   --------   d-----w-   c:\program files\Game Cam v1.4.0.5
2009-07-20 06:54 . 2009-06-23 08:22   2301208   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avguiadv.dll
2009-07-20 06:54 . 2009-06-23 08:22   353048   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgxch32.dll
2009-07-14 14:58 . 2009-07-14 14:58   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-07-14 10:48 . 2009-07-14 10:48   --------   d-----w-   C:\Sierra
2009-07-07 23:55 . 2009-07-07 23:55   41808   ----a-w-   c:\windows\system32\xfcodec.dll
2009-07-04 18:10 . 2009-07-04 18:14   --------   d-----w-   c:\program files\Badongo
2009-07-03 06:28 . 2009-07-03 06:27   2054424   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgcorex.dll
2009-07-03 06:28 . 2009-06-23 08:22   327688   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgldx86.sys
2009-07-03 06:28 . 2009-07-03 06:27   2167576   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgresf.dll
2009-07-03 06:28 . 2009-07-03 06:27   3403032   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgui.exe
2009-07-03 06:28 . 2009-06-23 08:22   906520   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgemc.exe
2009-07-03 06:28 . 2009-06-23 08:22   1204504   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgabout.dll
2009-07-03 06:28 . 2009-06-23 08:22   337176   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avglogx.dll
2009-07-03 06:28 . 2009-06-23 08:22   829208   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgcfgx.dll
2009-07-03 06:28 . 2009-06-23 08:22   3298072   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\setup.exe
2009-07-03 06:27 . 2009-06-23 08:21   1454360   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgupd.dll
2009-07-03 06:27 . 2009-06-23 08:21   1085208   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\avgupd.exe
2009-06-28 15:45 . 2009-06-28 15:48   --------   d-----w-   c:\documents and settings\Darek\Dane aplikacji\BESTplayer
2009-06-23 13:55 . 2009-06-14 14:07   1004800   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\AVG Security Toolbar\IEToolbar.dll
2009-06-23 11:45 . 2009-06-23 11:45   --------   d-----w-   c:\documents and settings\Darek\Ustawienia lokalne\Dane aplikacji\AVG Security Toolbar
2009-06-23 08:23 . 2009-06-23 08:22   832144   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\avg8\update\backup\AVGToolbarInstall.exe
2009-06-23 08:23 . 2009-07-06 05:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\AVG Security Toolbar
2009-06-23 08:23 . 2009-06-23 08:23   --------   d-----w-   c:\documents and settings\LocalService\Menu Start
2009-06-23 08:23 . 2009-06-23 08:23   --------   d-----w-   c:\documents and settings\LocalService\Dane aplikacji\AVGTOOLBAR

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-22 09:40 . 2008-09-16 17:03   --------   d-----w-   c:\documents and settings\Darek\Dane aplikacji\uTorrent
2009-07-22 08:06 . 2009-06-12 14:07   --------   d-----w-   c:\documents and settings\Darek\Dane aplikacji\Skype
2009-07-22 06:07 . 2008-12-31 18:32   --------   d-----w-   c:\documents and settings\Darek\Dane aplikacji\skypePM
2009-07-21 18:16 . 2008-10-01 16:47   189104   ----a-w-   c:\windows\system32\PnkBstrB.exe
2009-07-21 18:08 . 2008-10-01 16:48   139584   ----a-w-   c:\windows\system32\drivers\PnkBstrK.sys
2009-07-21 14:19 . 2009-04-09 16:51   --------   d-----w-   c:\documents and settings\Darek\Dane aplikacji\Xfire
2009-07-20 16:55 . 2008-09-16 07:00   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-07-09 12:49 . 2008-11-11 18:36   --------   d-----w-   c:\program files\MoorHunt
2009-07-09 07:25 . 2009-04-09 16:51   --------   d-----w-   c:\program files\Xfire
2009-07-03 06:27 . 2008-09-16 07:03   335752   ----a-w-   c:\windows\system32\drivers\avgldx86.sys
2009-06-28 15:51 . 2008-10-23 18:42   --------   d-----w-   c:\program files\NAPI-PROJEKT
2009-06-23 08:22 . 2008-09-16 07:03   11952   ----a-w-   c:\windows\system32\avgrsstx.dll
2009-06-23 08:22 . 2008-09-16 07:03   27784   ----a-w-   c:\windows\system32\drivers\avgmfx86.sys
2009-06-20 09:04 . 2009-06-20 09:04   --------   d-----r-   c:\program files\Skype
2009-06-20 09:04 . 2008-12-31 18:29   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Skype
2009-06-20 09:04 . 2009-06-20 09:04   --------   d-----w-   c:\program files\Common Files\Skype
2009-06-18 17:02 . 2009-06-18 17:02   8   ----a-w-   c:\windows\system32\nvModes.dat
2009-06-18 17:00 . 2009-06-18 17:00   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\nView_Profiles
2009-06-18 12:39 . 2008-10-01 16:46   75064   ----a-w-   c:\windows\system32\PnkBstrA.exe
2009-06-16 14:40 . 2008-04-14 20:50   119808   ----a-w-   c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2008-04-14 20:50   81920   ----a-w-   c:\windows\system32\fontsub.dll
2009-06-10 05:07 . 2009-06-09 21:54   409600   ----a-w-   c:\windows\system32\wrap_oal.dll
2009-06-10 05:07 . 2009-06-09 21:54   114688   ----a-w-   c:\windows\system32\OpenAL32.dll
2009-06-09 21:54 . 2009-06-09 21:54   --------   d-----w-   c:\program files\OpenAL
2009-06-08 06:27 . 2008-09-16 17:45   107888   ----a-w-   c:\windows\system32\CmdLineExt.dll
2009-06-07 08:42 . 2009-06-07 08:42   --------   d-----w-   c:\program files\Electronic Arts
2009-06-03 19:11 . 2008-04-14 20:50   1294848   ----a-w-   c:\windows\system32\quartz.dll
2009-06-03 14:45 . 2009-06-03 14:45   --------   d-----w-   c:\program files\Gif Animator XT
2009-05-28 09:28 . 2008-09-16 17:44   --------   d-----w-   c:\program files\Java
2009-05-28 09:28 . 2009-04-02 05:26   152576   ----a-w-   c:\documents and settings\Darek\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-24 06:16 . 2008-09-16 15:17   70024   ----a-w-   c:\documents and settings\Darek\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-23 21:15 . 2008-09-23 18:34   --------   d-----w-   c:\program files\Common Files\Adobe
2009-05-23 21:11 . 2009-02-26 14:00   --------   d-----w-   c:\program files\Autodesk
2009-05-23 20:55 . 2009-02-26 15:58   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Autodesk
2009-05-23 20:47 . 2008-10-01 13:30   --------   d-----w-   c:\program files\MagicISO
2009-05-10 06:59 . 2008-09-16 07:03   108552   ----a-w-   c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:34 . 2008-04-14 20:50   347648   ----a-w-   c:\windows\system32\localspl.dll
2009-05-03 08:37 . 2009-05-03 08:37   527   ----a-w-   c:\windows\eReg.dat
2009-04-30 22:30 . 2009-04-30 22:30   1194528   ----a-w-   c:\windows\system32\nvcplui.exe
2009-04-30 20:02 . 2009-04-30 20:02   663552   ----a-w-   c:\windows\system32\nvcuvid.dll
2009-04-30 20:02 . 2009-04-30 20:02   1720320   ----a-w-   c:\windows\system32\nvcuda.dll
2009-04-30 20:02 . 2009-04-30 20:02   1579630   ----a-w-   c:\windows\system32\nvdata.bin
2009-04-30 20:02 . 2009-04-30 20:02   1314816   ----a-w-   c:\windows\system32\nvcuvenc.dll
2009-04-30 20:02 . 2008-09-16 07:05   457248   ----a-w-   c:\windows\system32\nvudisp.exe
2009-04-30 20:02 . 2006-10-22 10:22   9994240   ----a-w-   c:\windows\system32\nvoglnt.dll
2009-04-30 20:02 . 2006-10-22 10:22   806912   ----a-w-   c:\windows\system32\nvapi.dll
2009-04-30 20:02 . 2006-10-22 10:22   8055584   ----a-w-   c:\windows\system32\drivers\nv4_mini.sys
2009-04-30 20:02 . 2006-10-22 10:22   5896320   ----a-w-   c:\windows\system32\nv4_disp.dll
2009-04-30 20:02 . 2006-10-22 10:22   143360   ----a-w-   c:\windows\system32\nvcodins.dll
2009-04-30 20:02 . 2006-10-22 10:22   143360   ----a-w-   c:\windows\system32\nvcod.dll
2009-04-29 04:47 . 2008-05-08 18:01   827392   ----a-w-   c:\windows\system32\wininet.dll
2009-04-29 04:47 . 2008-05-08 18:01   78336   ----a-w-   c:\windows\system32\ieencode.dll
2009-04-27 06:06 . 2001-10-26 16:15   80862   ----a-w-   c:\windows\system32\perfc015.dat
2009-04-27 06:06 . 2001-10-26 16:15   460922   ----a-w-   c:\windows\system32\perfh015.dat
2009-04-26 22:42 . 2008-09-16 06:57   457248   ----a-w-   c:\windows\system32\NVUNINST.EXE
2009-06-12 21:04 . 2008-09-16 19:29   134648   ----a-w-   c:\program files\mozilla firefox\components\brwsrcmp.dll
.

------- Sigcheck -------

[-] 2008-05-08 18:02   1571840   9F02C1CF7C3100E4AEA7DD8B6A86A01B   c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-26 08:36   1008896   ----a-w-   c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-16 68856]
"Steam"="d:\wojas\gry\counter strike 1 anthology\steam.exe" [2009-06-10 1217784]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-05-26 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-23 1948440]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ADSTOP"="c:\documents and settings\Darek\Pulpit\ADSTOP.exe" [2008-12-15 139264]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-30 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"sqkxybn"="c:\windows\system32\sqkxybn.exe" [2009-07-21 29184]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-11-17 577536]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-30 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

c:\documents and settings\Darek\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-23 08:22   11952   ----a-w-   c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\WojaS\\Gry\\BF2\\BF2.exe"=
"d:\\WojaS\\Gry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"d:\\WojaS\\Gry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\WojaS\\Gry\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"d:\\WojaS\\Gry\\Star Wars Jedi Knight_Jedi Academy\\GameData\\jamp.exe"=
"d:\\WojaS\\Gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
"d:\\WojaS\\Gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\WojaS\\Gry\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\WojaS\\Gry\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\WojaS\\Gry\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Darek\\Pulpit\\_Ygoow\\Ygoow.0.1f.beta24\\Ygoow.exe"=
"d:\\WojaS\\Gry\\Counter Strike 1 Anthology\\SteamApps\\wojas_pl14\\condition zero\\hl.exe"=
"d:\\WojaS\\Gry\\Counter Strike 1 Anthology\\SteamApps\\wojas_pl14\\counter-strike\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\WojaS\\Gry\\Call Of Duty\\CoDMP.exe"=
"d:\\WojaS\\Gry\\NFS MW\\speed.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"d:\\WojaS\\Gry\\Left.4.Dead.Full-Rip.Skullptura\\Left 4 Dead\\left4dead.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"d:\\WojaS\\Gry\\Battlefield 1942\\BF1942.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\WojaS\\Gry\\Counter Strike 1 Anthology\\SteamApps\\wojas_pl14\\condition zero deleted scenes\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"d:\\WojaS\\Gry\\Quake 4\\Quake4.exe"=
"d:\\WojaS\\Gry\\Call of Duty 4 - Modern Warfare\\CoD4MW\\iw3mp.exe"=
"d:\\WojaS\\Gry\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\WINDOWS\\system32\\sqkxybn.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-09-16 335752]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-09-16 108552]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-09-18 907032]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-09-18 298776]
S3 cpuz130;cpuz130;\??\c:\docume~1\Darek\USTAWI~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Darek\USTAWI~1\Temp\cpuz130\cpuz_x32.sys [?]
.
Zawartość folderu 'Zaplanowane zadania'

2009-07-22 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-14 20:18]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-Expressivo - d:\wojas\Różne\Expressivo Demo\expressivo.exe
HKLM-Run-C6501Sound - c6501.cpl


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uInternet Connection Wizard,ShellNext = hxxp://codecs.r8.org/
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\fffg57dp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - GooglePL
FF - prefs.js: browser.startup.homepage - hxxp://khanwars.wp.pl/?redirect=true
FF - prefs.js: keyword.URL - hxxp://www.googlc.pl/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\fffg57dp.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX - SPOSÓB POSTĘPOWANIA ----







FF - user.js: browser.search.selectedEngine - GooglePL
FF - user.js: keyword.URL - hxxp://www.googlc.pl/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - user.js: keyword.URL - hxxp://www.googlc.pl/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - user.js: keyword.URL - hxxp://www.googlc.pl/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-22 13:27
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-1078081533-1965331169-1177238915-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:5e,b8,9c,3f,6b,db,7e,4b,56,f3,72,b8,a3,3b,e7,45,8f,22,63,a4,13,fc,5e,
   03,73,0f,4c,85,ba,d0,ca,8e,99,17,24,6a,b3,7a,57,fd,58,6d,aa,1b,ef,8f,fa,6b,\
"??"=hex:ed,a0,c4,8b,cd,b4,ad,a9,30,99,16,66,52,69,42,4b

[HKEY_USERS\S-1-5-21-1078081533-1965331169-1177238915-1003\Software\SecuROM\License information*]
"datasecu"=hex:2e,80,ae,cc,91,84,c5,d3,53,88,55,6f,ed,00,87,37,f1,01,0f,f2,af,
   5e,d4,ce,d1,32,76,d1,30,58,bd,05,75,19,8f,9d,af,a3,50,e5,0b,a2,fd,98,b2,90,\
"rkeysecu"=hex:60,48,05,62,be,c5,0d,0b,c3,f4,05,d4,97,30,6c,90
.
Czas ukończenia: 2009-07-22 13:29
ComboFix-quarantined-files.txt  2009-07-22 11:29

Przed: 4 224 856 064 bajtów wolnych
Po: 8 100 610 048 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

605   --- E O F ---   2009-07-15 22:19


[Okocza]

wejdz na www.virustotal.com i przeskanuj plik c:\windows\system32\sqkxybn.exe i daj raport z tego skanu.

wykonaj:

zhakowane-konto-wow-a-logi-po-czyszczeniu-vt111408.html#p844321

[WojaS_PL]

Nie dało się zeskanować pliku przez Virus Total niestety, wyskakiwało że plik ma 0 bitów i nie da się go przesłać, ale zrobiłem skana przez AVG Anti-Virus Free i wykrył w tym pliku "Trojan Horse Generic14.GNI. AV automatycznie go usunął z folderu.

[Okocza]

w takim wypadku, wykonaj to o co prosilem w tamtym linku

[WojaS_PL]

Zrobiłem w większości to co mi pokazałeś. Dzięki za pomoc, teraz odczuwam jak mój komputer działa efektywniej i szybciej, no i w końcu pozbyłem się tego wstręciucha co w temacie i jeszcze kilku innych nieproszonych gości Jeszcze raz dzięki za pomoc !

Pozdro !!